- Freeradius-Users - lists.freeradius.org

Expand Ldap Attribute on Post-Auth section
by Renan 07 Jun '11

07 Jun '11

Hello there, I'm trying to evaluate an ldap returned attribute on the post-auth section. At my dictionary: ATTRIBUTE Aa 3000 string At my ldap.attrmap: checkItem AA eduPersonAffiliation And at my custom module: exec aloca_vlans { wait = yes program = "/usr/local/bin/script-teste.sh %{User-Name} %{control:Aa} %{reply:Aa} %{Aa} " input_pairs = request output_pairs = reply packet_type = Access-Accept shell_escape = yes } When running radiusd -X, I see the data getting fetched. [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] eduPersonAffiliation -> Aa == "5" [ldap] eduPersonAffiliation -> Aa == "2" [ldap] userPassword -> Password-With-Header == "xxxxxxxxxxxxx" [ldap] ntPassword -> NT-Password == xxxxxxxxxxxxxx [ldap] looking for reply items in directory... But when the variables are expanded it returns nothing: # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [reply_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/xxxxxx/reply-detail-20110606 [reply_log] /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/xxxxxx/reply-detail-20110606 [reply_log] expand: %t -> Mon Jun 6 15:04:10 2011 ++[reply_log] returns ok [aloca_vlans] expand: %{User-Name} -> renan.manola [aloca_vlans] expand: %{control:Aa} -> [aloca_vlans] expand: %{reply:Aa} -> [aloca_vlans] expand: %{Aa} -> I have specified the control and reply lists just as a test. If I don't specify the variable name at the dictionary file, the log complains of "unknown module not found". Best regards. -- Renan Manola Analista de Tecnologia da Informação Nucleo de Processamento de Dados (NPD) Universidade Federal do Espírito Santo (UFES) Ministério da Educação - Serviço Público Federal E-mail: rmanola(a)npd.ufes.br Antes de imprimir pense em seu compromisso com o Meio Ambiente. As informações existentes nesta mensagem e em seus arquivos anexados são para uso restrito, sendo seu sigilo protegido por lei. Caso você não seja o destinatário, saiba que leitura, divulgação ou cópia são proibidas. Neste caso, favor notificar o remetente e apagar as informações. O uso impróprio destas informações será tratado conforme as normas da empresa e a legislação em vigor.

4 8

Re: Renaming during Machine Authentication
by Mark Jones 07 Jun '11

07 Jun '11

Hi Phil thanks for answering. I am trying to authenticate the machines on bootup. I have an edir backend and am following this cool solutions article which is fairly old: http://www.novell.com/coolsolutions/feature/17044.html In it they talk about atrrib-rewrite but use it in the radiusd.conf file which in my limited knowledge of freeradius I think is an older way of doing it. Right now if i join a machine to the samba domain I have created, it automatically is imported into edirectory and named "machinename$". The article is not complete so I am really not sure if the machine is supposed to authenticate to edir or samba during bootup but the end result I want is the machine to authenticate on startup so the user has a single sign on experience like they would if they plugged into the network. Thanks again Mark >>> Phil Mayers <p.mayers(a)imperial.ac.uk> 05/14/11 2:50 AM >>> On 05/13/2011 11:21 PM, Mark Jones wrote: > That sounds good...where exactly do I put that in the config files? Well, since you didn't explain why you wanted to rename it (for what purpose) I can't say for sure. Usually, a lot of what goes on in FreeRADIUS is done with string expansions - for example you might have an SQL query defined in sql.conf: some_query = "select something from table where username='%{SQL-User-Name}" In this case, you're replace that with: some_query = "select something from table where username='%{mschap:User-Name}" But this is just an example. You need to be more specific about the problem(s) you're having if you want people to give you advice. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This communication is intended for the use of the recipient to which it is addressed and may contain confidential, personal and/or privileged information. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.

5 23

Re: freeradius 2.1.10 WARNING: Internal sanity check failed
by joanroldan 07 Jun '11

07 Jun '11

Hi, I have followed your advise and I went back to the default config. I have read the: http://deployingradius.com/documents/configuration/certificates.html And I have followed it step by step. Testing first the PAP auth with an entry in users.conf and it worked fine. Next I add the Wireless LAN Controller in clients.conf and change the default eap_type with peap. I get the next warning: Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Debug: WARNING: !! EAP session for state 0xc729a88ac72ab1dd did not finish! Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Testing with an WinXP and Win7 client, so I do not think its a Supplicant issue. The supplicant config is PEAP with MSCHAPv2, and no certificate validation. I have a look to certs/README file, and I have studied the ./bootstrap script I make sure xpextensions are applied.I also launch rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* Before modifying the server.cnf and ca.cnf and launch bootstrap script again. I always get the same warning, I do no undestand why. In http://deployingradius.com says it just worked, but not in my enviorment. I attach the output: Thu Mar 31 13:14:25 2011 : Info: Ready to process requests. rad_recv: Access-Request packet from host 10.118.249.20 port 32768, id=51, length=173 User-Name = "bob" Calling-Station-Id = "00-1B-77-8E-1E-A4" Called-Station-Id = "00-1E-4A-90-5F-30:eduroam" NAS-Port = 29 NAS-IP-Address = 10.118.249.20 NAS-Identifier = "WLC_2_SCC_LAB" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "911" EAP-Message = 0x0202000801626f62 Message-Authenticator = 0xfabf4ce8269ee315494653e616f244ce Thu Mar 31 13:14:26 2011 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Thu Mar 31 13:14:26 2011 : Info: +- entering group authorize {...} Thu Mar 31 13:14:26 2011 : Info: ++[preprocess] returns ok Thu Mar 31 13:14:26 2011 : Info: ++[chap] returns noop Thu Mar 31 13:14:26 2011 : Info: ++[mschap] returns noop Thu Mar 31 13:14:26 2011 : Info: ++[digest] returns noop Thu Mar 31 13:14:26 2011 : Info: [suffix] No '@' in User-Name = "bob", looking up realm NULL Thu Mar 31 13:14:26 2011 : Info: [suffix] No such realm "NULL" Thu Mar 31 13:14:26 2011 : Info: ++[suffix] returns noop Thu Mar 31 13:14:26 2011 : Info: [eap] EAP packet type response id 2 length 8 Thu Mar 31 13:14:26 2011 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Thu Mar 31 13:14:26 2011 : Info: ++[eap] returns updated Thu Mar 31 13:14:26 2011 : Info: [files] users: Matched entry bob at line 1 Thu Mar 31 13:14:26 2011 : Info: ++[files] returns ok Thu Mar 31 13:14:26 2011 : Info: ++[expiration] returns noop Thu Mar 31 13:14:26 2011 : Info: ++[logintime] returns noop Thu Mar 31 13:14:26 2011 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP Thu Mar 31 13:14:26 2011 : Info: ++[pap] returns noop Thu Mar 31 13:14:26 2011 : Info: Found Auth-Type = EAP Thu Mar 31 13:14:26 2011 : Info: # Executing group from file /etc/raddb/sites-enabled/default Thu Mar 31 13:14:26 2011 : Info: +- entering group authenticate {...} Thu Mar 31 13:14:26 2011 : Info: [eap] EAP Identity Thu Mar 31 13:14:26 2011 : Info: [eap] processing type tls Thu Mar 31 13:14:26 2011 : Info: [tls] Initiate Thu Mar 31 13:14:26 2011 : Info: [tls] Start returned 1 Thu Mar 31 13:14:26 2011 : Info: ++[eap] returns handled Sending Access-Challenge of id 51 to 10.118.249.20 port 32768 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc729a88ac72ab1dd3e4f8d4fc2851f1c Thu Mar 31 13:14:26 2011 : Info: Finished request 9. Thu Mar 31 13:14:26 2011 : Debug: Going to the next request Thu Mar 31 13:14:26 2011 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.118.249.20 port 32768, id=51, length=173 Thu Mar 31 13:14:28 2011 : Info: Sending duplicate reply to client WiSM port 32768 - ID: 51 Sending Access-Challenge of id 51 to 10.118.249.20 port 32768 Thu Mar 31 13:14:28 2011 : Debug: Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 10.118.249.20 port 32768, id=51, length=173 Thu Mar 31 13:14:30 2011 : Info: Sending duplicate reply to client WiSM port 32768 - ID: 51 Sending Access-Challenge of id 51 to 10.118.249.20 port 32768 Thu Mar 31 13:14:30 2011 : Debug: Waking up in 0.9 seconds. Thu Mar 31 13:14:31 2011 : Info: Cleaning up request 9 ID 51 with timestamp +60 Thu Mar 31 13:14:31 2011 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Thu Mar 31 13:14:31 2011 : Debug: WARNING: !! EAP session for state 0xc729a88ac72ab1dd did not finish! Thu Mar 31 13:14:31 2011 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Thu Mar 31 13:14:31 2011 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Thu Mar 31 13:14:31 2011 : Info: Ready to process requests. Thanks in advance. -- View this message in context: http://freeradius.1045715.n5.nabble.com/freeradius-2-1-10-WARNING-Internal-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 6

Multiple instance of an attribute in Access-Accept
by Martin 07 Jun '11

07 Jun '11

Hi, I am trying to send in access accept an attribute two times, for example Packet-Flow-Descriptor but it seems that are mixed up or missing on the wire. I am using freradius 3.0 with Mysql This is the user definition: +----+-------------------+-----------------------------------+----------+ | id | username | attribute | op | value | +----+-------------------+-------------------------------+----+----------+ | 39 | ethcs | Alvarion-WiMAX-Classifier-Direction | := | 3 | | 41 | ethcs | WiMAX-QoS-Id | := | 1 | | 40 | ethcs | WiMAX-IP-TOS-DSCP-Range-and-Mask | := | 0x18183f | | 38 | ethcs | WiMAX-Classifier-Priority | := | 1 | | 37 | ethcs | WiMAX-ClassifierID | := | 1 | | 36 | ethcs | WiMAX-Downlink-QOS-Id | := | 1 | | 35 | ethcs | WiMAX-Uplink-QOS-Id | := | 1 | | 34 | ethcs | WiMAX-Transport-Type | := | 1 | | 33 | ethcs | WiMAX-Direction | := | 3 | | 32 | ethcs | Packet-Data-Flow-Id | := | 1 | | 31 | ethcs | Alvarion-PDFID | := | 1 | | 30 | ethcs | Alvarion-R3-IF-Name | := | mgmt | | 42 | ethcs | WiMAX-Schedule-Type | := | 2 | | 43 | ethcs | WiMAX-Maximum-Sustained-Traffic-Rate | := | 10000 | | 44 | ethcs | Alvarion-R3-IF-Name | := | QinQ | | 45 | ethcs | Alvarion-PDFID | := | 2 | | 46 | ethcs | Alvarion-R3-IF-ID | := | 901 | | 47 | ethcs | Packet-Data-Flow-Id | := | 2 | | 48 | ethcs | WiMAX-Direction | := | 3 | | 49 | ethcs | WiMAX-Transport-Type | := | 3 | | 50 | ethcs | WiMAX-Uplink-QOS-Id | := | 1 | | 51 | ethcs | WiMAX-Downlink-QOS-Id | := | 1 | | 52 | ethcs | WiMAX-ClassifierID | := | 1 | | 53 | ethcs | WiMAX-Classifier-Priority | := | 1 | | 54 | ethcs | WiMAX-Classifier-Direction | := | 3 | | 55 | ethcs | WiMAX-VLAN-ID | := | 15 | +----+-------------------+-------------------------------------------+---- And this is what I get on the Wireshark: Radius Protocol Code: Access-Accept (2) Packet identifier: 0x1d (29) Length: 296 Authenticator: bbe87cb6720049ce93e6d2d896059a10 [This is a response to a request in frame 512] [Time from request: 0.002565000 seconds] Attribute Value Pairs AVP: l=18 t=Vendor-Specific(26) v=Alvarion(12394) VSA: l=12 t=Breezecom-Attr1(1): \001\006QinQ\003\004\000\002 Breezecom-Attr1: \001\006QinQ\003\004 AVP: l=41 t=Vendor-Specific(26) v=WiMAX(24757) VSA: l=35 t=WiMAX-Packet-Flow-Descriptor(28) C=0x00: 6 TLV(s) inside TLV: l=4 t=WiMAX-Packet-Data-Flow-Id(1): 2 TLV: l=3 t=WiMAX-Direction(4): Bi-Directional(3) TLV: l=3 t=WiMAX-Transport-Type(6): Ethernet(3) TLV: l=3 t=WiMAX-Uplink-QOS-Id(7): 1 TLV: l=3 t=WiMAX-Downlink-QOS-Id(8): 1 TLV: l=16 t=Unknown-Attribute(11): 010301020301040303070518183f Unknown-Attribute: 010301020301040303070518183f AVP: l=21 t=Vendor-Specific(26) v=WiMAX(24757) VSA: l=15 t=WiMAX-QoS-Descriptor(29) C=0x00: 3 TLV(s) inside TLV: l=3 t=WiMAX-QoS-Id(1): 1 TLV: l=3 t=WiMAX-Schedule-Type(4): Best-Effort(2) TLV: l=6 t=WiMAX-Maximum-Sustained-Traffic-Rate(6): 10000 AVP: l=14 t=Vendor-Specific(26) v=Alvarion(12394) VSA: l=8 t=Breezecom-Attr1(1): \002\006\000\000\003\205 Breezecom-Attr1: \002\006 AVP: l=15 t=Vendor-Specific(26) v=WiMAX(24757) VSA: l=9 t=WiMAX-Packet-Flow-Descriptor(28) C=0x00: 1 TLV(s) inside TLV: l=6 t=Unknown-Attribute(11): 0904000f Unknown-Attribute: 0904000f AVP: l=6 t=EAP-Message(79) Last Segment[1] AVP: l=18 t=Message-Authenticator(80): 8c74fb7e8449e0b1c65108742ae50199 AVP: l=52 t=User-Name(1): {am=1}4d3b54960b0a86c09a3a16d02a120f04(a)alvarion.ro AVP: l=91 t=Vendor-Specific(26) v=WiMAX(24757) VSA: l=85 t=WiMAX-MSK(5) C=0x00: 894f66ea95fba5626129c837a798cfc96a369110141a6ecb... WiMAX-MSK: 894f66ea95fba5626129c837a798cfc96a369110141a6ecb... Martin

2 1

(no subject)
by arpitha arpitha 07 Jun '11

07 Jun '11

which is the latest version of php_radius.dll and pls post a link to it. Advance thnks

2 1

how to output that attribute value as raw data?
by ichiro tanaka 07 Jun '11

07 Jun '11

Hi. I was using freeradus-2.1.10 as radius home server. I want to output log file that attribute value as raw data. For example, NOT "%{Acct-Terminate-Cause} -> User-Request" BUT "%{Acct-Terminate -Cause} -> 1". Then, I edited dictionary.rfc2866 like this. ---edited #VALUE Acct-Terminate-Cause User-Request 1 --------------------------------------------- The output became "%{Acct-Terminate-Cause} -> 1", and it became a hoped output. However, default setting has become illegal. ---illegal thing if(Acct-Terminate-Cause == User-Request){ sql } --------------------------------------------- Please teach the way of the setting. Thanks for your help. ichiro tanaka

2 3

Freeradius not releasing IPs from pool
by Angel L. Mateo 07 Jun '11

07 Jun '11

Hello, I have a problem with my pools in freeradius. The problems is that it is not releasing IPs from the pools. At least, not all of them, so after a while my users can't connect because the pool is full. I check that it is not releasing IPs because I get (I have replaced usernames with XXXX): root@vulpes21:/usr/share/doc/freeradius# radwho | grep 155.54.194 XXXXXXXX XXXXXXXXX PPP >999 Wed 10:28 155.54.213.20 155.54.194.128 XXXXXXXX XXXXXXXXX PPP >999 Wed 10:36 155.54.213.20 155.54.194.51 XXXXXXXX XXXXXXXXX PPP >999 Wed 10:42 155.54.213.20 155.54.194.8 XXXXXXXX XXXXXXXXX PPP >999 Wed 12:33 155.54.213.20 155.54.194.115 XXXXXXXX XXXXXXXXX PPP >999 Wed 12:37 155.54.213.20 155.54.194.101 XXXXXXXX XXXXXXXXX PPP >999 Wed 12:40 155.54.213.20 155.54.194.62 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:06 155.54.213.20 155.54.194.92 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:11 155.54.213.20 155.54.194.48 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:24 155.54.213.20 155.54.194.78 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:27 155.54.213.20 155.54.194.112 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:28 155.54.213.20 155.54.194.59 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:29 155.54.213.20 155.54.194.134 but rlm_ippol_tool shows a lot of IP addresses in use: root@vulpes21:/etc/freeradius# rlm_ippool_tool -a pool_vpn.ippool pool_vpn.ipindex | wc -l 122 In my configuration I have: authorize { vpn_log vpn_syslog suffix files_vpn pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap-email } } preacct { suffix files_vpn } accounting { vpn_log unix pool_vpn pool_vpn_alu pool_vpn_ryt radutmp vpn_acc_syslog sql_log_um } session { } post-auth { pool_vpn pool_vpn_alu pool_vpn_ryt vpn_log vpn_syslog } pre-proxy { } post-proxy { } Any idea? Ah... I'm running 2.1.8 from ubuntu 10.04. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

2 3

Unable to authenticate locally when remote proxy server is unavailable
by jch2006＠verizon.net 07 Jun '11

07 Jun '11

3 3

Setting Cached-Session-Policy
by Gerald Vogt 06 Jun '11

06 Jun '11

Hi! I am trying to get fast session resumption with VLAN assignments to work. I have tried the suggestion in this message: http://lists.freeradius.org/pipermail/freeradius-users/2011-April/msg00381.… However, it seems to me as if the post-auth section is too late to set the Cached-Session-Policy. I have added the following to the beginning of the post-auth section in the default site: post-auth { if ( reply:Cached-Session-Policy ) { if ( reply:Cached-Session-Policy =~ /vlan=(.+)/ ) { update reply { Reply-Message += "Cached policy: %{reply:Cached-Session-Policy}" Tunnel-Private-Group-ID := "%{1}" Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 } } } elsif ( reply:Tunnel-Private_group-ID ) { update reply { Cached-Session-Policy := "vlan=%{reply:Tunnel-Private-Group-ID}" } } I can see in the logs that this correctly sets Cached-Session-Policy, e.g. to vlan=10. However, during session resumption it will only add User-Name and Stripped-User-Name. During the initial session setup I can see that attributes are saved into the cache: [peap] Success [peap] Using saved attributes from the original Access-Accept Tunnel-Private-Group-Id:0 = "18" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN User-Name = "vogt" [peap] Saving response in the cache [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++? if (reply:Cached-Session-Policy ) ? Evaluating (reply:Cached-Session-Policy ) -> FALSE ++? if (reply:Cached-Session-Policy ) -> FALSE ++? elsif (reply:Tunnel-Private_group-ID ) ? Evaluating (reply:Tunnel-Private_group-ID ) -> TRUE ++? elsif (reply:Tunnel-Private_group-ID ) -> TRUE ++- entering elsif (reply:Tunnel-Private_group-ID ) {...} expand: vlan=%{reply:Tunnel-Private-Group-ID} -> vlan=18 +++[reply] returns noop ++- elsif (reply:Tunnel-Private_group-ID ) returns noop Now, if I understand the source code correctly, attributes are saved when freeradius logs "Saving response in the cache". I think this means that setting Cached-Session-Policy in post-auth is too late because at point the caching already happened and modifying Cached-Session-Policy won't affect what is stored in the cache. This is what is logged during session resumption: [peap] Adding cached attributes to the reply: User-Name = "vogt" Stripped-User-Name = "vogt" [eap] Freeing handler ++[eap] returns ok Should setting Cached-Session-Policy in post-auth have an effect on cached attributes or not? Cheers, Gerald

2 2

Freeradius + Alvarion 4Motion specify filter-id value inaccess-accept from value in user conf file ?
by Hahusseau, Thomas 06 Jun '11

06 Jun '11

Hello, I'm running latest version form Master Branch of Freeradius. I managed to connect an Alvarion CPE to an Alvarion 4M BS with Freeradius server as authenticator. Everything works well except that I directly specified in my /site-enable/default configuration file the value of "Filter-Id" attribute required by the base station. ----------- /site-enabled/default post-auth { exec update request { WiMAX-MN-NAI = "%{User-Name}" } update reply { WiMAX-FA-RK-Key = 0x00 WiMAX-MSK = "%{reply:EAP-MSK}" Filter-Id = "Profile1" } wimax Post-Auth-Type REJECT { # log failed authentications in SQL, too. # sql attr_filter.access_reject } } ----------- I would like to use different value of attribute "Filter-Id" for different users (specific QoS setting in Alvarion ASN-GW for each Filter-Id). I would like to use the "Filter-ID"'s value specified in my users conf file : ----------- users #standard customer cpe1(a)eads.com Cleartext-Password := "cpe1" Session-Timeout = 3600, Termination-Action = Radius-Request, Filter-Id = "Profile1" #VIP customer cpe2(a)eads.com Cleartext-Password := "cpe2" Session-Timeout = 3600, Termination-Action = Radius-Request, Filter-Id = "Profile2" ----------- I tried to use the same syntax as for WiMAX-MSK attribute: Filter-ID ="%{Filter-Id}" but it doesn't work (Filter-ID value in access-accept is empty). I googled "Filter-Id freeradius" and found nothing relevant. Is it possible to use Filter-ID value form users conf file in access-accept ? Here is an example on access-accept message with filter-id specified directly in site-enable/default conf file. ----------- radiusd -X (7) Found Auth-Type = ? (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (7) group authenticate { (7) - entering group authenticate {...} (7) eap : Request found, released from the list (7) eap : EAP/ttls (7) eap : processing type ttls (7) ttls : Authenticate (7) ttls : processing EAP-TLS (7) ttls : Received TLS ACK (7) ttls : Received TLS ACK (7) ttls : ACK handshake is finished (7) ttls : eaptls_verify returned 3 (7) ttls : eaptls_process returned 3 (7) ttls : Using saved attributes from the original Access-Accept (7) eap : Freeing handler (7) [eap] = ok (7) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (7) group post-auth { (7) - entering group post-auth {...} (7) [exec] = noop (7) update request { (7) expand: %{User-Name} -> {am=1}791d05915a25400ca9d1a3cb1a2c7ffa(a)eads.com (7) } # update request = noop (7) update reply { (7) expand: %{reply:EAP-MSK} -> 0x0473dcd65638bc4ef089945467f25e24f252b53f34e4d2f220d157c3d1192528cb185a0437d0a641fd5434d28738eae8f013d4b0308662a0e1b365d8ad542ce0 (7) } # update reply = noop (7) wimax : MIP-RK = 0x9ec871a65c3033e03c0d77ed55a1517d4b7dbbbeb2d782bcf369635861e64925c5db13c36286e2032c789ad6fe2c09cd21eda782a9a4758e9ce73f8f384c46b6 (7) wimax : MIP-SPI = bb9d949a (7) wimax : WARNING: WiMAX-IP-Technology not found in reply. (7) wimax : WARNING: Not calculating MN-HA keys (7) [wimax] = updated Sending Access-Accept of id 246 to 192.168.100.10 port 1812 MS-MPPE-Recv-Key = 0x0473dcd65638bc4ef089945467f25e24f252b53f34e4d2f220d157c3d1192528 MS-MPPE-Send-Key = 0xcb185a0437d0a641fd5434d28738eae8f013d4b0308662a0e1b365d8ad542ce0 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{am=1}791d05915a25400ca9d1a3cb1a2c7ffa(a)eads.com" WiMAX-FA-RK-Key = 0xb37b0b5832687e02c31b94319b2ba3077479411f WiMAX-MSK = 0x0473dcd65638bc4ef089945467f25e24f252b53f34e4d2f220d157c3d1192528cb185a0437d0a641fd5434d28738eae8f013d4b0308662a0e1b365d8ad542ce0 Filter-Id = "Profile1" WiMAX-FA-RK-SPI = 2593430971 (7) Finished request 7. ----------- Regards, Mr Thomas Hahusseau, Ingénieur réseau Cassidian (EADS)

2 5