- Freeradius-Users - lists.freeradius.org

Re: MSCHAP Errors
by Alan Buxey 15 May '12

15 May '12

What does the server try to run when actually dealing with your client? radius -X will show you, you can then try running that command yourself. alan

4 3

Conditionally passing custom attributes
by Chad Lensert 15 May '12

15 May '12

freeradius-server-utils-2.1.1-7.7.19.77 freeradius-server-libs-2.1.1-7.7.19.77 freeradius-server-2.1.1-7.10.1 Greetings all. I am trying to pass a list of custom attributes based on the information in the radius request. Originally, I tried matching on NAS-IP-Address as noted below, but it looks like I can also match on Client-IP-Address, which I would prefer. The issue I am having is that I don't see radius matching the right entry in the users file and returning specific custom attributes. I can't determine why it is choosing the last user entry in the users file. Here is an example of the users file. I expect the information from the request to match the first entry for user "chad". #################################################### DEFAULT Auth-Type=Pam Service-Type = NAS-Prompt-User, cisco-avpair +="shell:priv-lvl=2", cisco-avpair :="shell:roles*network-operator", Fall-Through = 1 ... #put customer user attributes here! chad NAS-IP-Address == "1.2.3.4" cisco-avpair += "NCS:virtual-domain0=ROOT-DOMAIN", cisco-avpair += "NCS:role0=Root" chad NAS-IP-Address == "2.3.4.5" cisco-avpair += "NCS:virtual-domain0=ROOT-DOMAIN", cisco-avpair += "NCS:role0=Root" chad Service-Type := Administrative-User, cisco-avpair := "shell:priv-lvl=15", cisco-avpair := "shell:roles*network-admin" #################################################### The debug from radius shows that the NAS-IP-Address in the first user entry matches the initial request. I also tried to match on Client-IP-Address, but the debugs always show radius matching on the last user entry and sending different attributes. Ready to process requests. rad_recv: Access-Request packet from host x.x.x.x port 19721, id=31, length=62 NAS-IP-Address = 1.2.3.4 Service-Type = Login-User NAS-Port-Type = Virtual User-Name = "chad" User-Password = "0123456789" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "chad", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry DEFAULT at line 1 [files] users: Matched entry chad at line 29 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = PAM +- entering group authenticate {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: authentication succeeded for <chad> ++[pam] returns ok Login OK: [chad/0123456789] (from client lensert port 0) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 31 to x.x.x.x port 19721 Service-Type := Administrative-User Cisco-AVPair := "shell:roles*network-admin" Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 9296, id=104, length=68 User-Name = "chad" User-Password = "0123456789" NAS-IP-Address = 2.3.4.5 Message-Authenticator = 0xb346bbcf6f763e4e9e32c2f4ddc657b9 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "chad", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry DEFAULT at line 1 [files] users: Matched entry chad at line 29 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = PAM +- entering group authenticate {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <chad>. Reason: Permission denied ++[pam] returns reject Failed to authenticate the user. Login incorrect: [chad/0123456789] (from client lensert port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> chad attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 104 to x.x.x.x port 9296 Finished request 1. Going to the next request Waking up in 2.7 seconds. rad_recv: Access-Request packet from host x.x.x.x port 55546, id=31, length=62 NAS-IP-Address = 1.2.3.4 Service-Type = Login-User NAS-Port-Type = Virtual User-Name = "chad" User-Password = "0123456789" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "chad", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry DEFAULT at line 1 [files] users: Matched entry chad at line 29 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = PAM +- entering group authenticate {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <chad>. Reason: Permission denied ++[pam] returns reject Failed to authenticate the user. Login incorrect: [chad/0123456789] (from client lensert port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> chad attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 31 to x.x.x.x port 55546 Finished request 2. Going to the next request Waking up in 0.4 seconds. Cleaning up request 0 ID 31 with timestamp +30 Waking up in 2.2 seconds. Cleaning up request 1 ID 104 with timestamp +32 Waking up in 2.3 seconds. Cleaning up request 2 ID 31 with timestamp +35 Ready to process requests.

2 1

Freeradius 100% cpu
by Arianna Manlio 15 May '12

15 May '12

Hi, I'm running this version of FR: # freeradius -v freeradius: FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 OS is: # cat /etc/debian_version 6.0.5 # uname -ar Linux 2.6.32-5-686 #1 SMP Sun May 6 04:01:19 UTC 2012 i686 GNU/Linux it's a VMware VM with 4 vCpu and 1 GB RAM. Auth module is MySQL. FR is working but it takes 100% CPU. Other strange thing is that load does not rise more than 1 (it should be 4 or more). Any suggestion? This is my relevant config: max_request_time = 60 cleanup_delay = 5 max_requests = 102400 (I've 18 clients) thread pool { start_servers = 32 max_servers = 256 min_spare_servers = 5 max_spare_servers = 20 max_requests_per_server = 0 } sql.conf sql { num_sql_socks = 8 connect_failure_retry_delay = 60 } Thank you very much

3 3

webauth and macauth
by djura 15 May '12

15 May '12

Hi, i am trying to setup radius auth for my AP. i've followed wiki instructions and it must be i overseen something my session printout and config files are below. I need your expert help with this one. Have anyone seen this kind of behaviour? br, jura root@zgpc-radius:~# /usr/sbin/freeradius -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on May 19 2011 at 15:42:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes msg_badpass = "Holly shit your password is bad!" } security { max_attributes = 200 reject_delay = 3 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "0123456789ABCDEF" nastype = "other" } client 192.168.113.0/24 { require_message_authenticator = no secret = "0123456789ABCDEF" shortname = "BLMOVI" } client 10.222.72.0/24 { require_message_authenticator = no secret = "0123456789ABCDEF" shortname = "ONTOVI" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "ok" from file /etc/freeradius/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Checking authorize {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "authorized_macs" from file /etc/freeradius/modules/files files authorized_macs { usersfile = "/etc/freeradius/authorized_macs" compat = "no" key = "%{Calling-Station-ID}" } Module: Instantiating module "reject" from file /etc/freeradius/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. rad_recv: Access-Request packet from host 10.222.72.112 port 65534, id=26, length=143 NAS-IP-Address = 100.1.1.1 NAS-Port-Id = "1.1" Framed-MTU = 1024 User-Name = "64-31-50-81-CB-2F" Calling-Station-Id = "64-31-50-81-CB-2F" Message-Authenticator = 0x55e71eef2d8919739367e5026db3bc16 EAP-Message = 0x020200110167706f6e2d48505c67706f6e NAS-Identifier = "BLM12" Ericsson-Attr-101 = 0x4552494353534f4e # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} [eap] EAP packet type response id 2 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++? if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) (Attribute Service-Type was not found) ?? Evaluating (Service-Type == 'Call-Check') -> FALSE expand: ^%{Calling-Station-ID}$ -> ^64-31-50-81-CB-2F$ ?? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> TRUE ++? if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) -> TRUE ++- entering if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) {...} +++[control] returns updated ++- if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) returns updated Found Auth-Type = EAP WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. # Executing group from file /etc/freeradius/sites-enabled/default Failed to authenticate the user. expand: Crap your password is bad! -> Crap your password is bad! Login incorrect: [64-31-50-81-CB-2F/<via Auth-Type = EAP>] (from client ONTOVI port 0 cli 64-31-50-81-CB-2F) Holly shit your password is bad! Using Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. # Executing group from file /etc/freeradius/sites-enabled/default Delaying reject of request 0 for 3 seconds Going to the next request Waking up in 0.9 seconds. Waking up in 1.9 seconds. rad_recv: Access-Request packet from host 10.222.72.112 port 65534, id=26, length=143 Waiting to send Access-Reject to client ONTOVI port 65534 - ID: 26 Waking up in 1.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 26 to 10.222.72.112 port 65534 rad_recv: Access-Request packet from host 10.222.72.112 port 65534, id=26, length=143 Sending duplicate reply to client ONTOVI port 65534 - ID: 26 Sending Access-Reject of id 26 to 10.222.72.112 port 65534 Waking up in 4.9 seconds. Cleaning up request 0 ID 26 with timestamp +43 Ready to process requests. ---------------------------------------------------------------------------- root@zgpc-radius:/etc/freeradius/sites-enabled# grep -v '#' ../clients.conf client localhost { ipaddr = 127.0.0.1 secret = 0123456789ABCDEF require_message_authenticator = no } client 10.222.72.0/24 { secret = 0123456789ABCDEF shortname = ONTOVI require_message_authenticator = no } ----------------------------------------------------------------------------- root@zgpc-radius:/etc/freeradius/sites-enabled# grep -v '#' ../radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes msg_badpass = "Crap your password is bad!" } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 3 status_server = yes } proxy_requests = no $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ root@zgpc-radius:/etc/freeradius/sites-enabled# --------------------------------------------------------------------------- root@zgpc-radius:/etc/freeradius/sites-enabled# grep -v '#' ../policy.conf policy { forbid_eap { if (EAP-Message) { reject } } permit_only_eap { if (!EAP-Message) { if (!"%{outer.request:EAP-Message}") { reject } } } deny_realms { if (User-Name =~ /@|\\/) { reject } } do_not_respond { update control { Response-Packet-Type := Do-Not-Respond } handled } cui_authorize { update request { Chargeable-User-Identity:='\\000' } } cui_postauth { if (FreeRadius-Proxied-To == 127.0.0.1) { if (outer.request:Chargeable-User-Identity) { update outer.reply { Chargeable-User-Identity:="%{md5:%{config:cui_hash_key}%{User-Name}}" } } } else { if (Chargeable-User-Identity) { update reply { Chargeable-User-Identity="%{md5:%{config:cui_hash_key}%{User-Name}}" } } } } cui_updatedb { if (reply:Chargeable-User-Identity) { cui } } cui_accounting { if (!Chargeable-User-Identity) { update control { Chargable-User-Identity := "%{cui: SELECT cui FROM cui WHERE clientipaddress = '%{Client-IP-Address}' AND callingstationid = '%{Calling-Station-Id}' AND username = '%{User-Name}'}" } } if (Chargeable-User-Identity && (Chargeable-User-Identity != "")) { cui } } rewrite_calling_station_id { if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i){ update request { Calling-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" } } else { noop } } } ------------------------------------------------------------------------------------------------------ root@zgpc-radius:/etc/freeradius/sites-enabled# grep -v '#' /etc/freeradius/eap.conf eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } } -- View this message in context: http://freeradius.1045715.n5.nabble.com/webauth-and-macauth-tp5703328.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

FreeRADIUS Installation on Windows Server 2008
by dsumalabe 15 May '12

15 May '12

Hi, I tried installing the FreeRADIUS ver 1.1.7-r0.0.2 and MYSQL 5.5.23 in Windows 7 and it works OK and also the Accounting and Authentication work OK. Now I started installing it in Windows Server 2008. When installing FreeRADIUS in Windows Server 2008, the installation does not finish. When installation is on approximately 90%, the chown.exe appears and stop from there. It will only continue when chown.exe cmd window is manually closed. Then Chmod.exe will appear and manually close it also to continue installation. Then the rm.exe, we did the same thing and installation was completed. The FreeRADIUS will start but it will not work properly because of this 3 items (chown.exe, chmod.exe and rm.exe). Please help me how to resolve the problem. Thanks and Kind Regards, dsumalabe -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-Installation-on-Windows-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

[PATCH]es decrement client limit on socket timeout, saner tls sample conf, and a pasto
by Brian Julin 15 May '12

15 May '12

Three patches versus master attached: The first puts a saner default config for radsec connections from clients, because in the dominant use-case for radsec clients (outside federation servers pointing to your IDP service) these connections are often nailed up by the client so if they timeout every thirty seconds (which is the new default as of the limit structure changes), the client just proceeds to rebuild them every 30 seconds. The second patch is a pasto that was preventing dhcp.c from compiling. Note I don't use this module, so I haven't tested that at all. The third patch decrements the client's connection limit counter when a socket times out so that a TCP connection falling down and restoring does not eventually run afoul of max_connections. Note this problem was pre-existing before for the new limit structure changes but also occured with them applied. This is only slightly tested, and might benefit from an experienced eyeball or two, especially WRT possibly backporting it.

1 0

How to set attribute value as null means that " "
by mimir 15 May '12

15 May '12

Hello, I want to add a custom attribute before replicate the accounting package with null value. I see that it is added successfully before replication, but when I check it on remote server, I can not see userid1 and userid2 attributes. Do you have any comment on this? [replicate] Replicating packet to Realm SECONDARY2 Sending Accounting-Request of id 235 to 127.0.0.6 port 2814 User-Name = "test" Calling-Station-Id = "1678912345" Framed-Protocol = PPP Acct-Status-Type = Start NAS-Port = 22 Acct-Session-Id = "6" Service-Type = Framed-User NAS-IP-Address = 135.243.90.19 * userid1 = "" userid2 = ""* -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-to-set-attribute-value-as-null-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

MSCHAP Errors
by sgilmour 15 May '12

15 May '12

Hi, I am running freeradius with Ubuntu and with the Active Directory Configuration. When doing PEAP authentication I keep on getting a MSCHAP Error. Not sure where to make changes or what changes to make. Is there something I need to add in the Radiusd.conf or the eap.conf file? Thanks in Advance for your help, Scott rad_recv: Access-Request packet from host 192.168.175.60 port 65202, id=132, length=146 User-Name = "SQA\\sqapeap" Service-Type = Framed-User Called-Station-Id = "00-1F-45-A7-9A-4E" Calling-Station-Id = "08-00-27-0D-CB-01" NAS-IP-Address = 192.168.175.60 NAS-Port = 128 NAS-Port-Id = "ge.3.24" Framed-MTU = 1500 NAS-Port-Type = Ethernet EAP-Message = 0x02010010015351415c73716170656170 Message-Authenticator = 0x6b9ffc8200a2e75ddfedebf83d4ab93a Fri May 11 08:08:12 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:12 2012 : Info: +- entering group authorize {...} Fri May 11 08:08:12 2012 : Info: ++[preprocess] returns ok Fri May 11 08:08:12 2012 : Info: ++[chap] returns noop Fri May 11 08:08:12 2012 : Info: ++[mschap] returns noop Fri May 11 08:08:12 2012 : Info: ++[digest] returns noop Fri May 11 08:08:12 2012 : Info: [suffix] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:12 2012 : Info: [suffix] No such realm "NULL" Fri May 11 08:08:12 2012 : Info: ++[suffix] returns noop Fri May 11 08:08:12 2012 : Info: [ntdomain] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:12 2012 : Info: [ntdomain] No such realm "NULL" Fri May 11 08:08:12 2012 : Info: ++[ntdomain] returns noop Fri May 11 08:08:12 2012 : Info: [eap] EAP packet type response id 1 length 16 Fri May 11 08:08:12 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Fri May 11 08:08:12 2012 : Info: ++[eap] returns updated Fri May 11 08:08:12 2012 : Info: ++[files] returns noop Fri May 11 08:08:12 2012 : Info: ++[expiration] returns noop Fri May 11 08:08:12 2012 : Info: ++[logintime] returns noop Fri May 11 08:08:12 2012 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Fri May 11 08:08:12 2012 : Info: ++[pap] returns noop Fri May 11 08:08:12 2012 : Info: ++? if (!control:Auth-Type) Fri May 11 08:08:12 2012 : Info: ? Evaluating !(control:Auth-Type) -> FALSE Fri May 11 08:08:12 2012 : Info: ++? if (!control:Auth-Type) -> FALSE Fri May 11 08:08:12 2012 : Info: Found Auth-Type = EAP Fri May 11 08:08:12 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:12 2012 : Info: +- entering group authenticate {...} Fri May 11 08:08:12 2012 : Info: [eap] EAP Identity Fri May 11 08:08:12 2012 : Info: [eap] processing type tls Fri May 11 08:08:12 2012 : Info: [tls] Initiate Fri May 11 08:08:12 2012 : Info: [tls] Start returned 1 Fri May 11 08:08:12 2012 : Info: ++[eap] returns handled Sending Access-Challenge of id 132 to 192.168.175.60 port 65202 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaa86bc7baa84a5473544135e4511878c Fri May 11 08:08:12 2012 : Info: Finished request 108. Fri May 11 08:08:12 2012 : Debug: Going to the next request Fri May 11 08:08:12 2012 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.175.60 port 65202, id=133, length=253 User-Name = "SQA\\sqapeap" Service-Type = Framed-User Called-Station-Id = "00-1F-45-A7-9A-4E" Calling-Station-Id = "08-00-27-0D-CB-01" NAS-IP-Address = 192.168.175.60 NAS-Port = 128 NAS-Port-Id = "ge.3.24" Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0xaa86bc7baa84a5473544135e4511878c EAP-Message = 0x0202006919800000005f160301005a0100005603014fad0132e1cd0d0b2431012b494f3795220fdba7d1e6c6a9be582687d5d2124b000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 Message-Authenticator = 0x6474a496d418b6236c2405061711197b Fri May 11 08:08:13 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authorize {...} Fri May 11 08:08:13 2012 : Info: ++[preprocess] returns ok Fri May 11 08:08:13 2012 : Info: ++[chap] returns noop Fri May 11 08:08:13 2012 : Info: ++[mschap] returns noop Fri May 11 08:08:13 2012 : Info: ++[digest] returns noop Fri May 11 08:08:13 2012 : Info: [suffix] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [suffix] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[suffix] returns noop Fri May 11 08:08:13 2012 : Info: [ntdomain] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [ntdomain] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[ntdomain] returns noop Fri May 11 08:08:13 2012 : Info: [eap] EAP packet type response id 2 length 105 Fri May 11 08:08:13 2012 : Info: [eap] Continuing tunnel setup. Fri May 11 08:08:13 2012 : Info: ++[eap] returns ok Fri May 11 08:08:13 2012 : Info: Found Auth-Type = EAP Fri May 11 08:08:13 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authenticate {...} Fri May 11 08:08:13 2012 : Info: [eap] Request found, released from the list Fri May 11 08:08:13 2012 : Info: [eap] EAP/peap Fri May 11 08:08:13 2012 : Info: [eap] processing type peap Fri May 11 08:08:13 2012 : Info: [peap] processing EAP-TLS Fri May 11 08:08:13 2012 : Debug: TLS Length 95 Fri May 11 08:08:13 2012 : Info: [peap] Length Included Fri May 11 08:08:13 2012 : Info: [peap] eaptls_verify returned 11 Fri May 11 08:08:13 2012 : Info: [peap] (other): before/accept initialization Fri May 11 08:08:13 2012 : Info: [peap] TLS_accept: before/accept initialization Fri May 11 08:08:13 2012 : Info: [peap] <<< TLS 1.0 Handshake [length 005a], ClientHello Fri May 11 08:08:13 2012 : Info: [peap] TLS_accept: SSLv3 read client hello A Fri May 11 08:08:13 2012 : Info: [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello Fri May 11 08:08:13 2012 : Info: [peap] TLS_accept: SSLv3 write server hello A Fri May 11 08:08:13 2012 : Info: [peap] >>> TLS 1.0 Handshake [length 0668], Certificate Fri May 11 08:08:13 2012 : Info: [peap] TLS_accept: SSLv3 write certificate A Fri May 11 08:08:13 2012 : Info: [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Fri May 11 08:08:13 2012 : Info: [peap] TLS_accept: SSLv3 write server done A Fri May 11 08:08:13 2012 : Info: [peap] TLS_accept: SSLv3 flush data Fri May 11 08:08:13 2012 : Info: [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A Fri May 11 08:08:13 2012 : Debug: In SSL Handshake Phase Fri May 11 08:08:13 2012 : Debug: In SSL Accept mode Fri May 11 08:08:13 2012 : Info: [peap] eaptls_process returned 13 Fri May 11 08:08:13 2012 : Info: [peap] EAPTLS_HANDLED Fri May 11 08:08:13 2012 : Info: ++[eap] returns handled Sending Access-Challenge of id 133 to 192.168.175.60 port 65202 EAP-Message = 0x0103040019c0000006ac16030100310200002d03014fad012d75fe0859349a42c0195d6ac5c14e2fd6931b128896862f3d545ecf1900002f000005ff0100010016030106680b0006640006610002da308202d6308201bea003020102020101300d06092a864886f70d0101050500305031133011060a0992268993f22c64011916036e657431133011060a0992268993f22c6401191603535141312430220603550403131b53514120323030382053797374656d204365727469666963617465301e170d3132303531303139343030395a170d3133303531303139343030395a3078310b3009060355040613025553310b300906035504080c024e4831 EAP-Message = 0x0e300c06035504070c0553616c656d310c300a060355040a0c03535141310c300a060355040b0c03535141310e300c06035504030c0553636f74743120301e06092a864886f70d01090116117371612e656e746572617379732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100cdf0ea02581b682e86d3fed11ab7f54da248a1ec6dbfd5535d85a44ac3ed3bdbbe16d6363b7c875a3f99cf1f9814bf428ec5e5751518e410f9a1043b2db75b55b1705e91038a3dcc78f9029038048d8e8138094fbff1820ebb74742222fb9a55e69b3a878c838576589eb4af2aaa966d9f58ce61b1fdd8c64db0c111a192f7cd020301 EAP-Message = 0x0001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000382010100b88c1d290a9d1a6c2ca060c0c0a97759d2e22b0814a513b1ad33e90baf162a06b73031b68a4af7932c0d9d804132245311e9e89364eb0170aa4be2e15a4d634c362adaece67dce2db986e39115c0a79e98b53f3406791a44486c41d998c311f2174385d00ce10449cb20b27b5112295a5afad0acc80775cada5399110cf36a51bb60fe7e1bd6a37b41fe9c3610be081b64a11049be9343037c80f65fe7f6b54b3a08c3a0e7ee6d17d26660c87fb131ebf0a602bbb74517df57ff37259ed572c5ced7d3bd17dc403abd071eee1eba EAP-Message = 0x439704ce0c37c762409e6b758cb1362f2117c2aaa8398f8d485a09bf64f8a8f02ff8356fecd6ac5405a284fb361c0c05e18a0003813082037d30820265a003020102021052e1d7f24b931dbc4e684cd8cf2e9853300d06092a864886f70d0101050500305031133011060a0992268993f22c64011916036e657431133011060a0992268993f22c6401191603535141312430220603550403131b53514120323030382053797374656d2043657274696669636174653020170d3131313132383230313534335a180f32313131313132383230323534325a305031133011060a0992268993f22c64011916036e657431133011060a0992268993f22c6401 EAP-Message = 0x191603535141312430220603 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaa86bc7bab85a5473544135e4511878c Fri May 11 08:08:13 2012 : Info: Finished request 109. Fri May 11 08:08:13 2012 : Debug: Going to the next request Fri May 11 08:08:13 2012 : Debug: Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 192.168.175.60 port 65202, id=134, length=154 User-Name = "SQA\\sqapeap" Service-Type = Framed-User Called-Station-Id = "00-1F-45-A7-9A-4E" Calling-Station-Id = "08-00-27-0D-CB-01" NAS-IP-Address = 192.168.175.60 NAS-Port = 128 NAS-Port-Id = "ge.3.24" Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0xaa86bc7bab85a5473544135e4511878c EAP-Message = 0x020300061900 Message-Authenticator = 0x000b75dcd813bd4f8963f6eb54bacb57 Fri May 11 08:08:13 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authorize {...} Fri May 11 08:08:13 2012 : Info: ++[preprocess] returns ok Fri May 11 08:08:13 2012 : Info: ++[chap] returns noop Fri May 11 08:08:13 2012 : Info: ++[mschap] returns noop Fri May 11 08:08:13 2012 : Info: ++[digest] returns noop Fri May 11 08:08:13 2012 : Info: [suffix] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [suffix] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[suffix] returns noop Fri May 11 08:08:13 2012 : Info: [ntdomain] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [ntdomain] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[ntdomain] returns noop Fri May 11 08:08:13 2012 : Info: [eap] EAP packet type response id 3 length 6 Fri May 11 08:08:13 2012 : Info: [eap] Continuing tunnel setup. Fri May 11 08:08:13 2012 : Info: ++[eap] returns ok Fri May 11 08:08:13 2012 : Info: Found Auth-Type = EAP Fri May 11 08:08:13 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authenticate {...} Fri May 11 08:08:13 2012 : Info: [eap] Request found, released from the list Fri May 11 08:08:13 2012 : Info: [eap] EAP/peap Fri May 11 08:08:13 2012 : Info: [eap] processing type peap Fri May 11 08:08:13 2012 : Info: [peap] processing EAP-TLS Fri May 11 08:08:13 2012 : Info: [peap] Received TLS ACK Fri May 11 08:08:13 2012 : Info: [peap] ACK handshake fragment handler Fri May 11 08:08:13 2012 : Info: [peap] eaptls_verify returned 1 Fri May 11 08:08:13 2012 : Info: [peap] eaptls_process returned 13 Fri May 11 08:08:13 2012 : Info: [peap] EAPTLS_HANDLED Fri May 11 08:08:13 2012 : Info: ++[eap] returns handled Sending Access-Challenge of id 134 to 192.168.175.60 port 65202 EAP-Message = 0x010402bc1900550403131b53514120323030382053797374656d20436572746966696361746530820122300d06092a864886f70d01010105000382010f003082010a0282010100b9042e7582826074208089933fdc1fc8bf8e64239b70ef9aec7d2ee32530c1f3bc858121e93418665c044a0249ab154afd55a2e256079aefe6573832b063c1b2758d224b2f41ba18e01bce10c09ad63597f52dc3a2440266d4ee210f0abcd2423555dfda3877f7a73662cec9031c52e63598ea99cead364c83ddfcad4dcb7bcee41692fa4c06f662f893192b68bc89a4abfffbbdab460f9d982910e788579aec31fe59b32c36092736773bb45136cf221eed38e6f8f0 EAP-Message = 0xbeca302387bddfaaf7d5829da1eca9bded6069d973a2b480614a4cde83184550e254a84466598ab46e170e6c7029e3c46f21e747eb9615fc2514890a20fbc670163206e53d8b52536e790203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604146e3141ffc209e19ce5bc6d9c84b5bd4c0e79d5b3301006092b06010401823715010403020100300d06092a864886f70d010105050003820101002156ce1cf81ed9b8790efe81b455a0343aae7934d7ee0adde1320fd5541c9e742e69800db373f3b6e7d6220c01eb8a6dfde466954584d89f74afa1b50f28407b74da0a44bde2f6 EAP-Message = 0x509c207af6f798370c7f7c74a4310d60cd1fdf1d61b16cae7fd22f65d23aec863fffa4c1d0f0a2cb79510c671e8c3b8b331d7839e978e91d0845e3df7d6c41f752307faf9d3f16e1c2d144a551873b1ca4d9ed3fa335012e0183bce5da28c0ff82ecbf9e080473ce9895328be6a82f7db1f0ae388e1abb70178951917b8aa3f72ecec031de3e21aa7f23621a5486974122c35ca5aaa1573fd88c29ee6bcd6f75c69b67590589d83f50cbcff092511676d3c1f431e55fd0cc7a16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaa86bc7ba882a5473544135e4511878c Fri May 11 08:08:13 2012 : Info: Finished request 110. Fri May 11 08:08:13 2012 : Debug: Going to the next request Fri May 11 08:08:13 2012 : Debug: Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 192.168.175.60 port 65202, id=135, length=356 User-Name = "SQA\\sqapeap" Service-Type = Framed-User Called-Station-Id = "00-1F-45-A7-9A-4E" Calling-Station-Id = "08-00-27-0D-CB-01" NAS-IP-Address = 192.168.175.60 NAS-Port = 128 NAS-Port-Id = "ge.3.24" Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0xaa86bc7ba882a5473544135e4511878c EAP-Message = 0x020400d01980000000c61603010086100000820080463837b28480ac2091fb5909466b4725bdbe02f0668e83e5f7b201fee88e3df3b1c4f73a52d49ed5ff52d196635efedf4e54883838a7afcd250a4198559f47af9bbc772d455be7661ad548acedd2b09bc402abd4f539cbf0203a3331d6c72f23224f10a73cd5d5d8826116eb302ba50726ea284ea102fed52d40827af8f06d6c14030100010116030100306f70fbdd038353383d237716dac89ac623320a0f62b076b6d371deb0f53d9a6fd7f20bd59b4ce1a160c8f9ea8d697ab8 Message-Authenticator = 0xd2b60ab5163a0a60b3803399892e8ad1 Fri May 11 08:08:13 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authorize {...} Fri May 11 08:08:13 2012 : Info: ++[preprocess] returns ok Fri May 11 08:08:13 2012 : Info: ++[chap] returns noop Fri May 11 08:08:13 2012 : Info: ++[mschap] returns noop Fri May 11 08:08:13 2012 : Info: ++[digest] returns noop Fri May 11 08:08:13 2012 : Info: [suffix] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [suffix] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[suffix] returns noop Fri May 11 08:08:13 2012 : Info: [ntdomain] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [ntdomain] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[ntdomain] returns noop Fri May 11 08:08:13 2012 : Info: [eap] EAP packet type response id 4 length 208 Fri May 11 08:08:13 2012 : Info: [eap] Continuing tunnel setup. Fri May 11 08:08:13 2012 : Info: ++[eap] returns ok Fri May 11 08:08:13 2012 : Info: Found Auth-Type = EAP Fri May 11 08:08:13 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authenticate {...} Fri May 11 08:08:13 2012 : Info: [eap] Request found, released from the list Fri May 11 08:08:13 2012 : Info: [eap] EAP/peap Fri May 11 08:08:13 2012 : Info: [eap] processing type peap Fri May 11 08:08:13 2012 : Info: [peap] processing EAP-TLS Fri May 11 08:08:13 2012 : Debug: TLS Length 198 Fri May 11 08:08:13 2012 : Info: [peap] Length Included Fri May 11 08:08:13 2012 : Info: [peap] eaptls_verify returned 11 Fri May 11 08:08:13 2012 : Info: [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange Fri May 11 08:08:13 2012 : Info: [peap] TLS_accept: SSLv3 read client key exchange A Fri May 11 08:08:13 2012 : Info: [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] Fri May 11 08:08:13 2012 : Info: [peap] <<< TLS 1.0 Handshake [length 0010], Finished Fri May 11 08:08:13 2012 : Info: [peap] TLS_accept: SSLv3 read finished A Fri May 11 08:08:13 2012 : Info: [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] Fri May 11 08:08:13 2012 : Info: [peap] TLS_accept: SSLv3 write change cipher spec A Fri May 11 08:08:13 2012 : Info: [peap] >>> TLS 1.0 Handshake [length 0010], Finished Fri May 11 08:08:13 2012 : Info: [peap] TLS_accept: SSLv3 write finished A Fri May 11 08:08:13 2012 : Info: [peap] TLS_accept: SSLv3 flush data Fri May 11 08:08:13 2012 : Info: [peap] (other): SSL negotiation finished successfully Fri May 11 08:08:13 2012 : Debug: SSL Connection Established Fri May 11 08:08:13 2012 : Info: [peap] eaptls_process returned 13 Fri May 11 08:08:13 2012 : Info: [peap] EAPTLS_HANDLED Fri May 11 08:08:13 2012 : Info: ++[eap] returns handled Sending Access-Challenge of id 135 to 192.168.175.60 port 65202 EAP-Message = 0x0105004119001403010001011603010030838d15cd73ed5acd80788f0f744777bbfb8f3496d0dbfe71c9daf3593ba18400ae3b6df1d139fa8710ea64bc780e3103 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaa86bc7ba983a5473544135e4511878c Fri May 11 08:08:13 2012 : Info: Finished request 111. Fri May 11 08:08:13 2012 : Debug: Going to the next request Fri May 11 08:08:13 2012 : Debug: Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.175.60 port 65202, id=136, length=154 User-Name = "SQA\\sqapeap" Service-Type = Framed-User Called-Station-Id = "00-1F-45-A7-9A-4E" Calling-Station-Id = "08-00-27-0D-CB-01" NAS-IP-Address = 192.168.175.60 NAS-Port = 128 NAS-Port-Id = "ge.3.24" Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0xaa86bc7ba983a5473544135e4511878c EAP-Message = 0x020500061900 Message-Authenticator = 0x81fced2e4c993f65247ce06be7d72a0c Fri May 11 08:08:13 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authorize {...} Fri May 11 08:08:13 2012 : Info: ++[preprocess] returns ok Fri May 11 08:08:13 2012 : Info: ++[chap] returns noop Fri May 11 08:08:13 2012 : Info: ++[mschap] returns noop Fri May 11 08:08:13 2012 : Info: ++[digest] returns noop Fri May 11 08:08:13 2012 : Info: [suffix] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [suffix] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[suffix] returns noop Fri May 11 08:08:13 2012 : Info: [ntdomain] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [ntdomain] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[ntdomain] returns noop Fri May 11 08:08:13 2012 : Info: [eap] EAP packet type response id 5 length 6 Fri May 11 08:08:13 2012 : Info: [eap] Continuing tunnel setup. Fri May 11 08:08:13 2012 : Info: ++[eap] returns ok Fri May 11 08:08:13 2012 : Info: Found Auth-Type = EAP Fri May 11 08:08:13 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authenticate {...} Fri May 11 08:08:13 2012 : Info: [eap] Request found, released from the list Fri May 11 08:08:13 2012 : Info: [eap] EAP/peap Fri May 11 08:08:13 2012 : Info: [eap] processing type peap Fri May 11 08:08:13 2012 : Info: [peap] processing EAP-TLS Fri May 11 08:08:13 2012 : Info: [peap] Received TLS ACK Fri May 11 08:08:13 2012 : Info: [peap] ACK handshake is finished Fri May 11 08:08:13 2012 : Info: [peap] eaptls_verify returned 3 Fri May 11 08:08:13 2012 : Info: [peap] eaptls_process returned 3 Fri May 11 08:08:13 2012 : Info: [peap] EAPTLS_SUCCESS Fri May 11 08:08:13 2012 : Info: [peap] Session established. Decoding tunneled attributes. Fri May 11 08:08:13 2012 : Info: [peap] Peap state TUNNEL ESTABLISHED Fri May 11 08:08:13 2012 : Info: ++[eap] returns handled Sending Access-Challenge of id 136 to 192.168.175.60 port 65202 EAP-Message = 0x0106002b19001703010020a7117ca0f626e9300ef5cfdf57fc9a14218ef6fe762945152331ee0d8a146294 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaa86bc7bae80a5473544135e4511878c Fri May 11 08:08:13 2012 : Info: Finished request 112. Fri May 11 08:08:13 2012 : Debug: Going to the next request Fri May 11 08:08:13 2012 : Debug: Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.175.60 port 65202, id=137, length=207 User-Name = "SQA\\sqapeap" Service-Type = Framed-User Called-Station-Id = "00-1F-45-A7-9A-4E" Calling-Station-Id = "08-00-27-0D-CB-01" NAS-IP-Address = 192.168.175.60 NAS-Port = 128 NAS-Port-Id = "ge.3.24" Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0xaa86bc7bae80a5473544135e4511878c EAP-Message = 0x0206003b190017030100309654ab90a674acdf836a4484b10af45223b24a84aea92020e329df8c2f4c8adae101fc89f98a9b5574dcd59ee84a8d81 Message-Authenticator = 0xff44378d5ab27db959ad202ba7850b00 Fri May 11 08:08:13 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authorize {...} Fri May 11 08:08:13 2012 : Info: ++[preprocess] returns ok Fri May 11 08:08:13 2012 : Info: ++[chap] returns noop Fri May 11 08:08:13 2012 : Info: ++[mschap] returns noop Fri May 11 08:08:13 2012 : Info: ++[digest] returns noop Fri May 11 08:08:13 2012 : Info: [suffix] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [suffix] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[suffix] returns noop Fri May 11 08:08:13 2012 : Info: [ntdomain] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [ntdomain] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[ntdomain] returns noop Fri May 11 08:08:13 2012 : Info: [eap] EAP packet type response id 6 length 59 Fri May 11 08:08:13 2012 : Info: [eap] Continuing tunnel setup. Fri May 11 08:08:13 2012 : Info: ++[eap] returns ok Fri May 11 08:08:13 2012 : Info: Found Auth-Type = EAP Fri May 11 08:08:13 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authenticate {...} Fri May 11 08:08:13 2012 : Info: [eap] Request found, released from the list Fri May 11 08:08:13 2012 : Info: [eap] EAP/peap Fri May 11 08:08:13 2012 : Info: [eap] processing type peap Fri May 11 08:08:13 2012 : Info: [peap] processing EAP-TLS Fri May 11 08:08:13 2012 : Info: [peap] eaptls_verify returned 7 Fri May 11 08:08:13 2012 : Info: [peap] Done initial handshake Fri May 11 08:08:13 2012 : Info: [peap] eaptls_process returned 7 Fri May 11 08:08:13 2012 : Info: [peap] EAPTLS_OK Fri May 11 08:08:13 2012 : Info: [peap] Session established. Decoding tunneled attributes. Fri May 11 08:08:13 2012 : Info: [peap] Peap state WAITING FOR INNER IDENTITY Fri May 11 08:08:13 2012 : Info: [peap] Identity - SQA\sqapeap Fri May 11 08:08:13 2012 : Info: [peap] Got inner identity 'SQA\sqapeap' Fri May 11 08:08:13 2012 : Info: [peap] Setting default EAP type for tunneled EAP session. Fri May 11 08:08:13 2012 : Info: [peap] Got tunneled request EAP-Message = 0x02060010015351415c73716170656170 server { Fri May 11 08:08:13 2012 : Debug: PEAP: Setting User-Name to SQA\sqapeap Sending tunneled request EAP-Message = 0x02060010015351415c73716170656170 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "SQA\\sqapeap" server inner-tunnel { Fri May 11 08:08:13 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel Fri May 11 08:08:13 2012 : Info: +- entering group authorize {...} Fri May 11 08:08:13 2012 : Info: ++[chap] returns noop Fri May 11 08:08:13 2012 : Info: ++[mschap] returns noop Fri May 11 08:08:13 2012 : Info: ++[unix] returns notfound Fri May 11 08:08:13 2012 : Info: [suffix] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [suffix] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[suffix] returns noop Fri May 11 08:08:13 2012 : Info: ++[control] returns noop Fri May 11 08:08:13 2012 : Info: [eap] EAP packet type response id 6 length 16 Fri May 11 08:08:13 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Fri May 11 08:08:13 2012 : Info: ++[eap] returns updated Fri May 11 08:08:13 2012 : Info: ++[files] returns noop Fri May 11 08:08:13 2012 : Info: ++[expiration] returns noop Fri May 11 08:08:13 2012 : Info: ++[logintime] returns noop Fri May 11 08:08:13 2012 : Info: ++[pap] returns noop Fri May 11 08:08:13 2012 : Info: Found Auth-Type = EAP Fri May 11 08:08:13 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel Fri May 11 08:08:13 2012 : Info: +- entering group authenticate {...} Fri May 11 08:08:13 2012 : Info: [eap] EAP Identity Fri May 11 08:08:13 2012 : Info: [eap] processing type mschapv2 Fri May 11 08:08:13 2012 : Debug: rlm_eap_mschapv2: Issuing Challenge Fri May 11 08:08:13 2012 : Info: ++[eap] returns handled } # server inner-tunnel Fri May 11 08:08:13 2012 : Info: [peap] Got tunneled reply code 11 EAP-Message = 0x010700251a0107002010624dc963efbbc11443de20dbf8bd85dd5351415c73716170656170 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x59b4f31f59b3e9805d8ea2f4cd3c97e6 Fri May 11 08:08:13 2012 : Info: [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010700251a0107002010624dc963efbbc11443de20dbf8bd85dd5351415c73716170656170 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x59b4f31f59b3e9805d8ea2f4cd3c97e6 Fri May 11 08:08:13 2012 : Info: [peap] Got tunneled Access-Challenge PEAP tunnel data out 0000: 1a 01 07 00 20 10 62 4d c9 63 ef bb c1 14 43 de PEAP tunnel data out 0010: 20 db f8 bd 85 dd 53 51 41 5c 73 71 61 70 65 61 PEAP tunnel data out 0020: 70 Fri May 11 08:08:13 2012 : Info: ++[eap] returns handled Sending Access-Challenge of id 137 to 192.168.175.60 port 65202 EAP-Message = 0x0107004b190017030100404c5f068f847f32059de6bba78bad464999de2685c4822ef1a0be6c23946a39f8dc6ce8af49120518a2d6a4c7d24274f82681cc2aba2c4dcc9f2b8cbcedc1f559 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaa86bc7baf81a5473544135e4511878c Fri May 11 08:08:13 2012 : Info: Finished request 113. Fri May 11 08:08:13 2012 : Debug: Going to the next request Fri May 11 08:08:13 2012 : Debug: Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.175.60 port 65202, id=138, length=255 User-Name = "SQA\\sqapeap" Service-Type = Framed-User Called-Station-Id = "00-1F-45-A7-9A-4E" Calling-Station-Id = "08-00-27-0D-CB-01" NAS-IP-Address = 192.168.175.60 NAS-Port = 128 NAS-Port-Id = "ge.3.24" Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0xaa86bc7baf81a5473544135e4511878c EAP-Message = 0x0207006b19001703010060d68c17c32bbdaf3df7da97a3e0e39e0e1a714b96ddc8c96b1ab1b08913479d66a9aefd071e7ebcf92e57af93058998d4a78ed1ec7adb91cd1fd895013488f59f7a2c64440d18932893e658efc5606eb3186bcf28c4a21ca590986f2daa88c166 Message-Authenticator = 0x65ad45297a9fe402a2370ae211ac674e Fri May 11 08:08:13 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authorize {...} Fri May 11 08:08:13 2012 : Info: ++[preprocess] returns ok Fri May 11 08:08:13 2012 : Info: ++[chap] returns noop Fri May 11 08:08:13 2012 : Info: ++[mschap] returns noop Fri May 11 08:08:13 2012 : Info: ++[digest] returns noop Fri May 11 08:08:13 2012 : Info: [suffix] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [suffix] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[suffix] returns noop Fri May 11 08:08:13 2012 : Info: [ntdomain] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [ntdomain] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[ntdomain] returns noop Fri May 11 08:08:13 2012 : Info: [eap] EAP packet type response id 7 length 107 Fri May 11 08:08:13 2012 : Info: [eap] Continuing tunnel setup. Fri May 11 08:08:13 2012 : Info: ++[eap] returns ok Fri May 11 08:08:13 2012 : Info: Found Auth-Type = EAP Fri May 11 08:08:13 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authenticate {...} Fri May 11 08:08:13 2012 : Info: [eap] Request found, released from the list Fri May 11 08:08:13 2012 : Info: [eap] EAP/peap Fri May 11 08:08:13 2012 : Info: [eap] processing type peap Fri May 11 08:08:13 2012 : Info: [peap] processing EAP-TLS Fri May 11 08:08:13 2012 : Info: [peap] eaptls_verify returned 7 Fri May 11 08:08:13 2012 : Info: [peap] Done initial handshake Fri May 11 08:08:13 2012 : Info: [peap] eaptls_process returned 7 Fri May 11 08:08:13 2012 : Info: [peap] EAPTLS_OK Fri May 11 08:08:13 2012 : Info: [peap] Session established. Decoding tunneled attributes. Fri May 11 08:08:13 2012 : Info: [peap] Peap state phase2 Fri May 11 08:08:13 2012 : Info: [peap] EAP type mschapv2 Fri May 11 08:08:13 2012 : Info: [peap] Got tunneled request EAP-Message = 0x020700461a02070041313f56ccb5d1debad1683c00be09180fe8000000000000000046eb0f981a6121ad65e5726b0ee0e2097d610172204c7f24005351415c73716170656170 server { Fri May 11 08:08:13 2012 : Debug: PEAP: Setting User-Name to SQA\sqapeap Sending tunneled request EAP-Message = 0x020700461a02070041313f56ccb5d1debad1683c00be09180fe8000000000000000046eb0f981a6121ad65e5726b0ee0e2097d610172204c7f24005351415c73716170656170 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "SQA\\sqapeap" State = 0x59b4f31f59b3e9805d8ea2f4cd3c97e6 server inner-tunnel { Fri May 11 08:08:13 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel Fri May 11 08:08:13 2012 : Info: +- entering group authorize {...} Fri May 11 08:08:13 2012 : Info: ++[chap] returns noop Fri May 11 08:08:13 2012 : Info: ++[mschap] returns noop Fri May 11 08:08:13 2012 : Info: ++[unix] returns notfound Fri May 11 08:08:13 2012 : Info: [suffix] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [suffix] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[suffix] returns noop Fri May 11 08:08:13 2012 : Info: ++[control] returns noop Fri May 11 08:08:13 2012 : Info: [eap] EAP packet type response id 7 length 70 Fri May 11 08:08:13 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Fri May 11 08:08:13 2012 : Info: ++[eap] returns updated Fri May 11 08:08:13 2012 : Info: ++[files] returns noop Fri May 11 08:08:13 2012 : Info: ++[expiration] returns noop Fri May 11 08:08:13 2012 : Info: ++[logintime] returns noop Fri May 11 08:08:13 2012 : Info: ++[pap] returns noop Fri May 11 08:08:13 2012 : Info: Found Auth-Type = EAP Fri May 11 08:08:13 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel Fri May 11 08:08:13 2012 : Info: +- entering group authenticate {...} Fri May 11 08:08:13 2012 : Info: [eap] Request found, released from the list Fri May 11 08:08:13 2012 : Info: [eap] EAP/mschapv2 Fri May 11 08:08:13 2012 : Info: [eap] processing type mschapv2 Fri May 11 08:08:13 2012 : Info: [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel Fri May 11 08:08:13 2012 : Info: [mschapv2] +- entering group MS-CHAP {...} Fri May 11 08:08:13 2012 : Info: [mschap] Creating challenge hash with username: sqapeap Fri May 11 08:08:13 2012 : Info: [mschap] Told to do MS-CHAPv2 for sqapeap with NT-Password Fri May 11 08:08:13 2012 : Info: [mschap] expand: %{Stripped-User-Name} -> Fri May 11 08:08:13 2012 : Info: [mschap] ... expanding second conditional Fri May 11 08:08:13 2012 : Info: [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Fri May 11 08:08:13 2012 : Info: [mschap] expand: %{User-Name:-None} -> SQA\sqapeap Fri May 11 08:08:13 2012 : Info: [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=SQA\sqapeap Fri May 11 08:08:13 2012 : Info: [mschap] mschap2: 62 Fri May 11 08:08:13 2012 : Info: [mschap] Creating challenge hash with username: sqapeap Fri May 11 08:08:13 2012 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=ab56b7e9f5df9308 Fri May 11 08:08:13 2012 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=46eb0f981a6121ad65e5726b0ee0e2097d610172204c7f24 Fri May 11 08:08:13 2012 : Debug: Exec-Program output: Access denied (0xc0000022) Fri May 11 08:08:13 2012 : Debug: Exec-Program-Wait: plaintext: Access denied (0xc0000022) Fri May 11 08:08:13 2012 : Debug: Exec-Program: returned: 1 Fri May 11 08:08:13 2012 : Info: [mschap] External script failed. Fri May 11 08:08:13 2012 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Fri May 11 08:08:13 2012 : Info: ++[mschap] returns reject Fri May 11 08:08:13 2012 : Info: [eap] Freeing handler Fri May 11 08:08:13 2012 : Info: ++[eap] returns reject Fri May 11 08:08:13 2012 : Info: Failed to authenticate the user. } # server inner-tunnel Fri May 11 08:08:13 2012 : Info: [peap] Got tunneled reply code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Fri May 11 08:08:13 2012 : Info: [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Fri May 11 08:08:13 2012 : Info: [peap] Tunneled authentication was rejected. Fri May 11 08:08:13 2012 : Info: [peap] FAILURE Fri May 11 08:08:13 2012 : Info: ++[eap] returns handled Sending Access-Challenge of id 138 to 192.168.175.60 port 65202 EAP-Message = 0x0108002b1900170301002041bcaaa17289a1c5162cb498969093ca0dd2347fe21bc72882bc25f3835f9a2a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaa86bc7bac8ea5473544135e4511878c Fri May 11 08:08:13 2012 : Info: Finished request 114. Fri May 11 08:08:13 2012 : Debug: Going to the next request Fri May 11 08:08:13 2012 : Debug: Waking up in 4.2 seconds. rad_recv: Access-Request packet from host 192.168.175.60 port 65202, id=139, length=191 User-Name = "SQA\\sqapeap" Service-Type = Framed-User Called-Station-Id = "00-1F-45-A7-9A-4E" Calling-Station-Id = "08-00-27-0D-CB-01" NAS-IP-Address = 192.168.175.60 NAS-Port = 128 NAS-Port-Id = "ge.3.24" Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0xaa86bc7bac8ea5473544135e4511878c EAP-Message = 0x0208002b19001703010020cf6d10b0828e97582b1814a25179ee1804abcc2a0a1c2381dfcf15f4a17f523e Message-Authenticator = 0x4ae4c683b92e1a5c105a719db10398c9 Fri May 11 08:08:13 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authorize {...} Fri May 11 08:08:13 2012 : Info: ++[preprocess] returns ok Fri May 11 08:08:13 2012 : Info: ++[chap] returns noop Fri May 11 08:08:13 2012 : Info: ++[mschap] returns noop Fri May 11 08:08:13 2012 : Info: ++[digest] returns noop Fri May 11 08:08:13 2012 : Info: [suffix] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [suffix] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[suffix] returns noop Fri May 11 08:08:13 2012 : Info: [ntdomain] No '@' in User-Name = "SQA\sqapeap", looking up realm NULL Fri May 11 08:08:13 2012 : Info: [ntdomain] No such realm "NULL" Fri May 11 08:08:13 2012 : Info: ++[ntdomain] returns noop Fri May 11 08:08:13 2012 : Info: [eap] EAP packet type response id 8 length 43 Fri May 11 08:08:13 2012 : Info: [eap] Continuing tunnel setup. Fri May 11 08:08:13 2012 : Info: ++[eap] returns ok Fri May 11 08:08:13 2012 : Info: Found Auth-Type = EAP Fri May 11 08:08:13 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group authenticate {...} Fri May 11 08:08:13 2012 : Info: [eap] Request found, released from the list Fri May 11 08:08:13 2012 : Info: [eap] EAP/peap Fri May 11 08:08:13 2012 : Info: [eap] processing type peap Fri May 11 08:08:13 2012 : Info: [peap] processing EAP-TLS Fri May 11 08:08:13 2012 : Info: [peap] eaptls_verify returned 7 Fri May 11 08:08:13 2012 : Info: [peap] Done initial handshake Fri May 11 08:08:13 2012 : Info: [peap] eaptls_process returned 7 Fri May 11 08:08:13 2012 : Info: [peap] EAPTLS_OK Fri May 11 08:08:13 2012 : Info: [peap] Session established. Decoding tunneled attributes. Fri May 11 08:08:13 2012 : Info: [peap] Peap state send tlv failure Fri May 11 08:08:13 2012 : Info: [peap] Received EAP-TLV response. Fri May 11 08:08:13 2012 : Info: [peap] The users session was previously rejected: returning reject (again.) Fri May 11 08:08:13 2012 : Info: [peap] *** This means you need to read the PREVIOUS messages in the debug output Fri May 11 08:08:13 2012 : Info: [peap] *** to find out the reason why the user was rejected. Fri May 11 08:08:13 2012 : Info: [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. Fri May 11 08:08:13 2012 : Info: [peap] *** what went wrong, and how to fix the problem. Fri May 11 08:08:13 2012 : Info: [eap] Handler failed in EAP/peap Fri May 11 08:08:13 2012 : Info: [eap] Failed in EAP select Fri May 11 08:08:13 2012 : Info: ++[eap] returns invalid Fri May 11 08:08:13 2012 : Info: Failed to authenticate the user. Fri May 11 08:08:13 2012 : Info: Using Post-Auth-Type Reject Fri May 11 08:08:13 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri May 11 08:08:13 2012 : Info: +- entering group REJECT {...} Fri May 11 08:08:13 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> SQA\sqapeap Fri May 11 08:08:13 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Fri May 11 08:08:13 2012 : Info: ++[attr_filter.access_reject] returns updated Fri May 11 08:08:13 2012 : Info: Delaying reject of request 115 for 1 seconds Fri May 11 08:08:13 2012 : Debug: Going to the next request Fri May 11 08:08:13 2012 : Debug: Waking up in 0.9 seconds. Fri May 11 08:08:14 2012 : Info: Sending delayed reject for request 115 Sending Access-Reject of id 139 to 192.168.175.60 port 65202 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Fri May 11 08:08:14 2012 : Debug: Waking up in 3.2 seconds. Fri May 11 08:08:17 2012 : Info: Cleaning up request 108 ID 132 with timestamp +1769 Fri May 11 08:08:17 2012 : Debug: Waking up in 0.5 seconds. Fri May 11 08:08:18 2012 : Info: Cleaning up request 109 ID 133 with timestamp +1770 Fri May 11 08:08:18 2012 : Info: Cleaning up request 110 ID 134 with timestamp +1770 Fri May 11 08:08:18 2012 : Info: Cleaning up request 111 ID 135 with timestamp +1770 Fri May 11 08:08:18 2012 : Info: Cleaning up request 112 ID 136 with timestamp +1770 Fri May 11 08:08:18 2012 : Info: Cleaning up request 113 ID 137 with timestamp +1770 Fri May 11 08:08:18 2012 : Info: Cleaning up request 114 ID 138 with timestamp +1770 Fri May 11 08:08:18 2012 : Debug: Waking up in 1.0 seconds. Fri May 11 08:08:19 2012 : Info: Cleaning up request 115 ID 139 with timestamp +1770 Fri May 11 08:08:19 2012 : Info: Ready to process requests. -- View this message in context: http://freeradius.1045715.n5.nabble.com/MSCHAP-Errors-tp5702886.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

EAP/TTLS Auth problem
by Steve Hopps 15 May '12

15 May '12

I'm trying to use FreeRadius with OpenLDAP for authentication of some Nanostation M2 access points, but have had no luck getting it to work. When using rad_eap_test to experiment, I logged the following: Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group PAP {...} [pap] login attempt with password "-removed-" [pap] Using CRYPT password "*" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Can anyone suggest what I'm doing wrong? The output for this section is the same with rad_eap_test or the AP itself.

4 11

Re:Specific User Trace and multiple radiusd instant(Tom Deng)
by 全球无线联盟 15 May '12

15 May '12

Fajar, Yes. We're using Linux ES 5.4. We're leasing a virtual server from a vendor. While Linux ES 5.4 is the Linux server it can provide. Actually, it helped us. As we need PPTP VPN dailup for our application, the PPTP VPN installation on 5.4 is very smooth. While we can't make it work on Linux ES 6.0/6.1. We got two freeradius versions available on 5.4, freeradius1 and freeradius2, and we selected freeradius2. Thanks for advise raddebug. So far, it doesn't work well for us. As your advise, we actually tried radmin. radmin> debug condition '(User-Name == 1)' radmin> radmin> show debug level 4 radmin> show debug condition (User-Name == 1) //"1" is the username. radmin> show debug file /var/log/radius/tom.log We tail -f /var/log/radius/tom.log. We found two issues. 1. The output from the radmin is diffirent from "Radius -X". While we consider radiusd -X output more helpful information. While radmin didn't. 2. We like to filter the debug information for user "1" only, while the radmin still output all users. Can you please help to advise what would be the reason? You mentioned ixc virtualization, do you have a web site link for this software? I googled it, but not found. As we leasing the virtual server, we failed to nest install VMWare on our server. So your virtual server may work. Hello, James, Thanks for your reply. As mentioned previously, we failed to install VMWare on our leased virtual box. The reason to want multiple radiusd is, we don't know the raddebug solution previouly. We planed run second freeradius for debug only. We also need multiple radiusd instant for some other reason. Alan, We tried to configure multiple instances, but failed. So we need a handy configuration guide. Thank you all. Tom Deng.

3 2