- Freeradius-Users - lists.freeradius.org

Mac Authorization
by Joren Love 16 Apr '11

16 Apr '11

Hi all, I've been struggling to get freeradius setup for a while now, and figured I'd post and see if anyone happens to know what I might be doing wrong.. I attempted to follow the guide here: http://wiki.freeradius.org/Mac-Auth but the raddb/modules/file module doesn't seem to exist. I tried adding files authorized_macs section to the end of modules/files but I am still getting a module not found error. If someone could help point me in the right direction, it'd be very much appreciated. -Joren root@icarus:~# freeradius -X FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, built on Jan 5 2010 at 02:56:18 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 192.168.50.55 { require_message_authenticator = no secret = "testing123" shortname = "3com" nastype = "other" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Loading virtual module rewrite_calling_station_id Module: Linked to module rlm_always Module: Instantiating noop always noop { rcode = "noop" simulcount = 0 mpp = no } /etc/freeradius/sites-enabled/default[81]: Failed to find module "authorize_macs". /etc/freeradius/sites-enabled/default[62]: Errors parsing authorize section.

5 8

Freeradius and Microsoft NPS
by Doty, Seth 16 Apr '11

16 Apr '11

I couldn't find anything in the archives with this error and i am fairly new to freeradius config anyway so i thought this would be a good start. We are looking to authenticate wireless users through freeradius and Microsoft NPS. Our outer authentication is PEAP and terminates at the radius server, inner is MSCHAPv2 and is passed to the NPS. With our current config we get a segfault at the end of the exchange. The output of radiusd -X is below FreeRADIUS Version 2.1.10, for host i386-redhat-linux-gnu, built on Mar 25 2011 at 15:16:13 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/proxy-inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm nebraska.gov { authhost = 10.1.1.1 secret = doomkey } realm DEFAULT { authhost = 10.1.1.1 secret = doomkey } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.1.2.11 { ipaddr = 10.1.1.11 netmask = 24 require_message_authenticator = no secret = "testing123" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server proxy-inner-tunnel { # from file /etc/raddb/sites-enabled/proxy-inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.11 port 32852, id=161, length=184 User-Name = "test.user" NAS-IP-Address = 10.2.2.252 NAS-Port = 0 NAS-Identifier = "10.2.2.252" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00242B8E4D0C" Called-Station-Id = "000B8661628C" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x02010011017061747269636b2e7365696d Aruba-Essid-Name = "NEW_TEST" Aruba-Location-Id = "2-floor-n" Message-Authenticator = 0x0616bb5f834210be7e960f52cb0e9968 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [eap] EAP packet type response id 1 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 161 to 10.1.1.11 port 32852 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe703083fe7011100d2e436560bc43afd Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.11 port 32852, id=162, length=322 User-Name = "test.user" NAS-IP-Address = 10.2.2.252 NAS-Port = 0 NAS-Identifier = "10.2.2.252" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00242B8E4D0C" Called-Station-Id = "000B8661628C" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0202008919800000007f160301007a0100007603014da4651f11687c8945759c5bc72d126446a89dcc2f646830f8a6380e598b33152055674930a9ee82feab2c2e101b752b495d9cdb7940be7b35de9e772f6a3ca860002800390038003500160013000a00330032002f000500040015001200090014001100080006000300ff020100000400230000 State = 0xe703083fe7011100d2e436560bc43afd Aruba-Essid-Name = "NEW_TEST" Aruba-Location-Id = "2-floor-n" Message-Authenticator = 0xe5cef2c78edefc6e81a609f48786c0a6 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [eap] EAP packet type response id 2 length 137 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 127 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 007a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 162 to 10.1.1.11 port 32852 EAP-Message = 0x0103040019c000000ab416030100310200002d03014da46529811361d8e16f2d7a616be1b602e3e2919631bd2627dacb9899fd5200000039010005ff01000100160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3131303430343133333332335a170d3131303630333133333332335a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a9b14db97cd672ef06bd5d7323ac4a0cd9129a49e1f945e3f62e5eceda01c78dd5c15a0f5f3e6282f25e90cd5b7fd4ef72f4ddb97f5aee EAP-Message = 0x503a805f613453811ba6f216101f77ddb0ebb877af89fd4fd426e5c2f3bf1ae95d399d8676873f56b5f12664a1f143a1f8bde34b9ca741ff920f3332192ad6cf7bb1d26e27969c18589b9172eb2adb0e6fa2b5bcfb103f9bd741bab7f73d6098be5501a87bd3a106866a46f52da3fa44bda96f987fd43c3ae7f41742335da304057dc5ebdfe6596996d6a56d7bf37d09318bfd8fadd96d02c347ddada868a582c1892b77a25cf564b0f8c523899762794f3afeb6c98d3627b14ddca4e0c9d6012f8a4606314f8c9ad70203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003820101006eab EAP-Message = 0xff4bbe32d78a691f9b40ab501816878b12468905da803571dbf899644c3d37fc870a0a9c959433cc0fec1ba0354e37d5ddc07003fd01e44756d0ee2511b0fe8995168471f34bd32c78118ba8c6a83b304e6fbfe64a8c73a42b14338749bf50726406e0111278cb5afcad64852d744f9a63930373ef090a5835f4c04963883239e5210599173b459e20df9dc225c0a88717af9f7f291db589fe3142cee39b6e02ae166790d6a2ba8ddd5416c55036959d31eb6499fb22602d114b9e6586dc3a664caf05828b71d25132c4ecc1bf4f7756bdc1abd00f61d6f5596328ca5bf035d163c2ea74f71d0cc78a161f172cc51976c83fc8fea70c9533b766d04f5f EAP-Message = 0x6b0004ab308204a73082038f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe703083fe6001100d2e436560bc43afd Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.11 port 32852, id=163, length=191 User-Name = "test.user" NAS-IP-Address = 10.2.2.252 NAS-Port = 0 NAS-Identifier = "10.2.2.252" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00242B8E4D0C" Called-Station-Id = "000B8661628C" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020300061900 State = 0xe703083fe6001100d2e436560bc43afd Aruba-Essid-Name = "NEW_TEST" Aruba-Location-Id = "cio-501-2-floor-n" Message-Authenticator = 0x088296f7b31bd2b2be0a82497014c5ba # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 163 to 10.1.1.11 port 32852 EAP-Message = 0x010403fc1940a003020102020900905b3b8852fd0eec300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3131303430343133333332335a170d3131303630333133333332335a308193310b3009060355040613024652310f300d0603550408130652616469757331 EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a02820101009ea811b7cba7e6567e64cd0bd554807703f2d411e3e22abe41ce1b12ff5e238cf9c337fdc410518a9014109e4fdf80d881b6319fabafefb6d391574227b3859ff9ab0fcc1394829d246dab1dd10e93306a55b7fcdd53b1ced6eb301781475071fd0b14cdbf54cd7f EAP-Message = 0xf81e753801ded67f9656c363593a558f51e3efda51771246a74b573e9016a81a5ba3e79dbcfb0fd21c03eb9515d0fc869cdf9f0c4bf08b460a074a5c0746aad7366ce47e074de35ac6cbc6b67dccc39f662cc067487fe6b7cb83f4dc08cd72ec53d3bc79a10ee4fa0b0902f308d3c0752d1a6dacc8dbd36d8d8ffa246c6f48ea01ff35808a50ba7f316a55db17e29e8486f1c879bd2d53530203010001a381fb3081f8301d0603551d0e041604146a9a07c92f12551551e50da7f47d53738b4d3a733081c80603551d230481c03081bd80146a9a07c92f12551551e50da7f47d53738b4d3a73a18199a48196308193310b300906035504061302465231 EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900905b3b8852fd0eec300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010029b8cf1cbf5d747887700d6b18f12ed58052573c7dc812b31982cc380ebac6158056c80a7a69c01bd2c7159d062e47bcf041930cbc0ba036ac7a27b9e1cb3ae8c99dd270c6effe11f71b9d EAP-Message = 0x874abf78f9decd20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe703083fe5071100d2e436560bc43afd Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.11 port 32852, id=164, length=191 User-Name = "test.user" NAS-IP-Address = 10.2.2.252 NAS-Port = 0 NAS-Identifier = "10.2.2.252" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00242B8E4D0C" Called-Station-Id = "000B8661628C" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020400061900 State = 0xe703083fe5071100d2e436560bc43afd Aruba-Essid-Name = "NEW_TEST" Aruba-Location-Id = "2-floor-n" Message-Authenticator = 0x5fea54e52ff7020307e9369153819ab0 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 164 to 10.1.1.11 port 32852 EAP-Message = 0x010502ce19001f296a73dbf89c4d8621f2c69e7118513620a7941bcb8b55eb0f0d775c8bb6d38e8456b4010e8b08e6cf77aca664bb9c1444860b4b7f8cc8a79c2be28e53ecadaaedd90ba76bd9b65e843650ab72e423f64cd10ea8850426f26718bc2361f69aed14ecc2e4cf8279f0028002b8ef862bf4188853373b53fc8e56e7a75195edc2ea50005b766a7d124bd27f82ce20618bef1eef48a38407db78d05f47c0ccc23aee91c2173c1a0e29477bb3521c160301020d0c0002090080da31238a05f6eedf9d5b91eeff972e6b5528207123b8482328ca6479df62f5feaef3265db2016fa1efda1c0b5b7970fe94db79beedb098301f3e76a336297b EAP-Message = 0x79a64d4f5e5c4ee2c9e7ea5c0dceb6951ca57884cec26dc1c7b962637f359fd567f1d90332eca7992407335ae57ac3f3a81d41cbcac6a2d134b3e96ec40a82e713000102008016339d22265101d312bb8d64f8116849a7da0415f97a52c6e79a59834de9dcbccd540fb6a18020c583ca36157be1c79282fc70a34cc3c448a3f7e92679fea1820d29b61f5ef5e51b661a42ce3c06ffa7eb3c2e83b7ceab444e15755379acc2f7494e8bfd2d1992d8260d80630e0de9ce1b9638ada8802fc92c76f24d55574d4b01003e36a342609b9560a17bff04a4252cb6e3fccca06684db9fe92fef1710b2dd33bceedab28c0d53dfea6955f5b385060079076a656f EAP-Message = 0xb8a1f8effd3df2e08c46f8287f4f431a84f35d65fcb021eba7b709e65d575b719171f8e55b31a7c42deebc228e96a5ab67a3189bd540802bccf3574e193b69e8491c7d7317be66ee85c750c15b9bbdb5c75f543e5d5208e282d650559bb8ef395dc1789bb05de51fcd1968bbbf7f18132b17118494f25267a776dbd04eab968565f4fd0b42b58af96aab5278c1c7b87493835848d2c9adf9afc832319f88b2e3ec6274be92d950b62c9763c4ff75c9586c6561f7c1da8cf9816f5dfd47e27ff7cbf68b33831df6d931571216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe703083fe4061100d2e436560bc43afd Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.11 port 32852, id=165, length=393 User-Name = "test.user" NAS-IP-Address = 10.2.2.252 NAS-Port = 0 NAS-Identifier = "10.2.2.252" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00242B8E4D0C" Called-Station-Id = "000B8661628C" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020500d01980000000c61603010086100000820080b753a187da65fcbf32bf4510126ad950841351833bfa926df86d30150e3db6128ecb9ac87c8a143485034ae2699440578386c35efc1832d820f2f5d19287cc5a1bddf44027e52c9b4722f7470b7b9ac68f7b439a64dce0c29d58206823a66b8d101dcad3d1e2bcbc3e5c8151862350cc56bde009f5292d427313dfcf9b346d4f14030100010116030100302275abdbd4b291187bf8c30716aeb8b4c35a2066ef8e35376783f985b543c7641519705c805518920b6730db2cf3f8f3 State = 0xe703083fe4061100d2e436560bc43afd Aruba-Essid-Name = "NEW_TEST" Aruba-Location-Id = "2-floor-n" Message-Authenticator = 0xea70c5a7279342dc2e9a7716302486e7 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [eap] EAP packet type response id 5 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 165 to 10.1.1.11 port 32852 EAP-Message = 0x0106004119001403010001011603010030888e0bc8a304387c1b1b06b504f111feaaf495a65a4a337e21b31a823b07d4a95fc526ba66055192c43a96b9d8194fd2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe703083fe3051100d2e436560bc43afd Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.1.11 port 32852, id=166, length=191 User-Name = "test.user" NAS-IP-Address = 10.2.2.252 NAS-Port = 0 NAS-Identifier = "10.2.2.252" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00242B8E4D0C" Called-Station-Id = "000B8661628C" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020600061900 State = 0xe703083fe3051100d2e436560bc43afd Aruba-Essid-Name = "NEW_TEST" Aruba-Location-Id = "2-floor-n" Message-Authenticator = 0xa3ab137ecad8188e573f0ce40879d28b # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 166 to 10.1.1.11 port 32852 EAP-Message = 0x0107002b190017030100209c84e5a5c4cf01729c0917cb908f722af669ea867c6a23840d8e82e7ffd163d7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe703083fe2041100d2e436560bc43afd Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.1.11 port 32852, id=167, length=281 User-Name = "test.user" NAS-IP-Address = 10.2.2.252 NAS-Port = 0 NAS-Identifier = "10.2.2.252" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00242B8E4D0C" Called-Station-Id = "000B8661628C" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0207006019001703010020b18441698a3054163e7f0300c3bcdc0fbf643d4137ebb77b44c0dd59efbe9f0417030100307ae8cc2d5ed5f3e3812a12b5b6af00b6dd3c9942520de94a67ea558f511a93edbc637547d988cbe0180b310ed798a2d3 State = 0xe703083fe2041100d2e436560bc43afd Aruba-Essid-Name = "NEW_TEST" Aruba-Location-Id = "2-floor-n" Message-Authenticator = 0x68e9720a7de844143b68be9482ebe875 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [eap] EAP packet type response id 7 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - test.user [peap] Got inner identity 'test.user' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x02070011017061747269636b2e7365696d server { PEAP: Setting User-Name to test.user Sending tunneled request EAP-Message = 0x02070011017061747269636b2e7365696d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test.user" server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test.user", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "test.user" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user test.user to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop } # server inner-tunnel [peap] Got tunneled reply code 0 PEAP: Calling authenticate in order to initiate tunneled EAP session. # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled PEAP: Cancelling proxy to realm DEFAULT until the tunneled EAP session has been established [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800261a01080021108bec4a10fc93416713985fc460e1e8357061747269636b2e7365696d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x300a6fa43002754358bae58add29bea8 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 167 to 10.1.1.11 port 32852 EAP-Message = 0x0108004b19001703010040b80dbd4428c724cbf3ea467e4898d7f4ee12fe8a1121add5deb7513b1bb8b5663426c36e75e97c08ebc340d837fd7a419d8dc0bf28d7cfc2c86c3a13aa37f925 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe703083fe10b1100d2e436560bc43afd Finished request 6. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.1.1.11 port 32852, id=168, length=313 User-Name = "test.user" NAS-IP-Address = 10.2.2.252 NAS-Port = 0 NAS-Identifier = "10.2.2.252" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00242B8E4D0C" Called-Station-Id = "000B8661628C" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0208008019001703010020abe03a208185f1ef617d0f3bea20a2ac0c1a3f86f47ed0d6686408807c17aea91703010050606ed055f27a962ae27e086442f29e32e47b2a7e9222d2e0520cd3ae0292852d8f8210cb332cfb0b642f1f91efa6e447291c14cc4258cdf4603239907fb0275b3da21ae4215f33ee70af14220ff4d217 State = 0xe703083fe10b1100d2e436560bc43afd Aruba-Essid-Name = "NEW_TEST" Aruba-Location-Id = "2-floor-n" Message-Authenticator = 0x393e75937d57c7590549cd893209225d # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [eap] EAP packet type response id 8 length 128 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800471a0208004231ab9b4b7bb1b43a02c55344c6b66b4f1f0000000000000000111f4d55532e8e1d0d740f7c3a3816c8badc2c81d608b986007061747269636b2e7365696d server { PEAP: Setting User-Name to test.user Sending tunneled request EAP-Message = 0x020800471a0208004231ab9b4b7bb1b43a02c55344c6b66b4f1f0000000000000000111f4d55532e8e1d0d740f7c3a3816c8badc2c81d608b986007061747269636b2e7365696d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test.user" State = 0x300a6fa43002754358bae58add29bea8 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test.user", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "test.user" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user test.user to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop } # server inner-tunnel [peap] Got tunneled reply code 0 PEAP: Calling authenticate in order to initiate tunneled EAP session. # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Not-EAP proxy set. Not composing EAP ++[eap] returns handled PEAP: Tunneled authentication will be proxied to DEFAULT PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. [eap] Tunneled session will be proxied. Not doing EAP. ++[eap] returns handled WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 114 to 10.1.1.49 port 1812 User-Name = "test.user" MS-CHAP-Challenge = 0x8bec4a10fc93416713985fc460e1e835 MS-CHAP2-Response = 0x0861ab9b4b7bb1b43a02c55344c6b66b4f1f0000000000000000111f4d55532e8e1d0d740f7c3a3816c8badc2c81d608b986 Proxy-State = 0x313638 Proxying request 7 to home server 10.1.1.49 port 1812 Sending Access-Request of id 114 to 10.1.1.49 port 1812 User-Name = "test.user" MS-CHAP-Challenge = 0x8bec4a10fc93416713985fc460e1e835 MS-CHAP2-Response = 0x0861ab9b4b7bb1b43a02c55344c6b66b4f1f0000000000000000111f4d55532e8e1d0d740f7c3a3816c8badc2c81d608b986 Proxy-State = 0x313638 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 10.1.1.49 port 1812, id=114, length=292 Proxy-State = 0x313638 Aruba-User-Role = "cio-network-fools" Filter-Id = "cio-networking" Tunnel-Private-Group-Id:0 = "default" Class = 0x3b8d059b00000137000117000000000000000000000000000000000101cbcd7d2f64d02b000000000001bce8 MS-MPPE-Recv-Key = 0x2b4667f48811747ee85b2622ef4ff35c MS-MPPE-Send-Key = 0x36f99fe6fbdfce26b1ac13a712ba4695 MS-CHAP2-Success = 0x08533d30373038453433324630343831443634383546343332304330413644313444373136354435413843 MS-CHAP-Domain = "\010STN" MS-Link-Utilization-Threshold = 50 MS-Link-Drop-Time-Limit = 120 # Executing section post-proxy from file /etc/raddb/sites-enabled/default +- entering group post-proxy {...} [eap] Doing post-proxy callback [eap] Passing reply from proxy back into the tunnel. server inner-tunnel { [eap] Passing reply back for EAP-MS-CHAP-V2 # Executing section post-proxy from file /etc/raddb/sites-enabled/inner-tunnel +- entering group post-proxy {...} ++[eap] returns noop WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel } # server inner-tunnel [eap] Final reply from tunneled session code 2 Proxy-State = 0x313638 Aruba-User-Role = "cio-network-fools" Filter-Id = "cio-networking" Tunnel-Private-Group-Id:0 = "default" Class = 0x3b8d059b00000137000117000000000000000000000000000000000101cbcd7d2f64d02b000000000001bce8 MS-MPPE-Recv-Key = 0x2b4667f48811747ee85b2622ef4ff35c MS-MPPE-Send-Key = 0x36f99fe6fbdfce26b1ac13a712ba4695 MS-CHAP2-Success = 0x08533d30373038453433324630343831443634383546343332304330413644313444373136354435413843 MS-CHAP-Domain = "\010STN" MS-Link-Utilization-Threshold = 50 MS-Link-Drop-Time-Limit = 120 [eap] Got reply 2

3 15

Re: EAP-TTLS Problem
by Milosh Droxy 16 Apr '11

16 Apr '11

Hi Something strange came up. after posting this, I tried it again one night, and strangely everything worked out just fine. (with the two Ubiquiti devices (http://www.ubnt.com/nanobridge) (one as AP and one as the client) and I wanted to be sure, so I tested it with a WRT120N Wireless router, and my laptop with ubuntu 10.10, worked OK again, I even tried it with my iPad and after confirming a certificate warning, it succeeded in connecting to the AP. So everything was ok I thought, but today when I wanted to run the test again, I got the same errors I got before >WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >WARNING: !! EAP session for state 0x829fae86829ebb1a did not finish! >WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility >WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! I thought maybe it's a time related issue for the certificates, so I set up a ntp server and sync the times and dates, but the WARNING showed up again. does this situation seem familiar to anybody? I'm helpless now! I didn't change ANYTHING! not before it was working fine, and not after, I just didn't use it for maybe about 2 weeks Here's the log when it was working fine. Thank you guys Milosh droxy Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.145 port 2048, id=0, length=138 User-Name = "test" NAS-Port = 0 Called-Station-Id = "00-15-6D-1C-A8-C5:TEST" Calling-Station-Id = "00-15-6D-1C-A8-D3" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x026700090174657374 Message-Authenticator = 0x966c9a3758421ff32156e186c61eb76e # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 103 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 10.10.10.145 port 2048 EAP-Message = 0x016800061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfed3ffabfebbeaab3449a6464e99ebae Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.145 port 2048, id=1, length=209 User-Name = "test" NAS-Port = 0 Called-Station-Id = "00-15-6D-1C-A8-C5:TEST" Calling-Station-Id = "00-15-6D-1C-A8-D3" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0268003e150016030100330100002f03014d9a098bf0978c355df4d62fa42b17d3cc0eeae6fc276fe6dff9b29393f367db000008002f000a000500040100 State = 0xfed3ffabfebbeaab3449a6464e99ebae Message-Authenticator = 0x4b1efe6eb985fe421236644cbdb113f5 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 104 length 62 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0033], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 02ad], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 10.10.10.145 port 2048 EAP-Message = 0x016902f41580000002ea160301002a0200002603014d9a098b3b9e8bb3deeb97793284e56d45d2323870a337d1f35cdf94c179278c00002f0016030102ad0b0002a90002a60002a33082029f30820208a003020102020107300d06092a864886f70d0101050500308188310b3009060355040613024952310f300d0603550408130654656872616e310f300d0603550407130654656872616e3111300f060355040a13084b69616e614e65743111300f060355040b1308576972656c657373310e300c0603550403130541646d696e3121301f06092a864886f70d010901161261646d696e406b69616e616e65742e6e6574301e170d31313033323931 EAP-Message = 0x30343634315a170d3132303332383130343634315a308188310b3009060355040613024952310f300d0603550408130654656872616e310f300d0603550407130654656872616e3111300f060355040a13084b69616e614e65743111300f060355040b1308576972656c657373310e300c0603550403130561646d696e3121301f06092a864886f70d010901161261646d696e406b69616e616e65742e6e657430819f300d06092a864886f70d010101050003818d0030818902818100b17583c61048d5da1d5fa392f432e3207d26738046b521ee303b4a79d49622e2317fc5e308cd43b47518c6a6b4af3f94657298ce34da415a2739e0fd8ac5ae3e EAP-Message = 0x9bf522f89a2a96ad3583c3c234403f0973a33910f788ead6bb7cd18b0979d3989168da37f8c4461267166b9239ef0fcb4ecc0dc113eb8872e1b91b7b9c1102e10203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100a8e736361a28260f8e1f2a42d670a642a5f3af562e2186cff8cda7e8ffa67e1a691dc014c48353514366a7c2932196a414344a707f9334607714793b599de63b5a17e5a3f437fc6a4d52d209e00593a6cfe55ac93f9c1d70f56f9e75b4a20ef8741810eb15d2ee57671e840bb8575ddc958f76e36d5ec69c9a35b760a2f17a9816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfed3ffabffbaeaab3449a6464e99ebae Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.145 port 2048, id=2, length=351 User-Name = "test" NAS-Port = 0 Called-Station-Id = "00-15-6D-1C-A8-C5:TEST" Calling-Station-Id = "00-15-6D-1C-A8-D3" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x026900cc1500160301008610000082008025a0c342d0e03d47cb83602f52d86a1abb8815964c220e763f7fdc7a34c46837658aaee06710e87e2f3de0d787291be6766a76dbb3fcf9285ad86f3e7b558234e7645f1804a955538e58b2e3db10af4cf80c3bd3d8f20d465cf8982bcec8e7ac844c6a1474295376f003cb9ed7c056319b9cccf830ecff5591a1e62b3174ac0f1403010001011603010030a4355f74e35bdfc0c09c3c285e5df2cf789ba51763df8e3dccc78c057614106aa975e5f63ad0f70f38d16bea623310df State = 0xfed3ffabffbaeaab3449a6464e99ebae Message-Authenticator = 0xdf7a9d7fffbfbbc12e23d0aedccc657e # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 105 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 10.10.10.145 port 2048 EAP-Message = 0x016a004515800000003b1403010001011603010030515c28dbb9af01c5df68db5c9a79160a7bb650284637d9ad7aee4db1e2d7ef9f94f84dba9b6551dad2a422e0ebe39b61 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfed3ffabfcb9eaab3449a6464e99ebae Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.145 port 2048, id=3, length=286 User-Name = "test" NAS-Port = 0 Called-Station-Id = "00-15-6D-1C-A8-C5:TEST" Calling-Station-Id = "00-15-6D-1C-A8-D3" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x026a008b15001703010080db0fe23fd8479d2c92cb1c1ae0ccea708a4822cb2a37ea0648890d1b813e64e1a1875c8f5147c2621e0a325f2eba540a622567f058a8d27923a91df622869b617677fb0ed76e24d4e5ee4eb9da78d4367d7f121593b04d66577734f3a839f3b15ae2b56160224a9078a614f50c6f0b18129384b48d95dc93cf9119c1da2960d0 State = 0xfed3ffabfcb9eaab3449a6464e99ebae Message-Authenticator = 0x9366d77282650efe70a69d65f9dfc957 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 106 length 139 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "test" MS-CHAP-Challenge = 0xf35244302cde5941bf59400d3db2610b MS-CHAP2-Response = 0xd50025cd28a00db1f559c2571e91efcba6fb00000000000000007f75cc7e81573e9f3de6fc54397693cea0dd3458dce84b8f FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "test" MS-CHAP-Challenge = 0xf35244302cde5941bf59400d3db2610b MS-CHAP2-Response = 0xd50025cd28a00db1f559c2571e91efcba6fb00000000000000007f75cc7e81573e9f3de6fc54397693cea0dd3458dce84b8f FreeRADIUS-Proxied-To = 127.0.0.1 server { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: test [mschap] Told to do MS-CHAPv2 for test with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop } # server [ttls] Got tunneled reply code 2 MS-CHAP2-Success = 0xd5533d43383734464446363634433839434441413845314345323846423435433331313431394139313337 MS-MPPE-Recv-Key = 0x3ea88b59cb73a3001d3ee04ac5dab228 MS-MPPE-Send-Key = 0x64126ac7c2ec499c8f52925316357c84 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 [ttls] Got tunneled Access-Accept [ttls] Got MS-CHAP2-Success, tunneling it to the client in a challenge. ++[eap] returns handled Sending Access-Challenge of id 3 to 10.10.10.145 port 2048 EAP-Message = 0x016b005f1580000000551703010050f2fa45a56374155384f5693a65a4375b1f1557f4569f084c1bcd9be825add2c16dd4e50a02e21ef0b15f2d3ac7268bfa4f5be0dbecaacf063376ca4591b2f5bff75228372ca28baf2f7ba8019cb419d5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfed3ffabfdb8eaab3449a6464e99ebae Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.145 port 2048, id=4, length=153 User-Name = "test" NAS-Port = 0 Called-Station-Id = "00-15-6D-1C-A8-C5:TEST" Calling-Station-Id = "00-15-6D-1C-A8-D3" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x026b00061500 State = 0xfed3ffabfdb8eaab3449a6464e99ebae Message-Authenticator = 0x65aa0dd598e522b5a35c067571ac497c # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 107 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake is finished [ttls] eaptls_verify returned 3 [ttls] eaptls_process returned 3 [ttls] Using saved attributes from the original Access-Accept [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 4 to 10.10.10.145 port 2048 MS-MPPE-Recv-Key = 0x597a4ceb752b01e71e733ddebf986d224906a62e975163479148f1f185a4dbee MS-MPPE-Send-Key = 0x3c7bbc2bea16305f5d1bcc22f9bd795fe6e50571d9ebf90939949d0bea7bcf2d EAP-Message = 0x036b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" Finished request 4. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +5 Cleaning up request 1 ID 1 with timestamp +5 Cleaning up request 2 ID 2 with timestamp +5 Cleaning up request 3 ID 3 with timestamp +5 Cleaning up request 4 ID 4 with timestamp +5 Ready to process requests. > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. EAP-TTLS Problem (Milosh Droxy) > > > ------------------------------ ---------------------------------------- > > Message: 1 > Date: Tue, 29 Mar 2011 16:10:41 +0430 > From: Milosh Droxy <droxy.net(a)gmail.com> > Subject: EAP-TTLS Problem > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <AANLkTim1pbcg7w30RLQj-iMTW7BTVCxtHGN_Nc3xS6Rm(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi > > ok, I've been searching and testing for about a week now. I'm quite sure > I've read almost every topic related to my problem on this mailing-list and > others. and I was afraid to ask for help because I've never posted on a > mailing list or a forum and I was really afraid of Alan DeKoK. > The Problem: > I'm trying to use Freeradius to authenticate users using EAP-TTLS MSCHAP, > with no success. > I use "FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu". on a > Ubuntu 10.04 64bit Server. > I've used these devices as clients > two Ubiquiti devices (http://www.ubnt.com/nanobridge) (one as AP and one > as > client) > A TP-Link TL-WR542G as AP and my laptop (running ubuntu 10.10) as client. > (and an iPad) > (There were NO Windows XP in any of my tests, so it's not a Microsoft > issue) > > and I've used eapol_test, with successful results, the problem only shows > when I try to authenticate remotely. since the eapol_test results were fine > I wont post the output here. (or should I ?) > > and here is the output for when I try to authenticate remotely (the output > is exactly the same with any combination I've tried) >

1 0

Apply Exception in Accounting Packets
by Nasser Heidari 16 Apr '11

16 Apr '11

Hello, Is it possible to NOT count Accounting packets (Input/Output) from a user to special destination? (I don't want to charge a PPPOE User who downloads a file from local Network.) I know that FreeRadius just uses the information that NAS have sent, but want to know that does anybody has any idea? Regards, Nasser

2 1

error on SQL HOWTO page
by Rich Reamer 15 Apr '11

15 Apr '11

Hello All, the SQL HOWTO page at: http://wiki.freeradius.org/SQL_HOWTO Has an is incorrect instruction. where it says: Your radiusd.conf should then look something like this: it should be: Your "default" file should then look something like this: Thanks, Rich -- Using Opera's revolutionary email client: http://www.opera.com/mail/

1 0

MAC Address and Username Binding on FreeRADIUS
by syharash 15 Apr '11

15 Apr '11

Hi, My FreeRadius is working fine, my wireless clients are able to authenticate with username and password from the /etc/raddb/users file and dynamic vlan assignment is working fine too. Need to now configure to restrict a user to get authenticated only from a single mac address, so the dynamic vlan assignment is restricted to that user only from its authorized mac address. Please help. I tried following the How-to guide but have not been able to get it working. please help. I have attached my configuration files for your reference, please let me know if how to go about doing it. http://freeradius.1045715.n5.nabble.com/file/n4297874/authorize_macs authorize_macs http://freeradius.1045715.n5.nabble.com/file/n4297874/default%5Bsites-avail… default%5Bsites-available%5D http://freeradius.1045715.n5.nabble.com/file/n4297874/eap.conf eap.conf http://freeradius.1045715.n5.nabble.com/file/n4297874/files files http://freeradius.1045715.n5.nabble.com/file/n4297874/policy.conf policy.conf http://freeradius.1045715.n5.nabble.com/file/n4297874/radiusd.conf radiusd.conf http://freeradius.1045715.n5.nabble.com/file/n4297874/users users -- View this message in context: http://freeradius.1045715.n5.nabble.com/MAC-Address-and-Username-Binding-on… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

How can I limit the maximum number of simultaneous logins on a per-user basis?
by Götz Reinicke - IT-Koordinator 15 Apr '11

15 Apr '11

Hi, I do have a basic understanding of Freeradius. We have a cisco wlan controller and an open ldap server working together with our freeradius server. (Users can authenticate and can accesss our wlan) Now, we'd like to limit the maximum number of simultaneous logins on a per-user and I saw some information, that that should be possible. But how? Where to start? Thanks for any hint to the doc or some examples! Best regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

2 2

SQL results going ... wrong
by Stefan Winter 15 Apr '11

15 Apr '11

Hi, I'm just implementing a new virtual server with a slightly complex query and sizable result set coming back in radreply. The query goes out as expected, and the MySQL reply is well-formed and looks as expected in wireshark when it comes back. But the debug output is ... interesting: Thu Apr 14 15:43:07 2011 : Info: [sql-aai] User found in radcheck table Thu Apr 14 15:43:07 2011 : Info: [sql-aai] expand: SELECT * FROM reply_aai_firstname WHERE username='%{SQL-User-Name}' UNION ALL SELECT * FROM reply_aai_lastname WHERE username='%{SQL-User-Name}' UNION ALL SELECT * FROM reply_aai_mail WHERE username='%{SQL-User-Name}' UNION ALL SELECT * FROM reply_aai_eduPersonAffiliation WHERE username='%{SQL-User-Name}' -> SELECT * FROM reply_aai_firstname WHERE username='swinter' UNION ALL SELECT * FROM reply_aai_lastname WHERE username='swinter' UNION ALL SELECT * FROM reply_aai_mail WHERE username='swinter' UNION ALL SELECT * FROM reply_aai_eduPersonAffiliation WHERE username='swinter' Thu Apr 14 15:43:07 2011 : Error: rlm_sql: Invalid operator "?x�{?(�{?@�{?D�{?<�{?D�{?Z�{?]�{?v�{?swinter" for attribute += Thu Apr 14 15:43:07 2011 : Error: rlm_sql (sql-aai): Error getting data from database Thu Apr 14 15:43:07 2011 : Error: [sql-aai] SQL query error; rejecting user Something looks like accessing memory where it better shouldn't. If I execute the xlated query on the MySQL server directly, the result looks beautiful: +----------+-----------------------+----+----------------------------------------------------------------+ | username | attribute | op | value | +----------+-----------------------+----+----------------------------------------------------------------+ | swinter | RESTENA-AAI-Attribute | += | urn:oid:2.5.4.42='Stefan' | | swinter | RESTENA-AAI-Attribute | += | urn:oid:2.5.4.4='Winter' | | swinter | RESTENA-AAI-Attribute | += | urn:oid:0.9.2342.19200300.100.1.3='stefan.winter(a)education.lu' | | swinter | RESTENA-AAI-Attribute | += | urn:oid:1.3.6.1.4.1.5923.1.1.1.1='member' | +----------+-----------------------+----+----------------------------------------------------------------+ So it must go wrong somewhere in the server. That same server executes many many other SQL queries of the radcheck style without issues. This is the first time I'm using a radreply query though. Version is 2.1.10. mysql client lib is so old I'm too ashamed to tell here. So... any known badnesses in MySQL/radreply? Anything I should do (besides updating mysql client libs, which has right now popped near the top of my TODO list)? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 4

Can FreeRadius connect to ACT! database?
by Jim Rice 14 Apr '11

14 Apr '11

I've been tinkering with dialup_admin and MySQL with FR 2.1.10. I have been able to get it to work for doing MAC authentication of Motorola Canopy SM's. The problem is that the customer database is hosted on Windows using ACT! It already contains the user account info, radio type, MAC address, and specified rate limits. A couple of choices: 1. Duplicate much of the data from ACT! and populate the MySQL database, then forever perform dual maintenance manually. 2. Use the ACT! SDK to develop a custom add-on to update the Radius database, or to write to flat files and copy them over (yuk.) (or hopefully): 3. Have Radius query the ACT! database directly? Is there an ODBC that can be made to work here? (At this point, I could care less about accounting.) I just need a simple MAC address lookup, and an Accept reply with a few attributes. I'd consider choice #4 if someone knows of one ... Thanks, Jim

3 4

how to send wifi connection attributes.
by Ramon Escriba 14 Apr '11

14 Apr '11

Hi all, I've a mac authentication schema working. Now I want to add 802.1x Eap+Mschapv2 for WiFI/Wire. We're using Aruba's AP. Aruba it's very peculiar, it extends an aruba-ap vlan between the controller & the AP's. The other configured vlans are secure tunnels inside this "aruba-ap" vlan. Our Aruba wifi has 2 main vlans, one for data the other for voip (alias SSID wifidata & wifivoip) with diff QoS. The test user "aaa" authentication it's correct, but I'm still not able to send to my aruba controller the vlan the authenticated user should be attach too. So to wifidata with a laptop, but to wifivoip with a mobile. I do cheat adding to the test user "aaa" a pair of radiusReplyItem attributes: Aruba-User-Vlan = 4000 Aruba-User-Role = "authenticated" The cheat works: (....) ++[exec] returns noop Sending Access-Accept of id 166 to 84.89.232.250 port 32834 Tunnel-Private-Group-Id:0 = "X1" Aruba-User-Vlan = 4000 Aruba-User-Role = "authenticated" User-Name = "aaa" MS-MPPE-Recv-Key = 0x634d9e2f148f2484671e78e939bb4a9661ac05f1f242a016e9b16458538d6632 MS-MPPE-Send-Key = 0x24d48bb9ce204be409131d3dd3226c4bb7bee7805c5dd006b25e2f9d0faca881 EAP-Message = 0x03260004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 55. (...) But without the cheat, does not. It connects correctly to the wifi, but as is attached to an incorrect vlan ,in our case the aruba-ap vlan, it does not get a correct ip from our dhcp. (.....) Sending Access-Accept of id 121 to 84.89.232.250 port 32834 Tunnel-Private-Group-Id:0 = "X1" User-Name = "aaa" MS-MPPE-Recv-Key = 0x6859e312650c6232d0b20930eba797e110036da56fb710248c676ba5558e05e0 MS-MPPE-Send-Key = 0x3520313eb26c8f00f9a4d561aa183cc3991d38dd89d43322ad32a80437f172d9 EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 10. Going to the next request The problem is one user "aaa" may be able to connect to wifidata & wifivoip with diferent devices (laptop / mobile). Any clue? Where should I force the radiusReplyItem ??? Regards.

1 1