- Freeradius-Users - lists.freeradius.org

FREE RADIUS client
by karnik jain 08 Feb '11

08 Feb '11

Hi, Can any one tell me that FREE RADIUS client is inernally doing UTF-8 conversion for the multilingual characters or It is replying on some other underlying module who is suppling credentials like username and password? Regards, Karnik Jain

3 5

Proxy Maintenance Process
by Brian Carpio 08 Feb '11

08 Feb '11

Hi All, Currently we are using freeradiusd to proxy / load balance requests to our backend radius application. However as I'm sure many of you encounter there are times which require maintenance / upgrades of the backend servers, what is the "best practice" in regards to putting home_servers into maintenance so that freeradiusd doesn't attempt to send traffic to them? I'm not sure if there is a simple command we can run? Or is the only option to comment out the home_server from the home_server_pool and then kill -1 to the radiusd process? Brian Carpio

5 9

Re: strategy question
by localhero＠mac.hush.com 07 Feb '11

07 Feb '11

I think there will be Group Policies in place. -lh On Mon, 07 Feb 2011 20:48:08 +0100 Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> wrote: >Hi, > >> In a project with some larger customer sites 802.1x >authentication >> shall be introduced. There are about 10 sites with roughly 500 >> employees each. >> It is expected that at least 5 to 10% of the pc may cause >problems >> when 802.1x authentication is activated. To identify those pc in > >> advance the idea is, to have the switches ask the freeradius >server >> for authentication. For two weeks or so the radius shall accept >all >> the requests, even if they fail because of invalid certificates. > >> The failure shall be reported. During this time the operating >staff >> may solve the problems with the pc. After that period the >problems >> are hopefully solved and the radius shall do "real" >authentication. >> >> Is this a idea that makes sense? >> Are there technical restictions that would avoid such an >approach > >it seems a fairly sensible approach to migration into an 802.1X >world - >I guess your guest/failed VLAN will be just the same as the normal >VLAN that real clients will go onto? (we were one of the sites to >ask cisco to reverse their decision that a failed VLAN - ie where >802.1X was attempted but failed - should be an operative VLAN >rather >than marked as some for of malicious attack). > >how are you going to go about configuring the PCs - GPO can be >used >to push out the setting if they are corporate/in ActiveDirectory > >alan >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

1 0

RE: strategy question
by localhero＠mac.hush.com 07 Feb '11

07 Feb '11

On Mon, 07 Feb 2011 20:44:37 +0100 Gary Gatten <Ggatten(a)waddell.com> wrote: >Makes sense to me. Will you be using MAC Auth Bypass for printers >and other "dumb" devices? Yes. -lh > >-----Original Message----- >From: freeradius-users- >bounces+ggatten=waddell.com(a)lists.freeradius.org >[mailto:freeradius-users- >bounces+ggatten=waddell.com(a)lists.freeradius.org] On Behalf Of >localhero(a)mac.hush.com >Sent: Monday, February 07, 2011 1:08 PM >To: freeradius-users(a)lists.freeradius.org >Subject: strategy question > >In a project with some larger customer sites 802.1x authentication > >shall be introduced. There are about 10 sites with roughly 500 >employees each. >It is expected that at least 5 to 10% of the pc may cause problems > >when 802.1x authentication is activated. To identify those pc in >advance the idea is, to have the switches ask the freeradius >server >for authentication. For two weeks or so the radius shall accept >all >the requests, even if they fail because of invalid certificates. >The failure shall be reported. During this time the operating >staff >may solve the problems with the pc. After that period the problems > >are hopefully solved and the radius shall do "real" >authentication. > >Is this a idea that makes sense? >Are there technical restictions that would avoid such an approach > >-lh > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > > > > > ><font size="1"> ><div style='border:none;border-bottom:double windowtext >2.25pt;padding:0in 0in 1.0pt 0in'> ></div> >"This email is intended to be reviewed by only the intended >recipient > and may contain information that is privileged and/or >confidential. > If you are not the intended recipient, you are hereby notified >that > any review, use, dissemination, disclosure or copying of this >email > and its attachments, if any, is strictly prohibited. If you have > received this email in error, please immediately notify the >sender by > return email and delete this email from your system." ></font> > > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

1 0

Possible typo in share/dictionary.dhcp
by Alexander Shikoff 07 Feb '11

07 Feb '11

Hello, if take a look on line 358 of share/dictionary.dhcp you may notice '=': VALUE DHCP-Parameter-Request-List DHCP-Keep-Alive-Interval 38 VALUE DHCP-Parameter-Request-List DHCP-Keep=Alive-Garbage 39 Is it possible typo? -- MINO-RIPE

3 3

issue with dialup.conf
by Tyller D 07 Feb '11

07 Feb '11

Hi I am having an issue, which may be the way I changed the dialup.conf or maybe its my logic. This is what I have done & am trying to achieve. freeradius is used to authenticate users at our hotspots, as we are using different nas devices and we must cater for them all i did this. in dictionary file I added an attribute called databank, then I created a perl script to check which type of nas the user is coming from and renaming databank to the correct attribute, now that works fine. Then on the stop request I need to update the value associated to databank to be (databank - (acctinputoctets+acctoutputoctets)). that way limiting users to only as much "data" as we stipulated in the begining. my problem is that it doesn't always update the databank value, I can see how much traffic a users used in his session (i.e. in the radacct table) so the accounting_stop_query & accounting_stop_query_alt are not failing, its just not updating the databank value in radcheck. here are the two queries accounting_stop_query = " \ UPDATE radacct,radcheck SET \ radacct.acctstoptime = '%S', \ radacct.acctsessiontime = '%{Acct-Session-Time}', \ radacct.acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ '%{%{Acct-Input-Octets}:-0}', \ radacct.acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ '%{%{Acct-Output-Octets}:-0}', \ radacct.acctterminatecause = '%{Acct-Terminate-Cause}', \ radcheck.value = radcheck.value - '%{Acct-Output-Octets}' - '%{Acct-Input-Octets}', \ radacct.acctstopdelay = '%{%{Acct-Delay-Time}:-0}', \ radacct.connectinfo_stop = '%{Connect-Info}' \ WHERE radacct.acctsessionid = '%{Acct-Session-Id}' \ AND radcheck.username = '%{SQL-User-Name}' \ AND radcheck.attribute = 'databank' \ AND radacct.username = '%{SQL-User-Name}' \ AND radacct.nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " \ UPDATE radacct,radcheck SET \ radacct.acctstoptime = '%S', \ radacct.acctsessiontime = '%{Acct-Session-Time}', \ radacct.acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ '%{%{Acct-Input-Octets}:-0}', \ radacct.acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ '%{%{Acct-Output-Octets}:-0}', \ radacct.acctterminatecause = '%{Acct-Terminate-Cause}', \ radacct.acctstopdelay = '%{%{Acct-Delay-Time}:-0}', \ radacct.connectinfo_stop = '%{Connect-Info}', \ radcheck.value = radcheck.value - '%{Acct-Output-Octets}' - '%{Acct-Input-Octets}' \ WHERE radacct.acctsessionid = '%{Acct-Session-Id}' \ AND radacct.username = '%{SQL-User-Name}' \ AND radacct.nasipaddress = '%{NAS-IP-Address}' \ AND radcheck.username = '%{SQL-User-Name}' \ AND radcheck.attribute = 'databank'" does anyone know how this can happen? could it be something to do with interim-updates (grasping at straws here). any help would be great. Thanks

3 12

Can't authenticate using LDAP (ldap+mysql+eap_ttls)
by Edgaras 07 Feb '11

07 Feb '11

Hello, I have configured freeradius (testing server) to try to authenticate using LDAP and if a user is not found in LDAP database, then try SQL. If I try authenticate using user found in SQL database - I get authorizated, authenticated and connected. But if I try authenticate as a user found in LDAP database - authentication fails in inner tunnel: server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test.user", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 6 length 79 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] performing user authorization for test.user [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> test.user [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=test.user) [ldap] expand: ou=Users, dc=xxxxxx, dc=lt -> ou=Users, dc=xxxxxx, dc=lt [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Users, dc=xxxxxx, dc=lt, with filter (uid=test.user) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user test.user authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++? if (notfound) ? Evaluating (notfound) -> FALSE ++? if (notfound) -> FALSE ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for test.user with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel *It says "Found Auth-Type = EAP" although in sites-enabled/inner-tunnel I have uncommented: Auth-Type LDAP { ldap } By the way, if I try to autnenticate using same user via radtest server, of course, don't go into the inner-tunnel and so I get authenticated. I'm adding full radius log. Thanks.

2 2

radius authentication support for telnet server.
by vijay s sheelavantar 07 Feb '11

07 Feb '11

Thank you very very much Mr.Fajar. After making changes in /etc/pam.d/login it's working. authentication request is coming to freeradius server and authentication is successful. :)I need one more help, Please let me know the configuration file for FTP alo. i have crated a wu-ftpd file inside /etc/pam.d/ but it is not working. Thanks & Regards,Vijay S.

2 1

Re: radius authentication support for telnet server.
by vijay s sheelavantar 07 Feb '11

07 Feb '11

Thank you very very much Mr.Fajar. After making changes in /etc/pam.d/login it's working. authentication request is coming to freeradius server and authentication is successful. :) Thanks & Regards,Vijay S.

1 0

Problem ms-chapv2
by Влад Власов 07 Feb '11

07 Feb '11

Hello.Please help me.I try to setup FreeRadius (FreeBSD 7.2-RELEASE amd64)to setup as proxy.Windows clients can`t connect this default settings in pppoe connection (on tab security enabled all auth protocols) server send 691 error.If i disable all protocols except mschapv1 everything works fine without errors. Please tell me what I am doing wrong.All settings in the conf files by default, changed only proxy.conf and client.conf. I tried 2.1.10 ,2.1.9 versions. ----------------------------------------Auth Fail --------------------------------------------------------------------- rad_recv: Access-Request packet from host 127.0.0.1 port 61233, id=68, length=277 NAS-Identifier = "PPPoE.mk.loc" NAS-IP-Address = 172.20.192.4 Message-Authenticator = 0x33297e1e26330d6c0df04a4b015b446c Acct-Session-Id = "7056520-TA233-3766-144" NAS-Port = 144 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022687293f7" NAS-Port-Id = "vlan3766" Vendor-12341-Attr-12 = 0x54413233332d333736362d313434 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:22:68:72:93:f7" User-Name = "test-user@moco" MS-CHAP-Challenge = 0xbb1e68bfac6b679afbba56b6670fde86 MS-CHAP2-Response = 0x0100a945a3ba1dad2b9d2e95511c58f8464a0000000000000000aab387818928b6f430030d50fc68517c64c578458737b561 Mon Feb 7 10:28:40 2011 : Info: +- entering group authorize {...} Mon Feb 7 10:28:40 2011 : Info: ++[preprocess] returns ok Mon Feb 7 10:28:40 2011 : Info: ++[chap] returns noop Mon Feb 7 10:28:40 2011 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Mon Feb 7 10:28:40 2011 : Info: ++[mschap] returns ok Mon Feb 7 10:28:40 2011 : Info: ++[digest] returns noop Mon Feb 7 10:28:40 2011 : Info: [suffix] Looking up realm "moco" for User-Name = "test-user@moco" Mon Feb 7 10:28:40 2011 : Info: [suffix] Found realm "moco" Mon Feb 7 10:28:40 2011 : Info: [suffix] Adding Stripped-User-Name = "test-user" Mon Feb 7 10:28:40 2011 : Info: [suffix] Adding Realm = "moco" Mon Feb 7 10:28:40 2011 : Info: [suffix] Proxying request from user test-user to realm moco Mon Feb 7 10:28:40 2011 : Info: [suffix] Preparing to proxy authentication request to realm "moco" Mon Feb 7 10:28:40 2011 : Info: ++[suffix] returns updated Mon Feb 7 10:28:40 2011 : Info: [eap] No EAP-Message, not doing EAP Mon Feb 7 10:28:40 2011 : Info: ++[eap] returns noop Mon Feb 7 10:28:40 2011 : Info: [files] users: Matched entry DEFAULT at line 172 Mon Feb 7 10:28:40 2011 : Info: ++[files] returns ok Mon Feb 7 10:28:40 2011 : Info: ++[expiration] returns noop Mon Feb 7 10:28:40 2011 : Info: ++[logintime] returns noop Mon Feb 7 10:28:40 2011 : Info: ++[pap] returns noop Mon Feb 7 10:28:40 2011 : Info: WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 255 to 172.20.192.19 port 1812 NAS-Identifier = "PPPoE.mk.loc" NAS-IP-Address = 172.20.192.4 Message-Authenticator = 0x00000000000000000000000000000000 Acct-Session-Id = "7056520-TA233-3766-144" NAS-Port = 144 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022687293f7" NAS-Port-Id = "vlan3766" Vendor-12341-Attr-12 = 0x54413233332d333736362d313434 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:22:68:72:93:f7" User-Name = "test-user" MS-CHAP-Challenge = 0xbb1e68bfac6b679afbba56b6670fde86 MS-CHAP2-Response = 0x0100a945a3ba1dad2b9d2e95511c58f8464a0000000000000000aab387818928b6f430030d50fc68517c64c578458737b561 Proxy-State = 0x3638 Mon Feb 7 10:28:40 2011 : Info: Proxying request 65 to home server 172.20.192.19 port 1812 Sending Access-Request of id 255 to 172.20.192.19 port 1812 NAS-Identifier = "PPPoE.mk.loc" NAS-IP-Address = 172.20.192.4 Message-Authenticator = 0x00000000000000000000000000000000 Acct-Session-Id = "7056520-TA233-3766-144" NAS-Port = 144 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022687293f7" NAS-Port-Id = "vlan3766" Vendor-12341-Attr-12 = 0x54413233332d333736362d313434 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:22:68:72:93:f7" User-Name = "test-user" MS-CHAP-Challenge = 0xbb1e68bfac6b679afbba56b6670fde86 MS-CHAP2-Response = 0x0100a945a3ba1dad2b9d2e95511c58f8464a0000000000000000aab387818928b6f430030d50fc68517c64c578458737b561 Proxy-State = 0x3638 Mon Feb 7 10:28:40 2011 : Debug: Going to the next request Mon Feb 7 10:28:40 2011 : Debug: Waking up in 0.4 seconds. rad_recv: Access-Reject packet from host 172.20.192.19 port 1812, id=255, length=43 Reply-Message = "Authorization failed." Mon Feb 7 10:28:40 2011 : Info: +- entering group post-proxy {...} Mon Feb 7 10:28:40 2011 : Info: [eap] No pre-existing handler found Mon Feb 7 10:28:40 2011 : Info: ++[eap] returns noop Mon Feb 7 10:28:40 2011 : Auth: Login incorrect (Home Server says so): [test-user/<via Auth-Type = mschap>] (from client localhost port 144 cli 0022687293f7) Mon Feb 7 10:28:40 2011 : Info: Using Post-Auth-Type Reject Mon Feb 7 10:28:40 2011 : Info: +- entering group REJECT {...} Mon Feb 7 10:28:40 2011 : Info: [attr_filter.access_reject] expand: %{User-Name} -> test-user@moco Mon Feb 7 10:28:40 2011 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Feb 7 10:28:40 2011 : Info: ++[attr_filter.access_reject] returns updated Mon Feb 7 10:28:40 2011 : Info: Delaying reject of request 65 for 1 seconds Mon Feb 7 10:28:40 2011 : Debug: Going to the next request Mon Feb 7 10:28:40 2011 : Debug: Waking up in 0.4 seconds. ---------------------------------------------------------------------------Auth OK---------------------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 127.0.0.1 port 51279, id=215, length=269 NAS-Identifier = "PPPoE.mk.loc" NAS-IP-Address = 172.20.192.4 Message-Authenticator = 0x539b02bddfa871d7d243e10a9f9a5446 Acct-Session-Id = "7057178-TA233-3766-393" NAS-Port = 393 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022687293f7" NAS-Port-Id = "vlan3766" Vendor-12341-Attr-12 = 0x54413233332d333736362d333933 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:22:68:72:93:f7" User-Name = "test-user@moco" MS-CHAP-Challenge = 0xbb1e68f8719180f3 MS-CHAP-Response = 0x0101000000000000000000000000000000000000000000000000d31328621ef9a79e6c1967d3fe23b98a82f34c9603465d55 Mon Feb 7 10:39:38 2011 : Info: +- entering group authorize {...} Mon Feb 7 10:39:38 2011 : Info: ++[preprocess] returns ok Mon Feb 7 10:39:38 2011 : Info: ++[chap] returns noop Mon Feb 7 10:39:38 2011 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Mon Feb 7 10:39:38 2011 : Info: ++[mschap] returns ok Mon Feb 7 10:39:38 2011 : Info: ++[digest] returns noop Mon Feb 7 10:39:38 2011 : Info: [suffix] Looking up realm "moco" for User-Name = "test-user@moco" Mon Feb 7 10:39:38 2011 : Info: [suffix] Found realm "moco" Mon Feb 7 10:39:38 2011 : Info: [suffix] Adding Stripped-User-Name = "test-user" Mon Feb 7 10:39:38 2011 : Info: [suffix] Adding Realm = "moco" Mon Feb 7 10:39:38 2011 : Info: [suffix] Proxying request from user test-user to realm moco Mon Feb 7 10:39:38 2011 : Info: [suffix] Preparing to proxy authentication request to realm "moco" Mon Feb 7 10:39:38 2011 : Info: ++[suffix] returns updated Mon Feb 7 10:39:38 2011 : Info: [eap] No EAP-Message, not doing EAP Mon Feb 7 10:39:38 2011 : Info: ++[eap] returns noop Mon Feb 7 10:39:38 2011 : Info: [files] users: Matched entry DEFAULT at line 172 Mon Feb 7 10:39:38 2011 : Info: ++[files] returns ok Mon Feb 7 10:39:38 2011 : Info: ++[expiration] returns noop Mon Feb 7 10:39:38 2011 : Info: ++[logintime] returns noop Mon Feb 7 10:39:38 2011 : Info: ++[pap] returns noop Mon Feb 7 10:39:38 2011 : Info: WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 132 to 172.20.192.19 port 1812 NAS-Identifier = "PPPoE.mk.loc" NAS-IP-Address = 172.20.192.4 Message-Authenticator = 0x00000000000000000000000000000000 Acct-Session-Id = "7057178-TA233-3766-393" NAS-Port = 393 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022687293f7" NAS-Port-Id = "vlan3766" Vendor-12341-Attr-12 = 0x54413233332d333736362d333933 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:22:68:72:93:f7" User-Name = "test-user" MS-CHAP-Challenge = 0xbb1e68f8719180f3 MS-CHAP-Response = 0x0101000000000000000000000000000000000000000000000000d31328621ef9a79e6c1967d3fe23b98a82f34c9603465d55 Proxy-State = 0x323135 Mon Feb 7 10:39:38 2011 : Info: Proxying request 24 to home server 172.20.192.19 port 1812 Sending Access-Request of id 132 to 172.20.192.19 port 1812 NAS-Identifier = "PPPoE.mk.loc" NAS-IP-Address = 172.20.192.4 Message-Authenticator = 0x00000000000000000000000000000000 Acct-Session-Id = "7057178-TA233-3766-393" NAS-Port = 393 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022687293f7" NAS-Port-Id = "vlan3766" Vendor-12341-Attr-12 = 0x54413233332d333736362d333933 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:22:68:72:93:f7" User-Name = "test-user" MS-CHAP-Challenge = 0xbb1e68f8719180f3 MS-CHAP-Response = 0x0101000000000000000000000000000000000000000000000000d31328621ef9a79e6c1967d3fe23b98a82f34c9603465d55 Proxy-State = 0x323135 Mon Feb 7 10:39:38 2011 : Debug: Going to the next request Mon Feb 7 10:39:38 2011 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 172.20.192.19 port 1812, id=132, length=703 Service-Type = Framed-User Framed-Protocol = PPP Session-Timeout = 864000 Acct-Interim-Interval = 180 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-CHAP-MPPE-Keys = 0x2e6b0d1ca7472bb173f893b5365eb36218b1a3efe287dd370000000000000000 Vendor-12341-Attr-6 = 0x38392e3233362e3139322e302f3138 Vendor-12341-Attr-6 = 0x38312e39352e3232342e302f3230 Vendor-12341-Attr-6 = 0x38392e3134362e36342e302f3138 Vendor-12341-Attr-6 = 0x38322e3231352e36342e302f3138 Vendor-12341-Attr-6 = 0x38332e36392e3132382e302f3139 Vendor-12341-Attr-6 = 0x38332e3232312e3136312e302f3234 Vendor-12341-Attr-6 = 0x38332e3232312e3136302e302f3139 Vendor-12341-Attr-6 = 0x3231372e32392e3131322e302f3230 Vendor-12341-Attr-6 = 0x38342e35342e36342e302f3138 Vendor-12341-Attr-6 = 0x38352e3131372e3232342e302f3139 Vendor-12341-Attr-6 = 0x38372e3233372e3233322e302f3231 Vendor-12341-Attr-6 = 0x39312e3138382e3132382e302f3139 Vendor-12341-Attr-6 = 0x39312e3139362e37362e302f3232 Vendor-12341-Attr-6 = 0x3231332e3230362e33322e302f3139 Vendor-12341-Attr-6 = 0x3231372e31322e38302e302f3230 Vendor-12341-Attr-6 = 0x3139352e3135382e302e302f3139 Vendor-12341-Attr-6 = 0x3139332e32372e3230362e302f3233 Vendor-12341-Attr-6 = 0x37372e3232302e3139322e302f3139 Vendor-12341-Attr-6 = 0x38302e38302e3230382e302f3230 Vendor-12341-Attr-6 = 0x3231332e3233302e36342e302f3138 Vendor-12341-Attr-6 = 0x39312e3230342e3233362e302f3232 Vendor-12341-Attr-6 = 0x36322e3230392e3132382e302f3230 Vendor-12341-Attr-7 = 0x696e23313d616c6c20726174652d6c696d697420313032343030302031323830303020313238303030 Vendor-12341-Attr-7 = 0x6f757423313d616c6c20726174652d6c696d697420313032343030302031323830303020313238303030 Mon Feb 7 10:39:38 2011 : Info: +- entering group post-proxy {...} Mon Feb 7 10:39:38 2011 : Info: [eap] No pre-existing handler found Mon Feb 7 10:39:38 2011 : Info: ++[eap] returns noop Mon Feb 7 10:39:38 2011 : Info: Found Auth-Type = MSCHAP Mon Feb 7 10:39:38 2011 : Info: Found Auth-Type = Accept Mon Feb 7 10:39:38 2011 : Error: Warning: Found 2 auth-types on request for user 'test-user' Mon Feb 7 10:39:38 2011 : Info: Auth-Type = Accept, accepting the user Mon Feb 7 10:39:38 2011 : Auth: Login OK: [test-user/<via Auth-Type = mschap>] (from client localhost port 393 cli 0022687293f7) Mon Feb 7 10:39:38 2011 : Info: +- entering group post-auth {...} Mon Feb 7 10:39:38 2011 : Info: ++[exec] returns noop Sending Access-Accept of id 215 to 127.0.0.1 port 51279 Service-Type = Framed-User Framed-Protocol = PPP Session-Timeout = 864000 Acct-Interim-Interval = 180 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-CHAP-MPPE-Keys = 0x2e6b0d1ca7472bb173f893b5365eb36218b1a3efe287dd370000000000000000 Vendor-12341-Attr-6 = 0x38392e3233362e3139322e302f3138 Vendor-12341-Attr-6 = 0x38312e39352e3232342e302f3230 Vendor-12341-Attr-6 = 0x38392e3134362e36342e302f3138 Vendor-12341-Attr-6 = 0x38322e3231352e36342e302f3138 Vendor-12341-Attr-6 = 0x38332e36392e3132382e302f3139 Vendor-12341-Attr-6 = 0x38332e3232312e3136312e302f3234 Vendor-12341-Attr-6 = 0x38332e3232312e3136302e302f3139 Vendor-12341-Attr-6 = 0x3231372e32392e3131322e302f3230 Vendor-12341-Attr-6 = 0x38342e35342e36342e302f3138 Vendor-12341-Attr-6 = 0x38352e3131372e3232342e302f3139 Vendor-12341-Attr-6 = 0x38372e3233372e3233322e302f3231 Vendor-12341-Attr-6 = 0x39312e3138382e3132382e302f3139 Vendor-12341-Attr-6 = 0x39312e3139362e37362e302f3232 Vendor-12341-Attr-6 = 0x3231332e3230362e33322e302f3139 Vendor-12341-Attr-6 = 0x3231372e31322e38302e302f3230 Vendor-12341-Attr-6 = 0x3139352e3135382e302e302f3139 Vendor-12341-Attr-6 = 0x3139332e32372e3230362e302f3233 Vendor-12341-Attr-6 = 0x37372e3232302e3139322e302f3139 Vendor-12341-Attr-6 = 0x38302e38302e3230382e302f3230 Vendor-12341-Attr-6 = 0x3231332e3233302e36342e302f3138 Vendor-12341-Attr-6 = 0x39312e3230342e3233362e302f3232 Vendor-12341-Attr-6 = 0x36322e3230392e3132382e302f3230 Vendor-12341-Attr-7 = 0x696e23313d616c6c20726174652d6c696d697420313032343030302031323830303020313238303030 Vendor-12341-Attr-7 = 0x6f757423313d616c6c20726174652d6c696d697420313032343030302031323830303020313238303030 Mon Feb 7 10:39:38 2011 : Info: Finished request 24. Mon Feb 7 10:39:38 2011 : Debug: Going to the next request

2 1