January 2014 - Freeradius-Users - lists.freeradius.org

Help Accounting packet forwarding
by battossai 02 Feb '14

02 Feb '14

hi, i'm just a newbie in freeradiu. can i get help about how to do a accounting packet forwarding. i need to setup netsweeper application, it says that this need accounting packet forwarding, and also about add avp at that accounting data. any tutorial can be shared ? thanks. Regards, Franky Yustanto

5 27

FreeRadius unauthorized access
by Mike Diggins 01 Feb '14

01 Feb '14

I'm running a FreeRadius server which authenticates to a Microsoft Windows 8 Active Directory via winbind and NTLM_AUTH. The service is used by a Cisco wireless network which uses WPA2 for user authentication (MS PEAP). My software versions are: Red Hat Enterprise Linux (v. 5 for 64-bit x86_64) freeradius2-2.1.12-4.el5_8 (RedHat) samba3x-winbind-3.5.10-0.110.el5_8 (RedHat) It came to my attention recently that some users may be gaining unauthorized access. An account was seen to be granted access (according to the FreeRadius log) even though the account does not exist within the AD, nor is it a local FreeRadius account (not that I can see anyway). What I see in my logs is: Jan 15 12:23:34 xxxxx radiusd[20330]: Login OK: [whoiswho] (from client xxxx port 13 cli xx-xx-xx-xx-xx-xx) Jan 18 08:07:58 xxxxx radiusd[22212]: Login OK: [hi] (from client xxxx port 13 cli xx-xx-xx-xx-xx-xx) The same accounts also appear on the wireless controller. To the best of my knowledge those accounts do not exist anywhere but somehow they are being authenticated. Blocking the account with an Auth-Type := Reject prevents it from authenticating. I've tested with the same account names using no password and various random passwords but I'm correctly denied access each time. I'm attempting to capture some more extensive logging during one of these logins but until I do, does anyone recognize a scenario where this might happen? -Mike

5 10

PEAP and Automatically use my Windows logon name
by Michal Bruncko 31 Jan '14

31 Jan '14

Hello I am trying to authenticate end VPN users using PEAP method toward freeradius server. On client side there is built-in VPN client (PPTP) on windows 7 machines. In general everything is working - users are able to autenticate once they manually use their credentials. Also the scenario with including (manually filled) domain name is also available and users are able to authenticate as well. The problems starting if I try to use "Automatically use my Windows logon name and password (and domain if any)" checkbox within PEAP method - the user is not able to autenticate even if the logged-in windows account (login/pass) is same than on server side. From the radius debug logs the problems started with beginning of mschapv2 module: Working part (with manually filled domain): [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel-vpn [mschapv2] +- entering group MS-CHAP {...} [mschapv2] ++? if ("%{My-Local-Client-Type}" == "user") [mschapv2] expand: %{My-Local-Client-Type} -> user [mschapv2] ? Evaluating ("%{My-Local-Client-Type}" == "user") -> TRUE [mschapv2] ++? if ("%{My-Local-Client-Type}" == "user") -> TRUE [mschapv2] ++- entering if ("%{My-Local-Client-Type}" == "user") {...} [mschap_vpn] Creating challenge hash with username: bob [mschap_vpn] Told to do MS-CHAPv2 for timeos with NT-Password [mschap_vpn] expand: --username=%{mschap:User-Name} -> --username=bob [mschap_vpn] Creating challenge hash with username: bob [mschap_vpn] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=63b158798144225d [mschap_vpn] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=44a58798471dc8e98dc3854e7c285246596fafb0c116cd14 Exec-Program output: NT_KEY: ABF2579A08227E23F0984101C44B8D12 Exec-Program-Wait: plaintext: NT_KEY: ABF2579A08227E23F0984101C44B8D12 Exec-Program: returned: 0 [mschap_vpn] adding MS-CHAPv2 MPPE keys +++[mschap_vpn] returns ok ++- if ("%{My-Local-Client-Type}" == "user") returns ok MSCHAP Success Not working case (using "Automatically use my Windows logon name..."): [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel-vpn [mschapv2] +- entering group MS-CHAP {...} [mschapv2] ++? if ("%{My-Local-Client-Type}" == "user") [mschapv2] expand: %{My-Local-Client-Type} -> user [mschapv2] ? Evaluating ("%{My-Local-Client-Type}" == "user") -> TRUE [mschapv2] ++? if ("%{My-Local-Client-Type}" == "user") -> TRUE [mschapv2] ++- entering if ("%{My-Local-Client-Type}" == "user") {...} [mschap_vpn] ERROR: User-Name (abrakadabra\bob) is not the same as MS-CHAP Name (bob) from EAP-MSCHAPv2 +++[mschap_vpn] returns reject ++- if ("%{My-Local-Client-Type}" == "user") returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [abrakadabra\\bob] (from client vpn.exmaple.com port 0 via TLS tunnel) mschap module: mschap mschap_vpn { with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --require-membership-of=S-1-5-21-248145504-287154277-2125575804-1588" } notes: - If I write the domain in login box manually, it is typed in uppercase (without ability to change) - "ABRAKADABRA\bob". If I check "Automatically use my Windows logon name...", the domain (only local-computer) name is pushed in lower case: "abrakadabra\bob". that's the main difference what I can see from comparing both debug logs. - if I write the domain manually inside the login name using "abrakadabra\bob" and keep the "Domain" field empty - the name will be pushed "abrakadabra\bob" - but in this case, I will be authenticated _successfully_. it sounds to me that this issue have nothing to do with uppercase/lowercase of domain name, but it must be something else which breaks all authentication using windows login credentials. - the client computer domain is not real domain - it's just the computer name but this does not matter as the domain name is not pushed to ntlm_auth at all. If I try to log in directly using "ntlm_auth" without providing "--domain" parameter - I will be authenticated correctly. please has anyone working PEAP authentication with ability to use "Automatically use my Windows logon name..."? What I am doing wrong. thank you michal

5 8

blockage in my Freeradius configuration
by Yves Deuscher 31 Jan '14

31 Jan '14

Hello, I can write to you because I found a wealth of important information about the list We use 2 freeradius servers for 2 different things -control access to our switches and -secure wifi Our access control switches, we have a fleet of 4000 switches allocate a hundred entity, each entity's IT department (DEP) headed by a central service, we (central) wish to have access to all switches and limit access computer services solely to their switches. "users" are in ldap and assigned to groups unix DEP25, DEP29, DEP57 ... the central unit is in all groups. in Users : we compare the shortname of the client file to unix group DEFAULT Group == "%{Client-Shortname}", Huntgroup-Name == "3com", Login-IP-Host != "127.0.0.1" Login-Service = 50, Service-Type = 7, huawei-exec-privilege = 3, 3Com-User-Access-Level = 3, Reply-Message = "Bonjour, %{User-name}" in client.conf client 192.168.25.0/22 { secret = XXXXXXXXXX description = reseau-25-Besancon shortname = DEP25 } client 192.168.29.0/22 { secret = XXXXXXXXXX description = reseau-29-Brest shortname =DEP29 } client 192.168.57.0/22 { secret = XXXXXXXXXX description = reseau-57-Metz shortname =DEP57 } For DEP commissioned the first connection goes well Thu Jan 30 23:48:28 2014 : Info: ++[eap] returns noop Thu Jan 30 23:48:28 2014 : Info: ++[unix] returns updated Thu Jan 30 23:48:28 2014 : Info: [files] expand: %{Client-Shortname} -> DEP25 Thu Jan 30 23:48:28 2014 : Info: [files] users: Matched entry DEFAULT at line 208 Thu Jan 30 23:48:28 2014 : Info: ++[files] returns ok for the following connections Thu Jan 30 23:48:28 2014 : Info: ++[eap] returns noop Thu Jan 30 23:48:28 2014 : Info: ++[unix] returns updated Thu Jan 30 23:48:28 2014 : Info: [files] users: Matched entry DEFAULT at line 208 Thu Jan 30 23:48:28 2014 : Info: ++[files] returns ok so the comparison is not recalculated and if a user wants to authenticate to DEP25 switches DEP57 it is allowed then it should not I miss something for the dynamic substitution takes place at each connection or I can not be the problem taken in the right direction have? More I try to configure a secure WPA / TTLS working with all key calculated installing Freeradius. by cons with mine I have a CA_unknown error do you have a clue? Thanking you in advance for any information you provide me sincerely

2 1

PEAP/MSCHAPv2 bounded to a particular MAC Address
by Marco Gaiarin 31 Jan '14

31 Jan '14

[ Sorry, i'm not subscribed to that list, i will follow it on the web interface but if you can, put me on CC. Thanks. ] Platform: debian squeeze, freeradius 2.1.10+dfsg-2+squeeze1. Some year ago i've setup a (i think rather standard) freeradius config to handle PEAP/MSCHAPv2 authentication (also machine account one) for some portable system. I've also enabled some ''static'' account, for some guests, eg i can add in 'users' file something like that: username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00" now i need to lock that ''static'' password to a particular MAC address. I've verified that my AP send 'Calling-Station-Id', and i've tried to (with some google help) something like that: username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00", Calling-Station-Id == "c8b5b723ecd7" or like that: username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00", Huntgroup-Name == "ipm1" having in 'huntgroups' a line like: ipm1 Calling-Station-Id == c8b5b723ecd7 But nothing works. I've also see: http://wiki.freeradius.org/guide/Mac-Auth/46b5f10bc41dd0d5bf3f8dda41e87dd9c… but seems to me unrelated, or at least probably could be useful the mac address normalization across different AP, but for now i'm in a testing phase. I'm doing the right thing? Thanks. -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/ Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN) marco.gaiarin(at)lanostrafamiglia.it t +39-0434-842711 f +39-0434-842797 Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA! http://www.lanostrafamiglia.it/chi_siamo/5xmille.php (cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

4 8

Freeradius server does not authenticate when the password is in MD5
by Cleiton Rodrigues de Souza 30 Jan '14

30 Jan '14

Hello guys, I have a freeradius server that is partially working, I can authenticate with passwords in plaintext and encrypted using the MD5 software 'NTRadPing Test Utility', both users than to the file 'users' as well as the MySQL database. When I try to authenticate from a notebook with windows 7, if the password is in plain text works, but if it is in MD5 not authentic, I believe that the settings in eap.conf files and other files are correct, does anyone know why infromar unable to authenticate when the password is encrypted in MD5? -- --------------------------------------------------------------------------------------------- Cordialmente, Cleiton R. de Souza

4 5

Re: Freeradius-Users Digest, Vol 105, Issue 101
by dilanka nayanajith 30 Jan '14

30 Jan '14

> Hi every one i am facing some problems, > > i configured radius server > i configured a client > and finally i have configured a user as well > > how do i block or deny access for users to log certain clients > > as and example -- > > User1 can log to the SWA but he should not be able to log to SWB > > please help me on this , i read so many articuls but cant fiend a way to do it authorize { if ((User-Name == 'User1') && ("%{client:shortname}" == 'SWA')) { update control { Auth-Type := 'Accept' } } } can you please tell me to which file that i want to include these cods > dilanka nayanajith > Thank you On Wed, Jan 29, 2014 at 3:21 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: cui-inner.post-auth and cui.post-auth (Alan Buxey) > 2. Does FreeRADIUS 2.1.12's ECDH support include > ECDH-RSA-AES128-SHA? (Edward Morris) > 3. Re: Help Accounting packet forwarding (battossai) > 4. How to set User access for certain clients (dilanka nayanajith) > 5. Re: Help Accounting packet forwarding (Arran Cudbard-Bell) > 6. Re: How to set User access for certain clients > (Arran Cudbard-Bell) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 28 Jan 2014 22:26:40 +0000 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org>, > stefan.paetow(a)diamond.ac.uk > Subject: Re: cui-inner.post-auth and cui.post-auth > Message-ID: <4279f9f1-e87d-4fe1-ad4a-1425371e10bd(a)email.android.com> > Content-Type: text/plain; charset="utf-8" > > I'm sure I submitted a patch for this. .. Maybe it only went into 2.x? > > alan > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. >

2 2

MS-CHAP2 Response is incorrect
by Matthew Ceroni 30 Jan '14

30 Jan '14

Hi: I have a FreeRadius server setup that is used to authenticate a WPA2-Enteprise wireless network. This is setup on a CentOS 6.5 server with FreeRadius version 2.1.12. I also followed the instructions on configuring ActiveDirectory. Everything works, 99% of the time. However after a certain amount of time running I start to get authentication failures. The log shows: Wed Jan 29 11:30:31 2014 : Debug: [eap] processing type mschapv2 Wed Jan 29 11:30:31 2014 : Debug: [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel Wed Jan 29 11:30:31 2014 : Debug: [mschapv2] +- entering group MS-CHAP {...} Wed Jan 29 11:30:31 2014 : Debug: [mschapv2] modsingle[authenticate]: calling mschap (rlm_mschap) for request 21 Wed Jan 29 11:30:31 2014 : Debug: [mschap] Creating challenge hash with username: vinoth Wed Jan 29 11:30:31 2014 : Debug: [mschap] Told to do MS-CHAPv2 for vinoth with NT-Password Wed Jan 29 11:30:31 2014 : Debug: [mschap] radius_xlat: Running registered xlat function of module mschap for string 'User-Name' Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: %{mschap:User-Name} -> vinoth Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: --username=%{%{mschap:User-Name}:-%{%{User-Name}:-None}} -> --username=vinoth Wed Jan 29 11:30:31 2014 : Debug: [mschap] radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' Wed Jan 29 11:30:31 2014 : Debug: [mschap] No NT-Domain was found in the User-Name. Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: %{mschap:NT-Domain} -> Wed Jan 29 11:30:31 2014 : Debug: [mschap] ... expanding second conditional Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: --domain=%{%{mschap:NT-Domain}:-CLAIRMAIL} -> --domain=CLAIRMAIL Wed Jan 29 11:30:31 2014 : Debug: [mschap] radius_xlat: Running registered xlat function of module mschap for string 'Challenge' Wed Jan 29 11:30:31 2014 : Debug: [mschap] Creating challenge hash with username: vinoth Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: %{mschap:Challenge} -> 26bae25103c92b9d Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=26bae25103c92b9d Wed Jan 29 11:30:31 2014 : Debug: [mschap] radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: %{mschap:NT-Response} -> bc3ebc2680d1a09bd8f20d10586071f40fa03830ca779b81 Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=bc3ebc2680d1a09bd8f20d10586071f40fa03830ca779b81 Wed Jan 29 11:30:31 2014 : Debug: [mschap] External script failed. Wed Jan 29 11:30:31 2014 : Debug: [mschap] FAILED: MS-CHAP2-Response is incorrect The issue is resolved by simply restarting FreeRadius. Any help on further troubleshooting would be appreciated. Thanks

2 2

Does FreeRADIUS 2.1.12's ECDH support include ECDH-RSA-AES128-SHA?
by Edward Morris 29 Jan '14

29 Jan '14

Using FreeRADIUS 2.1.12 (from debian package) and OpenSSL 1.0.1f, I've been able to successfully configure EAP-TLS with a number of ECDHE (ephemeral) cipher suites. However, my attempts to utilize ECDH (non-ephemeral) cipher suites fail with and error of "SSL3_GET_CLIENT_HELLO:no shared cipher." I've seen that same error occur both when I was attempting to employ a cipher suite not supported by FreeRADIUS (versions prior to 2.1.12 did not support any ECDHE cipher suites) and when I had a screwy configuration (e.g., attempts to use DSA cipher suites without first giving the server a DSA key). So I'm unclear on where the problem might lie. I've confirmed that the client/supplicant I'm testing with supports the ECDH cipher suite (tcpdump and wireshark shows the Client Hello message includes the cipher), and querying debian's OpenSSL ("openssl ciphers -v aECDH") confirmed it supports the cipher The only documentation I could find on this topic was the line 'ecdh_curve = "prime256v1"' in eap.conf. Any pointers or confirmation as to whether or not FreeRADIUS (any version) supports plain ECDH cipher suites would be greatly appreciated. Thanks Ed

2 2

Problem with spaces in usernames.
by Maciej Milewski 29 Jan '14

29 Jan '14

My main goal is creating EAP-TLS configuration but I wanted to be sure the easiest way is working fine. And it's not working for me. What's wrong that 3.0.0 version doesn't treat: "A Guest" the same way as aguest? They are configured this way in users file: "A Guest" Cleartext-Password := "123456" Reply-Message = "Hello %{User-Name}" aguest Cleartext-Password := "123456" Reply-Message = "Hello, %{User-Name}" and talking with radtest from other host makes following showing in debug: rad_recv: Access-Request packet from host 10.0.6.10 port 57803, id=3, length=77 User-Name = 'A Guest' User-Password = '123456' NAS-IP-Address = 10.0.6.10 NAS-Port = 0 Message-Authenticator = 0x3499158ba2be438b4e63389ffd091332 Wed Jan 29 17:20:58 2014 : Debug: (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:20:58 2014 : Debug: (0) authorize { Wed Jan 29 17:20:58 2014 : Debug: (0) filter_username filter_username { Wed Jan 29 17:20:58 2014 : Debug: (0) ? if (User-Name != "%{tolower:%{User-Name}}") Wed Jan 29 17:20:58 2014 : Debug: %{tolower:%{User-Name}} Wed Jan 29 17:20:58 2014 : Debug: Parsed xlat tree: Wed Jan 29 17:20:58 2014 : Debug: xlat: tolower Wed Jan 29 17:20:58 2014 : Debug: { Wed Jan 29 17:20:58 2014 : Debug: attribute: User-Name Wed Jan 29 17:20:58 2014 : Debug: { Wed Jan 29 17:20:58 2014 : Debug: ref 2 Wed Jan 29 17:20:58 2014 : Debug: list 1 Wed Jan 29 17:20:58 2014 : Debug: tag -128 Wed Jan 29 17:20:58 2014 : Debug: } Wed Jan 29 17:20:58 2014 : Debug: } Wed Jan 29 17:20:58 2014 : Debug: (0) expand: "%{tolower:%{User-Name}}" -> 'a guest' Wed Jan 29 17:20:58 2014 : Debug: (0) ? if (User-Name != "%{tolower:%{User-Name}}") -> TRUE Wed Jan 29 17:20:58 2014 : Debug: (0) if (User-Name != "%{tolower:%{User-Name}}") { Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[authorize]: calling reject (rlm_always) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[authorize]: returned from reject (rlm_always) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) [reject] = reject Wed Jan 29 17:20:58 2014 : Debug: (0) } # if (User-Name != "%{tolower:%{User-Name}}") = reject Wed Jan 29 17:20:58 2014 : Debug: (0) } # filter_username filter_username = reject Wed Jan 29 17:20:58 2014 : Debug: (0) } # authorize = reject Wed Jan 29 17:20:58 2014 : Debug: (0) Using Post-Auth-Type Reject Wed Jan 29 17:20:58 2014 : Debug: (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:20:58 2014 : Debug: (0) Post-Auth-Type REJECT { Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Wed Jan 29 17:20:58 2014 : Debug: %{User-Name} Wed Jan 29 17:20:58 2014 : Debug: Parsed xlat tree: Wed Jan 29 17:20:58 2014 : Debug: attribute: User-Name Wed Jan 29 17:20:58 2014 : Debug: { Wed Jan 29 17:20:58 2014 : Debug: ref 2 Wed Jan 29 17:20:58 2014 : Debug: list 1 Wed Jan 29 17:20:58 2014 : Debug: tag -128 Wed Jan 29 17:20:58 2014 : Debug: } Wed Jan 29 17:20:58 2014 : Debug: (0) attr_filter.access_reject : expand: "%{User-Name}" -> 'A Guest' Wed Jan 29 17:20:58 2014 : Debug: (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) [attr_filter.access_reject] = updated Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: calling eap (rlm_eap) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: returned from eap (rlm_eap) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) [eap] = noop Wed Jan 29 17:20:58 2014 : Debug: (0) remove_reply_message_if_eap remove_reply_message_if_eap { Wed Jan 29 17:20:58 2014 : Debug: (0) ? if (reply:EAP-Message && reply:Reply-Message) Wed Jan 29 17:20:58 2014 : Debug: (0) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE Wed Jan 29 17:20:58 2014 : Debug: (0) else else { Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: calling noop (rlm_always) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: returned from noop (rlm_always) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) [noop] = noop Wed Jan 29 17:20:58 2014 : Debug: (0) } # else else = noop Wed Jan 29 17:20:58 2014 : Debug: (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop Wed Jan 29 17:20:58 2014 : Debug: (0) } # Post-Auth-Type REJECT = updated Wed Jan 29 17:20:58 2014 : Debug: (0) Finished request 0. Wed Jan 29 17:20:58 2014 : Debug: Waking up in 0.3 seconds. Wed Jan 29 17:20:58 2014 : Debug: Waking up in 0.6 seconds. Wed Jan 29 17:20:59 2014 : Debug: (0) Sending delayed reject Sending Access-Reject of id 3 from 10.0.6.207 port 1812 to 10.0.6.10 port 57803 Wed Jan 29 17:20:59 2014 : Debug: Waking up in 4.9 seconds. Wed Jan 29 17:21:04 2014 : Debug: (0) Cleaning up request packet ID 3 with timestamp +29 Wed Jan 29 17:21:04 2014 : Info: Ready to process requests. rad_recv: Access-Request packet from host 10.0.6.10 port 44948, id=210, length=76 User-Name = 'aguest' User-Password = '123456' NAS-IP-Address = 10.0.6.10 NAS-Port = 0 Message-Authenticator = 0xdfd5232531e2f84735f3a9b1b94c22c9 Wed Jan 29 17:21:10 2014 : Debug: (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:21:10 2014 : Debug: (1) authorize { Wed Jan 29 17:21:10 2014 : Debug: (1) filter_username filter_username { Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name != "%{tolower:%{User-Name}}") Wed Jan 29 17:21:10 2014 : Debug: %{tolower:%{User-Name}} Wed Jan 29 17:21:10 2014 : Debug: Parsed xlat tree: Wed Jan 29 17:21:10 2014 : Debug: xlat: tolower Wed Jan 29 17:21:10 2014 : Debug: { Wed Jan 29 17:21:10 2014 : Debug: attribute: User-Name Wed Jan 29 17:21:10 2014 : Debug: { Wed Jan 29 17:21:10 2014 : Debug: ref 2 Wed Jan 29 17:21:10 2014 : Debug: list 1 Wed Jan 29 17:21:10 2014 : Debug: tag -128 Wed Jan 29 17:21:10 2014 : Debug: } Wed Jan 29 17:21:10 2014 : Debug: } Wed Jan 29 17:21:10 2014 : Debug: } Wed Jan 29 17:21:10 2014 : Debug: (1) expand: "%{tolower:%{User-Name}}" -> 'aguest' Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ / /) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ / /) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /@.*@/ ) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /@.*@/ ) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /\\.\\./ ) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /\\.\\./ ) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /\\.$/) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /\\.$/) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /(a)\\./) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /(a)\\./) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) } # filter_username filter_username = notfound Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [preprocess] = ok Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling chap (rlm_chap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from chap (rlm_chap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [chap] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling mschap (rlm_mschap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from mschap (rlm_mschap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [mschap] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling digest (rlm_digest) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from digest (rlm_digest) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [digest] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling suffix (rlm_realm) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) suffix : No '@' in User-Name = "aguest", looking up realm NULL Wed Jan 29 17:21:10 2014 : Debug: (1) suffix : No such realm "NULL" Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [suffix] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling eap (rlm_eap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) eap : No EAP-Message, not doing EAP Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from eap (rlm_eap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [eap] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling files (rlm_files) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) files : users: Matched entry aguest at line 57 Wed Jan 29 17:21:10 2014 : Debug: Hello, %{User-Name} Wed Jan 29 17:21:10 2014 : Debug: Parsed xlat tree: Wed Jan 29 17:21:10 2014 : Debug: literal: 'Hello, ' Wed Jan 29 17:21:10 2014 : Debug: attribute: User-Name Wed Jan 29 17:21:10 2014 : Debug: { Wed Jan 29 17:21:10 2014 : Debug: ref 2 Wed Jan 29 17:21:10 2014 : Debug: list 1 Wed Jan 29 17:21:10 2014 : Debug: tag -128 Wed Jan 29 17:21:10 2014 : Debug: } Wed Jan 29 17:21:10 2014 : Debug: (1) files : expand: "Hello, %{User-Name}" -> 'Hello, aguest' Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from files (rlm_files) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [files] = ok Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling expiration (rlm_expiration) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from expiration (rlm_expiration) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [expiration] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling logintime (rlm_logintime) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from logintime (rlm_logintime) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [logintime] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling pap (rlm_pap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from pap (rlm_pap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [pap] = updated Wed Jan 29 17:21:10 2014 : Debug: (1) } # authorize = updated Wed Jan 29 17:21:10 2014 : Debug: (1) Found Auth-Type = PAP Wed Jan 29 17:21:10 2014 : Debug: (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:21:10 2014 : Debug: (1) Auth-Type PAP { Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authenticate]: calling pap (rlm_pap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) pap : login attempt with password "123456" Wed Jan 29 17:21:10 2014 : Debug: (1) pap : Using clear text password "123456" Wed Jan 29 17:21:10 2014 : Debug: (1) pap : User authenticated successfully Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authenticate]: returned from pap (rlm_pap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [pap] = ok Wed Jan 29 17:21:10 2014 : Debug: (1) } # Auth-Type PAP = ok Wed Jan 29 17:21:10 2014 : Debug: (1) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:21:10 2014 : Debug: (1) post-auth { Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[post-auth]: calling exec (rlm_exec) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[post-auth]: returned from exec (rlm_exec) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [exec] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) remove_reply_message_if_eap remove_reply_message_if_eap { Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (reply:EAP-Message && reply:Reply-Message) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) else else { Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[post-auth]: calling noop (rlm_always) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[post-auth]: returned from noop (rlm_always) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [noop] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) } # else else = noop Wed Jan 29 17:21:10 2014 : Debug: (1) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop Wed Jan 29 17:21:10 2014 : Debug: (1) } # post-auth = noop Sending Access-Accept of id 210 from 10.0.6.207 port 1812 to 10.0.6.10 port 44948 Reply-Message = 'Hello, aguest' Wed Jan 29 17:21:10 2014 : Debug: (1) Finished request 1. Wed Jan 29 17:21:10 2014 : Debug: Waking up in 0.3 seconds. Wed Jan 29 17:21:10 2014 : Debug: Waking up in 4.6 seconds. -- Pozdrawiam, Maciej Milewski

5 6