- Freeradius-Users - lists.freeradius.org

Access-Reject (code 3) on an otherwise valid Accept packet / delayed reject when SQL module fails in post-auth
by Jason Antman 28 Oct '11

28 Oct '11

Hello, I'm have a FreeRADIUS 2.1.10 server on CentOS... with a backend MySQL database (logging) which is, as Alan would say, Broken - at peak usage times it's horribly overloaded. Up until yesterday, our post-auth section had a "sql" call not wrapped in a "redundant { sql / ok }". It seems that when the MySQL server gets overloaded, and the sql module fails/times out (can't find a configuration value for timeout, or a note on what the timeout actually is), the post-auth section stops and returns a Reject packet. Since it stops before attr_filter, it's returning a non-RFC-compliant REJECT... i.e. an otherwise valid and correct Access-Accept packet, but with a Code of 3 (Access-Reject) since the sql module failed. For the short-term, I wrapped the sql calls in post-auth and post-auth-type reject in redundant, followed by "ok", so that users will not get rejected because of failed logging (administrative/managerial decision, not mine) and gave up SQL post-auth logging in favor of not locking out users when the DB is struggling. Using the test described below, this appears to solve the problem of the improperly formed REJECT packets, but it still ends up with lots of "There are no DB handles to use! skipped 0, tried to connect 0" and then lots of "Info: WARNING Child is hung for request XXXX in component post-auth module sql." lines... I can only assume that these are a non-critical issue (i.e. the child is hung but will recover), but 1) I would like to set a much lower database timeout, i.e. have the sql module fail sooner and move on, and 2) as the "Login (OK|incorrect)" messages don't have the request number, it's difficult to associate these with a given client. An acceptable way to reproduce this is to start radiusd, and then issue a LOCK TABLES radpostauth WRITE; followed by bombarding the radius server with access-requests. In my case, after the DB handles fill up, I will start getting these invalid Reject packets out (a valid accept with a code of 3), along with the above log messages - and "Login OK" messages even for the clients who are rejected due to the sql failure. So a few questions: 1) The logging for this is flat-out wrong. When the SQL module fails in this way in post-auth (because of timeout), I'm still seeing "Auth: Login OK" in radius.log. I guess this could be "a matter of opinion", but the fact that I'm seeing a log message for OK but getting a reject out on the wire, seems like a bug. IMHO, the logging of ok/incorrect should either a) be delayed until JUST before the packet goes out, beyond where an Accept could turn into a Reject, or b) if/when an Accept packet is turned into a Reject and sent out on the wire, there should be an explicit log message stating such (as opposed to just the current "Sending delayed reject" which appears only in debug logs). 2) Is it the expected behavior that if a module in post-auth fails, the packet will be changed to a reject without passing through Post-Auth-Type REJECT, therefore without passing through attr_filter, therefore sending out a non-RFC-compliant Access-Reject packet? 3) As far as I can tell, this entire issue does *not* happen when running "radiusd -fXx"... in that case, radiusd will simply hang indefinitely until the DB recovers (or the table is unlocked, in testing). Does this sound right? Does anyone know if rlm_sql_mysql will behave differently in this way in debug mode as opposed to normal daemon mode? And does it seem correct that in debug mode, there doesn't seem to be a timeout for mysql? I was, however, able to replicate the issue when running "radiusd -fxx", i.e. no single threaded mode. 4) As an example of log output, see the lines below. I know that the 15:19:30 "Login OK" for client mc4k-121 port 8195 actually left as an Access-Reject packet (code 3), which still had User-Name, Callback-Id, Session-Timeout, Termination-Action, and two VSAs set, as the proper Accept for that user should. In certain instances with this problem, the SQL logging was queued somewhere (presumably on the MySQL side, waiting for the unlock) and actually made it to the DB, listed as an Accept packet and all, after radiusd sent out the incompliant Reject. However, of concern in the logs below is the fact that 3 of those Login OK lines (outer tunnel) were actually the invalid Access-Reject packets on the wire, but there's no indication of that here. While there is a vague "There are no DB handles to use" message, that doesn't specify which request it relates to (hence no way to tell which Login OK was actually rejected), nor does it explicitly say that the request will be rejected. ### BEGIN LOG SNIP Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-125 port 8255 cli 00:22:FB:8B:58:04 via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-125 port 8255 cli 00:22:FB:8B:58:04) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-125 port 10287 cli 58:B0:35:41:46:A1 via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-125 port 10287 cli 58:B0:35:41:46:A1) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8203 cli 1C:65:9D:16:2D:EB via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8203 cli 1C:65:9D:16:2D:EB) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8289 cli 70:F1:A1:8B:F2:F8 via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8289 cli 70:F1:A1:8B:F2:F8) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-126 port 6243 cli 88:53:2E:0D:F2:D7 via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-126 port 6243 cli 88:53:2E:0D:F2:D7) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8288 cli 88:9F:FA:77:F7:EE via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8288 cli 88:9F:FA:77:F7:EE) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8209 cli 8C:58:77:4C:78:CE via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8209 cli 8C:58:77:4C:78:CE) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8202 cli F0:B4:79:45:14:DD via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8202 cli F0:B4:79:45:14:DD) Thu Oct 27 15:19:29 2011 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-126 port 6278 cli 18:E7:F4:F6:C8:E6 via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-126 port 6278 cli 18:E7:F4:F6:C8:E6) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8273 cli 00:26:C6:83:50:82 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8273 cli 00:26:C6:83:50:82) Thu Oct 27 15:19:30 2011 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8295 cli CC:08:E0:EA:1A:23 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8295 cli CC:08:E0:EA:1A:23) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8195 cli 00:1E:C2:AB:03:07 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8195 cli 00:1E:C2:AB:03:07) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8219 cli 00:21:E9:DE:F2:3A via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8219 cli 00:21:E9:DE:F2:3A) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8272 cli 00:25:56:51:82:C8 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8272 cli 00:25:56:51:82:C8) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8280 cli E4:CE:8F:41:DD:82 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8280 cli E4:CE:8F:41:DD:82) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8300 cli 58:1F:AA:69:48:49 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8300 cli 58:1F:AA:69:48:49) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 10241 cli 04:0C:CE:D7:B3:28 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 10241 cli 04:0C:CE:D7:B3:28) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8301 cli 8C:58:77:66:0C:AE via TLS tunnel) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8301 cli 8C:58:77:66:0C:AE) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8202 cli F0:B4:79:45:14:DD via TLS tunnel) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8202 cli F0:B4:79:45:14:DD) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8284 cli 34:51:C9:2E:05:DD via TLS tunnel) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8284 cli 34:51:C9:2E:05:DD) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8271 cli 00:22:69:68:87:B4 via TLS tunnel) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8271 cli 00:22:69:68:87:B4) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8303 cli 00:21:5C:0C:9C:61 via TLS tunnel) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8303 cli 00:21:5C:0C:9C:61) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8213 cli 00:25:00:4D:5D:EA via TLS tunnel) ### END LOG SNIP So to summarize what I'm asking for/about: 1) In instances of a "delayed reject" caused by a failure in post-auth, would it be possible to have this clearly logged to radius.log, either instead of "Login OK", or something along the lines of "WARNING - delayed reject of previous request (request id, username, Calling Station Id, client, port)"? 2) Is there any way to maintain attr_filter.access_reject even with a delayed reject because of module failure in post-auth, so that these packets are still RFC-compliant? 3) Is there any way to configure the rlm_sql_mysql timeout, or whatever is causing this module to fail when the table is locked? 4) Can I get some clarification on the "There are no DB handles to use! skipped 0, tried to connect 0" and "Info: WARNING Child is hung for request XXXX in component post-auth module sql" radius.log messages, and the severity of these (i.e. does either of them definitively mean that a request was rejected?) Thank you for any advice/insight/comments/suggestions, Jason Antman Rutgers University, NJ, USA

2 1

ntlm_auth reconnection without login data?
by Andreas Rudat 28 Oct '11

28 Oct '11

Hi, if I connect to my radius server, I don't need my password anymore, also if I restart radius or my workstation. But why? Thanks

3 7

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 28 Oct '11

28 Oct '11

right now, the user that i am testing with has a password that is CRYPT. I am fairly certain that my user that i am binding with has the perms to read the userPassword attribute, but i will verify that this morning. On 10/28/2011 4:37 AM, freeradius-users-request(a)lists.freeradius.org wrote: > By default, userPassword is mapped to the FreeRADIUS attribute > Password-With-Header which assumes {label} prefixes, as this is most common. > > Also - are you*sure* the credentials you're using in the "ldap" module > to query the directory have permissions to read the userPassword attribute? -- Matthew Arguin Currensee, Inc. 54 Canal St, 4th Floor Boston, MA 02114 (617) 986-4758 (Office) _________________________________________________________________________ This email and any files transmitted with it are confidential and intended solely for the addressee. If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system. © 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions. Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824

2 1

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 28 Oct '11

28 Oct '11

Thanks Phil. question on that. in the deployment of ldap that we have in place the users password attribute is 'userPassword'. looking at the ldap attribute file and various online results, is the authentication looking for ntPassword for that ldap attribute as opposed to the userPassword one that i have? i know that the user i am testing with has the password that is showing up, i am guessing that maybe i have it assigned in the wrong attribute or i need to change the ldap mapping file to use the attribute i have? -m On 10/27/2011 5:14 PM, freeradius-users-request(a)lists.freeradius.org wrote: > Re: cisco WAP/FreeRadius/OpenLDAP -- Matthew Arguin Currensee, Inc. 54 Canal St, 4th Floor Boston, MA 02114 (617) 986-4758 (Office) _________________________________________________________________________ This email and any files transmitted with it are confidential and intended solely for the addressee. If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system. © 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions. Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824

3 2

cisco WAP/FreeRadius/OpenLDAP
by Matt Arguin 27 Oct '11

27 Oct '11

Hi All, having trouble setting up my RADIUS(FreeRADIUS Version 2.1.7) to auth to my openldap server (openldap-2.3.43-12.el5_6.7) on CentOS 5.5. i am trying to configure EAP-TLS and think i am pretty close. I am currently wondering if possibly i have an incorrect mapping in the ldap.attrs file (it is completely default right now). running 'radiusd -X' i do see some errors such as: rlm_ldap: performing search in dc=currensee,dc=com, with filter (uid=anonymous) rlm_ldap: object not found [ldap] search failed but later down the path of the session it looks like things are going ok , seeing a bunch of EAP challeges and it expanding the username and stuff being put in to the inner-tunnel. However, in the end: rlm_ldap: performing search in dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by uid [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? my ldap attribute for password is userPassword and i have tried changing the values in the ldap.attrs to match this but that did not help. Here is the full output of the run of radiusd in debug mode. Any insight is appreciated: Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=181, length=132 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x247be03937ef0698a7ad23d2f86aa54b EAP-Message = 0x0202000e01616e6f6e796d6f7573 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] performing user authorization for anonymous [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> anonymous [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=anonymous) [ldap] expand: dc=currensee,dc=com -> dc=currensee,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.local.currensee.com:389, authentication 0 rlm_ldap: bind as cn=radius,ou=Services,dc=currensee,dc=com/c17ad5805204465ab39d11e0381272c5 to ldap.local.currensee.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=currensee,dc=com, with filter (uid=anonymous) rlm_ldap: object not found [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop [eap] EAP packet type response id 2 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Found Auth-Type = EAP Found Auth-Type = EAP Warning: Found 2 auth-types on request for user 'anonymous' +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 181 to 192.168.10.31 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382012d02152159f345e3e0c333a Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=182, length=228 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x07f8f2c72439114d5efd54762efa740b EAP-Message = 0x0203005c190016030100510100004d03014ea9917e4e0fee76b71533a74710796e73ac02e494439b92a5338ee6d1f1bcd900002600390038003500160013000a00330032002f00050004001500120009001400110008000600030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382012d02152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 92 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0051], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 06cd], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 182 to 192.168.10.31 port 1645 EAP-Message = 0x0104040019c00000089c160301002a0200002603014ea9916c2187b4df7edfdaf6bcadb4e396d5e7fe95aa4b84bdb2342f281e64d00000390016030106cd0b0006c90006c60002a6308202a23082020b0203100028300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f EAP-Message = 0x63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3131313032313135313134335a170d3231313032303135313134335a3077310b3009060355040613025553311630140603550408130d4d61737361636875736574747331183016060355040a130f43757272656e7365652c20496e632e31133011060355040b130a4f7065726174696f6e733121301f060355040313186f7073322e6c6f63616c2e63757272656e7365652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100dbd67230f6e9b1f8d37cd689371e4965f6760ef34369b95ea48e1ef153be887b5dd5ef31 EAP-Message = 0x7a47e5d66048731d7458d9ae1ebe0508aa349d4fa74dd0c077cdca1fb2af2868d309e938cd6222f3c6737116ff656e10bbb175b76e2aa83c35efc2b0655f3bf669cabbad375d98d89c84f9d30b5887ac5225685c5bee55176ce2fe890203010001300d06092a864886f70d01010405000381810023558f75bca5500a1b7ca225f46cd98622ef05c01cc43e000dcae1cd19b8d8fcf7c53d2dff7c6403781839d0dd4a0bffb4eec337967c32665ee5f11720e09760c222e2fc6a029b0d4eb33c45614d21a6fb55cb6f01df47958d97578160057f0d23aa685539931ad0229522218b7d7c31f9fb1b8e94a9b88d6e8bc4f410a9701400041a308204163082 EAP-Message = 0x037fa003020102020900d869d83ec24831ce300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3130303432363138323634325a170d3230303432353138323634325a EAP-Message = 0x3081b931183016060355040a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382013d72152159f345e3e0c333a Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=183, length=142 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xfb2f68eee2f87814bcac62b0feb517d1 EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382013d72152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 183 to 192.168.10.31 port 1645 EAP-Message = 0x010503fc1940130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100d6e8fe8f9e3905fcd63f0c9f3b9eded323e8b7a1e47ef23d8d53a29572e41656e189ccd616664ad52ea7 EAP-Message = 0x36ee86a2e1fe0696e1fe24e0345cd5b3167530ef0d6b7a58f9f55774d7a403b9a03e5d9374118a1dbb30fcab8c8bc499ef62b3aac1aec00134b635416c73e2f555b24e08933cefe2fb2a47024ee61ab51490f1cae3070203010001a38201223082011e300c0603551d13040530030101ff301d0603551d0e04160414706ed0933d93523470a6e9bc979d124333df14b03081ee0603551d230481e63081e38014706ed0933d93523470a6e9bc979d124333df14b0a181bfa481bc3081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d01090116 EAP-Message = 0x12726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479820900d869d83ec24831ce300d06092a864886f70d010104050003818100d435d275a02b5e04e17e75b6046bbd1ab3ca33299cee907f2bd9c7603b3da4a23ee97e677e97e442bd855e8c2dffc351e134e03fbec16ad71eb7608c62c29bd2a2aaa2660013bc8d76520a5a9f3b516dcbddf6a773564e57c29e20d0a614a6116a36aef3cdfb EAP-Message = 0xdc510f1058d291e6310d9b53c8b17e521038a866f3510355ef29160301018d0c0001890080ff76d1db8e9c6aa6bbe3d1bcc691f539a047acfa556255866a6d802ab6698cb71cf82f2fb16dfe236b5855ea6c50768f5725618bf523493f97785eda71b4aab842513a83fdb1b2466f94df90ec6c771bc6c8004fe3695f678f44ed4618b609c0e8eaf250ea9aef1bfc6213d2e48bd75258d4b20fcb2ea89eb6f562a93619ebeb0001020080b5a0d1fe1783f77da04814409d4381253b3ffbf42bcb99c317280d8c75540d6fb116b748951b5f932db160803689d6f8ed466d8486abae167f27da11a06607c72df17a54d517f21ac5d620663643f8f855e518 EAP-Message = 0x9a37bae7ab57131e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382010d62152159f345e3e0c333a Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=184, length=142 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x1fd77cc584bc1051b7d9fe58107c4c3a EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382010d62152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 184 to 192.168.10.31 port 1645 EAP-Message = 0x010600b6190020da5b4f45515a10838c069b4f306c799dcae80fde0c7eecec68db12a3eaa188db7dcbf50200806bb73ce9d989ce3e074cef9ed67d06dfb226f888a3f8799c5df1c4bf4f652a966eac1ea47e789967cf2657c8a245141794ee18ee29c0ff4f3b3634573b90285e23472af4b29d2e75cac5db910ddac31d258f7f5e3bf8bafe20fe7c46c70bda90a2f67eef82eeff0e907606354f10dff1e2b6ce1cac104de8a8ec6c73cdec574616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382011d52152159f345e3e0c333a Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=185, length=340 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x60c232952342a311ee2bc93a26e4ce71 EAP-Message = 0x020600cc19001603010086100000820080a52906e4cab72051f10862c9b4e9db68968fa1c00ebc4f8c074fa28048ae720918e3e6dde2c7aecddddd342e1f5c6649fa27b48b6960a42370a44bb8ed450c95c35db9878c8e37bf4766de7da741e152ac923353122eba5812448d68414c59de2b16bb02ff0251b80feabf15ef38a54bfd78cda06c8ccee4cfa6088c8803d7361403010001011603010030c557f553edafc375c220d8b101de0f084b5177c27a77c54fb0d465a68e47620529713ff626312a53bf1e06d3ac1ca073 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382011d52152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 185 to 192.168.10.31 port 1645 EAP-Message = 0x0107004119001403010001011603010030ffe92683dad17988140bd1cded5144fa14720bb91cb28e33292d07a24deb1ef51839a5b0531e269e6f31be133887341b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382016d42152159f345e3e0c333a Finished request 4. Going to the next request Waking up in 1.2 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=186, length=142 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xef4b9bafcba2b7293142633bf00f1a52 EAP-Message = 0x020700061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382016d42152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 186 to 192.168.10.31 port 1645 EAP-Message = 0x0108002b190017030100203572669053841178aa51d4dea859b4aa66a10fe9dcce996c6d9e0bf40953d2a4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382017db2152159f345e3e0c333a Finished request 5. Going to the next request Waking up in 1.2 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=187, length=216 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x82af7372ebc34d1c5a983c695666352f EAP-Message = 0x0208005019001703010020381428016e79c1a921ad7bdf022e84bc4a9c4d00aef5e18e9da6abc10d096e501703010020fcac01f3ed169b5b12acb63a0c071b20a1dd48091f06a95457a478078cacbc42 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382017db2152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - marguin2 [peap] Got tunneled request EAP-Message = 0x0208000d016d61726775696e32 server { PEAP: Got tunneled identity of marguin2 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to marguin2 Sending tunneled request EAP-Message = 0x0208000d016d61726775696e32 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "marguin2" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: dc=currensee,dc=com -> dc=currensee,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by uid [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user marguin2 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010900221a0109001d105c038f58bcb3c4fc977d39febd11f16c6d61726775696e32 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2676f99a26e75640cc52013c4080612 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010900221a0109001d105c038f58bcb3c4fc977d39febd11f16c6d61726775696e32 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2676f99a26e75640cc52013c4080612 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 187 to 192.168.10.31 port 1645 EAP-Message = 0x0109004b190017030100407c0dcc2b6be749d2d560495f41a01c6ba27e65a9f3e1facf816a8486e3ebc9be251742e5134b24c41a4e3a1727748ce3ddec39e39c97c21d4de46155f44fe292 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382014da2152159f345e3e0c333a Finished request 6. Going to the next request Waking up in 0.2 seconds. Cleaning up request 0 ID 181 with timestamp +1285 Cleaning up request 1 ID 182 with timestamp +1285 Cleaning up request 2 ID 183 with timestamp +1285 Cleaning up request 3 ID 184 with timestamp +1285 Waking up in 3.6 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=188, length=216 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xba68c91d8ff9a8fc3d4b81978503d6a8 EAP-Message = 0x020900501900170301002038ddef970c4b5de2408e15dcf170380e2dae20f5b4906ca0b83ab09955f3adb31703010020c662bb01f949917629bbf706a765e7289242c9ac1bf7977e086d474a0c535275 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382014da2152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type nak [peap] Got tunneled request EAP-Message = 0x020900060306 server { PEAP: Setting User-Name to marguin2 Sending tunneled request EAP-Message = 0x020900060306 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "marguin2" State = 0xa2676f99a26e75640cc52013c4080612 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: dc=currensee,dc=com -> dc=currensee,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by uid [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user marguin2 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/gtc [eap] processing type gtc ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a000f0650617373776f72643a20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2676f99a36d69640cc52013c4080612 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a000f0650617373776f72643a20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2676f99a36d69640cc52013c4080612 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 188 to 192.168.10.31 port 1645 EAP-Message = 0x010a002b19001703010020ba7c2227f17381def4ec6006850ae086b0697cdfc41e97ee94d231ccdd551274 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382015d92152159f345e3e0c333a Finished request 7. Going to the next request Waking up in 2.4 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=189, length=216 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x4f5e68f91a36294046965c597972916c EAP-Message = 0x020a005019001703010020a4743668f0e6f04dc75a186b4547d127fe87d9ac737598ed00d339bd31eef34a1703010020c4266d8d1399b82aaf4d2dc72f527108219aa6f977d6481102df32ac0c4d6eff NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382015d92152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type gtc [peap] Got tunneled request EAP-Message = 0x020a000d06723061646b696c6c server { PEAP: Setting User-Name to marguin2 Sending tunneled request EAP-Message = 0x020a000d06723061646b696c6c FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "marguin2" State = 0xa2676f99a36d69640cc52013c4080612 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 10 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: dc=currensee,dc=com -> dc=currensee,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by uid [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user marguin2 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/gtc [eap] processing type gtc [gtc] +- entering group PAP {...} [pap] login attempt with password "r0adkill" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject [eap] Handler failed in EAP/gtc [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 189 to 192.168.10.31 port 1645 EAP-Message = 0x010b002b19001703010020bc3ae32e4fe71200cc035272d73d69789a34f8e7c790f035bee17b0980cdf04b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d338201ad82152159f345e3e0c333a Finished request 8. Going to the next request Waking up in 0.8 seconds. Cleaning up request 4 ID 185 with timestamp +1288 Cleaning up request 5 ID 186 with timestamp +1288 Waking up in 1.0 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=190, length=216 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x1688d578dda01e85e46ea3f9a3f33deb EAP-Message = 0x020b00501900170301002018a1fc697e05b342b2d81cc8e159577636727020200da90ecd9fc5a854639bd6170301002077d6f24b102100d28f33456f2390219e2ea88229cff0fe978b9df68ac5c60918 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d338201ad82152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.2 seconds. Cleaning up request 6 ID 187 with timestamp +1289 Waking up in 0.7 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 190 to 192.168.10.31 port 1645 EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.8 seconds. Cleaning up request 7 ID 188 with timestamp +1291 Waking up in 1.5 seconds. Cleaning up request 8 ID 189 with timestamp +1293 Waking up in 2.6 seconds. Cleaning up request 9 ID 190 with timestamp +1294 Ready to process requests. -- Matthew Arguin

3 2

Re: cisco WAP/FreeRadius/OpenLDAP
by Matt Arguin 27 Oct '11

27 Oct '11

\hrm..i guess maybe i am getting my info crossed. I am basically trying to get secure wireless set up for my office. we currently utilize and openldap server and are trying to put cisco 1142's in place. my understanding, and if you tell me i took a wrong turn, i will believe you.... is that the EAP-TLS secures the network and then the RADIUS component authorizes and authenticates the user . Again, I would believe you completely if you told me that I was mashing different sets of info together and coming up with my own incorrect set. -m On Thu, Oct 27, 2011 at 3:01 PM, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Custom MySQL Queries (JennyBlunt) > 2. RES: FreeRadius + MySQL | radacct: Errors and Warnings > (Daniel Menezes) > 3. Failed to load module "jradius" (Travis Dimmig) > 4. Re: Failed to load module "jradius" (Alan DeKok) > 5. RE: Failed to load module "jradius" (Travis Dimmig) > 6. Re: cisco WAP/FreeRadius/OpenLDAP (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 27 Oct 2011 10:37:28 -0700 (PDT) > From: JennyBlunt <jennyshoehorn(a)me.com> > Subject: Custom MySQL Queries > To: freeradius-users(a)lists.freeradius.org > Message-ID: <1319737048193-4943692.post(a)n5.nabble.com> > Content-Type: text/plain; charset=us-ascii > > Hello > > What's the best approach regarding custom mysql queries? I'd like to check > if a user is blocked whilst authorising.. > > Have tried to add something like this to my dictionary file: > > ATTRIBUTE User-Disabled-Attr 3002 integer > > And then putting a 1 / 0 in to radcheck against the user. > > What's the best way to do this kind of request? Is it better to write a > lookup somewhere else? > > Thanks > > J > > -- > View this message in context: http://freeradius.1045715.n5.nabble.com/Custom-MySQL-Queries-tp4943692p4943… > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > > ------------------------------ > > Message: 2 > Date: Thu, 27 Oct 2011 15:55:18 -0200 > From: "Daniel Menezes" <listas(a)dmnzs.com.br> > Subject: RES: FreeRadius + MySQL | radacct: Errors and Warnings > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <02ce01cc94d1$96c37790$c44a66b0$(a)com.br> > Content-Type: text/plain; charset="us-ascii" > > Fajar, > >> So you mean radutmp was the root cause of your problem? > > I don't know, but it's better now. =) > >> What does FR log says? Does it say it recives duplicate or conflicting > packets? >> If yes, then the db is still slow. You still need to fix it. If not, >> then the problem might be somewhere else (e.g. congested network >> causing dropped packets) > > This is strange! > When starting radius in debug mode I don't see any error, in normal mode > duplicate or conflicting packages have disappeared. > Always the statistics in MikroTik shows 2, 4 resends and timeouts .. a few. > > I'll try other ways, first, change the DB engine. > Tomorrow i'll write about. > > Thanks. > > > Sds, > > --- > Daniel Menezes > > > > > > ------------------------------ > > Message: 3 > Date: Thu, 27 Oct 2011 18:28:36 +0000 > From: Travis Dimmig <tdimmig(a)impulse.com> > Subject: Failed to load module "jradius" > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <2ECC69012853FB42A8ADABA5EB3B4B800C9D15CD(a)DSM-Mail01.dsm.net> > Content-Type: text/plain; charset="us-ascii" > > I don't seem to be able to get freeRadius to load the "jradius" module. My steps are as follows: > > wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.12.tar.gz > tar -xzvf freeradius-server-2.1.12.tar.gz > cd freeradius-server-2.1.12 > echo "rlm_jradius" >> src/modules/stable > ./configure && make && make install > cp src/modules/rlm_jradius/jradius./conf /usr/local/etc/raddb > > I configure jradius.conf to point to my JRadius server, and add jradius to the accounting section of sites-enabled. > "radiusd -X" gives: > /usr/local/etc/raddb/sites-enabled/default[443]: Failed to load module "jradius". > /usr/local/etc/raddb/sites-enabled/default[378]: Errors parsing accounting section. > > I have verified that the jradius libraries have been compiled and installed /usr/local/lib. > > I've managed to comile freeRadius with the jradius module before just fine.....not sure what the problem is now. Any help would be greatly appreciated. > > Travis Dimmig > Software Development Specialist > Impulse Point > www.impulse.com<http://www.impulse.com> > >

1 0

Failed to load module "jradius"
by Travis Dimmig 27 Oct '11

27 Oct '11

I don't seem to be able to get freeRadius to load the "jradius" module. My steps are as follows: wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.12.tar.gz tar -xzvf freeradius-server-2.1.12.tar.gz cd freeradius-server-2.1.12 echo "rlm_jradius" >> src/modules/stable ./configure && make && make install cp src/modules/rlm_jradius/jradius./conf /usr/local/etc/raddb I configure jradius.conf to point to my JRadius server, and add jradius to the accounting section of sites-enabled. "radiusd -X" gives: /usr/local/etc/raddb/sites-enabled/default[443]: Failed to load module "jradius". /usr/local/etc/raddb/sites-enabled/default[378]: Errors parsing accounting section. I have verified that the jradius libraries have been compiled and installed /usr/local/lib. I've managed to comile freeRadius with the jradius module before just fine.....not sure what the problem is now. Any help would be greatly appreciated. Travis Dimmig Software Development Specialist Impulse Point www.impulse.com<http://www.impulse.com>

2 2

FreeRadius + MySQL | radacct: Errors and Warnings
by Daniel Menezes 27 Oct '11

27 Oct '11

Hi all, First, sorry my bad English. I have a FreeRadius + MySQL setup with MikroTik as NAS. And a few days ago I have some warnings and errors in the log: Tue Oct 25 04:02:41 2011 : Info: Released IP xxx.xxx.xxx.xxx (did via-pppoe-01 cli xx:xx:xx:xx:xx:xx user dmnzs-test) Tue Oct 25 05:30:36 2011 : Error: Received conflicting packet from client my-pppoe-01 port 39595 - ID: 75 due to unfinished request 625066. Giving up on old request. Tue Oct 25 15:43:20 2011 : Error: WARNING: Unresponsive child for request 784, in module radutmp component accounting I read something about slow backend, tables indexes and other things. I've used the backend script 'mysqltuner.pl' to adjust the performance. It's better now, but the warnings and erros persists. Can anyone help me on this? Thanks in advance. Sds, --- Daniel Menezes

5 14

PEAP with Machine auth
by Bonald 27 Oct '11

27 Oct '11

Hi, I've spent too much time trying to fix this issue and going nowhere... I am trying to make MACHINE auth working on Windows/CiscoWLC and Freeradius. I have no problem with USER auth. The certificate is fine, I've created it using xpextension. I've also tried a Windows-CA certificate. I've also tried MACHINE auth with IAS and it's working. I've upgraded the WLC to 7.0.0.116, I was at 6.0.199-4 before. Why is it working with USER auth but not MACHINE auth ? Could someone give me some direction ? Thanks! Here's some logs: rad_recv: Access-Request packet from host 10.10.1.1 port 32770, id=58, length=280 User-Name = "host/MININT-EC23NBT.domain.local" Calling-Station-Id = "b4-74-9f-9d-55-fb" Called-Station-Id = "00-25-84-23-52-60:SSID--Secure" NAS-Port = 1 Cisco-AVPair = "audit-session-id=0132800a0000005618faa74e" NAS-IP-Address = 10.10.1.1 NAS-Identifier = "Controller-WLC2125" Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202002801686f73742f4d494e494e542d454332334e42542e6373646573696c65732e71632e6361 Message-Authenticator = 0x5b1e2e25b76f1f348cb1bb62b94b2d43 server peap { # Executing section authorize from file /etc/raddb/sites-enabled/peap +- entering group authorize {...} [suffix] No '@' in User-Name = "host/MININT-EC23NBT.domain.local", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 2 length 40 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/peap +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled } # server peap Sending Access-Challenge of id 58 to 10.10.1.1 port 32770 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd4ade9e4d4aef086c00dbb7516145db0 Finished request 232. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.1.1 port 32770, id=59, length=395 User-Name = "host/MININT-EC23NBT.domain.local" Calling-Station-Id = "b4-74-9f-9d-55-fb" Called-Station-Id = "00-25-84-23-52-60:SSID--Secure" NAS-Port = 1 Cisco-AVPair = "audit-session-id=0132800a0000005618faa74e" NAS-IP-Address = 10.10.1.1 NAS-Identifier = "Controller-WLC2125" Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0203008919800000007f160301007a0100007603014ea7fa1c69583120e18e33c7779ea4d03e42e8b960079d8f36ab746be5bb345a20512d0000ccfbf8a28c0c5d27fb46eac23b913c638cc133e76aa06671c2dca9bd0018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 State = 0xd4ade9e4d4aef086c00dbb7516145db0 Message-Authenticator = 0xde1ff14a20623ba0cc79cb552d264947 server peap { # Executing section authorize from file /etc/raddb/sites-enabled/peap +- entering group authorize {...} [suffix] No '@' in User-Name = "host/MININT-EC23NBT.domain.local", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 3 length 137 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/peap +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 127 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 007a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 037c], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server peap Sending Access-Challenge of id 59 to 10.10.1.1 port 32770 EAP-Message = 0x010403c6190016030100310200002d03014ea7fa24d1353592fe67e3ae98e501bbfbe366dc12f730a1d2ab15d1efcc9f3200002f000005ff01000100160301037c0b0003780003750003723082036e30820256a003020102020106300d06092a864886f70d01010505003075310b3009060355040613024341310b3009060355040813025143310c300a0603550407130345444e310c300a060355040a13034353493123302106092a864886f70d010901161474656368406373646573696c65732e71632e6361311830160603550403130f435349205061636b657466656e6365301e170d3131313032353233333930315a170d313131323234323333 EAP-Message = 0x3930315a3067310b3009060355040613024341310b3009060355040813025143310c300a060355040a1303435349311830160603550403130f435349205061636b657466656e63653123302106092a864886f70d010901161474656368406373646573696c65732e71632e636130820122300d06092a864886f70d01010105000382010f003082010a0282010100e8cae5b4a5b06ec6aea8b6e32c4490762772310d87985ea3d1bbf2632aafebd9b0ae70a615a77b3b8ef2dd985df3e54149b1d1bb0842e410c68dfa55ce176371db376a3bb1918d966ad140310224c4b510015ce15973537048a8e997bb2c7d21c2f57e99f90c1dbc3c584822f0d8bb EAP-Message = 0x1178343ddbcf2842aa1b17642bd60d545f3b505d1b1594e2981d472186df3b9132536b8a558f1836dd11039a3337886ab301b49de79ae5597f9958f030671aa3e47cae50f69e8008687492b3a97adc24111269da2585fc488943555520870007669e31550ea255fb9af4394cdae03ceadbffb29f2fafb0d16c47f57174fbaa4986e9749cdecb2fc33fd6886099f1538e670203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038201010053b69c137577d12947a7f63b7617b0ace3133df2048831b206c42751a63d48c1ca0802fa0b3aee3df03a6030848f9ed9d8370a3901bf4498e829 EAP-Message = 0xba37da6f48fb4f6aec7fee62fe06d36a11c2a13f94f188c1165c2ea8d0865cd5283462ec76c3de3df37967d94d9224425b8ea7921f8033711b4430ef1943ff29db366b7a0e6bdab6ddcdede222e7f3642fb886a3eea1316ed7ede26b8aa1dcdc7b4bcb6fefae97ba9c0eec9750bd45cf29e93be3b58b2534ba203f11b9e9a4b05980c844cebf79044f17f3f08797d9b912de8fc1cec712e42c2c87189817d456bcb3469c0043306504f2d58e779fc810a75d8d5784b54ce4c351188d50cd052b618d28d0461516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd4ade9e4d5a9f086c00dbb7516145db0 Finished request 233. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.1.1 port 32770, id=60, length=264 User-Name = "host/MININT-EC23NBT.domain.local" Calling-Station-Id = "b4-74-9f-9d-55-fb" Called-Station-Id = "00-25-84-23-52-60:SSID--Secure" NAS-Port = 1 Cisco-AVPair = "audit-session-id=0132800a0000005618faa74e" NAS-IP-Address = 10.10.1.1 NAS-Identifier = "Controller-WLC2125" Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 State = 0xd4ade9e4d5a9f086c00dbb7516145db0 Message-Authenticator = 0x3f92eaba33074a895121d2885b384802 server peap { # Executing section authorize from file /etc/raddb/sites-enabled/peap +- entering group authorize {...} [suffix] No '@' in User-Name = "host/MININT-EC23NBT.domain.local", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/peap +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server peap Sending Access-Challenge of id 60 to 10.10.1.1 port 32770 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd4ade9e4d6a8f086c00dbb7516145db0 Finished request 234. Going to the next request Waking up in 4.9 seconds. Cleaning up request 232 ID 58 with timestamp +4714 Cleaning up request 233 ID 59 with timestamp +4714 Cleaning up request 234 ID 60 with timestamp +4714 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xd4ade9e4d6a8f086 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests.

6 24

systemd and FreeRADIUS
by Stefan Winter 27 Oct '11

27 Oct '11

Hi, seems like openSUSE is going the fancy way and throws good old INIT overboard with their next release. System initialisation and housekeeping is changing towards systemd instead. So, in 20-something days I'll try to get my first FreeRADIUS running on that, and can't use my good old init scripts any more (I guess I could with some systemd-to-INIT legacy support, but I like eating fresh dogfood). Is there already someone working on systemd description files for FreeRADIUS? If not, I'll (have to :-) ) give it a go myself... Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 2