August 2013 - Freeradius-Users - lists.freeradius.org

RE: VLAN assignment to HP Switch with 802.1x client
by Shaw, Colin M. 09 Aug '13

09 Aug '13

Thanks for the reply Phil. > > difference. Lastly, for testing purposes, if I insert the required > > attributes into the default post-auth then it all works and the wired > > client is assigned the correct vlan, so again the switch side must be > > ok and I also therefore presume all the dictionary entries are there > > as required. But I shouldn't need (or want) to do this. > > Yes you should. You should always aim to set these attributes in post-auth; > otherwise you'll see what you are seeing, the attributes getting set in access- > challenge. This is a function of how EAP is processed by the server. Ok, but the attribute values are going to be different for different clients (as matched & specified in the users file). Can I deal with that in post-auth? For this particular service we are simply matching the switch from a huntgroup and setting the vlan in the users file (so we are not even doing any of the LDAP lookups we do in some of our wireless services): So in users we have: DEFAULT Huntgroup-Name == "resnet-wired-auth-sw" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = resnet, Fall-Through = No > > Without a full debug, it's not obvious what you need to change, because it's > not obvious what you are doing. But it *might* be that you've missed > "use_tunneled_reply" in the "peap {}" section. My peap section in eap.conf is: peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } > > > > Hopefully this sort of thing has been done enough times that someone out > > there has fallen into whatever trap I currently find myself in and can > > point me in the right direction I need to be looking. But if not, I can > > of course supply the output of radiusd -X and the switch debug if it's > > going to help any. > > Yes, it will. Ok. Below is an example of the output from the switch debug and radiusd -x (sorry it's not from the same attempt, but the outcomes seem identical regardless of the session). In this test to keep things a bit simpler I switched off the ldap authorization we normally have enabled - the debug output is big enough as it is and the ldap lookup is not needed for this (I've tried with it enabled as well though). Note that vlan 120 is the default vlan on the switch port, and is what the switch is wrongly putting the client on when authentication is successful with the new server - it's being put on the default vlan regardless of what vlan that is set as. radiusd -X: (Only thing I've removed is a lot of the repeated entries for [preprocess] expand: %{Client-IP-Address} ->) Ready to process requests. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=123, length=348 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" EAP-Message = 0x02010018017465737477696669406162646e2e61632e756b Message-Authenticator = 0x168dbbb1d5f0c6df099507e2a0b6f02f MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 24 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 20 ++[files] returns ok ++[expiration] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Flushing SSL sessions (of #0) [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 123 to x.x.x.x port 1812 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "resnet" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e74c686cb9198540381901eb Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=124, length=479 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e74c686cb9198540381901eb EAP-Message = 0x0202008919800000007f160301007a01000076030152010d5c1c755b6e7a70e2a637ee6144578d9cc2b51299984a3ebed45860c4c0205936d330d320b58435451ecbc1e0a851a243e1956163a 4fbd4f13713a176ae030018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 Message-Authenticator = 0x506da8d0b547c788e7fdcc6228030b7a MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 137 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 127 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 007a], ClientHello SSL: Client requested nonexistent cached session 5936d330d320b58435451ecbc1e0a851a243e1956163a4fbd4f13713a176ae03 [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0051], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0d41], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 124 to x.x.x.x port 1812 EAP-Message = 0x0103040019c000000da516030100510200004d030152010d5c3210cd66496b25a43efe40e34aa5a48092009029aa4be30cbb89f896206165f84387d24004e04f4badfd6f5000bfacd09cad352 3e232e6cef6db3d9b5b002f000005ff010001001603010d410b000d3d000d3a000529308205253082040da0030201020212112162a61e0bc8aaffe89f2f89b3613bc788300d06092a864886f70d 0101050500305d310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d7361313330310603550403132a476c6f62616c5369676e204f7267616e697a617 4696f6e2056616c69646174696f6e204341202d2047 EAP-Message = 0x32301e170d3132303731313135343030325a170d3137303731313135333135315a3070310b30090603550406130247423111300f0603550408130853636f746c616e643111300f06035504071 308416265726465656e311f301d060355040a1316556e6976657273697479206f6620416265726465656e311a3018060355040313117261646975732e6162646e2e61632e756b30820122300d06 092a864886f70d01010105000382010f003082010a0282010100c006610261569828f6cd2239da8d6c8b2f32c14a4f3ddc14b00a2bbb458be49c292b00d6af16e913f9790fa3c0e5f9b1f482601 b7d53124297f3f115d827db4f992c78f8b73059a393 EAP-Message = 0x18b48ac15797b9b1877b28e5b306a5db2fcffc68a8e435c2e5c9db0caea5ca3bb8573aa29d76e4d461e9415243a67589829893b2734b8fb0a04f199639589049b511155dd15e2749f538b69fe f73a6f917a0f8998cb39785e4c3aa75d8fa35e578bbd80baa3494f0024573f95e3823cdbc7c6a1b663e3f7e643d2958ca0ae9f6be5e8891ad3a21f14727a2adaafd4979782173a6fb516018126a 91ada644b0f4355b227ead7fc041a761450e7087ee27f944266d225a430203010001a38201ca308201c6300e0603551d0f0101ff0404030205a0304c0603551d2004453043304106092b0601040 1a03201143034303206082b06010505070201162668 EAP-Message = 0x747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f301c0603551d110415301382117261646975732e6162646e2e61632e756b30090603551d1304023 000301d0603551d250416301406082b0601050507030106082b0601050507030230450603551d1f043e303c303aa038a0368634687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f 67732f67736f7267616e697a6174696f6e76616c67322e63726c30819606082b06010505070101048189308186304706082b06010505073002863b687474703a2f2f7365637572652e676c6f626 16c7369676e2e636f6d2f6361636572742f67736f72 EAP-Message = 0x67616e697a6174696f6e7661 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e64d686cb9198540381901eb Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=125, length=348 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e64d686cb9198540381901eb EAP-Message = 0x020300061900 Message-Authenticator = 0x116b1855c08cd970fefe2dd99b22651a MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 125 to x.x.x.x port 1812 EAP-Message = 0x010403fc19406c67322e637274303b06082b06010505073001862f687474703a2f2f6f637370322e676c6f62616c7369676e2e636f6d2f67736f7267616e697a6174696f6e76616c6732301d0 603551d0e04160414f78dde93afa8effe4fdbc4932e8d2029a5c06e8b301f0603551d230418301680145d46b28dc44b741cbbedf573b63ab7388f759e7e300d06092a864886f70d010105050003 8201010083c427e4c31f4af6d06897c2829aec0fd2a9d5cccb745effdf7f5a4cfcb28a29071f7e1a9bd5fd5fb9542ece1ebc2c91522c790e9990bf5107e05a59a9cd98874568285d8c667f4a461 f1c23edad40cdd9de0a830d173cb6faf7b0be14eccd EAP-Message = 0x78b860d3b5dfcac3e29122557abf70266ea30f5ff2b8a57c953cb60b7eeb7d9897e01a9bb9a8aac01ef96b63ec1075369ae9ad0f547621d4a4bec7d0a28afcb7e7b8d3104c02b8e273052b88b b0497fc17b07d11fa1759a730b4474ba52206dbc304dd1a52ce5c655e42169d486f301436001dffea9b20d1eeaaf74874475d8fc36413fbc47a5761e57745c90061603035ec9118cfceff1e2a08 1b5f63d9bb779400048f3082048b30820373a003020102020b0400000000012f4ee142f9300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a13104 76c6f62616c5369676e206e762d73613110300e0603 EAP-Message = 0x55040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3131303431333130303030305a170d3232303431333130303030305a305d310 b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d7361313330310603550403132a476c6f62616c5369676e204f7267616e697a6174696f6e2056616c69 646174696f6e204341202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100dd351df22054261ad0efa56f81765970dce7f4d403241f240e9d229fd4273 27a2b7cee8be361623817afb44b7a9f67211c2d9554 EAP-Message = 0xba79bab6c4f20d2174176774e2b16408996078fb67c24bf7278d6f3676cf318ce5f106d7dc570e5baceece2dabaaa9702f0286c8b1d0080795ea2aecd19ee4365c3ba636b5438babf78e3e001 bff85596b62018d82e84aba38b3e0c3f46d19a7ea05dd8467c266c72402735ab5eea419d9fc00ceb6a48ddf7ebd5fb23a9d84314fc8630ce4d80d52a37e011bd467a51828eb01a7823cd98e1de5 470dba8b5914a31f1f4beae2274686ce9d39c46641a7e215236b5647c1edc553e4d4801f6bfa804698b209a60f95be6688930203010001a38201503082014c300e0603551d0f0101ff040403020 10630120603551d130101ff040830060101ff020100 EAP-Message = 0x301d0603551d0e04 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e54a686cb9198540381901eb Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=126, length=348 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e54a686cb9198540381901eb EAP-Message = 0x020400061900 Message-Authenticator = 0xa39534ada4b4b62e8f39dbeb66b46a8c MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 126 to x.x.x.x port 1812 EAP-Message = 0x010503fc19401604145d46b28dc44b741cbbedf573b63ab7388f759e7e30470603551d200440303e303c0604551d20003034303206082b06010505070201162668747470733a2f2f7777772e6 76c6f62616c7369676e2e636f6d2f7265706f7369746f72792f30330603551d1f042c302a3028a026a0248622687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f726f6f742e6372 6c303d06082b060105050701010431302f302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f74723130290603551d250422302006082 b0601050507030106082b06010505070302060a2b06 EAP-Message = 0x01040182370a0303301f0603551d23041830168014607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100737aec012c1722919acab16718a2bac 805899224de1fb8ab449ff7405565f2e0f42ec7deb03f99151f957082e99b4a64242016f07617d21bfeacfa06b477cf98d82aec5715d85e4edd8b96e153331991d5846e25ef0fcbadbfdb4b6b56 ccb5d4403e265eb659f4c590c909c484dfbc267d82e9ebf45bfcc815de09184586b38b4dc76b35279b60f6a45a2a5849b1d83543c632bb5e3bc44a21c1a03b5ec123a9cedbd5bafe5d6dfd007ef af1943761b900396696a99cb41e11ef55d8b4d8b0c4 EAP-Message = 0xa5ae320a2ff82df4a2a7ff36d35e638b4e12f7b5288075ee942f70a0567739aa399717fc00f3cf66e7a27192ab059b732e7ae7e72159098d30a1ac5cca197af8000379308203753082025da00 3020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e 060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a30573 10b300906035504061302424531193017060355040a EAP-Message = 0x1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a86488 6f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cb ab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123 c927896d6dc746e934461d18dc746b2750e86e8198a EAP-Message = 0xd56d6cd5781695a2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e44b686cb9198540381901eb Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=127, length=348 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e44b686cb9198540381901eb EAP-Message = 0x020500061900 Message-Authenticator = 0x021a9250c5747a74c8497726c945f15f MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 127 to x.x.x.x port 1812 EAP-Message = 0x010601c91900e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2 ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b 661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3c a3d614dd34609b33ec3a0e363551bf2baefad39e143 EAP-Message = 0xb938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b11 5b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f4 2be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e016030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e348686cb9198540381901eb Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=128, length=680 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e348686cb9198540381901eb EAP-Message = 000206015019800000014616030101061000010201008b00d78219cd2390d34f32fe9caeb4de7c4fe65a91e3c6763b22ba06096d4c7a4573faf0617fede564d7e691eaa7bad9d523f9a965793a7 50548db117f234a151c254d734acc5599387e6dee409410a4531b137887fe973f881c32ce652710b693f3c2e0251e967c19fe656bad3b6caa962a9095f2080b46417cad03e33571392fe6915b0c a36adf59987b461c291dcf319c707df307190ca927f98e9fe9e8b64e9022db6ee1c18939d6c41f6a59d89417a13cb4cd482b0a4bcc7826a92c92b31731df22488573087e789bb91c13952d0dff8 71cce3b0773c90b45c74e00c0005cf386b04504d3ff EAP-Message = 0xb0485b74f7956159fa1704e55ab4d31ed1625bfda2343b68140301000101160301003035585c69924c15007235b8e1e71b8a7827f96c9fd4093b32db8d10e9ea138d01e4e77662e37f6999e99 b96c9072d71d6 Message-Authenticator = 0x2dee2d2be7996467e6824f731ee3d14f MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data SSL: adding session 6165f84387d24004e04f4badfd6f5000bfacd09cad3523e232e6cef6db3d9b5b to cache [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 128 to x.x.x.x port 1812 EAP-Message = 0x0107004119001403010001011603010030eb16e53e55c7b54849272977678e0538dcd33f875800cee2a67eb292ad77e640e9ffec1733ebeccfcdc882168d9f40fa Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e249686cb9198540381901eb Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=129, length=348 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e249686cb9198540381901eb EAP-Message = 0x020700061900 Message-Authenticator = 0x562d796d691cd91c89ffb97581861286 MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 129 to x.x.x.x port 1812 EAP-Message = 0x0108002b19001703010020040fc44c91ba44f7bd9bddec59e6e31e17bde5d24d964b64d248b8ab55cfc6a2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e146686cb9198540381901eb Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=130, length=401 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e146686cb9198540381901eb EAP-Message = 0x0208003b1900170301003031effb5325043a7d60adabb9b8a0252e9be2e2b2ba985ed1f25fa50ec27fafefed984a3fe1c64d45ca9ddc29923e9100 Message-Authenticator = 0xbe72500ee8d8531d0fa47b4db221dba2 MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 8 length 59 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - testx(a)abdn.ac.uk [peap] Got inner identity 'testx(a)abdn.ac.uk' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x02080018017465737477696669406162646e2e61632e756b server { [peap] Setting User-Name to testx(a)abdn.ac.uk Sending tunneled request EAP-Message = 0x02080018017465737477696669406162646e2e61632e756b FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testx(a)abdn.ac.uk" Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 8 length 24 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x ++[files] returns noop ++[expiration] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x0109002d1a0109002810003ab4b0ebafb4a77061274bf5668fda7465737477696669406162646e2e61632e756b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7e8074c07e896ed096a9cd7911a48739 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0109002d1a0109002810003ab4b0ebafb4a77061274bf5668fda7465737477696669406162646e2e61632e756b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7e8074c07e896ed096a9cd7911a48739 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 130 to x.x.x.x port 1812 EAP-Message = 0x0109004b19001703010040823a8435990e74e1a1008520cbd9b383a45fc84de1204f3fca3b1e7467552c2a36f3f9acc23692e15a93a6f5e8ba9727cf12d7879c4607dbe7dd36732fa935cc Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e047686cb9198540381901eb Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=131, length=449 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e047686cb9198540381901eb EAP-Message = 0x0209006b19001703010060182b591b778c6d6203f6eef6c5bb7ac1ed35cbd08d7c2c82b9ddad5d157d845f92dd071a9aa51150d8905464424e708e34fdb6d220256cac4a2010cb34958cd22b3 2e43538c2e9585bda432fc2238f2fdd4abc3bfd44fb24fe186342c37cbba4 Message-Authenticator = 0x704dc77781b14614a41ea8d814e1ee69 MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 9 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0209004e1a0209004931da2a4b19cf93e70067fa2ed835f0db300000000000000000a0825219da677f2a0f064a344431282f64d355292c323965007465737477696669406162646e2e61632e7 56b server { [peap] Setting User-Name to testx(a)abdn.ac.uk Sending tunneled request EAP-Message = 0x0209004e1a0209004931da2a4b19cf93e70067fa2ed835f0db300000000000000000a0825219da677f2a0f064a344431282f64d355292c323965007465737477696669406162646e2e61632e7 56b FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testx(a)abdn.ac.uk" State = 0x7e8074c07e896ed096a9cd7911a48739 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 9 length 78 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x ++[files] returns noop ++[expiration] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschapv2] ++? if ((EAP-Type == 1) || (EAP-Message =~ /^0x02..00061a..$/)) [mschapv2] ?? Evaluating (EAP-Type == 1) -> FALSE [mschapv2] ?? Evaluating (EAP-Message =~ /^0x02..00061a..$/) -> FALSE [mschapv2] ++? if ((EAP-Type == 1) || (EAP-Message =~ /^0x02..00061a..$/)) -> FALSE [mschapv2] ++- entering else else {...} [mschap] Creating challenge hash with username: testx(a)abdn.ac.uk [mschap] Client is using MS-CHAPv2 for testx(a)abdn.ac.uk, we need NT-Password [mschap] expand: %{Stripped-User-Name} -> testx [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=testx [mschap] Creating challenge hash with username: testx(a)abdn.ac.uk [mschap] expand: %{mschap:Challenge} -> 8f7e12267adfef9c [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=8f7e12267adfef9c [mschap] expand: %{mschap:NT-Response} -> a0825219da677f2a0f064a344431282f64d355292c323965 [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=a0825219da677f2a0f064a344431282f64d355292c323965 Exec-Program output: NT_KEY: 84D49D39C55C2983830A96941BD1D7AA Exec-Program-Wait: plaintext: NT_KEY: 84D49D39C55C2983830A96941BD1D7AA Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys +++[mschap] returns ok ++- else else returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a00331a0309002e533d41433336464635303544413032374234374543314237464433453631363144384246433334363936 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7e8074c07f8a6ed096a9cd7911a48739 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00331a0309002e533d41433336464635303544413032374234374543314237464433453631363144384246433334363936 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7e8074c07f8a6ed096a9cd7911a48739 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 131 to x.x.x.x port 1812 EAP-Message = 0x010a005b19001703010050099889e745a0cb12423f5c7e64cb1a2f7723411b9adccd81fd40cc0dbfe9828ebdaa8c15412abe265e6c04100de5e9556a707bec78739d33822b2732d2ba050bdf6 40a6ca232a68dd52c4b2757f913af Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176ef44686cb9198540381901eb Finished request 8. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=132, length=385 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176ef44686cb9198540381901eb EAP-Message = 0x020a002b19001703010020d8caf6fd9d96650ff344d457d8a8412b78f5fe4dd966d1fae7485f2ed861a27d Message-Authenticator = 0x5deaf00357d43558e49095a3f6ca29bc MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00061a03 server { [peap] Setting User-Name to testx(a)abdn.ac.uk Sending tunneled request EAP-Message = 0x020a00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testx(a)abdn.ac.uk" State = 0x7e8074c07f8a6ed096a9cd7911a48739 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 10 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x ++[files] returns noop ++[expiration] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel +- entering group post-auth {...} [reply_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [reply_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/reply-detail-20130806 [reply_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/reply-detail-20130806 [reply_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[reply_log] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xacbbc63ebd6b3c7e993938ca4acc15cb MS-MPPE-Recv-Key = 0xe37c54e02433c82a6f60d5a90b6eceaf EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testx" [peap] Got tunneled reply RADIUS code 2 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xacbbc63ebd6b3c7e993938ca4acc15cb MS-MPPE-Recv-Key = 0xe37c54e02433c82a6f60d5a90b6eceaf EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testx" [peap] Tunneled authentication was successful. [peap] SUCCESS [peap] Saving tunneled attributes for later ++[eap] returns handled Sending Access-Challenge of id 132 to x.x.x.x port 1812 EAP-Message = 0x010b002b190017030100209d098a2bb1a57dba1b3f00ca81dbcc3028ad018d6787771efbb8955ce1263b62 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176ee45686cb9198540381901eb Finished request 9. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=133, length=385 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176ee45686cb9198540381901eb EAP-Message = 0x020b002b190017030100209bc7ce2e9fc0caa38604cade411e3373e153471a8fb8113d5c51e1424baaf4b3 Message-Authenticator = 0xe48e296335f7379ea7170dee7dec4241 MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 11 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [peap] Using saved attributes from the original Access-Accept User-Name = "testx" [peap] Saving response in the cache [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop [reply_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [reply_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/reply-detail-20130806 [reply_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/reply-detail-20130806 [reply_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[reply_log] returns ok Sending Access-Accept of id 133 to x.x.x.x port 1812 User-Name = "testx" MS-MPPE-Recv-Key = 0x828f7f8bcf286eae0e609f69762db9e7114a5eb5f2dc922a450d175c06f27e1e MS-MPPE-Send-Key = 0xe2972bc77c895a34b6bfaf07da5794995b97beeefbe3b12f934653dfa0662cc4 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 10. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host x.x.x.x port 1813, id=134, length=118 Acct-Session-Id = "001200000030" Acct-Status-Type = Start Service-Type = Framed-User Acct-Authentic = RADIUS NAS-Port = 125 Calling-Station-Id = "xx-xx-xx-xx-xx-xx" NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx" MS-RAS-Vendor = 11 Acct-Delay-Time = 0 # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 125,NAS-Identifier = "x.x.x.x",NAS-IP-Address = x.x.x.x,Acct-Session-Id = "001200000030",User-Name = "testx"' [acct_unique] Acct-Unique-Session-ID = "9d892381f6e04dad". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "testx", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Realm = "DEFAULT" [suffix] Accounting realm is LOCAL. ++[suffix] returns ok ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> x.x.x.x [detail] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/detail-20130806 [detail] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/detail-20130806 [detail] expand: %t -> Tue Aug 6 15:51:10 2013 ++[detail] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> testx attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 134 to x.x.x.x port 1813 Finished request 11. Cleaning up request 11 ID 134 with timestamp +23 Going to the next request "debug security" on HP switch: 0004:20:13:34.92 1X m8021xCtrl:Port F5: connection detected. 0004:20:13:34.92 1X m8021xCtrl:Port F5: sent ReqId #1 to 0180c2-000003. 0004:20:13:34.94 1X m8021xCtrl:Port F5: added new client xxxxxx-xxxxxx. 0004:20:13:34.94 1X m8021xCtrl:Port F5: received RspId #1 from xxxxxx-xxxxxx. 0004:20:13:34.94 1X m8021xCtrl:Port F5: started authentication session for client xxxxxx-xxxxxx. 0004:20:13:34.94 RAD mRadiusCtr:Received RADIUS MSG: AUTH REQUEST, session: 165, access method: PORT-ACCESS. 0004:20:13:34.94 1X m8021xCtrl:Port F5: received EAP identity request for client xxxxxx-xxxxxx. 0004:20:13:34.94 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:34.94 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:34.94 RAD mRadiusCtr:ACCESS REQUEST id: 95 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: x.x.x.x 0004:20:13:34.95 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:35.45 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:35.95 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:36.45 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:36.95 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:37.95 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:37.96 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:37.96 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:37.98 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.02 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.03 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.03 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.06 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.50 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.79 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.79 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.79 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.79 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:39.55 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:39.55 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:39.55 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:39.93 RAD mRadiusCtr:ACCESS REQUEST id: 95 to y.y.y.y has timed out. 0004:20:13:39.93 1X m8021xCtrl:Port F5: received notification for client xxxxxx-xxxxxx: 'Can't reach RADIUS server...' 0004:20:13:39.93 1X m8021xCtrl:Port F5: dropped notification for client xxxxxx-xxxxxx. 0004:20:13:39.93 RAD mRadiusCtr:ACCESS REQUEST id: 95 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: x.x.x.x 0004:20:13:39.99 RAD tRadiusR:ACCESS CHALLENGE id: 95 from y.y.y.y received. 0004:20:13:39.99 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:39.99 1X m8021xCtrl:Port F5: sent EAP request #2 to 0180c2-000003. 0004:20:13:39.99 RAD tRadiusR:ACCESS CHALLENGE id: 95 from y.y.y.y received. 0004:20:13:39.99 RAD tRadiusR:ACCESS CHALLENGE id: 95 from y.y.y.y DROPPED, not in waiting for server reply state. 0004:20:13:39.99 1X m8021xCtrl:Port F5: received type 25 EAP response #2 from xxxxxx-xxxxxx. 0004:20:13:39.99 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:39.99 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:39.99 RAD mRadiusCtr:ACCESS REQUEST id: 96 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: x.x.x.x 0004:20:13:40.05 RAD tRadiusR:ACCESS CHALLENGE id: 96 from y.y.y.y received. 0004:20:13:40.05 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.05 1X m8021xCtrl:Port F5: sent EAP request #3 to 0180c2-000003. 0004:20:13:40.06 1X m8021xCtrl:Port F5: received type 25 EAP response #3 from xxxxxx-xxxxxx. 0004:20:13:40.06 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.06 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.06 RAD mRadiusCtr:ACCESS REQUEST id: 97 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: x.x.x.x 0004:20:13:40.06 RAD tRadiusR:ACCESS CHALLENGE id: 97 from y.y.y.y received. 0004:20:13:40.06 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.06 1X m8021xCtrl:Port F5: sent EAP request #4 to 0180c2-000003. 0004:20:13:40.06 1X m8021xCtrl:Port F5: received type 25 EAP response #4 from xxxxxx-xxxxxx. 0004:20:13:40.06 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.06 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.06 RAD mRadiusCtr:ACCESS REQUEST id: 98 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: x.x.x.x 0004:20:13:40.07 RAD tRadiusR:ACCESS CHALLENGE id: 98 from y.y.y.y received. 0004:20:13:40.07 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.07 1X m8021xCtrl:Port F5: sent EAP request #5 to 0180c2-000003. 0004:20:13:40.07 1X m8021xCtrl:Port F5: received type 25 EAP response #5 from xxxxxx-xxxxxx. 0004:20:13:40.07 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.07 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.07 RAD mRadiusCtr:ACCESS REQUEST id: 99 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: x.x.x.x 0004:20:13:40.07 RAD tRadiusR:ACCESS CHALLENGE id: 99 from y.y.y.y received. 0004:20:13:40.07 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.07 1X m8021xCtrl:Port F5: sent EAP request #6 to 0180c2-000003. 0004:20:13:40.08 1X m8021xCtrl:Port F5: received type 25 EAP response #6 from xxxxxx-xxxxxx. 0004:20:13:40.08 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.08 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.08 RAD mRadiusCtr:ACCESS REQUEST id: 100 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: z.z.z.z 0004:20:13:40.09 RAD tRadiusR:ACCESS CHALLENGE id: 100 from y.y.y.y received. 0004:20:13:40.09 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.09 1X m8021xCtrl:Port F5: sent EAP request #7 to 0180c2-000003. 0004:20:13:40.09 1X m8021xCtrl:Port F5: received type 25 EAP response #7 from xxxxxx-xxxxxx. 0004:20:13:40.09 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.09 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.09 RAD mRadiusCtr:ACCESS REQUEST id: 101 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: z.z.z.z 0004:20:13:40.09 RAD tRadiusR:ACCESS CHALLENGE id: 101 from y.y.y.y received. 0004:20:13:40.09 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.09 1X m8021xCtrl:Port F5: sent EAP request #8 to 0180c2-000003. 0004:20:13:40.10 1X m8021xCtrl:Port F5: received type 25 EAP response #8 from xxxxxx-xxxxxx. 0004:20:13:40.10 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.10 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.10 RAD mRadiusCtr:ACCESS REQUEST id: 102 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: z.z.z.z 0004:20:13:40.10 RAD tRadiusR:ACCESS CHALLENGE id: 102 from y.y.y.y received. 0004:20:13:40.10 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.10 1X m8021xCtrl:Port F5: sent EAP request #9 to 0180c2-000003. 0004:20:13:40.11 1X m8021xCtrl:Port F5: received type 25 EAP response #9 from xxxxxx-xxxxxx. 0004:20:13:40.11 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.11 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.11 RAD mRadiusCtr:ACCESS REQUEST id: 103 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: z.z.z.z 0004:20:13:40.26 RAD tRadiusR:ACCESS CHALLENGE id: 103 from y.y.y.y received. 0004:20:13:40.26 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.26 1X m8021xCtrl:Port F5: sent EAP request #10 to 0180c2-000003. 0004:20:13:40.27 1X m8021xCtrl:Port F5: received type 25 EAP response #10 from xxxxxx-xxxxxx. 0004:20:13:40.27 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.27 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.27 RAD mRadiusCtr:ACCESS REQUEST id: 104 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: z.z.z.z 0004:20:13:40.28 RAD tRadiusR:ACCESS CHALLENGE id: 104 from y.y.y.y received. 0004:20:13:40.28 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.28 1X m8021xCtrl:Port F5: sent EAP request #11 to 0180c2-000003. 0004:20:13:40.28 1X m8021xCtrl:Port F5: received type 25 EAP response #11 from xxxxxx-xxxxxx. 0004:20:13:40.28 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.28 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.28 RAD mRadiusCtr:ACCESS REQUEST id: 105 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: z.z.z.z 0004:20:13:40.30 RAD tRadiusR:ACCESS ACCEPT id: 105 from y.y.y.y received. 0004:20:13:40.30 1X m8021xCtrl:Port F5: received Success for client xxxxxx-xxxxxx, finished authentication session. 0004:20:13:40.30 UMIB m8021xCtrl:added new dca client xxxxxx-xxxxxx for new client port F5. 0004:20:13:40.30 UMIB m8021xCtrl:Client Mac xxxxxx-xxxxxx, accessMode 8021x 0004:20:13:40.30 1X m8021xCtrl:Port F5: starting session for client xxxxxx-xxxxxx. 0004:20:13:40.30 1X m8021xCtrl:Port F5: sent Success #11 to xxxxxx-xxxxxx. 0004:20:13:40.30 RAD tRadiusR:Removing RADIUS REQUEST id: 105 from queue. 0004:20:13:40.30 RAD mRadiusCtr:Received RADIUS MSG: ACCT REQUEST, session: 83. 0004:20:13:41.81 RAD mRadiusCtr:ACCOUNTING REQUEST id: 106 to y.y.y.y, session: 83, access method: CONSOLE, User-Name: testx, Calling-Station-Id: xxxxxx-xxxxxx, NAS-IP-Address: x.x.x.x. 0004:20:13:41.82 RAD tRadiusR:ACCOUNTING RESPONSE id: 106 from y.y.y.y received. 0004:20:13:41.82 RAD tRadiusR:Removing RADIUS REQUEST id: 106 from queue. 0004:20:14:27.07 RAD mRadiusCtr:Received RADIUS MSG: ACCT REQUEST, session: 32. 0004:20:14:27.07 RAD mRadiusCtr:ACCOUNTING REQUEST id: 107 to y.y.y.y, session: 32, access method: CONSOLE, User-Name: manager, Calling-Station-Id: a.a.a.a, NAS-IP-Address: x.x.x.x. 0004:20:14:27.08 RAD tRadiusR:ACCOUNTING RESPONSE id: 107 from y.y.y.y received. 0004:20:14:27.08 RAD tRadiusR:Removing RADIUS REQUEST id: 107 from queue. 0004:20:14:50.59 SSH tSsh0:Too many authentication failures, status = -6403 0004:20:15:07.30 RAD mRadiusCtr:Received RADIUS MSG: ACCT REQUEST, session: 84. 0004:20:15:07.30 RAD mRadiusCtr:ACCOUNTING REQUEST id: 108 to y.y.y.y, session: 84, access method: CONSOLE, User-Name: manager, Calling-Station-Id: a.a.a.a, NAS-IP-Address: x.x.x.x. 0004:20:15:07.32 RAD tRadiusR:ACCOUNTING RESPONSE id: 108 from y.y.y.y received. 0004:20:15:07.32 RAD tRadiusR:Removing RADIUS REQUEST id: 108 from queue. Thanks, Colin The University of Aberdeen is a charity registered in Scotland, No SC013683.

3 3

Configuring the DHCP module to forward request to another Radius server.
by Fabrice-externe SEGURA 09 Aug '13

09 Aug '13

Hi. I'm trying to use Freeradius 2.2.0 to catch DHCP request on a local network (a specific interface and physical network of my machine), and forward it to another radius server (through another interface), using the radius protocol, to get authorized, and get the IP address to respond with to the DHCP request. I managed to successfully install freeradius, the DHCP module listens and interpret properly incoming requests (and performs properly some attribute rewrites), but I can't find out what line(s) I should put in the "dhcp DHCP-Discover" section of dhcp.conf, to turn the incoming DHCP request into an outgoing radius request to get IP address and authorization from the other radius server (basically, do the proxy job !). I see that there is an example to get authorization and IP allocation with "mac2ip" locally, based on a file, but not how to trigger the forwarding of a new request. Any advice / idea ?

4 9

Multiple policy files
by Jonathan Gazeley 09 Aug '13

09 Aug '13

For a while I've been using FreeRADIUS with a set of includes.d-style directories that I can drop modules, virtual sites, etc into. This works well - until today. So far I've only had one included policy file in use, and the stock policy.conf is commented out. Today I tried to add another new virtual site which also has a policy file. Although radiusd -X clearly shows that the new policy file is being read, my virtual server is unable to call upon policies defined in the file. On a FreeRADIUS server with no other sites/policies, the new site and policy work fine, so it appears to be some kind of namespace issue. I've been through both policy files and there are no namespace clashes. Each policy file has its own name, e.g. policy eduroam {} and policy rainbow {}. Unusually, the debug log doesn't seem to be that helpful (it says that the files have been loaded, and that the policy can't be found by name). Apologies for the naming scheme - the various sites, modules and policies we currently manage have been inherited from various authors and I'm working on overhauling it. "debug-working.log" is from a FreeRADIUS server using only the new virtual site, which works. "debug-not-working.log" is from a full development FreeRADIUS server with other sites and policies, which does not work. "policies" is the policy file used with the existing (eduroam) sites "rainbow.conf" is the new policy that works on its own, but not in conjunction with other policies. Can anyone spare a few minutes to cast an eye over the debug output and see if I've missed something? I spent all yesterday afternoon looking and this problem and didn't make much progress. Thanks, Jonathan

4 5

How to store session info in external database?
by Maciej Lew 09 Aug '13

09 Aug '13

Hi, I would like to store freeradius session information like Acct-Session-Id, Acct-Start-Time, Acct-Stop-Time, Acct-Input-Octets, Acct-Output-Octets, Framed-IP-Address, NAS-IP-Address in external database. We have our devices connected to databases which are readonly so we cannot store those informations there. Also we have database where we want to store session statistics from all devices. Is that possible to achieve ? Till now we tried setting up virtual host with Auth-Type rules redirecting to script but we cannot receive Acct-Session-Id. Here is how our /etc/freeradius/sites-avaliable/default looks like: authorize { chap mschap sql update control { Auth-Type := `/etc/freeradius/bin/testradius '%{User-Name}' '%{Calling-Station-Id}' '%{NAS-IP-Address}' '%{reply:Framed-IP-Address}' '%{reply:Acct-Session-Id}' '%{reply:Acct-Unique-Session-Id}'` } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } } preacct { acct_unique } accounting { # sql } session { # sql } post-auth { # sql } Sorry for any language mistakes :) -- Pozdrawiam Maciej Lew tel. 883-376-062

4 5

Sending the Framed-IP-Address from a module
by Romeo Mihalcea 09 Aug '13

09 Aug '13

I got a complicated schema where my radius server needs to send the Framed-IP-Address based on the results of a redis-db query so, I would like to know if if the post-auth part of my default config I can do that. Something like (or any other solutions doing this): update reply { Framed-IP-Address := xxx.xx.xx.xx } where xxx.xx.xx.xx is an ip address returned by a module. Much appreciated.

1 0

Re: Problems setting up a freeradius server with PEAP
by Alan Buxey 08 Aug '13

08 Aug '13

Hi How are you generating the certs and what format are they in? alan

1 0

Problems setting up a freeradius server with PEAP
by Jochen Gatternig 08 Aug '13

08 Aug '13

Hello I am currently trying to setup a Freeradius server on a SUSE 12.04. I tried with the packaged version and a version compiled from source (both 2.20). What works is the basic username/password authentication. As soon as I create the certificates (CA, server & client) and try to fire up the server, I'm getting the following error messages: rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt rlm_eap_tls: Error reading private key file /usr/local/etc/raddb/certs/server.pem rlm_eap: Failed to initialize type tls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[310]: Failed to find "eap" in the "modules" section. /usr/local/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. The eap.conf file has been modified: default_eap_type = peap However, the error appers regardless of the default_eap_type parameter. All other settings remained standard. Does anyone know how to handle this problem? Thanks! Regards Jochen

2 1

Can't figure out Group Authentication
by Jernej 08 Aug '13

08 Aug '13

Hi! i am kindly asking for help or pointing right way to solve this problem. Right now we are using LDAP for authentication to IBM products. Last thing we try to do is use Freeradius on same LDAP schema for wireless purposes (Cisco network). We didn't have problems with basic authentication, but when we try to implement Groups in same way than we used before we hit a hard rock. Our LDAP schema looks like: ou= entries + ou= groups + ou=services + cn=wireless -> uniquemember : uid=user0001, ou=users, ou=entries uniquemember : uid=user0002, ou=users, ou=entries + ou=users + uid = user0001 mail = user1(a)firm.com pass: something + uid = user0002 mail = user2(a)firm.com pass: something We are authenticating user by mail and password attribute. Is it possible to make search to met this criterias? Thank you and have a nice day.

1 0

VLAN assignment to HP Switch with 802.1x client
by Shaw, Colin M. 08 Aug '13

08 Aug '13

Hi, I'm in the process of attempting to move our 802.1x services off of an aging freeRADIUS (v1) server onto a newly built server running freeRADIUS v2.2 Tests so far with wireless clients using 802.1x PEAP/MS-CHAPv2 are working ok. Clients can authenticate (against AD) and be assigned the different vlans that I want them to be assigned. So the authentication, AD interaction & vlan assignment are all working as should be there. However, we also use wired 802.1x on some of our HP 5406 switches. This currently works fine with the existing old freeRADIUS server, so the actual switch configs (I've tested more than one) must be ok. But I cannot get the switches to use the assigned vlan that the clients (who again use PEAP/MS-CHAPv2) are given with the new freeRADIUS server. I've not changed the vlans that are to be used, the only change is the switch now points to the new RADIUS server. Running radiusd -X shows that the correct attributes are still being supplied early on in the authenticate process: "Sending Access-Challenge of id 123 to x.x.x.x port 1812 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "resnet" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e74c686cb9198540381901eb" Note I've also tried the vlan id number as well as the name (although the name works fine in the old server, so should be fine here). Plus I've tried using Egress-VLANID or Egress-VLAN-Name, but it made no difference. Lastly, for testing purposes, if I insert the required attributes into the default post-auth then it all works and the wired client is assigned the correct vlan, so again the switch side must be ok and I also therefore presume all the dictionary entries are there as required. But I shouldn't need (or want) to do this. i.e. in post-auth update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-ID := "resnet" } It's as though the attributes are being removed or ignored somewhere in the PEAP/inner-tunnel process (but that's just a guess). What am I just not getting here? I'm sure it must be something simple but I can't see it. Hopefully this sort of thing has been done enough times that someone out there has fallen into whatever trap I currently find myself in and can point me in the right direction I need to be looking. But if not, I can of course supply the output of radiusd -X and the switch debug if it's going to help any. Thanks in advance, Colin The University of Aberdeen is a charity registered in Scotland, No SC013683.

2 1

returning a HEX String as a HEX String (bit string) instead of the decimal equivalent - FreeRADIUS 2.1.10
by Andy 07 Aug '13

07 Aug '13

Hello, This is my first post here so please excuse any missed etiquette. I have read through the wiki's and googled a lot and not found anything. I have been trying configure our switch ports (HP 2910al) with Tagged VLANs via Egress-VLANID and Egress-VLAN-Name. The Radius backend is OpenLDAP, and I have tried setting the data type in OpenLDAP to binary, UTF-8 and IA5, but no matter what I do, the value returned by RADIUS is the decimal equivalent of the HEX bit string I enter :( For example I'm trying to store and send 0x31000012 to indicate a tagged VLAN (0x31) on VLAN 12. But looking at freeradius -X output I can see it sending the decimal number, when the switch wants the bit string as it was stored, and hence throws an error! Is this a FreeRADIUS thing or an OpenLDAP data type thing? Any help and advice would be greatly appreciated as I'm stuck. Thanks in advance, Andy.

4 11