- Freeradius-Users - lists.freeradius.org

Invitation to connect on LinkedIn
by Satelite Cihuy via LinkedIn 28 Apr '11

28 Apr '11

LinkedIn ------------Satelite Cihuy requested to add you as a connection on LinkedIn: ------------------------------------------ Glen, I'd like to add you to my professional network on LinkedIn. - Satelite Accept invitation from Satelite Cihuy http://www.linkedin.com/e/f5ihn8-gn1ehblw-3g/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijR… View invitation from Satelite Cihuy http://www.linkedin.com/e/f5ihn8-gn1ehblw-3g/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijR… -- (c) 2011, LinkedIn Corporation

1 0

Freeradius error
by Andrei M. Castillo 28 Apr '11

28 Apr '11

Hi guys, New to Freeradius. I installed freeradius in a virtualbox but cant get it work. This is the error that I get. rad_recv: Access-Request packet from host 127.0.0.1 port 52378, id=160, length=119 User-Name = "test-01" User-Password = "test-01" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0xb4f32db02020dde2dea54abf00aad93e State = 0x1924712819bb75814c2d329074168479 EAP-Message = 0x029f00160410804938cd9f788564d605731c54d4ceaf # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test-01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 159 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication [eap] Handler failed in EAP/md5 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test-01 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 160 to 127.0.0.1 port 52378 EAP-Message = 0x049f0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 4 ID 159 with timestamp +5907 Waking up in 0.9 seconds. Cleaning up request 5 ID 160 with timestamp +5907 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 37217, id=174, length=91 User-Name = "test-01" User-Password = "test-01" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x3731176813fa2d963f45aad0433d91ce EAP-Message = 0x02ad000c01746573742d3031 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test-01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 173 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 174 to 127.0.0.1 port 37217 EAP-Message = 0x01ae00160410dd3b9e060bc20ab6c7618dabcbaba135 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x254299cc25ec9d2a127daea22ca93a94 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 37217, id=175, length=119 User-Name = "test-01" User-Password = "test-01" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x74c8493a76c0fd7a58208e5ea899acfe State = 0x254299cc25ec9d2a127daea22ca93a94 EAP-Message = 0x02ae0016041005754627c66e7e1f2dd289bddf3faede # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test-01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 174 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication [eap] Handler failed in EAP/md5 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test-01 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 175 to 127.0.0.1 port 37217 EAP-Message = 0x04ae0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 6 ID 174 with timestamp +6089 Waking up in 0.9 seconds. Cleaning up request 7 ID 175 with timestamp +6089 Ready to process requests. Kindly check my users conf. #test-01 Cleartext-Password := "test-01" # # Please read the documentation file ../doc/processing_users_file, # or 'man 5 users' (after installing the server) for more information. # # This file contains authentication security and configuration # information for each user. Accounting requests are NOT processed # through this file. Instead, see 'acct_users', in this directory. # # The first field is the user's name and can be up to # 253 characters in length. This is followed (on the same line) with # the list of authentication requirements for that user. This can # include password, comm server name, comm server port number, protocol # type (perhaps set by the "hints" file), and huntgroup name (set by # the "huntgroups" file). # # If you are not sure why a particular reply is being sent by the # server, then run the server in debugging mode (radiusd -X), and # you will see which entries in this file are matched. # # When an authentication request is received from the comm server, # these values are tested. Only the first match is used unless the # "Fall-Through" variable is set to "Yes". # # A special user named "DEFAULT" matches on all usernames. # You can have several DEFAULT entries. All entries are processed # in the order they appear in this file. The first entry that # matches the login-request will stop processing unless you use # the Fall-Through variable. # # If you use the database support to turn this file into a .db or .dbm # file, the DEFAULT entries _have_ to be at the end of this file and # you can't have multiple entries for one username. # # Indented (with the tab character) lines following the first # line indicate the configuration values to be passed back to # the comm server to allow the initiation of a user session. # This can include things like the PPP configuration values # or the host to log the user onto. # # You can include another `users' file with `$INCLUDE users.other' # # # For a list of RADIUS attributes, and links to their definitions, # see: # # http://www.freeradius.org/rfc/attributes.html # # # Deny access for a specific user. Note that this entry MUST # be before any other 'Auth-Type' attribute which results in the user # being authenticated. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #lameuser Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # Deny access for a group of users. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # # This is a complete entry for "steve". Note that there is no Fall-Through # entry so that no DEFAULT entry will be used, and the user will NOT # get any attributes in addition to the ones listed here. # steve Cleartext-Password := "testing" Auth-Type := pap # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP # Auth-Type := md5, # Service-Type = Administrative-user, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP # # This is an entry for a user with a space in their name. # Note the double quotes surrounding the name. # #"John Doe" Cleartext-Password := "hello" # Reply-Message = "Hello, %{User-Name}" # # Dial user back and telnet to the default host for that port # #Deg Cleartext-Password := "ge55ged" # Service-Type = Callback-Login-User, # Login-IP-Host = 0.0.0.0, # Callback-Number = "9,5551212", # Login-Service = Telnet, # Login-TCP-Port = Telnet # # Another complete entry. After the user "dialbk" has logged in, the # connection will be broken and the user will be dialed back after which # he will get a connection to the host "timeshare1". # #dialbk Cleartext-Password := "callme" # Service-Type = Callback-Login-User, # Login-IP-Host = timeshare1, # Login-Service = PortMaster, # Callback-Number = "9,1-800-555-1212" # # user "swilson" will only get a static IP number if he logs in with # a framed protocol on a terminal server in Alphen (see the huntgroups file). # # Note that by setting "Fall-Through", other attributes will be added from # the following DEFAULT entries # #swilson Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.65, # Fall-Through = Yes # # If the user logs in as 'username.shell', then authenticate them # using the default method, give them shell access, and stop processing # the rest of the file. # #DEFAULT Suffix == ".shell" # Service-Type = Login-User, # Login-Service = Telnet, # Login-IP-Host = your.shell.machine # # The rest of this file contains the several DEFAULT entries. # DEFAULT entries match with all login names. # Note that DEFAULT entries can also Fall-Through (see first entry). # A name-value pair from a DEFAULT entry will _NEVER_ override # an already existing name-value pair. # # # Set up different IP address pools for the terminal servers. # Note that the "+" behind the IP address means that this is the "base" # IP address. The Port-Id (S0, S1 etc) will be added to it. # #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.32+, # Fall-Through = Yes #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "delft" # Framed-IP-Address = 192.168.2.32+, # Fall-Through = Yes # # Sample defaults for all framed connections. # #DEFAULT Service-Type == Framed-User # Framed-IP-Address = 255.255.255.254, # Framed-MTU = 576, # Service-Type = Framed-User, # Fall-Through = Yes # # Default for PPP: dynamic IP address, PPP mode, VJ-compression. # NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected # by the terminal server in which case there may not be a "P" suffix. # The terminal server sends "Framed-Protocol = PPP" for auto PPP. # DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression. # DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for SLIP: dynamic IP address, SLIP mode. # DEFAULT Hint == "SLIP" Framed-Protocol = SLIP # # Last default: rlogin to our main server. # #DEFAULT # Service-Type = Login-User, # Login-Service = Rlogin, # Login-IP-Host = shellbox.ispdomain.com # # # # Last default: shell on the local terminal server. # # # DEFAULT # Service-Type = Administrative-User # On no match, the user is denied access. Thank you. Drei

3 2

MS-CHAP-V2 with no retry
by John Hayward 27 Apr '11

27 Apr '11

According to RFC2759 section 9.1.3 - 9.1.5 an authentication failure can return (E=691 R=0) --- failure no retry or (E=691 R=1) failure, disable short timeout and allow a retry with ++ID. freeradius apparently only returns (E=691 R=1) in three different places in src/modules/rlm_mschap/rlm_mschap.c apple wireless clients have a known bug Bug ID# 8112557 which fails to increment the ID in the response to the challenge failure message. The Microsoft NPS logs this failure and silently discards the retry attempt. The effect is that the user of the apple device never sees a message that tells them the need to change their password. I am unsure if free radius checks the ID of a retry packet from a device but the effect is similar - users are left in the dark as to why they cannot connect when their password has been changed. It has been reported that if the Microsoft NPS server is configured for no retries (E=691 R=0) that mac/iphones/ipads then act like windows xp machines in that they report to the user that the password needs attention. Would it be possible to modify rlm_mschap.c to be conigured as to how many retries were allowed before returning authentication failure with no retry? johnh...

6 59

Help with machine authentication
by Eldred, Bob 26 Apr '11

26 Apr '11

Hello there, I've spent the last couple days combing the interwebs, hoping to find the (probably stupid and minor) config issue with a FreeRADIUS server I've been asked to implement. I've successfully enabled and tested user authentication as a first step, but the next step is to move from that to machine authentication. I'll tackle proxying after I can make this work (hopefully without having to bother the list). Environment: CentOS (dmesg gives: Linux version 2.6.18-194.el5 (mockbuild(a)builder16.centos.org) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-48)) #1 SMP Fri Apr 2 14:58:35 EDT 2010) Samba v 3.0.33-3.29.el5_5.1 FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Problem: After configuring a Windows XP SP3 supplicant for machine authentication (which is stupidly complex, given the required registry hacks to make it work), I get this in the debug output: ++[mschap] returns noop [ntdomain] No '\' in User-Name = "host/C776669.ppmenergy.us", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop Now, I can clearly see that there *is* no '\' in the hostname there, nor should there be. But everything I've found on the web indicates that with the version of FreeRADIUS and Samba I have, %{mschap:User-Name} should be rewritten as C776669$. Getting the domain of the thing will be another challenge of its own, I imagine. Thank you in advance, for any help you can offer. -Bob Following is the complete output of the server startup, and then the output of a request: FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <secret> response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm PPMENERGY.US { } realm PPMENERGY { } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <secret> nastype = "other" } client 10.56.160.5/32 { require_message_authenticator = no secret = <secret> shortname = "coloPrimary" nastype = "cisco" } client 10.56.160.6/32 { require_message_authenticator = no secret = <secret> shortname = "coloBackup" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --domain=%{mschap:NT-Domain:-00}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --domain=%{mschap:NT-Domain:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating ntdomain realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Ready to process requests. -------------------------------------------- Request output: rad_recv: Access-Request packet from host 10.56.160.5 port 32768, id=219, length=214 User-Name = "host/C776669.ppmenergy.us" Calling-Station-Id = "00-1b-77-88-ae-3e" Called-Station-Id = "8c-b6-4f-a6-36-80:IBD-Global" NAS-Port = 13 NAS-IP-Address = 10.56.160.5 NAS-Identifier = "POR-WAPCTL-01" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "209" EAP-Message = 0x020600061900 State = 0x1c7725f51f713c6d6a5dce719626f316 Message-Authenticator = 0xf118377d72bb899a7ff3fa3525355301 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] No '\' in User-Name = "host/C776669.ppmenergy.us", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 219 to 10.56.160.5 port 32768 EAP-Message = 0x010700061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1c7725f518703c6d6a5dce719626f316 Finished request 14. Going to the next request Waking up in 4.9 seconds. Please be advised that email addresses for Iberdrola Renewables personnel have changed to first.last(a)iberdrolaREN.com effective Aug. 16, 2010. Please make a note. Thank you. This message is intended for the exclusive attention of the recipient(s) indicated. Any information contained herein is strictly confidential and privileged. If you are not the intended recipient, please notify us by return e-mail and delete this message from your computer system. Any unauthorized use, reproduction, alteration, filing or sending of this message and/or any attached files may lead to legal action being taken against the party(ies) responsible for said unauthorized use. Any opinion expressed herein is solely that of the author(s) and does not necessarily represent the opinion of the Company. The sender does not guarantee the integrity, speed or safety of this message, and does not accept responsibility for any possible damage arising from the interception, incorporation of viruses, or any other damage as a result of manipulation.

2 2

FreeRadius not working!!
by Amrita Mandpe 26 Apr '11

26 Apr '11

Hi Alan, I tried to implement FreeRadius Server for authentication against wireless laptop users, using TLS authentication(Self Signed Certificate) and it worked perfectly fine. But, when i tried to implement the same on a virtual machine,its giving me the error- Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Im using the latest version i.e. 2.1.10 of freeradius.Please let me know what is the exact issue?? Is it because i'm running the server on Virtual machine instead of Physical server?? Also, i have installed the openssl development headers ( openssl 0.9.8 version). Regards, Amrita

3 2

Condition-Based Accounting Proxy
by eitarad 26 Apr '11

26 Apr '11

Hi, Sorry for being such a newbie (; I would like to achieve the following situation: I`ve installed a FreeRadius server which will act as a proxy accounting server, Meaning that the server is forwarding the Accounting-Requests to another server. Now, I would like that once the FreeRadius server receives the Accounting-Request packet, he will check in a MySQL DB if the "User-Name" exists, if so - he will forward the Accounting-Request to the proxy server; If it does not exists, he will do nothing (halt). Please advice on how can I move forward. Thanks in advance! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Condition-Based-Accounting-Proxy-tp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

can attr_filter.accounting_response be used in post-proxy section ?
by 魏景鹏 26 Apr '11

26 Apr '11

Dear All, In post-proxy section, I wrote lines as follows: post-proxy { if(cond) { attr_filter.accounting_response } } But it seems not work as expected. Any Ideas? Best Regards WeiJingPeng

2 2

"EAP session ... did not finish!" with VPN connections
by Zeus V Panchenko 26 Apr '11

26 Apr '11

Hi, it is my another attempt to know, how to cope with `EAP session ... did not finish' warning ... i have: OS: FreeBSD-8.x amd64 FreeRADIUS v.2.1.10 core freeradius configured with eap-tls, devices in my lan Symbian (Nokia E51,E52,E71,E72,E90) Android (HTC DesireS) Maemo (Nokia N900) xNIX (ASUS EeePC900) WindowsXP (various hardware) receiving authorization and ip address via dhcp without any problem but remote symbian devices behind vpn sometimes experience troubles ... in `radiusd -X' output, the problem looks this way: Going to the next request Waking up in 4.9 seconds. Cleaning up request 44 ID 6 with timestamp +3088 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x3866e92b3b62e4aa did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. the same remote symbian device which experienced problems via vpn, is experiencing no problem if i try to get authorization for it from lan or if i install clone (the same version with the same configuration) of core freeradius locally at the remote vpn side, than i can get authorization for the device which was unable to get it with core freeradius remotely so, what can be the cause of this weird behaviour? -- Zeus V. Panchenko IT Dpt., IBS ltd GMT+2 (EET)

2 2

Re: Freeradius-Users Digest, Vol 72, Issue 78
by arpitha arpitha 26 Apr '11

26 Apr '11

've actually installed freeradius n 've been successful 2 authenticate from same system using radtest. Sql integration 2 is successfully working. I wanna use EAP to connect to another system. On 4/26/11, freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Authenticating against Win2k8r2 without ntlm_auth (schilling) > 2. Re: Authenticating against Win2k8r2 without ntlm_auth > (Thomas Smith) > 3. Re: Authenticating against Win2k8r2 without ntlm_auth > (Phil Mayers) > 4. Re: Authenticating against Win2k8r2 without ntlm_auth > (Phil Mayers) > 5. (arpitha arpitha) > 6. Re: (Suman Dash) > 7. Problem with EAP-TLS authentication in Freeradius (senthil kumar) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 25 Apr 2011 09:44:33 -0400 > From: schilling <schilling2006(a)gmail.com> > Subject: Re: Authenticating against Win2k8r2 without ntlm_auth > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <BANLkTik2ML94FHiB_0HGtTvC=CAyv-szZw(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Could we extend the AD schema with another accessible ntPassword hash, > and thus use LDAP against AD for PEAP/MSCHAP? > > Schilling > > On Sun, Apr 24, 2011 at 4:33 AM, Phil Mayers <p.mayers(a)imperial.ac.uk> > wrote: >> On 04/24/2011 12:48 AM, Thomas Smith wrote: >> >>> While Samba 3.5 and Likewise 6 fixed the problems authenticating >>> against Win2k8r2, Likewise removed support for Samba/Winbind in their >>> 6.x series product (they included full support for Samba/Winbind in >>> their 5.x series product)--they now use their own libraries to provide >>> "winbind" functionality. The result of this is that the Samba-included >>> ntlm_auth no longer works (and Likewise doesn't provide a comparable >>> replacement)--since my FreeRADIUS install was using ntlm_auth for AD >>> authentication and authorization, it is no longer working. >> >> If you're using Samba/ntlm_auth, you're probably doing PEAP/MSCHAP, in >> which >> case you have precisely one option - continuing to use Samba/ntlm_auth. >> >> Neither kerberos nor LDAP against AD (nor any other method) can be used to >> process MSCHAP authentications. >> >> If Likewise are going to replace bits of the Samba stack, they should >> provide compatible bits. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > ------------------------------ > > Message: 2 > Date: Mon, 25 Apr 2011 11:33:56 -0700 > From: Thomas Smith <theitsmith(a)gmail.com> > Subject: Re: Authenticating against Win2k8r2 without ntlm_auth > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <BANLkTimfyMS_qobO1bxE4Q8xgKDz0zA6yQ(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > On Sun, Apr 24, 2011 at 1:33 AM, Phil Mayers <p.mayers(a)imperial.ac.uk> > wrote: >> On 04/24/2011 12:48 AM, Thomas Smith wrote: >> >>> While Samba 3.5 and Likewise 6 fixed the problems authenticating >>> against Win2k8r2, Likewise removed support for Samba/Winbind in their >>> 6.x series product (they included full support for Samba/Winbind in >>> their 5.x series product)--they now use their own libraries to provide >>> "winbind" functionality. The result of this is that the Samba-included >>> ntlm_auth no longer works (and Likewise doesn't provide a comparable >>> replacement)--since my FreeRADIUS install was using ntlm_auth for AD >>> authentication and authorization, it is no longer working. >> >> If you're using Samba/ntlm_auth, you're probably doing PEAP/MSCHAP, in >> which >> case you have precisely one option - continuing to use Samba/ntlm_auth. >> >> Neither kerberos nor LDAP against AD (nor any other method) can be used to >> process MSCHAP authentications. >> >> If Likewise are going to replace bits of the Samba stack, they should >> provide compatible bits. > > Yeah, that's exactly what I've been doing. I was hoping to find > another method, but that doesn't sound promising. > > I brought this to Likewise' attention as soon as I noticed the issue. > They are looking into it but haven't given me a time frame for a > "fix", or even if there will provide one. > > > ------------------------------ > > Message: 3 > Date: Mon, 25 Apr 2011 21:30:14 +0100 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Authenticating against Win2k8r2 without ntlm_auth > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4DB5D9D6.7060706(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 04/25/2011 02:44 PM, schilling wrote: >> Could we extend the AD schema with another accessible ntPassword hash, >> and thus use LDAP against AD for PEAP/MSCHAP? > > Yes, if you know everyones plaintext password. But if you do, you don't > have this problem at all; you can just store Cleartext-Password in some > secured SQL database and use that. > > In short: it's usually impractical. > > > ------------------------------ > > Message: 4 > Date: Mon, 25 Apr 2011 21:39:10 +0100 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Authenticating against Win2k8r2 without ntlm_auth > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4DB5DBEE.4040606(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 04/25/2011 07:33 PM, Thomas Smith wrote: >> >> I brought this to Likewise' attention as soon as I noticed the issue. >> They are looking into it but haven't given me a time frame for a >> "fix", or even if there will provide one. > > I'm not familiar with Likewise (nor do I have any desire to become so). > But if they provide any development libraries or infrastructure, you may > be able to implement the feature yourself. > > All "ntlm_auth" ends up doing is SamNetworkLogon RPC against the > netlogon pipe of a domain controller. Minimally, they just need to > provide you a binary (or you code one up) that calls that RPC using the > challenge and ntresponse values (along with username/domain) and returns > the NT key value. > > The other alternative would be to compile Samba into a separate > directory tree, and configure it carefully - then join it to the domain > as a separate "virtual" domain member, which is only used for running > winbind and ntlm_auth. You might have problems with nmbd and binding to > port 13x. > > But honestly: it would probably be easier to just run Samba on your > FreeRadius servers, and forgo Likewise. > > > ------------------------------ > > Message: 5 > Date: Tue, 26 Apr 2011 10:16:22 +0530 > From: arpitha arpitha <arpithaarp(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Message-ID: <BANLkTikd7_UuLhduJUhcRacJf43+coJThw(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > hi, 'm very new to freeradius, i want to setup radius server to > authenticate another system connected through an access point. i'l b > grateful if any1 can tell d steps 2 do this r give links 2 d related > materials. Thnks in advance :-) > > > ------------------------------ > > Message: 6 > Date: Tue, 26 Apr 2011 10:40:31 +0530 > From: Suman Dash <suman(a)clydontech.com> > Subject: Re: > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4DB653C7.3080203(a)clydontech.com> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > Please read the documentation on how to setup freeradius. From your post > it is unclear as what type of auth you need. There are official docs at > freeradius.org which you might want to see. > > On 4/26/2011 10:16 AM, arpitha arpitha wrote: >> hi, 'm very new to freeradius, i want to setup radius server to >> authenticate another system connected through an access point. i'l b >> grateful if any1 can tell d steps 2 do this r give links 2 d related >> materials. Thnks in advance :-) >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> >> __________ Information from ESET NOD32 Antivirus, version of virus >> signature database 6042 (20110414) __________ >> >> The message was checked by ESET NOD32 Antivirus. >> >> http://www.eset.com >> >> >> >> >

1 0

Problem with EAP-TLS authentication in Freeradius
by senthil kumar 26 Apr '11

26 Apr '11

Hi All, I am using Freeradius 2.1.0 PEAP/TTLS is working fine and I am facing problem in TLS authentication. I am able to generate certificate but while connecting it throws Authentication error. Can some one send me client.cnf and server.cnf. Also let me know whether installing only client is enough or do we need to install ca.pem also in client side. Please let me know how to debug it. rad_recv: Access-Request packet from host 192.168.1.1 port 4906, id=6, length=147 User-Name = "maemo(a)nokia.com" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0023692c6f74" Calling-Station-Id = "0025d05b72ab" NAS-Identifier = "0023692c6f74" NAS-Port = 2 Framed-MTU = 1400 State = 0xc0ff35f8c1fd389f4e860dc8a76c03f8 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060d00 Message-Authenticator = 0xcf453c67c6fe4f7695dbba231da2ba1e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "nokia.com" for User-Name = "maemo(a)nokia.com" [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "maemo" [suffix] Adding Realm = "DEFAULT" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry maemo at line 74 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.1.1 port 4906 EAP-Message = 0x010304000dc00000085b310e300c060355040a13054e6f6b6961311e301c06092a864886f70d010901160f6d616d656f406e6f6b69612e636f6d310e300c060355040313054d6565676f301e170d3131303430373038333135345a170d3132303430363038333135345a306e310b300906035504061302494e310b3009060355040813024b413112301006035504071309536f6d657768657265310e300c060355040a13054e6f6b6961311e301c06092a864886f70d010901160f6d616d656f406e6f6b69612e636f6d310e300c060355040313054d6565676f30820122300d06092a864886f70d01010105000382010f003082010a0282010100ebdf EAP-Message = 0xbd5045d1129f68d6354ecaf6d0b003ba682e0399145d83af7d3f7baeac7b70278682f26b7a6cf02cb0f70d06c27cd5666f6acd0a6e1a05f14cbca9ee2ca06038289d718635789b9378b41d5d89d98c09528e5d75a7ed1210ab639c80a82bb7f727a6641b4ead338d36c98e4910f69add0990c1838bf1dd67d3ef00190a8c50afa3d267b4721eb24c9297eac37244c2f09bf5db1e864ed3e71d7b2f1523f957d040b88bdfbb50ffa7a1fcb77fe8f692faeaf4f26539f93d4b16fefd22576b63425a3b106d4100a7e606110980202629a14f721f576e7b57e94182c695034f33cc5cf153c08074379ee285a4800d30fcc3eeb9618e95b3298852c0e050cc EAP-Message = 0x370203010001a381d33081d0301d0603551d0e041604146495968035da2071580d6554ff37f49f34a6a4fc3081a00603551d2304819830819580146495968035da2071580d6554ff37f49f34a6a4fca172a470306e310b300906035504061302494e310b3009060355040813024b413112301006035504071309536f6d657768657265310e300c060355040a13054e6f6b6961311e301c06092a864886f70d010901160f6d616d656f406e6f6b69612e636f6d310e300c060355040313054d6565676f82090088f0548531fc31df300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100c60eb4fe9642b5cf1a479ddd03 EAP-Message = 0x31954bd3c5a8c13dac220146915074390da01b0cf44950935ca2fad0bbca312ad8d1ac38a0ad88e51bc7bfc4df349d238aa9dee95ccc333e46e422da2fd67073a5fc1d6109e623efdf7be334a6746b4d3eb012ddb331600471732e961861980a4d0a146e56ee383e1717a209476a34d2ad7153a00f0729976f4d73d4979dc992ab8cc4515787e68afd1979038963882c5f55ed1d038c137689ef3e0fa52d63eabe0466ef126564ff4627776f31dba8bd91b9c486ddf6e8399c755bd29456cfed9bda7890851bfb23d3c381e5176a6b6c86ea9cefc5b7428409e35a794775d27f1664c06aeb46842f61c6145a71a7a0fdea54e316030100800d00007803 EAP-Message = 0x01024000720070306e310b30 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc0ff35f8c2fc389f4e860dc8a76c03f8 Finished request 156. Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 4908, id=6, length=147 User-Name = "maemo(a)nokia.com" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0023692c6f74" Calling-Station-Id = "0025d05b72ab" NAS-Identifier = "0023692c6f74" NAS-Port = 2 Framed-MTU = 1400 State = 0xc0ff35f8c2fc389f4e860dc8a76c03f8 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060d00 Message-Authenticator = 0xdeea6893aacbe253ed951368cec20746 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "nokia.com" for User-Name = "maemo(a)nokia.com" [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "maemo" [suffix] Adding Realm = "DEFAULT" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry maemo at line 74 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.1.1 port 4908 EAP-Message = 0x010400790d800000085b0906035504061302494e310b3009060355040813024b413112301006035504071309536f6d657768657265310e300c060355040a13054e6f6b6961311e301c06092a864886f70d010901160f6d616d656f406e6f6b69612e636f6d310e300c060355040313054d6565676f0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc0ff35f8c3fb389f4e860dc8a76c03f8 Finished request 157. Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 4910, id=6, length=154 User-Name = "maemo(a)nokia.com" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0023692c6f74" Calling-Station-Id = "0025d05b72ab" NAS-Identifier = "0023692c6f74" NAS-Port = 2 Framed-MTU = 1400 State = 0xc0ff35f8c3fb389f4e860dc8a76c03f8 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204000d0d001503010002012a Message-Authenticator = 0x782f15b2fce0fe49f406f1cb224b1ccf +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "nokia.com" for User-Name = "maemo(a)nokia.com" [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "maemo" [suffix] Adding Realm = "DEFAULT" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry maemo at line 74 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Alert [length 0002], warning bad_certificate TLS Alert read:warning:bad certificate [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode SSL Application Data TLS failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> maemo(a)nokia.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 158 for 1 seconds Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 4912, id=6, length=136 User-Name = "maemo(a)nokia.com" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0023692c6f74" Calling-Station-Id = "0025d05b72ab" NAS-Identifier = "0023692c6f74" NAS-Port = 2 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204000d0d001503010002020a Message-Authenticator = 0x542730d7c53937fe5e038692a71646ff +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "nokia.com" for User-Name = "maemo(a)nokia.com" [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "maemo" [suffix] Adding Realm = "DEFAULT" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry maemo at line 74 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> maemo(a)nokia.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 159 for 1 seconds Going to the next request Waking up in 0.4 seconds. Cleaning up request 146 ID 6 with timestamp +2141 Cleaning up request 147 ID 6 with timestamp +2141 Waking up in 0.5 seconds. Sending delayed reject for request 158 Sending Access-Reject of id 6 to 192.168.1.1 port 4910 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Sending delayed reject for request 159 Sending Access-Reject of id 6 to 192.168.1.1 port 4912 Waking up in 1.1 seconds. Cleaning up request 148 ID 6 with timestamp +2143 Cleaning up request 149 ID 6 with timestamp +2143 Cleaning up request 150 ID 6 with timestamp +2143 Cleaning up request 151 ID 6 with timestamp +2143 Waking up in 1.0 seconds. Cleaning up request 152 ID 6 with timestamp +2143 Cleaning up request 153 ID 6 with timestamp +2143 Waking up in 1.7 seconds. Cleaning up request 154 ID 6 with timestamp +2146 Cleaning up request 155 ID 6 with timestamp +2146 Cleaning up request 156 ID 6 with timestamp +2146 Cleaning up request 157 ID 6 with timestamp +2146 Waking up in 1.0 seconds. Cleaning up request 158 ID 6 with timestamp +2146 Cleaning up request 159 ID 6 with timestamp +2146 Regards Senthil

1 0