- Freeradius-Users - lists.freeradius.org

Freeradius2 + Daloradius
by Samuel 20 Jan '11

20 Jan '11

Please can someone shed light on what I must have done wrong. I have Freeradius 2 installed on Centos 5.5 with Mysql 5 and added Daloradius 0.9-8 as a frontend. All seem OK except that I get an error with the radius logs. Daloradius claims /var/log/radius/radius.log does not exist but it is there. Dolaradius was looking originally for /var/log/freeradius/radius.log. I have made changes in the ~/library/exten-radius_log.php file to look for /var/log/radius/radius.log yet no success. Has anyone got a solution please ? Thanks Samuel

1 0

Logging Authentication Rejects
by Kristoffer Milligan 20 Jan '11

20 Jan '11

radiusd: FreeRADIUS Version 2.2.0, for host i686-pc-linux-gnu, built on Apr 30 2010 at 09:48:09 root@hostname:~# lsb_release -a Distributor ID: Ubuntu Description: Ubuntu 9.10 Release: 9.10 Codename: karmic Good day list, I am trying to set up some logging on my radius server. The server is responsible for a WiMAX network running on equipment from Alvarion. After a troublesome start, things are starting to straighten out. I've now reached the point where I want to apply some additional logging to start ironing out minor bugs. Running FR in debug mode, I see the occasional access-reject (mostly caused by wrongly configured username/passwords), and I would like to log these to my database. In my default tunnel, I have added sql_log module to the post-auth section, subsection Post-Auth-Type REJECT. The default SQL looks like this: # Post-Auth = "INSERT INTO ${postauth_table} \ # (username, pass, reply, authdate) VALUES \ # ('%{User-Name}', '%{User-Password:-Chap-Password}', \ # '%{reply:Packet-Type}', '%S'); which would provide a line of log (in my case) looking something like this: Incremental Id, =F8=F334534534645645645687(a)WiMAX.com, '', 'Access-Reject', DATETIME. (The username is jus something I typed out, but that's what they look like). This data is good to give me an idea of how many access rejects I am getting, but I have no clue from what usernames they are coming, nor WHY they were rejected. I know that the username in the inner tunnel is plaintext as well, meaning it looks like i.e kristoffer(a)WiMAX.com. My question is; What should my SQL look like if I want to log the following data: Incremental id, 'Attempted/Cleartext Username', 'Attempted/Cleartext password', 'Access-Reject - {Rejection-Reason}', DATETIME ? Looking forwards to your replies.. Sincerely, Kristoffer Milligan

2 1

Re: force_check_config - how to use?
by William Bulley 20 Jan '11

20 Jan '11

According to Alan DeKok <aland(a)deployingradius.com> on Wed, 01/19/11 at 13:57: > > I *think* it's something you can add to a module configuration to > force it to instantiate itself. Normally, when "radiusd -C" is used, > the SQL module is skipped, because checking the config doesn't mean > opening 50 sockets to the SQL server. Adding "force_check_config=yes" > will make modules like SQL instantiate themselves, including opening 50 > sockets to the SQL server. Thanks. I came across this while trying to debug a gnarly situation with the mschap module. The configs in modules/mschap include at the end: #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" This was changed by an adminstrator to --username=%{mschap:User-Name:-None} except that the leading left brace ("{") was omitted... :-( The output of radiusd -XC concluded that "Configuration appears to be OK." when in fact mschap authentications could never recover the User-Name when ntlm_auth was given --username=%mschap:User-Name:-None} to deal with... My question: is there any way to parse and check the "value" of the ntlm_auth variable in the modules/mschap file for valid syntax? Inside cf_item_parse() in src/main/conffile.c there is a PW_TYPE_STRING_PTR case of the switch statement. In this case there is the following comment: /* * Expand variables which haven't already been * expanded automagically when the configuration * file was read. */ It doesn't seem that this ntlm_auth variable was expanded when the config file was read. After this comment is an if statement "if (value == dflt)" which, if true, results in a call to cf_expand_variables() passing the above ntlm_auth string value as "value". It appears to me that this if statement will never be true, since the default value for ntlm_auth is NULL, so any string value (right hand side of ntlm_auth variable) will not be NULL, nor will the pointers match. And if they did, what is the purpose of expanding a variable which is NULL? The net result is that the human error (see typo above) was not discovered while configuration checking with -XC which gave a false positive indication. Very confusing... Regards, web... -- William Bulley Email: web(a)umich.edu 72 characters width template ----------------------------------------->|

3 4

Radping Works Wireless fails
by mjonesmcne 20 Jan '11

20 Jan '11

Hi all I am trying to setup freeradius on an OES2 server to authenticate via ldap to edir. I have been following the document freeradius-edir from here http://www.novell.com/coolsolutions/assets/freeradius-edir.pdf , but now i am stuck. Radping works shown as the first login, but wireless fails shown after the broken line. Can anyone shed some light on what might be wrong? Thanks in advance Mark radius2:/home/radius # radiusd -x Starting - reading configuration files ... Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded LDAP rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x80125f20 Module: Instantiated ldap (ldap) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls rlm_eap: Loaded and initialized type ttls rlm_eap: Loaded and initialized type peap rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication 172.17.152.34:1812 Listening on accounting 172.17.152.34:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.152.0.61:1851, id=27, length=46 User-Name = "mjones" User-Password = "xxxxx" rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. rlm_ldap: - authenticate rlm_ldap: login attempt by "mjones" with password "xxxx" rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to 172.17.152.4:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder.b64 rlm_ldap: setting TLS CACert Directory to /etc/raddb/certs/ rlm_ldap: setting TLS Require Cert to demand rlm_ldap: bind as cn=adm_radius,o=hpsd_48/xxxxx to 172.17.152.4:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: user DN: cn=Mjones,o=HPSD_48 rlm_ldap: (re)connect to 172.17.152.4:636, authentication 1 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder.b64 rlm_ldap: setting TLS CACert Directory to /etc/raddb/certs/ rlm_ldap: setting TLS Require Cert to demand rlm_ldap: bind as cn=Mjones,o=HPSD_48/xxxxx to 172.17.152.4:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user mjones authenticated succesfully Login OK: [mjones] (from client xxxxxx port 0) ----------------------------------------------------------------------------------------------------- Sending Access-Accept of id 27 to 10.152.0.61 port 1851 rad_recv: Access-Request packet from host 10.152.0.100:36595, id=29, length=194 NAS-IP-Address = 10.152.0.100 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "mjones" Calling-Station-Id = "0022FA4B4F18" Called-Station-Id = "000B86611894" MS-CHAP-Challenge = 0x31f67b603f85bedb36920a24a8519b6b MS-CHAP2-Response = 0x0700ac3bda3013be2b60fd6c451363cf5b470000000000000000021dd9e1c54f208a9d350faa59da531e667ca8ec1a5678f9 Service-Type = Login-User Aruba-Essid-Name = "HPSD_RAD2" Aruba-Location-Id = "Tech 01" rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Login incorrect: [mjones] (from client xxxxxx port 0 cli 0022FA4B4F18) rad_recv: Access-Request packet from host 10.152.0.100:36595, id=29, length=194 Sending Access-Reject of id 29 to 10.152.0.100 port 36595 -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radping-Works-Wireless-fails-tp3348… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

None
by Mark Jones 20 Jan '11

20 Jan '11

1 0

force_check_config - how to use?
by William Bulley 19 Jan '11

19 Jan '11

About twenty months ago, a commit to src/main/modules.c occurred with the following comment: Allow administrators to force_check_config There is a check inside find_module_instance() in that file for a value pair of that name with a value of "yes": cp = cf_pair_find(cs, "force_check_config"); if (cp) value = cf_pair_value(cp); if (value && (strcmp(value, "yes") == 0)) goto print_inst; cf_log_module(cs, "Skipping instantiation of %s", instname); The use of force_check_config doesn't seem to be documented anywhere. The only hits on Google are from the above commit. I have seached back three years on this list for the string force_check_config to no avail. I assume I need to have a force_check_config value pair with a value of "yes" somewhere in the request, but I don't know how to make that happen. Any pointers would be appreciated. Thanks. Regards, web... -- William Bulley Email: web(a)umich.edu 72 characters width template ----------------------------------------->|

2 1

Problem with iPods/iTouches
by Rob Yamry 19 Jan '11

19 Jan '11

We have a stangle problem going on with the Apple iTouches in the district here. This started since they were upgraded to iOS v.4.x....so it seems. What is happening is that the user will put in their credentials and get prompted to accept the certificate as it says its untrusted. The user clicks accept, all looks good and then it says it failed to connected. So they hit dismiss on that message, click join again, accept the certificate again and then they are accepted onto the network. But, sometimes they have to hit Dismiss/Join up to 15-20 times until it will accept it. Right now I am working with a default install FreeRadius v2.1.8 for testing this, including default certificates. I was planning on slowly adding in my config to narrow it down, but the problem appears to be happening by default. I *thought* that setting the default_eap_type to peap was causing it, but I had it happen when it was set to md5 as well. Im working on a iPod Touch with iOS v4.2. Below is the debug output of a failed attempt, and the follow up attempt that put the user through. *********************** FAILED ATTEMPT *************************** Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, length=277 User-Name = "ktest5" NAS-IP-Address = 127.0.4.1 NAS-Port = 259 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "58:b0:35:28:19:ad" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "KASD_TEST" Service-Type = Framed-User Vendor-4329-Attr-3 = 0x3035303030313031343330353233 > > 3035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x0200000b016b7465737435 > Message-Authenticator = 0x32cf9f891633152f0f139a53cb61f9ee > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 0 length 11 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[unix] returns notfound > ++[files] returns noop > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type tls > [tls] Initiate > [tls] Start returned 1 > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = 0x010100061920 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xc4b1fdf8c4b0e4f9163ffe27c4915746 > Finished request 0. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=420 > Cleaning up request 0 ID 66 with timestamp +30 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = > 0x0201008819800000007e16030100790100007503014d2e0343e5f920d1f519dbfeac002febc3736014d9bee7e0c55fd8085b99b7af00003ac00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a0009000300080033003900160015001401000012000a00080006001700180019000b00020100 > State = 0xc4b1fdf8c4b0e4f9163ffe27c4915746 > Message-Authenticator = 0xf4e7c59223ecd3e5741cc6cc48762e1f > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 1 length 136 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > TLS Length 126 > [peap] Length Included > [peap] eaptls_verify returned 11 > [peap] (other): before/accept initialization > [peap] TLS_accept: before/accept initialization > [peap] <<< TLS 1.0 Handshake [length 0079], ClientHello > [peap] TLS_accept: SSLv3 read client hello A > [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello > [peap] TLS_accept: SSLv3 write server hello A > [peap] >>> TLS 1.0 Handshake [length 085e], Certificate > [peap] TLS_accept: SSLv3 write certificate A > [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone > [peap] TLS_accept: SSLv3 write server done A > [peap] TLS_accept: SSLv3 flush data > [peap] TLS_accept: Need to read more data: SSLv3 read client > certificate A > In SSL Handshake Phase > In SSL Accept mode > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x0102040019c00000089b160301002a0200002603014d2e0330bf07fe39f7236a619358e64fa3db011bcbda7c9b9584846f6e32102000002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 > EAP-Message = > 0x301e170d3131303131323138353335325a170d3132303131323138353335325a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100e8460af12ab26451d71f5f5853ac201a8dee4f3c17d2f6c4725f4c9cc44fc6ae87c1b32d3e62fcd1964c8b1f81044272b76dbaa079cbd3dd727461dfd7a5 > EAP-Message = > 0x8b623cc4e0c8beccafbc499fc74e8d17e3c9fbd9aafbac061bfa1309372c83e95c8dd5da071d7d97fdd7660ab45c93db04d72184885f895897d840ac4934c11f51c81c4d2e83dccf646b499739781cdff243a48f064e209bef2d2bcde936c6104b63ee467f448d005c127b83bfa708aeed69f1467d3b280a4f1b151d153ce7216ea94c2e33fe400de92d84b823c5b32828959b9ea5b8afbc063ba5db0cabb0b602fdf90e60c354b8e788facfc654ff2310ea763297ea1aef098b4ddb5466abb528910203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100904c9828165a2de337 > EAP-Message = > 0x50191a87ef600b1584376573598f31e772c944faf6e61c383d477c201b0aa6cf8bcb49d8b416f2de1e84774a9423608aad94af078dad2b6b30979d1c6b58cd8eefa9cf827d27f7755f8030dbc7c9e230187f212a5d4400928da0cc2845a7b5048a3b7425818fb437ac9c33746b39aaf4aa49af51340496250c837496f449307860f6cae9bd224c557af44806b46ac837b12a149124e35da9bde2538d9f39c2c33fe33dc7df0d45c5bec5bda68294a994af2db4f7298cf47e680cbca4789791aa3048a17761e4c71ebbd9b82bd324af0dbe8ce26ae88ee8a5d16dbd6685dce7ecb7af820abf975c67bfd34797fbefa47a4eed95cca895860004ab308204 > EAP-Message = 0xa73082038fa0030201020209 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xc4b1fdf8c5b3e4f9163ffe27c4915746 > Finished request 1. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 1 ID 66 with timestamp +30 > Ready to process requests. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=290 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x020200061900 > State = 0xc4b1fdf8c5b3e4f9163ffe27c4915746 > Message-Authenticator = 0xa5c69d05dee0560c68b7d67d25b2e0b1 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 2 length 6 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] Received TLS ACK > [peap] ACK handshake fragment handler > [peap] eaptls_verify returned 1 > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x010303fc194000ae0fc87b0b841be2300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3131303131323138353335315a170d3132303131323138353335315a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 > EAP-Message = > 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d73060bc3e4f3bacd8c526ff5efa081cbfd333963c0a90272e83d654b8d1a16a25c9e1358b347d3f91d49ed29d387fd6de5ba5fe18c43b48065e8f1bb9dcb22d1a8679925af0bdc049d32199ba543f1d40a7c6b3578892efcaea646bdde6442593b17cb4713fb4d6f0616a5db38d9b > EAP-Message = > 0xfd1d6e9dd30b6e536ba717a75adaa7c87fd019e83bea06f5eacb6a09fa9954b60ccc92116455610a2674a03a4ecacee05ce914a72a27965d55471df19c8751fdb69fe66426bb236f7d57cfffe41822e7d8ddfc6c1c8f5b45e6010c896918c4f111626979b280ddf2219099024cb0efb17c9660df9fc642edc9874074cb83e93349b19a2c16409b7444545ee27b2a52bb9d0203010001a381fb3081f8301d0603551d0e04160414872c00a6ed850850f4e202b4d86a1d663b35fd8e3081c80603551d230481c03081bd8014872c00a6ed850850f4e202b4d86a1d663b35fd8ea18199a48196308193310b3009060355040613024652310f300d06035504 > EAP-Message = > 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900ae0fc87b0b841be2300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100a5c0c601e1cb4606aa986dc240b7488bb4afd8c0e81ba0361530d556ad117222cdcc5a57a13fe3eb073ca72dff40db0a58c8d835ec110485bd158ab6cd1d8583cd575710b49070b3794384d2cff45f22b81e > EAP-Message = 0x2dc327be959645c8 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xc4b1fdf8c6b2e4f9163ffe27c4915746 > Finished request 2. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=290 > Cleaning up request 2 ID 66 with timestamp +39 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x020300061900 > State = 0xc4b1fdf8c6b2e4f9163ffe27c4915746 > Message-Authenticator = 0x834956d460493056f00e0117298d68d7 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 3 length 6 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] Received TLS ACK > [peap] ACK handshake fragment handler > [peap] eaptls_verify returned 1 > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x010400b51900387bb57f237040a0b009495fcb1c4460694c6214f871d93a5afddfcc7aa7727e9ce657d22551e936e9415eea3a0ce78a7ea4b121f711fc19e2b505b4fa004bcc2952effdc18d0cd1ec6fe10bf431e8a189a5cbefcaebd9beab4e75c2309b55de25a9e392112915ad1c7b866a902f091b366eb96e7aa6ab544889069e70fda7ad8a9ec9eb729a6db3aeeb3ca9965daf0d515783a89a0947b6004eaad452777ae3413772aa2f5f16030100040e000000 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xc4b1fdf8c7b5e4f9163ffe27c4915746 > Finished request 3. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=622 > Cleaning up request 3 ID 66 with timestamp +39 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = > 0x020401501980000001461603010106100001020100373aae08036c5c081766d84efb8b257d7a9840bd2d91f9fbb1bad0c23993b1becc777b0890f6c8eb6b9ad515a2a5436dd50ea6feaeb8d0e9d3b7142af44ef0a0d52004a50e4b3022e3c2752cbc9caff85cbbd8281543a4a2c1b8a9a9141dd4430cafb7375f8d1a299c321a10edf205010f828f80cb188855d7888ef33d2c14d9bbc52bb23e99e2570ec2be2e6896f918c61926fbfc21009af339abbf671c483c897e7f5a9614f7ffd003d126edeebb752e3af6f8dc63a10a314fb5d105124ce25332a68c7b6aee6bebcf5eb9aa3a3853cdb0ecef655a78107a86ce327d51d84fb858490131e5c8 > EAP-Message = > 0x4fdfa622a41c66fd40edceb1c3cc99f33a0591a75a1c419d681403010001011603010030183a1d1ce2e805a60d16d91940d4b659bc1ecda540c675ea25f530b5c3ebe4114d5553609074df1351384da76ab4f78a > State = 0xc4b1fdf8c7b5e4f9163ffe27c4915746 > Message-Authenticator = 0xef9d2df3d5a31b39f3ddf68d687d6b5c > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 4 length 252 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > TLS Length 326 > [peap] Length Included > [peap] eaptls_verify returned 11 > [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange > [peap] TLS_accept: SSLv3 read client key exchange A > [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] > [peap] <<< TLS 1.0 Handshake [length 0010], Finished > [peap] TLS_accept: SSLv3 read finished A > [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] > [peap] TLS_accept: SSLv3 write change cipher spec A > [peap] >>> TLS 1.0 Handshake [length 0010], Finished > [peap] TLS_accept: SSLv3 write finished A > [peap] TLS_accept: SSLv3 flush data > [peap] (other): SSL negotiation finished successfully > SSL Connection Established > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x0105004119001403010001011603010030c5ca03d2a20ef23d2e6375c8153c3e6c1afa2151b0232004998802bece4070cb14b8a1bffac3874c849f89a1f8450de2 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xc4b1fdf8c0b4e4f9163ffe27c4915746 > Finished request 4. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=277 > Cleaning up request 4 ID 66 with timestamp +39 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x0206000b016b7465737435 > Message-Authenticator = 0x7667edddd0b6ae7ddec276f6fc0d09fd > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 6 length 11 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[unix] returns notfound > ++[files] returns noop > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type tls > [tls] Initiate > [tls] Start returned 1 > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = 0x010700061920 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x8791eff18796f6b55a0a76adc31036d5 > Finished request 5. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=420 > Cleaning up request 5 ID 66 with timestamp +42 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = > 0x0207008819800000007e16030100790100007503014d2e034fe43eb22c54e9c30587e009b69a0a7712664fc62b7754d5321207a9e700003ac00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a0009000300080033003900160015001401000012000a00080006001700180019000b00020100 > State = 0x8791eff18796f6b55a0a76adc31036d5 > Message-Authenticator = 0xdd954eaa01deac01b7a9d0973e934401 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 7 length 136 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > TLS Length 126 > [peap] Length Included > [peap] eaptls_verify returned 11 > [peap] (other): before/accept initialization > [peap] TLS_accept: before/accept initialization > [peap] <<< TLS 1.0 Handshake [length 0079], ClientHello > [peap] TLS_accept: SSLv3 read client hello A > [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello > [peap] TLS_accept: SSLv3 write server hello A > [peap] >>> TLS 1.0 Handshake [length 085e], Certificate > [peap] TLS_accept: SSLv3 write certificate A > [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone > [peap] TLS_accept: SSLv3 write server done A > [peap] TLS_accept: SSLv3 flush data > [peap] TLS_accept: Need to read more data: SSLv3 read client > certificate A > In SSL Handshake Phase > In SSL Accept mode > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x0108040019c00000089b160301002a0200002603014d2e033cabdd48cf6a4f062f86f5947a33952f7547e4871741c1b81a7c7ae51e00002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 > EAP-Message = > 0x301e170d3131303131323138353335325a170d3132303131323138353335325a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100e8460af12ab26451d71f5f5853ac201a8dee4f3c17d2f6c4725f4c9cc44fc6ae87c1b32d3e62fcd1964c8b1f81044272b76dbaa079cbd3dd727461dfd7a5 > EAP-Message = > 0x8b623cc4e0c8beccafbc499fc74e8d17e3c9fbd9aafbac061bfa1309372c83e95c8dd5da071d7d97fdd7660ab45c93db04d72184885f895897d840ac4934c11f51c81c4d2e83dccf646b499739781cdff243a48f064e209bef2d2bcde936c6104b63ee467f448d005c127b83bfa708aeed69f1467d3b280a4f1b151d153ce7216ea94c2e33fe400de92d84b823c5b32828959b9ea5b8afbc063ba5db0cabb0b602fdf90e60c354b8e788facfc654ff2310ea763297ea1aef098b4ddb5466abb528910203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100904c9828165a2de337 > EAP-Message = > 0x50191a87ef600b1584376573598f31e772c944faf6e61c383d477c201b0aa6cf8bcb49d8b416f2de1e84774a9423608aad94af078dad2b6b30979d1c6b58cd8eefa9cf827d27f7755f8030dbc7c9e230187f212a5d4400928da0cc2845a7b5048a3b7425818fb437ac9c33746b39aaf4aa49af51340496250c837496f449307860f6cae9bd224c557af44806b46ac837b12a149124e35da9bde2538d9f39c2c33fe33dc7df0d45c5bec5bda68294a994af2db4f7298cf47e680cbca4789791aa3048a17761e4c71ebbd9b82bd324af0dbe8ce26ae88ee8a5d16dbd6685dce7ecb7af820abf975c67bfd34797fbefa47a4eed95cca895860004ab308204 > EAP-Message = 0xa73082038fa0030201020209 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x8791eff18699f6b55a0a76adc31036d5 > Finished request 6. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=290 > Cleaning up request 6 ID 66 with timestamp +42 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x020800061900 > State = 0x8791eff18699f6b55a0a76adc31036d5 > Message-Authenticator = 0x806cd522495a9dea0f1b63c2c7612616 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 8 length 6 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] Received TLS ACK > [peap] ACK handshake fragment handler > [peap] eaptls_verify returned 1 > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x010903fc194000ae0fc87b0b841be2300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3131303131323138353335315a170d3132303131323138353335315a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 > EAP-Message = > 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d73060bc3e4f3bacd8c526ff5efa081cbfd333963c0a90272e83d654b8d1a16a25c9e1358b347d3f91d49ed29d387fd6de5ba5fe18c43b48065e8f1bb9dcb22d1a8679925af0bdc049d32199ba543f1d40a7c6b3578892efcaea646bdde6442593b17cb4713fb4d6f0616a5db38d9b > EAP-Message = > 0xfd1d6e9dd30b6e536ba717a75adaa7c87fd019e83bea06f5eacb6a09fa9954b60ccc92116455610a2674a03a4ecacee05ce914a72a27965d55471df19c8751fdb69fe66426bb236f7d57cfffe41822e7d8ddfc6c1c8f5b45e6010c896918c4f111626979b280ddf2219099024cb0efb17c9660df9fc642edc9874074cb83e93349b19a2c16409b7444545ee27b2a52bb9d0203010001a381fb3081f8301d0603551d0e04160414872c00a6ed850850f4e202b4d86a1d663b35fd8e3081c80603551d230481c03081bd8014872c00a6ed850850f4e202b4d86a1d663b35fd8ea18199a48196308193310b3009060355040613024652310f300d06035504 > EAP-Message = > 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900ae0fc87b0b841be2300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100a5c0c601e1cb4606aa986dc240b7488bb4afd8c0e81ba0361530d556ad117222cdcc5a57a13fe3eb073ca72dff40db0a58c8d835ec110485bd158ab6cd1d8583cd575710b49070b3794384d2cff45f22b81e > EAP-Message = 0x2dc327be959645c8 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x8791eff18598f6b55a0a76adc31036d5 > Finished request 7. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=290 > Cleaning up request 7 ID 66 with timestamp +43 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x020900061900 > State = 0x8791eff18598f6b55a0a76adc31036d5 > Message-Authenticator = 0xf2ec741c480f9339eaa13537cadc59e4 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 9 length 6 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] Received TLS ACK > [peap] ACK handshake fragment handler > [peap] eaptls_verify returned 1 > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x010a00b51900387bb57f237040a0b009495fcb1c4460694c6214f871d93a5afddfcc7aa7727e9ce657d22551e936e9415eea3a0ce78a7ea4b121f711fc19e2b505b4fa004bcc2952effdc18d0cd1ec6fe10bf431e8a189a5cbefcaebd9beab4e75c2309b55de25a9e392112915ad1c7b866a902f091b366eb96e7aa6ab544889069e70fda7ad8a9ec9eb729a6db3aeeb3ca9965daf0d515783a89a0947b6004eaad452777ae3413772aa2f5f16030100040e000000 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x8791eff1849bf6b55a0a76adc31036d5 > Finished request 8. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 8 ID 66 with timestamp +43 > Ready to process requests. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=277 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x0201000b016b7465737435 > Message-Authenticator = 0xacd1f25254d19ef7ef878a3a79e240be > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 1 length 11 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[unix] returns notfound > ++[files] returns noop > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type tls > [tls] Initiate > [tls] Start returned 1 > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = 0x010200061920 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x119bd5731199cc528cc4c05b9703cffa > Finished request 9. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=420 > Cleaning up request 9 ID 66 with timestamp +48 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = > 0x0202008819800000007e16030100790100007503014d2e0355d881daaa7bc48ab53b8cbf1877d5045d28d27e8bc56439c8160f2d2e00003ac00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a0009000300080033003900160015001401000012000a00080006001700180019000b00020100 > State = 0x119bd5731199cc528cc4c05b9703cffa > Message-Authenticator = 0x502685c6634bcf13076884276d720178 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 2 length 136 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > TLS Length 126 > [peap] Length Included > [peap] eaptls_verify returned 11 > [peap] (other): before/accept initialization > [peap] TLS_accept: before/accept initialization > [peap] <<< TLS 1.0 Handshake [length 0079], ClientHello > [peap] TLS_accept: SSLv3 read client hello A > [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello > [peap] TLS_accept: SSLv3 write server hello A > [peap] >>> TLS 1.0 Handshake [length 085e], Certificate > [peap] TLS_accept: SSLv3 write certificate A > [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone > [peap] TLS_accept: SSLv3 write server done A > [peap] TLS_accept: SSLv3 flush data > [peap] TLS_accept: Need to read more data: SSLv3 read client > certificate A > In SSL Handshake Phase > In SSL Accept mode > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x0103040019c00000089b160301002a0200002603014d2e0342163fcd54d6877c34fe6b48bf4ada483c9daaeb893988fd2bdc1ee46300002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 > EAP-Message = > 0x301e170d3131303131323138353335325a170d3132303131323138353335325a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100e8460af12ab26451d71f5f5853ac201a8dee4f3c17d2f6c4725f4c9cc44fc6ae87c1b32d3e62fcd1964c8b1f81044272b76dbaa079cbd3dd727461dfd7a5 > EAP-Message = > 0x8b623cc4e0c8beccafbc499fc74e8d17e3c9fbd9aafbac061bfa1309372c83e95c8dd5da071d7d97fdd7660ab45c93db04d72184885f895897d840ac4934c11f51c81c4d2e83dccf646b499739781cdff243a48f064e209bef2d2bcde936c6104b63ee467f448d005c127b83bfa708aeed69f1467d3b280a4f1b151d153ce7216ea94c2e33fe400de92d84b823c5b32828959b9ea5b8afbc063ba5db0cabb0b602fdf90e60c354b8e788facfc654ff2310ea763297ea1aef098b4ddb5466abb528910203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100904c9828165a2de337 > EAP-Message = > 0x50191a87ef600b1584376573598f31e772c944faf6e61c383d477c201b0aa6cf8bcb49d8b416f2de1e84774a9423608aad94af078dad2b6b30979d1c6b58cd8eefa9cf827d27f7755f8030dbc7c9e230187f212a5d4400928da0cc2845a7b5048a3b7425818fb437ac9c33746b39aaf4aa49af51340496250c837496f449307860f6cae9bd224c557af44806b46ac837b12a149124e35da9bde2538d9f39c2c33fe33dc7df0d45c5bec5bda68294a994af2db4f7298cf47e680cbca4789791aa3048a17761e4c71ebbd9b82bd324af0dbe8ce26ae88ee8a5d16dbd6685dce7ecb7af820abf975c67bfd34797fbefa47a4eed95cca895860004ab308204 > EAP-Message = 0xa73082038fa0030201020209 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x119bd5731098cc528cc4c05b9703cffa > Finished request 10. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 10 ID 66 with timestamp +48 > Ready to process requests.

5 10

Help needed with user authentication
by Luke Hammond 19 Jan '11

19 Jan '11

Hey, i am new so sorry that i know nothing about Freeradius. Basically, i found a tutorial and followed it to get Freeradius2, Mysql and Daloradius working together.. that part is ok. But i am confused with this: I want to have a wireless network, that will be open, and when a user connects and tries to browse they get redirected to a page where they have to login, and that will talk to freeradius to make sure the user is authorised, then it will accept them and continue to where they were trying to browse to.. Thats basically what i need, but how does Freeradius do that? Where is that page so i can edit it with my logo or whatever? Or do i need more software to have that login page? Please assist, am desperate here to get this working.. thanks in advance!

3 3

Spaces in the end of User-Name.
by admin 19 Jan '11

19 Jan '11

Hi! What i must to specify in a config file of freeradius2 that in each request before its further handling it automatically deleted spaces in the end of %{User-Name}? The parameter nospace_user doesn't work. Not to start up users with spaces in username doesn't approach.

3 6

Request information for EAP TTLS
by Aman Arneja 19 Jan '11

19 Jan '11

> Hi > > I am new to Free Radius and was just wondering if some1 can help me out. I > am planning to implement an EAP TTLS client and was wondering the following > about Free Radius for my testing. > > 1.) Does Free Radius Implementation of EAP TTLS Support the following > > a.) Client auth during phase 1 > b.) Id privacy can be explicitly enabled or disables > c.) Allowing tunneled methods such as FAST, PEAP as inner methods > d.) Method chaining in phase 2 > > Thanx in advance for your help guys > > Aman Arneja > >

1 0