September 2013 - Freeradius-Users - lists.freeradius.org

Active Directory authentication question
by Roberto Carna 19 Sep '13

19 Sep '13

Dear, I have several Windows 7 clients over WiFi autheticating throug EAP-TLS to a Freeradius 2.1 service against a local MySQL database, it works OK. Now I have to change the authentication from MySQL to a remote Active Directory on a Windows 2012 server. Because I don't know so much about Windows world, I need to know if I have to use NTLM, LDAP or Kerberos in order to authenticate against the remote AD. Thanks a lot !!! Roberto

5 8

Looking for help with DHCP
by Alan DeKok 19 Sep '13

19 Sep '13

Not many people know that FreeRADIUS implements DHCP. I'd like to change that. I'm therefore offering to pay for some work on the feature. As background, the current version does DHCP, and DHCP relaying. It allocates IPs from an SQL pool. The git "master" branch has a script to import an ISC lease file into the SQL database. We need more. I'm looking for the following: - detailed documentation on how to get it working. Ideally a step-by-step guide, in the style of the EAP docs on http://deployingradius.com/ - the documentation should include examples of an ISC configuration, and how it maps to a FreeRADIUS configuration - the documentation should include simple tests, and common problems to check - it should include any new scripts, etc. necessary to get it working. - any code / configuration will become part of the main FreeRADIUS releases - the documentation and worked examples will get hosted on the FreeRADIUS web site, and prominently linked from the main page - your name will go on everything - since my company is paying for it, all copyright will belong to Network RADIUS SARL. This is a request for *paid* work. I'm prepared to pay reasonable rates for this. And not the "$100 bounty for 6 days work" kind of nonsense, either. Please send email to me with your proposal, background, and price. I'll pick someone in the next week, and work behind the scenes to get this done. The hope is to crush that pesky ISC server. It's been frustrating people world-wide for years. :) Alan DeKok.

1 0

DHCP relaying
by Nikolaos Milas 19 Sep '13

19 Sep '13

Hi, I would like to ask how we can direct FR dhcp server (using an ldap backend) to relay to another dhcp server. The idea is that we have a db of known MAC addresses which have an associated VLAN (assigned during MAC Auth) and a static IP address (assigned through FR dhcp server). If a MAC address is unknown, we would like to be able to relay to another dhcp server which will be responsible for dynamic IP address allocation (because, as I understand, FR does not support dynamic IP address allocation) on a private IP address range, with limited access. What will be the "command" to use for relaying? Thanks in advance, Nick

2 3

ipad ssl error in free radius
by val john 19 Sep '13

19 Sep '13

hi guys we are getting follwong error in our radius log when ipad trying to connect to our WIFI network , our WIFI network using EAP-TTLS + LDAP authentication , All other devices (linux , windows, mac os 10.8 , Suse , android ) are working fine apart from ipads .. Error === Tue Sep 17 13:36:25 2013 : Error: TLS Alert read:warning:close notify Tue Sep 17 13:36:25 2013 : Error: TLS_accept: failed in SSLv3 read client certificate A Tue Sep 17 13:36:25 2013 : Error: rlm_eap: SSL error error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure Tue Sep 17 13:36:25 2013 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Tue Sep 17 13:36:25 2013 : Auth: Login incorrect (TLS Alert read:warning:close notify): [user(a)ihk.com] (from client ManagementAPs port 1 cli 00-88-65-42-50-88) Do you guys any idea what cause this issue Thank you John

4 3

Version 2.2.1 has been released.
by Alan DeKok 17 Sep '13

17 Sep '13

After a long wait, we have released the 2.2.1 version of FreeRADIUS. The focus of this release is stability. Minor features may be added, but the goal is to increase system stability at the cost of missing features. People interested in major new features should look at the v3 release branch. Our focus now is fixing the last few issues in v3, before making a new release. Once v3 has been released, there will be no further new development on Version 2. Bug fixes and security issues will be addressed for three (3) years after v3 has been released. The change log for v2.2.1 is as follows: Alan DeKok FreeRADIUS Project Leader ----- Feature improvements * Updated dictionaries for alcatel, broadsoft, bskyb, dlink, meru, telkom, trapeze, proxim, zeus, rfc6677, 6911, and rfc6930. * Added %{randstr:..} support. Creates random strings in a controllable format. * Added operator support to rlm_python * Added %{hex:...} for hex version of raw attribute data * Added %{sha1:...} for SHA1 hashing of data * Added %{base64:...} for raw attribute data (e.g. 32-bit IP addr), and %{tobase64:...} for the printable string form (e.g. 1.2.3.4), and %{base64tohex:...} to convert a base64 string to a hex string. * rlm_expr is now responsible for registering many of the xlat expansions. This is cleaner than bundling them all in the server core. You should ensure 'expr' is listed in instantiate to ensure correct operation of xlat expansions. * Use correct terminology when printing errors regarding request/ response/message authenticators. * Added keytab support to Heimdal Kerberos. Patch from Ryan Steinmetz. * radsqlrelay does multiple INSERTs in one transaction. Patch from Uwe Meyer-Gruhl. * Run Post-Proxy-Type Reject {} if the upstream server rejected the request. * On startup, the server checks if it was linked with the correct OpenSSL libraries. If not, it errors out. This prevents later crashes in OpenSSL, due to library incompatibilities. * Added radmin command "hup main.log", to re-open the log files, without HUPing any other part of the server. * Added support for EAP-Key-Name. See raddb/sites-available/default, and look for comments mentioning EAP-Key-Name. MacSec now works. * Added support for hex numbers (0x...) to %{expr: ...} * Backported TLS client certificate validation from 3.0.0. * Run Post-Auth for EAP inner-tunnel methods. * Added more RFCs * Added "show config <path>" to radmin. You can now examine any configuration item in a running server. * Added TLS-Client-Cert-X509v3-Extended-Key-Usage for TLS-based EAP methods. It is set automatically from the fields in the certificate. * Add CRLCP attribute in certificate creation script. Windows phones require it. Patch from Alan Buxey. Bug fixes * Skip OCSP if there's no host / port / url, with soft_fail * Properly decode AT_IDENTITY in EAP-SIM. Patch from Iliya Peregoudov * Thread max_queue_size has better bounds checking. * Use correct variable for warning message if the user misconfigures the server. * radtest is more generous about parsing ppphint * radeapclient now accepts -4 and -6, just like radclient. Patch from John Dennis. * Ignore ".rpmnew" and a bunch of other files when loading config files from a directory. * Wait for child threads before exiting. This prevents errors on exit, but may increase exit time if databases are blocked! Patch from Iliya Peregoudov. * Wrap rbtree calls in mutexes in rlm_cache to prevent memory corruption. Patch from Phil Mayers. * Port fix for %{3GPP-*} expansion from master branch. * Fix sample certificate scripts when multiple client certs are made * Track return code priorities across if/else/elsif in unlang. Closes #107 * In debug mode, print out DHCP options when sending a DHCP packet. * Fixes to the redis modules from Brian Candler * Print better debug message for LDAP "operations error" * Fix a number of minor issues as found by Coverity * Frees module config in order to prevent occasional crash on exit * Update DHCP debugging messages to make it clearer what's going on. * Print multiple DHCP options the correct number of times in debugging mode * On debug builds, don't dlclose() modules when '-m' is used. This allows valgrind to show module symbols. * Don't count Status-Server packets in Access-Request statistics * Minor cleanups to debug output * Be more careful handling module configurations to avoid crash on otherwise clean exit. * For raddebug, correctly set the group of the output file. * renamed dhclient to dhcpclient. People who install it shouldn't have their systems broken. * for EAP-TLS methods, random_file is no longer required. OpenSSL already reads /dev/urandom. * Fix Suse and Redhat scripts. Patches from Fajar Nugraha. * Minor bug fix for base64 decoding. * Allow two consecutive WiMAX TLVs of the same number. * Remove requirement that User-Name has to match MS-CHAP-User-Name. I18n issues means that the character sets could be different. * Don't use ephemeral thread states from PyGILState_Ensure(), use our own, generated one per thread and stored in TLS. * Port module processing fixes from v3. The code is simpler, and one or two esoteric bugs are now gone. * update code handling max_requests_per_server. It should now work correctly. * wrap ASCTIME_R for systems not supporting the standard API.

1 0

Re: Freeradius2 + MySQL + Accouting
by Arran Cudbard-Bell 17 Sep '13

17 Sep '13

On 17 Sep 2013, at 19:02, Wederson Rodrigues <wederson(a)vipvilhena.com.br> wrote: > I used radtest just to show the attributes that are returning. > > I'm using a debian (ppp) as NAS, with the enabled plugins: plugin > rp-radius.so pppoe.so radattr.so Even better, RTFS. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

1 0

Freeradius2 + MySQL + Accouting
by Wederson Rodrigues 17 Sep '13

17 Sep '13

Regards, I have a server configured with freeradius2 rlm_mysql and have authentication working well. But the Accouting is only done on start and stop. Wanted it to be done every 5 minutes (300 interim-update) but is not working. Radtest result: Sending Access-Request of id 250 to 127.0.0.1 port 1812 User-Name = "cebolark2" User-Password = "xxxxx" NAS-IP-Address = xxxxxxx NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id = 250, length = 59 Acct-Status-Type = Interim-Update Acct-Interim-Interval = 300 Calling-Station-Id = "C89CDC4B8CA9" Filter-Id = "m2048" Framed-IP-Address = yyy.yyy.yyy.yyy But the table radcct not updated, only start and stop. -- []'s ----------------------------------------- .'. Wederson Rodrigues .'. (CeBoLaRk) VIP - Vilhena Internet Provider Gerente de T.I. http://www.vipvilhena.com.br MSN: cebolark(a)hotmail.com SKYPE: cebolark EMAIL: wederson(a)vipvilhena.com.br INOC VOIP: 28240*100 Celular: 0xx69 8437-0186 Fixo: 0xx69 3322-2244 -----------------------------------------

2 1

reconnecting to mysql
by Edgars Makņa 17 Sep '13

17 Sep '13

Hello, I just setup 2.2.0 from freebsd ports. In the testing environment it looks okey except this error: rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 It appears on every second authorization attempt. Ping to mysql server runs fine, another db's works without any clue. Google didnt give me any answers about this problem. rad_recv: Access-Request packet from host 127.0.0.1 port 27983, id=47, length=50 User-Name = "2-40" User-Password = "PjTKX2Ln" Framed-Protocol = PPP # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2-40", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> 2-40 [sql] sql_set_user escaped user --> '2-40' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribu rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribu [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergrou [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, grou [sql] User found in group Plaza20 [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, grou rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = PAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "PjTKX2Ln" [pap] Using CRYPT password "PCA82A.D836/k" [pap] User authenticated successfully ++[pap] returns ok Login OK: [2-40/PjTKX2Ln] (from client localhost port 0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> 2-40 [sql] sql_set_user escaped user --> '2-40' [sql] expand: %{User-Password} -> PjTKX2Ln [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 47 to 127.0.0.1 port 27983 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 47 with timestamp +51 Ready to process requests. Thanks.

2 1

EAP-TLS works but not PEAP/EAP-TLS
by John Carter 17 Sep '13

17 Sep '13

Hi, I've got a Windows 7 machine attempting to connect to FreeRADIUS 2.2.0. EAP-TLS with a client certificate works fine, but with PEAP/EAP-TLS it doesn't. Is there anything I'm missing? The problem appears to be that the client doesn't send over the client cert. I know Windows is very fussy with what it accepts as a cert for EAP-TLS, but I'm confused as to why it works for one and not the other. Mon Sep 16 12:56:55 2013 : Info: [tls] Length Included Mon Sep 16 12:56:55 2013 : Info: [tls] eaptls_verify returned 11 Mon Sep 16 12:56:55 2013 : Info: [tls] (other): before/accept initialization Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: before/accept initialization Mon Sep 16 12:56:55 2013 : Info: [tls] <<< TLS 1.0 Handshake [length 005a], ClientHello Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: SSLv3 read client hello A Mon Sep 16 12:56:55 2013 : Info: [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: SSLv3 write server hello A Mon Sep 16 12:56:55 2013 : Info: [tls] >>> TLS 1.0 Handshake [length 053e], Certificate Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: SSLv3 write certificate A Mon Sep 16 12:56:55 2013 : Info: [tls] >>> TLS 1.0 Handshake [length 000d], CertificateRequest Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: SSLv3 write certificate request A Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: SSLv3 flush data Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A Mon Sep 16 12:56:55 2013 : Debug: In SSL Handshake Phase ... Mon Sep 16 12:57:00 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Sep 16 12:57:00 2013 : Debug: WARNING: !! EAP session for state 0x7c569f3d755a860c did not finish! Mon Sep 16 12:57:00 2013 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Mon Sep 16 12:57:00 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Sep 16 12:57:00 2013 : Info: Ready to process requests. radius.log: http://pastebin.com/9fBdxfYt eap.conf: http://pastebin.com/7dL69pmQ inner-tunnel: http://pastebin.com/BGzJSKz0 Thanks, John. -- John Carter Identity Networks jcarter(a)identitynetworks.com skype:jcartermeru

2 2

Debugging "No EAP session matching the State variable"
by John Douglass 16 Sep '13

16 Sep '13

I run two freeradius servers (both 2.2.0 x86_64) with MySQL backends doing ntlm_auth (RHEL 6 Samba 3.6.9) for EAP-PEAP-MSChapV2 for our client devices. I have enabled the server debug using radmin (the debug file is HUUUUUGE so that is why I am not posting it along with). I have googled and read and analyzed as much as I can so I am looking to the list to see if anyone has experienced this problem. I was concentrating on a single user mhaley: Sep 16 08:40:33 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:40:42 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:40:42 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:40:54 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:40:54 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:41:22 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:41:22 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:41:33 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:41:33 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:41:49 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:41:49 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:42:08 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:42:08 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:42:12 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:42:12 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:42:15 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:42:15 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 09:57:56 newdvlanb radiusd[15211]: Invalid user: [mhaley7] (from client Rich-core-WiSM-E port 29 cli 3c:e0:72:a5:b7:81) Sep 16 09:58:01 newdvlanb radiusd[15211]: Invalid user: [mhaley7] (from client Rich-core-WiSM-E port 29 cli 3c:e0:72:a5:b7:81) Sep 16 09:58:57 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-E port 29 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 09:58:57 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-E port 29 cli 3c:e0:72:a5:b7:81) Sep 16 10:03:42 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 10:03:42 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81) Sep 16 10:03:49 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 10:03:54 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81) Sep 16 10:06:09 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 10:06:09 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81) Sep 16 10:36:10 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 10:36:10 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81) Around there (without the OK's, I am seeing many of this style of message): Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [jwalters38] (from client resnet1-WiSM-A port 13 cli a8:26:d9:34:bc:5f) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [arogers44] (from client Rich-core-WiSM-E port 29 cli a8:06:00:cc:6b:29) Sep 16 09:57:56 newdvlanb radiusd[15211]: Invalid user: [mhaley7] (from client Rich-core-WiSM-E port 29 cli 3c:e0:72:a5:b7:81) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [bboggess3] (from client Rich-core-WiSM-E port 29 cli 40:a6:d9:9a:9a:53) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [cparker31] (from client Rich-core-WiSM-E port 29 cli 88:53:95:79:ea:0c) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [djohnson77] (from client Rich-core-WiSM-E port 29 cli 60:45:bd:f2:7e:a8) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [lnichols3] (from client Rich-core-WiSM-E port 29 cli e0:75:7d:4e:97:bb) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [oanachebe3] (from client Rich-core-WiSM-E port 29 cli 98:d6:f7:5f:aa:cf) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [bmcgowan6] (from client Rich-core-WiSM-E port 29 cli c8:aa:21:39:7e:32) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [yyu98] (from client Rich-core-WiSM-E port 29 cli 9c:3a:af:60:ed:bc) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. I need some guidance on what to enable, what to look for, etc. to fix this. I will be glad to post a full debug log (this server is very busy, but it's beefy beefy so should be handling things). I'll gladly post the multi megabyte debug log somewhere with a date/time of when things are occurring. Within the debug mode, I didn't see a way for me to follow a given thread of authentication. It looks like (forgive me if I am misreading) the debug messages are interleaved. There appears to be a process ID (5357?) but that same guide number style doesn't appear in the debug (allowing me to focus in on that one authentication session). It appears to be doing ok, but these failed auth's may appear to the end user as a wireless session drop so I am very concerned. [root@newdvlana 2013]# /services/snacks/lawn/util/radius-server-status.sh Received response ID 28, code 2, length = 140 FreeRADIUS-Total-Access-Requests = 14103212 FreeRADIUS-Total-Access-Accepts = 2072612 FreeRADIUS-Total-Access-Rejects = 132162 FreeRADIUS-Total-Access-Challenges = 11896299 FreeRADIUS-Total-Auth-Responses = 14101073 FreeRADIUS-Total-Auth-Duplicate-Requests = 430 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 1824 FreeRADIUS-Total-Auth-Unknown-Types = 0 After finding some messages on the devel list, I saw some reference to memory clean up but that was a while ago so not sure how valid that comment/problem is in the 2.2.0 version. How should I approach this problem? - John Douglass, Sr. Systems IT/Architect

2 1