- Freeradius-Users - lists.freeradius.org

huntgroup check problems
by Oscar Remírez de Ganuza Satrústegui 27 Jan '12

27 Jan '12

Hello everybody, We are using freeradius (Version 2.1.9) to serve access requests for 802.1x, using PEAP/EAP/MSCHAPv2 (windows7). We use LDAP for authentication (user accounts) and authorization (Ldap-Groups). We also tunneled the request to the same radius for our realm "unav.es". I am having some problems using huntgroups to identified the origin of a request. I have simplified the test trying to find out the problem, but I do not understand what it is happening: * It works ok when I use the following users file: ----- users file ----- DEFAULT Ldap-Group=="unav.radius.empleado" Reply-Message = "Empleado from test switch" DEFAULT Auth-Type := Reject Reply-Message = "Access not allowed." ----- * But it fails when I check the huntgroup: ----- users file ----- DEFAULT Huntgroup-Name == "huntpruebas", Ldap-Group=="unav.radius.empleado" Reply-Message = "Empleado from test switch" DEFAULT Auth-Type := Reject Reply-Message = "Access not allowed." ----- (The "notworking log" is appended at the end of the message. I had to trim it to make it shorter) (The "workingok log" is not attached as it made this message bigger than allowed on this list). I can see in the "not working log" that on the first requests the huntgroup is been recognised ok. I just do not understand why it tries again to check it, until it fails (request #9). I also do not understand why it needs so many requests (12!) to work ok. I will appreciate any help understanding what is happening, in order to find a solution for my problem. If it is needed more log or config files, I can attached them without problem. Thanks a lot. ====== Not working log ====== Thu Jan 19 12:34:20 2012 : Info: FreeRADIUS Version 2.1.9, for host i686-pc-linux-gnu, built on Oct 4 2010 at 13:35:26 [trimmed] Thu Jan 19 12:34:20 2012 : Debug: main { Thu Jan 19 12:34:20 2012 : Debug: prefix = "/usr/local/etc2/freeradius" Thu Jan 19 12:34:20 2012 : Debug: localstatedir = "/usr/local/etc2/freeradius/var" Thu Jan 19 12:34:20 2012 : Debug: logdir = "/usr/local/etc2/freeradius/var/log/radius" Thu Jan 19 12:34:20 2012 : Debug: libdir = "/usr/local/etc2/freeradius/lib" Thu Jan 19 12:34:20 2012 : Debug: radacctdir = "/usr/local/etc2/freeradius/var/log/radius/radacct" Thu Jan 19 12:34:20 2012 : Debug: hostname_lookups = no Thu Jan 19 12:34:20 2012 : Debug: max_request_time = 30 Thu Jan 19 12:34:20 2012 : Debug: cleanup_delay = 5 Thu Jan 19 12:34:20 2012 : Debug: max_requests = 1024 Thu Jan 19 12:34:20 2012 : Debug: pidfile = "/usr/local/etc2/freeradius/var/run/radiusd/radiusd.pid" Thu Jan 19 12:34:20 2012 : Debug: checkrad = "/usr/local/etc2/freeradius/sbin/checkrad" Thu Jan 19 12:34:20 2012 : Debug: debug_level = 0 Thu Jan 19 12:34:20 2012 : Debug: proxy_requests = yes Thu Jan 19 12:34:20 2012 : Debug: log { Thu Jan 19 12:34:20 2012 : Debug: stripped_names = no Thu Jan 19 12:34:20 2012 : Debug: auth = no Thu Jan 19 12:34:20 2012 : Debug: auth_badpass = no Thu Jan 19 12:34:20 2012 : Debug: auth_goodpass = no Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: security { Thu Jan 19 12:34:20 2012 : Debug: max_attributes = 200 Thu Jan 19 12:34:20 2012 : Debug: reject_delay = 1 Thu Jan 19 12:34:20 2012 : Debug: status_server = yes Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: radiusd: #### Loading Realms and Home Servers #### Thu Jan 19 12:34:20 2012 : Debug: proxy server { Thu Jan 19 12:34:20 2012 : Debug: retry_delay = 5 Thu Jan 19 12:34:20 2012 : Debug: retry_count = 3 Thu Jan 19 12:34:20 2012 : Debug: default_fallback = yes Thu Jan 19 12:34:20 2012 : Debug: dead_time = 120 Thu Jan 19 12:34:20 2012 : Debug: wake_all_if_all_dead = no Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: realm unav.es { Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: realm LOCAL { Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: home_server localhost { Thu Jan 19 12:34:20 2012 : Debug: ipaddr = 127.0.0.1 Thu Jan 19 12:34:20 2012 : Debug: port = 1812 Thu Jan 19 12:34:20 2012 : Debug: type = "auth+acct" Thu Jan 19 12:34:20 2012 : Debug: secret = "testing123" Thu Jan 19 12:34:20 2012 : Debug: response_window = 20 Thu Jan 19 12:34:20 2012 : Debug: max_outstanding = 65536 Thu Jan 19 12:34:20 2012 : Debug: require_message_authenticator = no Thu Jan 19 12:34:20 2012 : Debug: zombie_period = 40 Thu Jan 19 12:34:20 2012 : Debug: status_check = "status-server" Thu Jan 19 12:34:20 2012 : Debug: ping_interval = 30 Thu Jan 19 12:34:20 2012 : Debug: check_interval = 30 Thu Jan 19 12:34:20 2012 : Debug: num_answers_to_alive = 3 Thu Jan 19 12:34:20 2012 : Debug: num_pings_to_alive = 3 Thu Jan 19 12:34:20 2012 : Debug: revive_interval = 120 Thu Jan 19 12:34:20 2012 : Debug: status_check_timeout = 4 Thu Jan 19 12:34:20 2012 : Debug: irt = 2 Thu Jan 19 12:34:20 2012 : Debug: mrt = 16 Thu Jan 19 12:34:20 2012 : Debug: mrc = 5 Thu Jan 19 12:34:20 2012 : Debug: mrd = 30 Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: home_server_pool my_auth_failover { Thu Jan 19 12:34:20 2012 : Debug: type = fail-over Thu Jan 19 12:34:20 2012 : Debug: home_server = localhost Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: radiusd: #### Loading Clients #### Thu Jan 19 12:34:20 2012 : Debug: client localhost { Thu Jan 19 12:34:20 2012 : Debug: ipaddr = 127.0.0.1 Thu Jan 19 12:34:20 2012 : Debug: require_message_authenticator = no Thu Jan 19 12:34:20 2012 : Debug: secret = "testing123" Thu Jan 19 12:34:20 2012 : Debug: nastype = "other" Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: client naspruebas { Thu Jan 19 12:34:20 2012 : Debug: ipaddr = 159.237.8.200 Thu Jan 19 12:34:20 2012 : Debug: require_message_authenticator = no Thu Jan 19 12:34:20 2012 : Debug: secret = "pruebas" Thu Jan 19 12:34:20 2012 : Debug: shortname = "naspruebas" Thu Jan 19 12:34:20 2012 : Debug: nastype = "other" Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: radiusd: #### Instantiating modules #### Thu Jan 19 12:34:20 2012 : Debug: instantiate { Thu Jan 19 12:34:20 2012 : Debug: (Loaded rlm_exec, checking if it's valid) Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to module rlm_exec Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating exec Thu Jan 19 12:34:20 2012 : Debug: exec { Thu Jan 19 12:34:20 2012 : Debug: wait = no Thu Jan 19 12:34:20 2012 : Debug: input_pairs = "request" Thu Jan 19 12:34:20 2012 : Debug: shell_escape = yes Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: (Loaded rlm_expr, checking if it's valid) Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to module rlm_expr Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating expr Thu Jan 19 12:34:20 2012 : Debug: (Loaded rlm_expiration, checking if it's valid) Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to module rlm_expiration Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating expiration Thu Jan 19 12:34:20 2012 : Debug: expiration { Thu Jan 19 12:34:20 2012 : Debug: reply-message = "Password Has Expired " Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: (Loaded rlm_logintime, checking if it's valid) Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to module rlm_logintime Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating logintime Thu Jan 19 12:34:20 2012 : Debug: logintime { Thu Jan 19 12:34:20 2012 : Debug: reply-message = "You are calling outside your allowed timespan " Thu Jan 19 12:34:20 2012 : Debug: minimum-timeout = 60 Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: radiusd: #### Loading Virtual Servers #### Thu Jan 19 12:34:20 2012 : Debug: server inner-tunnel { Thu Jan 19 12:34:20 2012 : Debug: modules { Thu Jan 19 12:34:20 2012 : Debug: Module: Checking authenticate {...} for more modules to load Thu Jan 19 12:34:20 2012 : Debug: (Loaded rlm_pap, checking if it's valid) Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to module rlm_pap Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating pap Thu Jan 19 12:34:20 2012 : Debug: pap { Thu Jan 19 12:34:20 2012 : Debug: encryption_scheme = "auto" Thu Jan 19 12:34:20 2012 : Debug: auto_header = no Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: (Loaded rlm_chap, checking if it's valid) Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to module rlm_chap Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating chap Thu Jan 19 12:34:20 2012 : Debug: (Loaded rlm_mschap, checking if it's valid) Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to module rlm_mschap Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating mschap Thu Jan 19 12:34:20 2012 : Debug: mschap { Thu Jan 19 12:34:20 2012 : Debug: use_mppe = yes Thu Jan 19 12:34:20 2012 : Debug: require_encryption = yes Thu Jan 19 12:34:20 2012 : Debug: require_strong = yes Thu Jan 19 12:34:20 2012 : Debug: with_ntdomain_hack = no Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: (Loaded rlm_unix, checking if it's valid) Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to module rlm_unix Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating unix Thu Jan 19 12:34:20 2012 : Debug: unix { Thu Jan 19 12:34:20 2012 : Debug: radwtmp = "/usr/local/etc2/freeradius/var/log/radius/radwtmp" Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: (Loaded rlm_eap, checking if it's valid) Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to module rlm_eap Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating eap Thu Jan 19 12:34:20 2012 : Debug: eap { Thu Jan 19 12:34:20 2012 : Debug: default_eap_type = "md5" Thu Jan 19 12:34:20 2012 : Debug: timer_expire = 60 Thu Jan 19 12:34:20 2012 : Debug: ignore_unknown_eap_types = no Thu Jan 19 12:34:20 2012 : Debug: cisco_accounting_username_bug = no Thu Jan 19 12:34:20 2012 : Debug: max_sessions = 4096 Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to sub-module rlm_eap_md5 Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating eap-md5 Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to sub-module rlm_eap_leap Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating eap-leap Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to sub-module rlm_eap_gtc Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating eap-gtc Thu Jan 19 12:34:20 2012 : Debug: gtc { Thu Jan 19 12:34:20 2012 : Debug: challenge = "Password: " Thu Jan 19 12:34:20 2012 : Debug: auth_type = "PAP" Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to sub-module rlm_eap_tls Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating eap-tls Thu Jan 19 12:34:20 2012 : Debug: tls { Thu Jan 19 12:34:20 2012 : Debug: rsa_key_exchange = no Thu Jan 19 12:34:20 2012 : Debug: dh_key_exchange = yes Thu Jan 19 12:34:20 2012 : Debug: rsa_key_length = 512 Thu Jan 19 12:34:20 2012 : Debug: dh_key_length = 512 Thu Jan 19 12:34:20 2012 : Debug: verify_depth = 0 Thu Jan 19 12:34:20 2012 : Debug: pem_file_type = yes Thu Jan 19 12:34:20 2012 : Debug: private_key_file = "/usr/local/etc2/freeradius/etc/raddb/certs/radius.unav.es_privatekey.pem" Thu Jan 19 12:34:20 2012 : Debug: certificate_file = "/usr/local/etc2/freeradius/etc/raddb/certs/radius.unav.es_cert.pem" Thu Jan 19 12:34:20 2012 : Debug: CA_file = "/usr/local/etc2/freeradius/etc/raddb/certs/TERENASSL_PATH.pem" Thu Jan 19 12:34:20 2012 : Debug: dh_file = "/usr/local/etc2/freeradius/etc/raddb/certs/dh" Thu Jan 19 12:34:20 2012 : Debug: random_file = "/usr/local/etc2/freeradius/etc/raddb/certs/random" Thu Jan 19 12:34:20 2012 : Debug: fragment_size = 1024 Thu Jan 19 12:34:20 2012 : Debug: include_length = yes Thu Jan 19 12:34:20 2012 : Debug: check_crl = no Thu Jan 19 12:34:20 2012 : Debug: cipher_list = "DEFAULT" Thu Jan 19 12:34:20 2012 : Debug: make_cert_command = "/usr/local/etc2/freeradius/etc/raddb/certs/bootstrap" Thu Jan 19 12:34:20 2012 : Debug: cache { Thu Jan 19 12:34:20 2012 : Debug: enable = no Thu Jan 19 12:34:20 2012 : Debug: lifetime = 24 Thu Jan 19 12:34:20 2012 : Debug: max_entries = 255 Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to sub-module rlm_eap_ttls Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating eap-ttls Thu Jan 19 12:34:20 2012 : Debug: ttls { Thu Jan 19 12:34:20 2012 : Debug: default_eap_type = "md5" Thu Jan 19 12:34:20 2012 : Debug: copy_request_to_tunnel = yes Thu Jan 19 12:34:20 2012 : Debug: use_tunneled_reply = no Thu Jan 19 12:34:20 2012 : Debug: virtual_server = "inner-tunnel" Thu Jan 19 12:34:20 2012 : Debug: include_length = yes Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to sub-module rlm_eap_peap Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating eap-peap Thu Jan 19 12:34:20 2012 : Debug: peap { Thu Jan 19 12:34:20 2012 : Debug: default_eap_type = "mschapv2" Thu Jan 19 12:34:20 2012 : Debug: copy_request_to_tunnel = yes Thu Jan 19 12:34:20 2012 : Debug: use_tunneled_reply = no Thu Jan 19 12:34:20 2012 : Debug: proxy_tunneled_request_as_eap = no Thu Jan 19 12:34:20 2012 : Debug: virtual_server = "inner-tunnel" Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating eap-mschapv2 Thu Jan 19 12:34:20 2012 : Debug: mschapv2 { Thu Jan 19 12:34:20 2012 : Debug: with_ntdomain_hack = no Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:20 2012 : Debug: Module: Checking authorize {...} for more modules to load Thu Jan 19 12:34:20 2012 : Debug: (Loaded rlm_realm, checking if it's valid) Thu Jan 19 12:34:20 2012 : Debug: Module: Linked to module rlm_realm Thu Jan 19 12:34:20 2012 : Debug: Module: Instantiating suffix Thu Jan 19 12:34:20 2012 : Debug: realm suffix { Thu Jan 19 12:34:20 2012 : Debug: format = "suffix" Thu Jan 19 12:34:20 2012 : Debug: delimiter = "@" Thu Jan 19 12:34:20 2012 : Debug: ignore_default = no Thu Jan 19 12:34:20 2012 : Debug: ignore_null = no Thu Jan 19 12:34:20 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: (Loaded rlm_files, checking if it's valid) Thu Jan 19 12:34:21 2012 : Debug: Module: Linked to module rlm_files Thu Jan 19 12:34:21 2012 : Debug: Module: Instantiating files Thu Jan 19 12:34:21 2012 : Debug: files { Thu Jan 19 12:34:21 2012 : Debug: usersfile = "/usr/local/etc2/freeradius/etc/raddb/users" Thu Jan 19 12:34:21 2012 : Debug: acctusersfile = "/usr/local/etc2/freeradius/etc/raddb/acct_users" Thu Jan 19 12:34:21 2012 : Debug: preproxy_usersfile = "/usr/local/etc2/freeradius/etc/raddb/preproxy_users" Thu Jan 19 12:34:21 2012 : Debug: compat = "no" Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: (Loaded rlm_ldap, checking if it's valid) Thu Jan 19 12:34:21 2012 : Debug: Module: Linked to module rlm_ldap Thu Jan 19 12:34:21 2012 : Debug: Module: Instantiating ldap Thu Jan 19 12:34:21 2012 : Debug: ldap { Thu Jan 19 12:34:21 2012 : Debug: server = "ldappre.si.unav.es" Thu Jan 19 12:34:21 2012 : Debug: port = 389 Thu Jan 19 12:34:21 2012 : Debug: password = "xxx" Thu Jan 19 12:34:21 2012 : Debug: identity = "cn=radiusOp,dc=unav,dc=es" Thu Jan 19 12:34:21 2012 : Debug: net_timeout = 1 Thu Jan 19 12:34:21 2012 : Debug: timeout = 4 Thu Jan 19 12:34:21 2012 : Debug: timelimit = 3 Thu Jan 19 12:34:21 2012 : Debug: tls_mode = no Thu Jan 19 12:34:21 2012 : Debug: start_tls = no Thu Jan 19 12:34:21 2012 : Debug: tls_require_cert = "allow" Thu Jan 19 12:34:21 2012 : Debug: tls { Thu Jan 19 12:34:21 2012 : Debug: start_tls = yes Thu Jan 19 12:34:21 2012 : Debug: require_cert = "allow" Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: basedn = "ou=radius,o=accounts,dc=unav,dc=es" Thu Jan 19 12:34:21 2012 : Debug: filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" Thu Jan 19 12:34:21 2012 : Debug: base_filter = "(objectclass=radiusprofile)" Thu Jan 19 12:34:21 2012 : Debug: password_attribute = "unavRadiusPasswd" Thu Jan 19 12:34:21 2012 : Debug: auto_header = no Thu Jan 19 12:34:21 2012 : Debug: access_attr_used_for_allow = yes Thu Jan 19 12:34:21 2012 : Debug: groupname_attribute = "cn" Thu Jan 19 12:34:21 2012 : Debug: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" Thu Jan 19 12:34:21 2012 : Debug: groupmembership_attribute = "member" Thu Jan 19 12:34:21 2012 : Debug: dictionary_mapping = "/usr/local/etc2/freeradius/etc/raddb/ldap.attrmap" Thu Jan 19 12:34:21 2012 : Debug: ldap_debug = 104 Thu Jan 19 12:34:21 2012 : Debug: ldap_connections_number = 10 Thu Jan 19 12:34:21 2012 : Debug: compare_check_items = no Thu Jan 19 12:34:21 2012 : Debug: do_xlat = no Thu Jan 19 12:34:21 2012 : Debug: set_auth_type = yes Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: rlm_ldap: Registering ldap_groupcmp for Ldap-Group Thu Jan 19 12:34:21 2012 : Debug: rlm_ldap: Registering ldap_xlat with xlat_name ldap Thu Jan 19 12:34:21 2012 : Debug: rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section. Thu Jan 19 12:34:21 2012 : Debug: rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc2/freeradius/etc/raddb/ldap.attrmap [trimmed] Thu Jan 19 12:34:21 2012 : Debug: conns: 0x830e3c0 Thu Jan 19 12:34:21 2012 : Debug: Module: Checking session {...} for more modules to load Thu Jan 19 12:34:21 2012 : Debug: (Loaded rlm_radutmp, checking if it's valid) Thu Jan 19 12:34:21 2012 : Debug: Module: Linked to module rlm_radutmp Thu Jan 19 12:34:21 2012 : Debug: Module: Instantiating radutmp Thu Jan 19 12:34:21 2012 : Debug: radutmp { Thu Jan 19 12:34:21 2012 : Debug: filename = "/usr/local/etc2/freeradius/var/log/radius/radutmp" Thu Jan 19 12:34:21 2012 : Debug: username = "%{User-Name}" Thu Jan 19 12:34:21 2012 : Debug: case_sensitive = yes Thu Jan 19 12:34:21 2012 : Debug: check_with_nas = yes Thu Jan 19 12:34:21 2012 : Debug: perm = 384 Thu Jan 19 12:34:21 2012 : Debug: callerid = yes Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: Module: Checking post-proxy {...} for more modules to load Thu Jan 19 12:34:21 2012 : Debug: Module: Checking post-auth {...} for more modules to load Thu Jan 19 12:34:21 2012 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Thu Jan 19 12:34:21 2012 : Debug: Module: Linked to module rlm_attr_filter Thu Jan 19 12:34:21 2012 : Debug: Module: Instantiating attr_filter.access_reject Thu Jan 19 12:34:21 2012 : Debug: attr_filter attr_filter.access_reject { Thu Jan 19 12:34:21 2012 : Debug: attrsfile = "/usr/local/etc2/freeradius/etc/raddb/attrs.access_reject" Thu Jan 19 12:34:21 2012 : Debug: key = "%{User-Name}" Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: } # modules Thu Jan 19 12:34:21 2012 : Debug: } # server Thu Jan 19 12:34:21 2012 : Debug: server { Thu Jan 19 12:34:21 2012 : Debug: modules { Thu Jan 19 12:34:21 2012 : Debug: Module: Checking authenticate {...} for more modules to load Thu Jan 19 12:34:21 2012 : Debug: Module: Checking authorize {...} for more modules to load Thu Jan 19 12:34:21 2012 : Debug: (Loaded rlm_preprocess, checking if it's valid) Thu Jan 19 12:34:21 2012 : Debug: Module: Linked to module rlm_preprocess Thu Jan 19 12:34:21 2012 : Debug: Module: Instantiating preprocess Thu Jan 19 12:34:21 2012 : Debug: preprocess { Thu Jan 19 12:34:21 2012 : Debug: huntgroups = "/usr/local/etc2/freeradius/etc/raddb/huntgroups" Thu Jan 19 12:34:21 2012 : Debug: hints = "/usr/local/etc2/freeradius/etc/raddb/hints" Thu Jan 19 12:34:21 2012 : Debug: with_ascend_hack = no Thu Jan 19 12:34:21 2012 : Debug: ascend_channels_per_line = 23 Thu Jan 19 12:34:21 2012 : Debug: with_ntdomain_hack = no Thu Jan 19 12:34:21 2012 : Debug: with_specialix_jetstream_hack = no Thu Jan 19 12:34:21 2012 : Debug: with_cisco_vsa_hack = no Thu Jan 19 12:34:21 2012 : Debug: with_alvarion_vsa_hack = no Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: Module: Checking preacct {...} for more modules to load Thu Jan 19 12:34:21 2012 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Thu Jan 19 12:34:21 2012 : Debug: Module: Linked to module rlm_acct_unique Thu Jan 19 12:34:21 2012 : Debug: Module: Instantiating acct_unique Thu Jan 19 12:34:21 2012 : Debug: acct_unique { Thu Jan 19 12:34:21 2012 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: Module: Checking accounting {...} for more modules to load Thu Jan 19 12:34:21 2012 : Debug: (Loaded rlm_detail, checking if it's valid) Thu Jan 19 12:34:21 2012 : Debug: Module: Linked to module rlm_detail Thu Jan 19 12:34:21 2012 : Debug: Module: Instantiating detail Thu Jan 19 12:34:21 2012 : Debug: detail { Thu Jan 19 12:34:21 2012 : Debug: detailfile = "/usr/local/etc2/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Thu Jan 19 12:34:21 2012 : Debug: header = "%t" Thu Jan 19 12:34:21 2012 : Debug: detailperm = 384 Thu Jan 19 12:34:21 2012 : Debug: dirperm = 493 Thu Jan 19 12:34:21 2012 : Debug: locking = no Thu Jan 19 12:34:21 2012 : Debug: log_packet_header = no Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: Module: Instantiating attr_filter.accounting_response Thu Jan 19 12:34:21 2012 : Debug: attr_filter attr_filter.accounting_response { Thu Jan 19 12:34:21 2012 : Debug: attrsfile = "/usr/local/etc2/freeradius/etc/raddb/attrs.accounting_response" Thu Jan 19 12:34:21 2012 : Debug: key = "%{User-Name}" Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: Module: Checking session {...} for more modules to load Thu Jan 19 12:34:21 2012 : Debug: Module: Checking post-proxy {...} for more modules to load Thu Jan 19 12:34:21 2012 : Debug: Module: Checking post-auth {...} for more modules to load Thu Jan 19 12:34:21 2012 : Debug: } # modules Thu Jan 19 12:34:21 2012 : Debug: } # server Thu Jan 19 12:34:21 2012 : Debug: radiusd: #### Opening IP addresses and Ports #### Thu Jan 19 12:34:21 2012 : Debug: listen { Thu Jan 19 12:34:21 2012 : Debug: type = "auth" Thu Jan 19 12:34:21 2012 : Debug: ipaddr = * Thu Jan 19 12:34:21 2012 : Debug: port = 0 Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: listen { Thu Jan 19 12:34:21 2012 : Debug: type = "acct" Thu Jan 19 12:34:21 2012 : Debug: ipaddr = * Thu Jan 19 12:34:21 2012 : Debug: port = 0 Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: listen { Thu Jan 19 12:34:21 2012 : Debug: type = "control" Thu Jan 19 12:34:21 2012 : Debug: listen { Thu Jan 19 12:34:21 2012 : Debug: socket = "/usr/local/etc2/freeradius/var/run/radiusd/radiusd.sock" Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: } Thu Jan 19 12:34:21 2012 : Debug: Listening on authentication address * port 1812 Thu Jan 19 12:34:21 2012 : Debug: Listening on accounting address * port 1813 Thu Jan 19 12:34:21 2012 : Debug: Listening on command file /usr/local/etc2/freeradius/var/run/radiusd/radiusd.sock Thu Jan 19 12:34:21 2012 : Debug: Listening on proxy address * port 1814 Thu Jan 19 12:34:21 2012 : Info: Ready to process requests. rad_recv: Access-Request packet from host 159.237.8.200 port 3490, id=46, length=124 NAS-IP-Address = 159.237.8.200 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xb666f25ec9310bf99e0ac965a3325f71 NAS-Port = 5 Framed-MTU = 1490 User-Name = "caraiz(a)unav.es" Calling-Station-Id = "D0-67-E5-13-CC-17" EAP-Message = 0x02ff00130163617261697a40756e61762e6573 Thu Jan 19 12:35:17 2012 : Info: +- entering group authorize {...} Thu Jan 19 12:35:17 2012 : Info: ++[preprocess] returns ok Thu Jan 19 12:35:17 2012 : Info: ++[chap] returns noop Thu Jan 19 12:35:17 2012 : Info: ++[mschap] returns noop Thu Jan 19 12:35:17 2012 : Info: [suffix] Looking up realm "unav.es" for User-Name = "caraiz(a)unav.es" Thu Jan 19 12:35:17 2012 : Info: [suffix] Found realm "unav.es" Thu Jan 19 12:35:17 2012 : Info: [suffix] Adding Stripped-User-Name = "caraiz" Thu Jan 19 12:35:17 2012 : Info: [suffix] Adding Realm = "unav.es" Thu Jan 19 12:35:17 2012 : Info: [suffix] Authentication realm is LOCAL. Thu Jan 19 12:35:17 2012 : Info: ++[suffix] returns ok Thu Jan 19 12:35:17 2012 : Info: [eap] EAP packet type response id 255 length 19 Thu Jan 19 12:35:17 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Thu Jan 19 12:35:17 2012 : Info: ++[eap] returns updated Thu Jan 19 12:35:17 2012 : Debug: [ldap] Entering ldap_groupcmp() Thu Jan 19 12:35:17 2012 : Info: [files] expand: ou=radius,o=accounts,dc=unav,dc=es -> ou=radius,o=accounts,dc=unav,dc=es Thu Jan 19 12:35:17 2012 : Info: [files] expand: %{Stripped-User-Name} -> caraiz Thu Jan 19 12:35:17 2012 : Info: [files] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=caraiz) Thu Jan 19 12:35:17 2012 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Jan 19 12:35:17 2012 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Jan 19 12:35:17 2012 : Debug: [ldap] attempting LDAP reconnection Thu Jan 19 12:35:17 2012 : Debug: [ldap] (re)connect to ldappre.si.unav.es:389, authentication 0 Thu Jan 19 12:35:17 2012 : Debug: [ldap] starting TLS Thu Jan 19 12:35:17 2012 : Debug: [ldap] bind as cn=radiusOp,dc=unav,dc=es/RAD1bar to ldappre.si.unav.es:389 Thu Jan 19 12:35:17 2012 : Debug: [ldap] waiting for bind result ... Thu Jan 19 12:35:17 2012 : Debug: [ldap] Bind was successful Thu Jan 19 12:35:17 2012 : Debug: [ldap] performing search in ou=radius,o=accounts,dc=unav,dc=es, with filter (uid=caraiz) Thu Jan 19 12:35:17 2012 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Jan 19 12:35:17 2012 : Info: [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Thu Jan 19 12:35:17 2012 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Jan 19 12:35:17 2012 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Jan 19 12:35:17 2012 : Debug: [ldap] performing search in ou=radius,o=accounts,dc=unav,dc=es, with filter (&(cn=unav.radius.empleado)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) Thu Jan 19 12:35:17 2012 : Debug: [ldap] object not found Thu Jan 19 12:35:17 2012 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Jan 19 12:35:17 2012 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Jan 19 12:35:17 2012 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Jan 19 12:35:17 2012 : Debug: [ldap] performing search in uid=caraiz,ou=radius,o=accounts,dc=unav,dc=es, with filter (objectclass=*) Thu Jan 19 12:35:17 2012 : Debug: [ldap] performing search in uid=unav.radius.arun,ou=groups,ou=radius,o=accounts,dc=unav,dc=es, with filter (cn=unav.radius.empleado) Thu Jan 19 12:35:17 2012 : Debug: [ldap] object not found Thu Jan 19 12:35:17 2012 : Debug: [ldap] performing search in uid=unav.radius.vpn,ou=groups,ou=radius,o=accounts,dc=unav,dc=es, with filter (cn=unav.radius.empleado) Thu Jan 19 12:35:17 2012 : Debug: [ldap] object not found Thu Jan 19 12:35:17 2012 : Debug: [ldap] performing search in uid=unav.radius.wireless,ou=groups,ou=radius,o=accounts,dc=unav,dc=es, with filter (cn=unav.radius.empleado) Thu Jan 19 12:35:17 2012 : Debug: [ldap] object not found Thu Jan 19 12:35:17 2012 : Debug: [ldap] performing search in uid=unav.radius.empleado,ou=groups,ou=radius,o=accounts,dc=unav,dc=es, with filter (cn=unav.radius.empleado) Thu Jan 19 12:35:17 2012 : Debug: rlm_ldap::ldap_groupcmp: User found in group unav.radius.empleado Thu Jan 19 12:35:17 2012 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Jan 19 12:35:17 2012 : Info: [files] users: Matched entry DEFAULT at line 1 Thu Jan 19 12:35:17 2012 : Info: ++[files] returns ok Thu Jan 19 12:35:17 2012 : Info: [ldap] performing user authorization for caraiz Thu Jan 19 12:35:17 2012 : Info: [ldap] expand: %{Stripped-User-Name} -> caraiz Thu Jan 19 12:35:17 2012 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=caraiz) Thu Jan 19 12:35:17 2012 : Info: [ldap] expand: ou=radius,o=accounts,dc=unav,dc=es -> ou=radius,o=accounts,dc=unav,dc=es Thu Jan 19 12:35:17 2012 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Jan 19 12:35:17 2012 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Jan 19 12:35:17 2012 : Debug: [ldap] performing search in ou=radius,o=accounts,dc=unav,dc=es, with filter (uid=caraiz) Thu Jan 19 12:35:17 2012 : Info: [ldap] Added User-Password = uSB8232 in check items Thu Jan 19 12:35:17 2012 : Info: [ldap] looking for check items in directory... Thu Jan 19 12:35:17 2012 : Debug: [ldap] unavRadiusPasswd -> Cleartext-Password == "uSB8232" Thu Jan 19 12:35:17 2012 : Info: [ldap] looking for reply items in directory... Thu Jan 19 12:35:17 2012 : Info: [ldap] user caraiz authorized to use remote access Thu Jan 19 12:35:17 2012 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Jan 19 12:35:17 2012 : Info: ++[ldap] returns ok Thu Jan 19 12:35:17 2012 : Info: ++[expiration] returns noop Thu Jan 19 12:35:17 2012 : Info: ++[logintime] returns noop Thu Jan 19 12:35:17 2012 : Info: [pap] Found existing Auth-Type, not changing it. Thu Jan 19 12:35:17 2012 : Info: ++[pap] returns noop Thu Jan 19 12:35:17 2012 : Info: Found Auth-Type = EAP Thu Jan 19 12:35:17 2012 : Info: +- entering group authenticate {...} Thu Jan 19 12:35:17 2012 : Info: [eap] EAP Identity Thu Jan 19 12:35:17 2012 : Info: [eap] processing type md5 Thu Jan 19 12:35:17 2012 : Debug: rlm_eap_md5: Issuing Challenge Thu Jan 19 12:35:17 2012 : Info: ++[eap] returns handled Sending Access-Challenge of id 46 to 159.237.8.200 port 3490 Reply-Message = "Empleado from test switch" EAP-Message = 0x0100001604100355c7206b87c18d1b2f8d1f8d4e3c72 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9739c5919739c13875490ff836b45426 Thu Jan 19 12:35:17 2012 : Info: Finished request 0. ... Requests 1 to 8 have been trimmed to make the log shorter, but the huntgroup is been recognized ok too. Next is request #9 where for the first time the huntgroup check is not working and the user get rejected: ... Thu Jan 19 12:35:18 2012 : Info: Finished request 8. Thu Jan 19 12:35:18 2012 : Debug: Going to the next request Thu Jan 19 12:35:18 2012 : Debug: Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 159.237.8.200 port 3490, id=55, length=182 NAS-IP-Address = 159.237.8.200 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x4e2e7f7fc86e811f98694a66f5ca6805 NAS-Port = 5 Framed-MTU = 1490 User-Name = "caraiz(a)unav.es" Calling-Station-Id = "D0-67-E5-13-CC-17" State = 0x9739c5919f31dc3875490ff836b45426 EAP-Message = 0x0208003b190017030100302457ac1cb0d098d7cd44203a9d979a317ba06ed8370ef62a14955f4012fb98a6721e402a122fd366d3e8d673895d20fd Thu Jan 19 12:35:18 2012 : Info: +- entering group authorize {...} Thu Jan 19 12:35:18 2012 : Info: ++[preprocess] returns ok Thu Jan 19 12:35:18 2012 : Info: ++[chap] returns noop Thu Jan 19 12:35:18 2012 : Info: ++[mschap] returns noop Thu Jan 19 12:35:18 2012 : Info: [suffix] Looking up realm "unav.es" for User-Name = "caraiz(a)unav.es" Thu Jan 19 12:35:18 2012 : Info: [suffix] Found realm "unav.es" Thu Jan 19 12:35:18 2012 : Info: [suffix] Adding Stripped-User-Name = "caraiz" Thu Jan 19 12:35:18 2012 : Info: [suffix] Adding Realm = "unav.es" Thu Jan 19 12:35:18 2012 : Info: [suffix] Authentication realm is LOCAL. Thu Jan 19 12:35:18 2012 : Info: ++[suffix] returns ok Thu Jan 19 12:35:18 2012 : Info: [eap] EAP packet type response id 8 length 59 Thu Jan 19 12:35:18 2012 : Info: [eap] Continuing tunnel setup. Thu Jan 19 12:35:18 2012 : Info: ++[eap] returns ok Thu Jan 19 12:35:18 2012 : Info: Found Auth-Type = EAP Thu Jan 19 12:35:18 2012 : Info: +- entering group authenticate {...} Thu Jan 19 12:35:18 2012 : Info: [eap] Request found, released from the list Thu Jan 19 12:35:18 2012 : Info: [eap] EAP/peap Thu Jan 19 12:35:18 2012 : Info: [eap] processing type peap Thu Jan 19 12:35:18 2012 : Info: [peap] processing EAP-TLS Thu Jan 19 12:35:18 2012 : Info: [peap] eaptls_verify returned 7 Thu Jan 19 12:35:18 2012 : Info: [peap] Done initial handshake Thu Jan 19 12:35:18 2012 : Info: [peap] eaptls_process returned 7 Thu Jan 19 12:35:18 2012 : Info: [peap] EAPTLS_OK Thu Jan 19 12:35:18 2012 : Info: [peap] Session established. Decoding tunneled attributes. Thu Jan 19 12:35:18 2012 : Info: [peap] Identity - caraiz(a)unav.es Thu Jan 19 12:35:18 2012 : Info: [peap] Got tunneled request EAP-Message = 0x020800130163617261697a40756e61762e6573 server { Thu Jan 19 12:35:18 2012 : Debug: PEAP: Got tunneled identity of caraiz(a)unav.es Thu Jan 19 12:35:18 2012 : Debug: PEAP: Setting default EAP type for tunneled EAP session. Thu Jan 19 12:35:18 2012 : Debug: PEAP: Setting User-Name to caraiz(a)unav.es Sending tunneled request EAP-Message = 0x020800130163617261697a40756e61762e6573 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "caraiz(a)unav.es" NAS-IP-Address = 159.237.8.200 NAS-Port-Type = Ethernet Service-Type = Framed-User NAS-Port = 5 Framed-MTU = 1490 Calling-Station-Id = "D0-67-E5-13-CC-17" server inner-tunnel { Thu Jan 19 12:35:18 2012 : Info: +- entering group authorize {...} Thu Jan 19 12:35:18 2012 : Info: ++[chap] returns noop Thu Jan 19 12:35:18 2012 : Info: ++[mschap] returns noop Thu Jan 19 12:35:18 2012 : Info: ++[unix] returns notfound Thu Jan 19 12:35:18 2012 : Info: [suffix] Looking up realm "unav.es" for User-Name = "caraiz(a)unav.es" Thu Jan 19 12:35:18 2012 : Info: [suffix] Found realm "unav.es" Thu Jan 19 12:35:18 2012 : Info: [suffix] Adding Stripped-User-Name = "caraiz" Thu Jan 19 12:35:18 2012 : Info: [suffix] Adding Realm = "unav.es" Thu Jan 19 12:35:18 2012 : Info: [suffix] Authentication realm is LOCAL. Thu Jan 19 12:35:18 2012 : Info: ++[suffix] returns ok Thu Jan 19 12:35:18 2012 : Info: ++[control] returns ok Thu Jan 19 12:35:18 2012 : Info: [eap] EAP packet type response id 8 length 19 Thu Jan 19 12:35:18 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Thu Jan 19 12:35:18 2012 : Info: ++[eap] returns updated Thu Jan 19 12:35:18 2012 : Info: [files] users: Matched entry DEFAULT at line 4 Thu Jan 19 12:35:18 2012 : Info: ++[files] returns ok Thu Jan 19 12:35:18 2012 : Info: [ldap] performing user authorization for caraiz Thu Jan 19 12:35:18 2012 : Info: [ldap] expand: %{Stripped-User-Name} -> caraiz Thu Jan 19 12:35:18 2012 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=caraiz) Thu Jan 19 12:35:18 2012 : Info: [ldap] expand: ou=radius,o=accounts,dc=unav,dc=es -> ou=radius,o=accounts,dc=unav,dc=es Thu Jan 19 12:35:18 2012 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Jan 19 12:35:18 2012 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Jan 19 12:35:18 2012 : Debug: [ldap] performing search in ou=radius,o=accounts,dc=unav,dc=es, with filter (uid=caraiz) Thu Jan 19 12:35:18 2012 : Info: [ldap] Added User-Password = uSB8232 in check items Thu Jan 19 12:35:18 2012 : Info: [ldap] looking for check items in directory... Thu Jan 19 12:35:18 2012 : Debug: [ldap] unavRadiusPasswd -> Cleartext-Password == "uSB8232" Thu Jan 19 12:35:18 2012 : Info: [ldap] looking for reply items in directory... Thu Jan 19 12:35:18 2012 : Info: [ldap] user caraiz authorized to use remote access Thu Jan 19 12:35:18 2012 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Jan 19 12:35:18 2012 : Info: ++[ldap] returns ok Thu Jan 19 12:35:18 2012 : Info: ++[expiration] returns noop Thu Jan 19 12:35:18 2012 : Info: ++[logintime] returns noop Thu Jan 19 12:35:18 2012 : Info: [pap] Found existing Auth-Type, not changing it. Thu Jan 19 12:35:18 2012 : Info: ++[pap] returns noop Thu Jan 19 12:35:18 2012 : Info: Found Auth-Type = Reject Thu Jan 19 12:35:18 2012 : Info: Auth-Type = Reject, rejecting user Thu Jan 19 12:35:18 2012 : Info: Failed to authenticate the user. } # server inner-tunnel Thu Jan 19 12:35:18 2012 : Info: [peap] Got tunneled reply code 3 Reply-Message = "Access not allowed." Thu Jan 19 12:35:18 2012 : Info: [peap] Got tunneled reply RADIUS code 3 Reply-Message = "Access not allowed." Thu Jan 19 12:35:18 2012 : Info: [peap] Tunneled authentication was rejected. Thu Jan 19 12:35:18 2012 : Info: [peap] FAILURE Thu Jan 19 12:35:18 2012 : Info: ++[eap] returns handled Sending Access-Challenge of id 55 to 159.237.8.200 port 3490 EAP-Message = 0x0109002b19001703010020419852f0a6019cefb1881bb24d6bacc3bc6ca4cb0712da325d9708366a31c62d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9739c5919e30dc3875490ff836b45426 Thu Jan 19 12:35:18 2012 : Info: Finished request 9. ... Then it comes request #10 that is rejected too as the user session weas rejected before: * Oscar Remírez de Ganuza Satrústegui* Servicios Informáticos (Área de Infraestructuras) Universidad de Navarra Tel. +34 948425600 x3130 http://www.unav.es/SI/

2 3

Re: self-signed root CA
by Alan Buxey 27 Jan '12

27 Jan '12

I wouldn't normally support them but in fact Microsoft have some very good documentation for EAP-TLS on the Windows platform. Granted, not very user friendly for finding it on their MSDN (which my phone spell-checker wants to change to madness ;) ) or knowledgebase pages...but that's what Google is for. OSX on the other hand....why oh why did they [Apple] do THAT for the Lion release?? :( alan -- This smartphone has free worldwide WiFi access using eduroam. Now. that IS smart.

1 0

Service radiusd Start vs radiusd
by eric.chang 26 Jan '12

26 Jan '12

Hi guys, Whats the different between command: # Service radiusd start # radiusd when i use radiusd or radiusd -X everything works fine. but when i use service radiusd start, i have problem connecting with the postgresql DB. Log: (radiusd) Thu Jan 26 08:38:10 2012 : Info: Loaded virtual server inner-tunnel Thu Jan 26 08:38:10 2012 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Thu Jan 26 08:38:10 2012 : Info: rlm_sql (sql): Attempting to connect to radiusd@localhost:5432/radiusdb Thu Jan 26 08:38:10 2012 : Info: Loaded virtual server <default> Thu Jan 26 08:38:10 2012 : Info: Ready to process requests. Thu Jan 26 08:38:16 2012 : Info: Exiting normally. (service radiusd start) Thu Jan 26 08:39:23 2012 : Info: Loaded virtual server inner-tunnel Thu Jan 26 08:39:23 2012 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Thu Jan 26 08:39:23 2012 : Info: rlm_sql (sql): Attempting to connect to radiusd@localhost:5432/radiusdb Thu Jan 26 08:39:23 2012 : Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusd@localhost:radiusdb Thu Jan 26 08:39:23 2012 : Error: rlm_sql (sql): Failed to connect DB handle #0 Thu Jan 26 08:39:23 2012 : Info: Loaded virtual server <default> Thu Jan 26 08:39:23 2012 : Info: Ready to process requests. Thu Jan 26 08:39:28 2012 : Info: Exiting normally. Thanks Eric -- View this message in context: http://freeradius.1045715.n5.nabble.com/Service-radiusd-Start-vs-radiusd-tp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 16

freradius Segmentation fault
by Ski Mountain 26 Jan '12

26 Jan '12

I am testing out authentication with radtest. If I send the wrong group password I get "invalid Message-Authenticator" which is what I expect, the second I put in the correct password I get the "Segmentation fault" This is on Ubuntu 10.04.3 LTS. Is this a knows issue, or am I screwing something up? Thanks :/etc/freeradius# /usr/sbin/freeradius -X FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 5 2010 at 02:49:11 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radie" password = "global" radius_db = "freeradius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radie@localhost:/freeradius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 45010, id=52, length=95 User-Name = "testemail(a)domaintest.de" User-Password = "hM0d6Z6xx4" NAS-IP-Address = 44.44.80.249 NAS-Port = 1813 Message-Authenticator = 0xe87c8ae1c74622f9ecac5b64204ccb13 +- entering group authorize {...} Segmentation fault

3 3

Freeradius and rlm_perl auth
by Fabricio Flores 26 Jan '12

26 Jan '12

Hello I´m using a perl script to authenticate in a web services. My scrpit works with the web services but I want that with my scrpit authenticate in a freeradius server. I don´t know wich files I must modify and what I must modify to it works. Thaks for your answers. -- Fabricio A. Flores G. Egresado en Ingeniería en Sistemas MSN: fabri_floresg(a)hotmail.com Google: fabrifloresg(a)gmail.com Twitter: fabricioflores Skype: fabriciofloresgallardo Blog Personal <http://fabricioflores.wordpress.com/>

1 0

Re: mschap/NTLM and different membership-of with variables
by Gonzalo 26 Jan '12

26 Jan '12

sorry, I found my mistake and was on the AP device. the "outer.reply" work fine. But still want understand how this work so , if somebody can share a link that's explain how variables work in detail, it will be appreciate. Thanks. Gonzalo. -- View this message in context: http://freeradius.1045715.n5.nabble.com/mschap-NTLM-and-different-membershi… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Changing domain for ntlm_auth
by NdK 26 Jan '12

26 Jan '12

Hi all. To let (most (*)) users login with their e-mail address, I'd need to "translate" the realm part to a domain. So I added to proxy.conf : realm PERSONALE { } realm STUDENTI { } realm "~^studio\\.unibo\\.it" { Realm := "STUDENTI" } realm "~^studio\\.unibo\\.it" { Realm := "PERSONALE" } realm "~^unibo\\.it" { Realm := "PERSONALE" } What I thought it would do was "if user name is like '@studio.unibo.it' then set REALM to be local 'STUDENTI'" but obviously I was wrong... Request is EAP-PEAP-MSChapv2 and the authentication oracle is an AD node (hence the use of ntlm_auth). If I authenticate using user@PERSONALE it works perfectly. What am I missing? (*) Just 'most' users since I couldn't yet find a way to use the UPN, so users whose UPN have been changed must login with their 'base' name. Don't think there's an easy fix for this, since even joined win machines *sometimes* refuse the changed UPN... Tks, Diego.

4 16

Organizing accounting attributes
by Aurélien Lafranchise 26 Jan '12

26 Jan '12

Hi All ! Is it possible to sort accounting attributes and values in a certain order under the detail files ? I manage to remove some unwanted attributes receives but I can't sort the others. Thanks for your replies. Aurélien Lafranchise Network Operations Manager Mob.: +33 (0)6 03 88 36 26 Fax: +33 (0)4 83 33 45 61 eMail: aurelien.lafranchise(a)mobiquithings.com Web: http://www.mobiquithings.com

2 2

Juniper Questions (MX/ERX)
by Paul Stewart 25 Jan '12

25 Jan '12

Hi there.. I'm trying to get an understanding on a FreeRadius installation how to enable the unisphere.dictionary. There are specific attributes in that file that we need such as "Unisphere-Ingress-Policy-Name". By default, this dictionary file is commented out due to "attribute conflicts". Can someone share a bit more info? I need unisphere attributes and also erx attributes to function on the same FreeRadius system ultimately .. We have a mixture of Juniper ERX equipment and Juniper MX equipment that needs to talk to FreeRadius. When I try to add a "Unisphere-Ingress-Policy-Name = 512k" for example in the users file I get "invalid integer" error. Thanks for any insight. Paul

5 4

request tracking
by Travis Dimmig 25 Jan '12

25 Jan '12

How does freeRadius track requests? I get errors along the lines of "Error: Discarding duplicate request from client [IP REDACTED]:49603 - ID: 204 due to unfinished request 298385" Far more often than I believe I should. What does it mean for a request to be unfinished, and how does freeRadius determine that a request is a duplicate? Travis Dimmig Software Development Specialist Impulse Point www.impulse.com<http://www.impulse.com>

3 4