- Freeradius-Users - lists.freeradius.org

Authentication with a script
by Craig Smith 14 Jan '11

14 Jan '11

Hi, Could someone please share with me the best way to do external authentication using FreeRADIUS and a script written in Python or PHP? Thanks in advance, Craig

5 4

FW: Problem with PEAP MS-ChapV2 against AD
by Graham, Robert 14 Jan '11

14 Jan '11

I am testing the new version of FreeRadius (v2.1.10) on a CentOS 5 server with Samba 3.4.3 installed. The ultimate goal is to do 802.1x port authentication (Vista machines) for Wired connections and authenticate the users against Windows 2008 R2 AD. I configured Samba and join it to the Domain, and configured FreeRadius per the instructions on the Wiki. Testing against AD was successful, so I configured FreeRadius to use EAP-PEAP, generated my own certificates and ran into problems when testing it out. When I generated the certificates, I created the server key and server csr with openssl. I signed the csr with a Windows CA (adding the XPextensions) and then converted the DER format to PEM using openssl. I verified that the certificate did have the Extended Key Attributes: [root@radius mycerts]# openssl x509 -text -noout -in radius2.pem shows: X509v3 Extended Key Usage: TLS Web Server Authentication When I try to authenticate, I did not see any errors, but at the end of the debug output shows: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x17d5444b10dc5de2 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. I regenerated the certificates with the same results. Does anyone have a clue on what is happening? Here is the Debug output: rad_recv: Access-Request packet from host 172.16.1.2 port 1645, id=177, length=112 User-Name = "MEM\\test1" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.2 NAS-Port = 2 Calling-Station-Id = "00-1B-78-4E-00-12" EAP-Message = 0x02010010014d454d5c7267726168616d Message-Authenticator = 0xe1910a3453bca0c7c905bfc2e5cd5aec # Executing section authorize from file /usr//etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "MEM\test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 16 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 53 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr//etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 177 to 172.16.1.2 port 1645 Service-Type = Framed-User Framed-Protocol = PPP EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x17d5444b17d75de2f7dce27aee56b663 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.1.2 port 1645, id=178, length=236 User-Name = "MEM\\test1" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.2 NAS-Port = 2 Calling-Station-Id = "00-1B-78-4E-00-12" State = 0x17d5444b17d75de2f7dce27aee56b663 EAP-Message = 0x0202007a198000000070160301006b0100006703014d2f6a09730b74f908bd8b719705 896b0b5eb2fe01f3fa3e0c26d38bcffa7361000018002f00350005000ac009c00ac013c0 1400320038001300040100002600000010000e00000b6d656d5c7267726168616d000a00 080006001700180019000b00020100 Message-Authenticator = 0x63e3265e98a3bb083f39d950ae2ade9f # Executing section authorize from file /usr//etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "MEM\test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 122 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr//etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 112 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 006b], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 084e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 178 to 172.16.1.2 port 1645 EAP-Message = 0x0103040019c00000088b160301002a0200002603014d2f698b6d3788f388aa9228162c 3f76d3fe9a63fe494c39669259b60b9de8ad00002f00160301084e0b00084a0008470004 af308204ab30820393a003020102020a23987bed000000000009300d06092a864886f70d 0101050500304f31133011060a0992268993f22c6401191603636f6d31173015060a0992 268993f22c64011916076d656d2d696e73311f301d060355040313166d656d2d696e732d 4d454d2d4c41422d4443332d4341301e170d3131303131333138313134385a170d313230 3131333138323134385a308190310b30090603550406130255533111300f060355040813 084d EAP-Message = 0x6973736f7572693111300f06035504071308436f6c756d626961310c300a060355040a 13034d454d310b3009060355040b13024953311b3019060355040313127261646975732e 6d656d2d696e732e636f6d3123302106092a864886f70d01090116147365637572697479 406d656d2d696e732e636f6d305c300d06092a864886f70d0101010500034b0030480241 00f36a27a2cafae70e6ba4a457802e352b6cb99976513c47cad6ec7585eedc5a565e736d bbc5377935dc2143414ee3620b1657503df4f5658c6d4549b322db5a090203010001a382 020d30820209301d0603551d0e04160414787066c86e7a89d1c0bc0df2d001a9de5a7590 a630 EAP-Message = 0x1f0603551d2304183016801477292debc77ac57e073627dba3229e6faf5b76103081d8 0603551d1f0481d03081cd3081caa081c7a081c48681c16c6461703a2f2f2f434e3d6d65 6d2d696e732d4d454d2d4c41422d4443332d43412c434e3d6d656d2d6c61622d6463332c 434e3d4344502c434e3d5075626c69632532304b657925323053657276696365732c434e 3d53657276696365732c434e3d436f6e66696775726174696f6e2c44433d6d656d2d696e 732c44433d636f6d3f63657274696669636174655265766f636174696f6e4c6973743f62 6173653f6f626a656374436c6173733d63524c446973747269627574696f6e506f696e74 3081 EAP-Message = 0xc806082b060105050701010481bb3081b83081b506082b060105050730028681a86c64 61703a2f2f2f434e3d6d656d2d696e732d4d454d2d4c41422d4443332d43412c434e3d41 49412c434e3d5075626c69632532304b657925323053657276696365732c434e3d536572 76696365732c434e3d436f6e66696775726174696f6e2c44433d6d656d2d696e732c4443 3d636f6d3f634143657274696669636174653f626173653f6f626a656374436c6173733d 63657274696669636174696f6e417574686f72697479300c0603551d130101ff04023000 30130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500 0382 EAP-Message = 0x0101003a8b2d68ea968ca3eb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x17d5444b16d65de2f7dce27aee56b663 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.1.2 port 1645, id=179, length=120 User-Name = "MEM\\test1" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.2 NAS-Port = 2 Calling-Station-Id = "00-1B-78-4E-00-12" State = 0x17d5444b16d65de2f7dce27aee56b663 EAP-Message = 0x020300061900 Message-Authenticator = 0x1a2ddd0cffc8a6eeb4bd5af56a73316f # Executing section authorize from file /usr//etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "MEM\test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr//etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 179 to 172.16.1.2 port 1645 EAP-Message = 0x010403fc19407aa413407a16a4e2e344994d020646636e4b03b012a0a7011631e0a917 fd491b2ad6795c8e210fbeb759e66ace486020b3c2da8778d05bf6b04431547da91e04bc 304cc957f8782b5a6a903608da92903dc7bef79579d77e65b65ab8984156d8a6997219b9 0bbd75db4b432c48d3c97430916cc47a76bc095daedc0f0749f05f51bce08543a2192b78 7f15a208d6a2db4009df5079cf20e7986548032df3b55d36428bceae20295f7b7db4b745 18a92058f72016204e226e158f3b1150dcfca79b3f831954b7917f3b52f22e831506b0f0 3d8970e4be34e73ce4edbfe2b52917939b0a1b3026467291a722f3fafa13ec7ad395d76c 7ee0 EAP-Message = 0x0003923082038e30820276a00302010202101d65a3c4272ba9ae4000af16adf133e830 0d06092a864886f70d0101050500304f31133011060a0992268993f22c6401191603636f 6d31173015060a0992268993f22c64011916076d656d2d696e73311f301d060355040313 166d656d2d696e732d4d454d2d4c41422d4443332d4341301e170d313031303134303035 3434315a170d3335313031343031303433395a304f31133011060a0992268993f22c6401 191603636f6d31173015060a0992268993f22c64011916076d656d2d696e73311f301d06 0355040313166d656d2d696e732d4d454d2d4c41422d4443332d434130820122300d0609 2a86 EAP-Message = 0x4886f70d01010105000382010f003082010a0282010100dec78b70f45103e5f3d835b4 d757320e0442c0ce223a37d5148087d0d9cac90f1244fab1b4d6e57bf0f04a9df770d973 d1a35379bd1448159880adb6c059d7bc48c19790b784e0cb0519f73605687435a943a99f 063e36eb4584535c35a7f3d6f4900c54712280080bb229245b8a7f9ec39047ed0e1a906f 632f97d4b75c6369817f85479e6cb009bb5be487ecd7b2186c818efd595b13faafbe0385 5adf655cdf70f23fbc7ddb63c8ea3466ae027252fccb877bc9adebfc4d637faf3f55366c 4fa53cab5dde9edfc1dead59b4b56479ec52fdb91cc8a282ebc2529d41f3088c3858e80b 1628 EAP-Message = 0x708eda94966f51a236d785f13193e252ea7279b5bd6c2ee4553b0203010001a3663064 301306092b060104018237140204061e0400430041300b0603551d0f040403020186300f 0603551d130101ff040530030101ff301d0603551d0e0416041477292debc77ac57e0736 27dba3229e6faf5b7610301006092b06010401823715010403020100300d06092a864886 f70d010105050003820101004ed045d54a6ec8362174cc3b70e9617f31fcec9951c61f8c f8e850fed2b86207295690201a1cbb174870927fa6c847289688da1a0b33ee935c9d2b57 83547de88e1b42e1f04aa001fe2af230e35da26b6cfe17ae58b5e4a875c53d7249380777 82df EAP-Message = 0x6c3bec718651f019 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x17d5444b15d15de2f7dce27aee56b663 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.1.2 port 1645, id=180, length=120 User-Name = "MEM\\test1" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.2 NAS-Port = 2 Calling-Station-Id = "00-1B-78-4E-00-12" State = 0x17d5444b15d15de2f7dce27aee56b663 EAP-Message = 0x020400061900 Message-Authenticator = 0x952d481043dda4da8eca2b39ffd30fcb # Executing section authorize from file /usr//etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "MEM\test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr//etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 180 to 172.16.1.2 port 1645 EAP-Message = 0x010500a519002b3a66c8e8526d8ca3c9e036f7c21295735cffc7cca62e8d1da2526a65 a9f79a69c80e259b2ac75781bf6c6f80ec149a46dd773307ecdfc2346ecd140ae08475e2 bbf8d4cc45677d0c0821e9f3b3001899691830b151c99665a689a177a97682fb1a740da6 bf92d05b83f293bc3d3ce00dea49df7eb6d39032dc5e4ad50419e189e57751e10cb9939b 43a4c39b945fa0fd57f05dc01c16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x17d5444b14d05de2f7dce27aee56b663 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.1.2 port 1645, id=181, length=258 User-Name = "MEM\\test1" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.2 NAS-Port = 2 Calling-Station-Id = "00-1B-78-4E-00-12" State = 0x17d5444b14d05de2f7dce27aee56b663 EAP-Message = 0x02050090198000000086160301004610000042004019a92f516c2ed12eed5c4b4f4de6 3dbd4200f5c6293ff30e2565451f3775ffcbb01d71c341ac94d80926258517db6c5e7512 05e76bdc724f025dc43e441288b51403010001011603010030b7b8c1cc4e21a2c6fd1e52 308e75c347510b2336a38c4ace61bde40495ac3bc86b53995adf75e9c428d63028edb075 4b Message-Authenticator = 0x502b16df4abdeec82fb8a4031b883444 # Executing section authorize from file /usr//etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "MEM\test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr//etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 134 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 181 to 172.16.1.2 port 1645 EAP-Message = 0x0106004119001403010001011603010030740816e4b8e4c191780d546c1443a25171c6 2261bb4bbd7fa91dd713403f86418f33de753f3af5259f8ad46ed0d64abf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x17d5444b13d35de2f7dce27aee56b663 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.1.2 port 1645, id=182, length=120 User-Name = "MEM\\test1" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.2 NAS-Port = 2 Calling-Station-Id = "00-1B-78-4E-00-12" State = 0x17d5444b13d35de2f7dce27aee56b663 EAP-Message = 0x020600061900 Message-Authenticator = 0x01334a4b91706f8128e35f10f6c74e0d # Executing section authorize from file /usr//etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "MEM\test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr//etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 182 to 172.16.1.2 port 1645 EAP-Message = 0x0107002b190017030100201437bd7da4e0d7dccb3f7880d51fa1881eae5c67aad13229 4e712cd80416cfbb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x17d5444b12d25de2f7dce27aee56b663 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.1.2 port 1645, id=183, length=173 User-Name = "MEM\\test1" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.2 NAS-Port = 2 Calling-Station-Id = "00-1B-78-4E-00-12" State = 0x17d5444b12d25de2f7dce27aee56b663 EAP-Message = 0x0207003b1900170301003076edeff553f5cb4d13a2ed7029ba397c77cf9d64c3d4712d 1fc345d3d0dfdd1cec8ba1521e7800fab983b4b9c28068bb Message-Authenticator = 0xea354eec0fbb47ee4a142b0d6920754e # Executing section authorize from file /usr//etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "MEM\test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 59 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr//etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - MEM\test1 [peap] Got inner identity 'MEM\test1' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x02070010014d454d5c7267726168616d server { PEAP: Setting User-Name to MEM\test1 Sending tunneled request EAP-Message = 0x02070010014d454d5c7267726168616d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "MEM\\test1" server inner-tunnel { # Executing section authorize from file /usr//etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "MEM\test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 16 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr//etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010800251a0108002010a088cefe33e2d8f8c4b799ed59c5fb0d4d454d5c7267726168 616d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc0c1c1a1c0c9db106b079f71f54582b1 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800251a0108002010a088cefe33e2d8f8c4b799ed59c5fb0d4d454d5c7267726168 616d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc0c1c1a1c0c9db106b079f71f54582b1 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 183 to 172.16.1.2 port 1645 EAP-Message = 0x0108004b190017030100402047ac117f1fb44413571911d8cc5218a52dcd31033604e2 4e1884e44ef4d3a56b0540d56451fbbcaa3dc0ba6856c560b31b06642fa27235651d8869 8617735b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x17d5444b11dd5de2f7dce27aee56b663 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.1.2 port 1645, id=184, length=221 User-Name = "MEM\\test1" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.2 NAS-Port = 2 Calling-Station-Id = "00-1B-78-4E-00-12" State = 0x17d5444b11dd5de2f7dce27aee56b663 EAP-Message = 0x0208006b19001703010060ed7d3f594ba21455ac85cb59be5680cbec08cd20c7e2ac70 5c3d5289aadb43318fded2bc16e793b1fe21206e81054dece94dc95f6a5402014a10a21c 4f09d86a069d624832465c2ed89040cda57f84cb0298184274cec6eeb88a17f0198a0594 Message-Authenticator = 0x4c97f3f00ebaf2a9bd5a748646064d04 # Executing section authorize from file /usr//etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "MEM\test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr//etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800461a020800413139db069aec3a1482eaf5437cc12dc36200000000000000002f f233ba94c6cc0ff8b204e09e8217c1f93dd23f6a175caa004d454d5c7267726168616d server { PEAP: Setting User-Name to MEM\test1 Sending tunneled request EAP-Message = 0x020800461a020800413139db069aec3a1482eaf5437cc12dc36200000000000000002f f233ba94c6cc0ff8b204e09e8217c1f93dd23f6a175caa004d454d5c7267726168616d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "MEM\\test1" State = 0xc0c1c1a1c0c9db106b079f71f54582b1 server inner-tunnel { # Executing section authorize from file /usr//etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "MEM\test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 70 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr//etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /usr//etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: test1 [mschap] Told to do MS-CHAPv2 for test1 with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=test1 [mschap] expand: %{mschap:NT-Domain} -> MEM [mschap] expand: --domain=%{%{mschap:NT-Domain}:-MEM} -> --domain=MEM [mschap] mschap2: a0 [mschap] Creating challenge hash with username: test1 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=101d5affa80deb2a [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=2ff233ba94c6cc0ff8b204e09e8217c1f93dd23f6a175caa Exec-Program output: NT_KEY: D17434B7303CD6FA2ABE17CDB536D69D Exec-Program-Wait: plaintext: NT_KEY: D17434B7303CD6FA2ABE17CDB536D69D Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010900331a0308002e533d363836324644434335413636363431333041383135354636 43454332414535354530433031354133 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc0c1c1a1c1c8db106b079f71f54582b1 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010900331a0308002e533d363836324644434335413636363431333041383135354636 43454332414535354530433031354133 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc0c1c1a1c1c8db106b079f71f54582b1 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 184 to 172.16.1.2 port 1645 EAP-Message = 0x0109005b190017030100503ab95bfb4fc74f8bdbc39c6a332f01e8238c1548c1d905ed c81dc513033f398190f455a6a164b10035f08c1b0eef983b1174dc9136c66507a8209a06 f26adf1ed27f08e7c1f157ae925b63dc1d3452f0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x17d5444b10dc5de2f7dce27aee56b663 Finished request 7. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 177 with timestamp +72 Cleaning up request 1 ID 178 with timestamp +72 Cleaning up request 2 ID 179 with timestamp +72 Cleaning up request 3 ID 180 with timestamp +72 Cleaning up request 4 ID 181 with timestamp +72 Cleaning up request 5 ID 182 with timestamp +72 Cleaning up request 6 ID 183 with timestamp +72 Cleaning up request 7 ID 184 with timestamp +72 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x17d5444b10dc5de2 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

3 4

Authentication of users via a shell script
by Craig Smith 14 Jan '11

14 Jan '11

Clarification from my previous email. From http://freeradius.org/features/authentication.html If a password is not available locally for some reason, the server can pass the authentication to another system such as LDAP, PAM, Unix (/etc/passwd), Kerberos, Active Directory, or RADIUS server via RADIUS proxying. Local programs (e.g. CGI scripts) can also be used to authenticate users via shell scripts or any other method. Perl orPython scripts can be pre-loaded into the server, which significantly lowers the cost of running such programs. How do I do the authentication of users via a shell script? Thanks again!

2 1

dialup_admin php notice errors
by Todd Bateman 14 Jan '11

14 Jan '11

I am using Slackware Linux 13.1 64 bit with Apache 2.2.15 (with mod_ssl 2.2.15) OpenSSL 0.9.8n PHP 5.2.13 and freeradius 2.1.10. I am trying to configure dialup_admin for web administration. I went through the dialup_admin/doc/HOWTO and to the best of my knowledge I did everything right. But when I go to the main page I get the following PHP notice errors above the menu items: [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: import_request_variables() [<a href='function.import-request-variables'>function.import-request-variables</a>]: No prefix specified - possible security hazard in /usr/local/sbin/dialup_admin/conf/config.php3 on line 8, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant general_use_session - assumed 'general_use_session' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 66, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Undefined variable: login in /usr/local/sbin/dialup_admin/conf/config.php3 on line 73, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Undefined variable: login in /usr/local/sbin/dialup_admin/conf/config.php3 on line 76, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant general_username_mappings_file - assumed 'general_username_mappings_file' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 86, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant general_username_mappings_file - assumed 'general_username_mappings_file' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 87, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 100, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 100, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 100, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 100, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 100, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 100, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant general_use_session - assumed 'general_use_session' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 106, referer: http://192.168.1.2/dialup/ [Tue Jan 04 14:38:39 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant general_use_session - assumed 'general_use_session' in /usr/local/sbin/dialup_admin/html/buttons/default/buttons.html.php3 on line 91, referer: http://192.168.1.2/dialup/ and if I go down to the menu and click on the accounting link I get the following PHP notice errors in the main content part of the web page [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: import_request_variables() [<a href='function.import-request-variables'>function.import-request-variables</a>]: No prefix specified - possible security hazard in /usr/local/sbin/dialup_admin/conf/config.php3 on line 8, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant general_use_session - assumed 'general_use_session' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 66, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined variable: login in /usr/local/sbin/dialup_admin/conf/config.php3 on line 73, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined variable: login in /usr/local/sbin/dialup_admin/conf/config.php3 on line 76, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant general_username_mappings_file - assumed 'general_username_mappings_file' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 86, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant general_username_mappings_file - assumed 'general_username_mappings_file' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 87, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 100, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 100, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 100, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 100, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 100, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 100, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant general_use_session - assumed 'general_use_session' in /usr/local/sbin/dialup_admin/conf/config.php3 on line 106, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant general_sql_attrs_file - assumed 'general_sql_attrs_file' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 7, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined offset: 3 in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 12, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 13, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 14, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant func - assumed 'func' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 15, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant general_use_session - assumed 'general_use_session' in /usr/local/sbin/dialup_admin/lib/acctshow.php3 on line 17, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant sql_type - assumed 'sql_type' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 28, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined index: groupname in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant show - assumed 'show' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 43, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant desc - assumed 'desc' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined index: xascendsessionsvrkey in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 40, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Use of undefined constant general_charset - assumed 'general_charset' in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 111, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined variable: queryflag in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 117, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined variable: item_of_w1 in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 175, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined variable: add in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 185, referer: http://192.168.1.2/dialup/buttons.php3 [Tue Jan 04 14:40:22 2011] [error] [client 192.168.1.10] PHP Notice: Undefined variable: queryflag in /usr/local/sbin/dialup_admin/htdocs/accounting.php3 on line 206, referer: http:// 192.168.1.2/dialup/buttons.php3 I get the same thing for every menu item that I click on, I used the main and accounting as examples. Am I doing something wrong? Is this a bug? Is there some sort of fix for this? If someone could point me in the right direction to get rid of these PHP notice errors it would be greatly appreciated.

5 13

RE: Re: Loadbalancing and failover using different servers
by Juan Perez 14 Jan '11

14 Jan '11

> Juan Perez wrote: > > I want to implement a RADIUS load-balancing and failover scenario using > > FreeRadius and Cisco ACS. The idea I have in mind is to have these two > > servers answering to RADIUS requests in a round-robin fashion and should > > one of them for some reason go down, the other one would take care of > > answering to the RADIUS requests. > > You will need a load balancer in front of the two servers. > > > Have any of you implemented such an scenario, using FreeRadius together > > with another RADIUS server from a different vendor? If so, what are the > > main problems you found doing this (incompatibility, high-maintenance > > costs, effort, etc)? > > > > I'd be very glad to hear from you as to why such an scenario > > make/doesn't make sense. > > I don't see why you would put two different servers into one > load-balance pool. And even worse, pairing a horrible server with a > great one! > > Alan DeKok. > Hi Alan, Ok, it is actually two scenarios, one with the load-balancer, and another one with the failover, but I'm more interested in the failover part. You don't have to convince me of FreeRadius being the best RADIUS server around, that I know already but the idea behind pairing FreeRadius with a horrible server is as follows. Let's suppose that I have two servers running the latest and shiniest version of FreeRadius and for some reason there is a bug in FreeRadius that causes the server to crash when a specially crafted RADIUS packet is received. Let's suppose that there is also an attacker (a disglunted employee maybe?), who knows about this bug and decides to attack my FreeRadius servers, so he starts sending these specially crafted packets to each server and since the two servers have the same bug, both of them would die upon receiving these packets. If I have two servers from different vendors, I could thus hopefully guarantee that at least the horrible server would continue working while an attack targeted at FreeRadius is going on. The horrible server doesn't need to be necessarily a Cisco ACS, any other horrible server would do it (Microsoft IAS, Steel-Belted, etc). So, does it make sense now or is the idea too stupid to be even considered? Juan

3 2

Loadbalancing and failover using different servers
by Juan Perez 14 Jan '11

14 Jan '11

Hi everybody, I want to implement a RADIUS load-balancing and failover scenario using FreeRadius and Cisco ACS. The idea I have in mind is to have these two servers answering to RADIUS requests in a round-robin fashion and should one of them for some reason go down, the other one would take care of answering to the RADIUS requests. Have any of you implemented such an scenario, using FreeRadius together with another RADIUS server from a different vendor? If so, what are the main problems you found doing this (incompatibility, high-maintenance costs, effort, etc)? I'd be very glad to hear from you as to why such an scenario make/doesn't make sense. Regards Juan

3 2

freeradius and dhcp relaying
by Seppo Sandberg 14 Jan '11

14 Jan '11

Hello, in Freeradius 2.1.10 is it possible to set up the dhcp server to serve as a dhcp relay? Best regards, Seppo

3 10

802.1x eap via freeradius over 1131APs to wlc4402 on ent suse with 2003 AD
by Jason Hall 14 Jan '11

14 Jan '11

Ok, I connect to the wireless with my client cert installed, I get a see an eap exchange but cannot connect. I've been looking over this for days now, just wanted to get some advice/help because I'm honestly lost at this point. Feel free to ask me for anything else you need to see. Jason Hall -- begin -X output -- FreeRADIUS Version 2.1.1, for host x86_64-suse-linux-gnu, built on Feb 23 2009 at 21:43:09 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" shortname = "(domain).com" nastype = "other" } client 10.40.2.11/24 { require_message_authenticator = no secret = "(secret)" shortname = "private-network-1" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } realm (domain) { } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "(root key password)" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Instantiating ntdomain realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.40.2.11 port 32769, id=212, length=174 User-Name = "(domain)\\(username)" Calling-Station-Id = "00-24-D7-29-45-30" Called-Station-Id = "00-1D-70-02-20-70:(domain)" NAS-Port = 29 NAS-IP-Address = 10.40.2.11 NAS-Identifier = "Cisco_b2:3f:03" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02020011015353505f43435c4a48616c6c Message-Authenticator = 0x3e4f70b0ba4049be59b248ac79b67555 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "(domain)\(username)", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 212 to 10.40.2.11 port 32769 EAP-Message = 0x0103001604105d2f7ac821c18b3dda4fc5a730446754 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa900c63aa903c2d5a3d2ff9a18384d61 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.40.2.11 port 32769, id=213, length=181 User-Name = "(domain)\\(username)" Calling-Station-Id = "00-24-D7-29-45-30" Called-Station-Id = "00-1D-70-02-20-70:(domain)" NAS-Port = 29 NAS-IP-Address = 10.40.2.11 NAS-Identifier = "Cisco_b2:3f:03" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060319 State = 0xa900c63aa903c2d5a3d2ff9a18384d61 Message-Authenticator = 0x8cce320615eaa79d7a6c8a2041a0a494 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "(domain)\(username)", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 213 to 10.40.2.11 port 32769 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa900c63aa804dfd5a3d2ff9a18384d61 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.40.2.11 port 32769, id=214, length=301 User-Name = "(domain)\\(username)" Calling-Station-Id = "00-24-D7-29-45-30" Called-Station-Id = "00-1D-70-02-20-70:(domain)" NAS-Port = 29 NAS-IP-Address = 10.40.2.11 NAS-Identifier = "Cisco_b2:3f:03" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204007e198000000074160301006f0100006b03014d2f9202942c3269ed5eaade3623eed7959631bdb8b3599f2d872fe0ad7cbab9000018002f00350005000ac013c014c009c00a00320038001300040100002aff0100010000000011000f00000c7373705f63635c6a68616c6c000a0006000400170018000b00020100 State = 0xa900c63aa804dfd5a3d2ff9a18384d61 Message-Authenticator = 0xa0ca7cf59c8e8dc3f81e213053c9a17e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "(domain)\(username)", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 126 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 116 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 006f], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0ae0], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 214 to 10.40.2.11 port 32769 EAP-Message = 0x0105040019c000000b2416030100310200002d03014d2f91b5c8c10b6de09f4b353486dc7b23e5d4fc7d504ad599a8380cf337bb7400002f000005ff010001001603010ae00b000adc000ad90005643082056030820448a003020102020101300d06092a864886f70d01010505003081a4310b3009060355040613025553310e300c060355040813055465786173311e301c060355040a131553757373657220486f6c64696e67732c204c4c432e314230400603550403133953757373657220486f6c64696e67732c204c4c432e2053656375726520576972656c65737320547275737465642043657274696669636174653121301f06092a864886f7 EAP-Message = 0x0d0109011612697461646d696e407375737365722e636f6d301e170d3131303131303230333134325a170d3231303130363230333134325a3081a3310b3009060355040613025553310e300c060355040813055465786173311e301c060355040a131553757373657220486f6c64696e67732c204c4c432e3141303f0603550403133853757373657220486f6c64696e67732c204c4c432e2053656375726520576972656c657373205365727665722043657274696669636174653121301f06092a864886f70d0109011612697461646d696e407375737365722e636f6d30820122300d06092a864886f70d01010105000382010f003082010a028201 EAP-Message = 0x0100bcace3a1736baa41e7b28a9779bc5505649c2ac7055c1748827d678fe5762f8e815088097070ec4d063dc5f5b0ce4905f53d191fca459147e11b8bda3215e6e75ecbcd3e6a2097809c60370572236f79d114648251b3b6951e7d7ad8b386047adb1c73d8465a4fbe3755f4fd9758f5648917c95f8657997dfb435d32cd264771b07b8f1ffef2169b25809fb515d092f0d805488f8b0240b04bc91c9e8c4d80b5a9dd6eafd4424f68dc89cd0061f778c176bce198cdaf16f8bb683d6ec8c79b6b7401dbe928f549f8445cd77e489c9bd96a78ac6f4cfa42f0b6ad70f5676a284be39d51137c1524e920ed9e7b26b25bbf1d5b149a66bcc13384dd39 EAP-Message = 0x83c898a4dd0203010001a382019a3082019630090603551d1304023000303006096086480186f842010d04231621596153542047656e65726174656420536572766572204365727469666963617465301106096086480186f8420101040403020640300b0603551d0f0404030205a0301d0603551d0e041604146bfc53ec4d8c1de2655e487f85462269cfa0fe273081d90603551d230481d13081ce801414b80c1e8732c50053300194e1d8b6e1c4aed5e2a181aaa481a73081a4310b3009060355040613025553310e300c060355040813055465786173311e301c060355040a131553757373657220486f6c64696e67732c204c4c432e3142304006 EAP-Message = 0x035504031339537573736572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa900c63aab05dfd5a3d2ff9a18384d61 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.40.2.11 port 32769, id=215, length=181 User-Name = "(domain)\\(username)" Calling-Station-Id = "00-24-D7-29-45-30" Called-Station-Id = "00-1D-70-02-20-70:(domain)" NAS-Port = 29 NAS-IP-Address = 10.40.2.11 NAS-Identifier = "Cisco_b2:3f:03" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 State = 0xa900c63aab05dfd5a3d2ff9a18384d61 Message-Authenticator = 0x9f5b906f012841434b8c0b92aef12acc +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "(domain)\(username)", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 215 to 10.40.2.11 port 32769 EAP-Message = 0x010603fc194020486f6c64696e67732c204c4c432e2053656375726520576972656c65737320547275737465642043657274696669636174653121301f06092a864886f70d0109011612697461646d696e407375737365722e636f6d82090089a2f8f8346912ee301d0603551d11041630148112697461646d696e407375737365722e636f6d301d0603551d12041630148112697461646d696e407375737365722e636f6d300d06092a864886f70d01010505000382010100db045c6fca66795e0f54111e406e5896d6e31d483c32db0c93d7fbf25b60cdb0698bc63300e4d3f44d2c73fac15ec3d41edd36b011a3ad9a87f0171885ff5646c86ba4e8 EAP-Message = 0x596bca83e15f117235ae85ea5e09c9c0bb6b0834ae94e9effc9585f147139f9b7889d460f4fa7ce5a2d0198bf01f2beb25be74b61c9d947b1fb3786f5ce17de32cc542bf3a72cf7ad43aa76fba5e7ae9c797290b99fe7864f48bccbc982e498a335f229be5d96c7ca1882051d38b433f63483c36faa619fc8c786fc209e4aac95a8dfd8fe159db33ae5d1992b3726c5af714983cbd894140833c4893da99beb55d06c6f0995e9d2777c5a1e9b3f32b5ad7d9d12ed479fef3679fdaa400056f3082056b30820453a00302010202090089a2f8f8346912ee300d06092a864886f70d01010505003081a4310b3009060355040613025553310e300c060355 EAP-Message = 0x040813055465786173311e301c060355040a131553757373657220486f6c64696e67732c204c4c432e314230400603550403133953757373657220486f6c64696e67732c204c4c432e2053656375726520576972656c65737320547275737465642043657274696669636174653121301f06092a864886f70d0109011612697461646d696e407375737365722e636f6d301e170d3131303131303230323932305a170d3231303130373230323932305a3081a4310b3009060355040613025553310e300c060355040813055465786173311e301c060355040a131553757373657220486f6c64696e67732c204c4c432e31423040060355040313395375 EAP-Message = 0x7373657220486f6c64696e67732c204c4c432e2053656375726520576972656c65737320547275737465642043657274696669636174653121301f06092a864886f70d0109011612697461646d696e407375737365722e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100de30822d81162b33fefec5a17b1b571c521487e99c20d212a8ce11298d2a34eadc2a6f4f721b5f95c7e45e94aca99df5a60dfbcdeeeac9dcde35585cf1ab350e2a426ee3e8cfe65c041f42b2fcc2a30e689120b6d5bd289d272b95a46ecf0cb610a1f8d767cb735addc6ad8b392b073790c9b8dafe857e3810c33065491d159883b9 EAP-Message = 0x538fce96e6f0bcc3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa900c63aaa06dfd5a3d2ff9a18384d61 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.40.2.11 port 32769, id=216, length=181 User-Name = "(domain)\\(username)" Calling-Station-Id = "00-24-D7-29-45-30" Called-Station-Id = "00-1D-70-02-20-70:(domain)" NAS-Port = 29 NAS-IP-Address = 10.40.2.11 NAS-Identifier = "Cisco_b2:3f:03" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600061900 State = 0xa900c63aaa06dfd5a3d2ff9a18384d61 Message-Authenticator = 0xb0a93c1c5de441689c546bff953552ac +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "(domain)\(username)", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 216 to 10.40.2.11 port 32769 EAP-Message = 0x0107033e19009acb9a429750087b478f4f28df800790b0fe850a08ed684bf275aef974f7cf1d695a2ae22a042dd7213978179a2afa8026e80e3c665f0e291c6cb49bd67d9b310fa31642c4a6743021a544285809c4253b3d8ba4bdfa1db0d84a324146733d6fd57ebe6fff1a01d57533ee7d7945a57a922bdca5c7830203010001a382019c30820198300f0603551d130101ff040530030101ff302c06096086480186f842010d041f161d596153542047656e657261746564204341204365727469666963617465301106096086480186f8420101040403020106300b0603551d0f040403020106301d0603551d0e0416041414b80c1e8732c5005330 EAP-Message = 0x0194e1d8b6e1c4aed5e23081d90603551d230481d13081ce801414b80c1e8732c50053300194e1d8b6e1c4aed5e2a181aaa481a73081a4310b3009060355040613025553310e300c060355040813055465786173311e301c060355040a131553757373657220486f6c64696e67732c204c4c432e314230400603550403133953757373657220486f6c64696e67732c204c4c432e2053656375726520576972656c65737320547275737465642043657274696669636174653121301f06092a864886f70d0109011612697461646d696e407375737365722e636f6d82090089a2f8f8346912ee301d0603551d11041630148112697461646d696e407375 EAP-Message = 0x737365722e636f6d301d0603551d12041630148112697461646d696e407375737365722e636f6d300d06092a864886f70d01010505000382010100ca48048305b23d2e01dc30838e24ae8dfe74dd335c421ab1b054ee3afb25bf6376f2c1d7da4dda99e414acc1bbe8a4d2e0da6bc7880a6628300f33a2b0170f558dcb606b161eed7b7e53bb10356c56af6b34c48a1de0fad2e23ccb81bac25fdf1a3985ddbd33ddea7f52206425852bf3cd6f9c04598a09143ce6041be582b5a66637b8e7b2359cac82d0950362fde436325c790321f54b5881d57c18e9a2f4c3605402e3b50da27645ed0b32f358fd4ad9fc933718125f31bd6e2ad41747d637792a EAP-Message = 0xdb511a797d44a5272c4694fd77e0336aab254d1cf3655ac4eec005d52428d0aac5786d8572150662155d42a8401f044faa97d650ed5e9f189eae9ea81ddf16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa900c63aad07dfd5a3d2ff9a18384d61 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.40.2.11 port 32769, id=217, length=513 User-Name = "(domain)\\(username)" Calling-Station-Id = "00-24-D7-29-45-30" Called-Station-Id = "00-1D-70-02-20-70:(domain)" NAS-Port = 29 NAS-IP-Address = 10.40.2.11 NAS-Identifier = "Cisco_b2:3f:03" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0207015019800000014616030101061000010201009a78a32ab69ac47fd717688c8e5f5b673aabe81f8d2021a4829398faa5f1cec667b9317950d7edd93808eb55f56ad23124b940a2c00e18dec4e82ea50af0a9fd127e6ae2985c319eec98078ef361dd63a3802d16f58ce99580c2bf3dd1ecfdacdf8a58b8ea94954afcda8eb14b57d67b0b3b813bba5cd80a9818c44ddb9b2213381e2dccc4768904ecc733be2cdb19fa371815a6f3b902e8d95d279b1832d2aab0cfaf194e091f00771eec0ee88ef766f373e93d84624eb0a3ab1804795535ce2b08ccdd8ca7f78a2288d8bc27651e9c706a9e597651366d5cc94c036138e47181e9788a57a5a916 EAP-Message = 0x4bc098427e639d833761b5bdfed6b316a55406d42d8a19bd14030100010116030100306656570ba40bb3282b036c3c969ac8f7e9511f50550ced6b21a082a886cfb3ae209d4109bd193cc0f0def9395faf7618 State = 0xa900c63aad07dfd5a3d2ff9a18384d61 Message-Authenticator = 0x3a4f1365b73bada36da646a0671428cb +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "(domain)\(username)", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 217 to 10.40.2.11 port 32769 EAP-Message = 0x0108004119001403010001011603010030161865cc699da89650f3e7ce640e6b086e573dd17514716c46d50498bb3e5d02e040f450e614f19e2feafa1af0186cc8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa900c63aac08dfd5a3d2ff9a18384d61 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.40.2.11 port 32769, id=218, length=181 User-Name = "(domain)\\(username)" Calling-Station-Id = "00-24-D7-29-45-30" Called-Station-Id = "00-1D-70-02-20-70:(domain)" NAS-Port = 29 NAS-IP-Address = 10.40.2.11 NAS-Identifier = "Cisco_b2:3f:03" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800061900 State = 0xa900c63aac08dfd5a3d2ff9a18384d61 Message-Authenticator = 0xa0943465f1407909729911da8fb5b48c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "(domain)\(username)", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 218 to 10.40.2.11 port 32769 EAP-Message = 0x0109002b1900170301002084ee051f9779be59188d096034de18a7a94be3a5ca72647d4f79ab554b6fec9d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa900c63aaf09dfd5a3d2ff9a18384d61 Finished request 6. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 10.40.2.11 port 32769, id=219, length=234 User-Name = "(domain)\\(username)" Calling-Station-Id = "00-24-D7-29-45-30" Called-Station-Id = "00-1D-70-02-20-70:(domain)" NAS-Port = 29 NAS-IP-Address = 10.40.2.11 NAS-Identifier = "Cisco_b2:3f:03" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0209003b190017030100306f7bab96d6d63036e0bb725d1949089071153172a6e25cfba4744a58cd5a6372e9cf3a3475a07a2b902df17f763cb274 State = 0xa900c63aaf09dfd5a3d2ff9a18384d61 Message-Authenticator = 0x97434ca49bae047c3ea91ff71064950d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "(domain)\(username)", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 59 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - (domain)\(username) [peap] Got tunnled request EAP-Message = 0x02090011015353505f43435c4a48616c6c server (null) { PEAP: Got tunneled identity of (domain)\(username) PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to (domain)\(username) Sending tunneled request EAP-Message = 0x02090011015353505f43435c4a48616c6c FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "(domain)\\(username)" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "(domain)\(username)", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "(domain)" for User-Name = "(domain)\(username)" [ntdomain] Found realm "(domain)" [ntdomain] Adding Stripped-User-Name = "(username)" [ntdomain] Adding Realm = "(domain)" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok ++[control] returns ok [eap] EAP packet type response id 9 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a00261a010a002110b8d8b7f2698d6c4547c89393a90171365353505f43435c4a48616c6c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd2c630a7d2cc2a826808083c20a703b8 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00261a010a002110b8d8b7f2698d6c4547c89393a90171365353505f43435c4a48616c6c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd2c630a7d2cc2a826808083c20a703b8 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 219 to 10.40.2.11 port 32769 EAP-Message = 0x010a004b19001703010040195ae6d9f978634a3e75a51c482927b5b7db06ed62edeed6afe234cab520a6e7c0ae90f474c0cbf29d316410ce7822c700cca659da41f0c4533b059ac2be0115 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa900c63aae0adfd5a3d2ff9a18384d61 Finished request 7. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 10.40.2.11 port 32769, id=220, length=282 User-Name = "(domain)\\(username)" Calling-Station-Id = "00-24-D7-29-45-30" Called-Station-Id = "00-1D-70-02-20-70:(domain)" NAS-Port = 29 NAS-IP-Address = 10.40.2.11 NAS-Identifier = "Cisco_b2:3f:03" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020a006b1900170301006030bf25d92f9528dbe9f11937d488bc75fbf25c7feb986c834b15010317ce3eda4935cf61a665d86730d7434fae79336dc652360792e8694274b94b6e2844039f2f88708d5cc2d3e588dec660648661dea641fb62e476ffe68cebef782ab8399d State = 0xa900c63aae0adfd5a3d2ff9a18384d61 Message-Authenticator = 0x83e9623e00b31de770019d9c60b90fea +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "(domain)\(username)", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunnled request EAP-Message = 0x020a00471a020a0042314d0b9d8cd906abc30c6c3a605d6f42b40000000000000000c089c6a1e5b21d8d8671904d0c3003e6db1a66d3f2b7db28005353505f43435c4a48616c6c server (null) { PEAP: Setting User-Name to (domain)\(username) Sending tunneled request EAP-Message = 0x020a00471a020a0042314d0b9d8cd906abc30c6c3a605d6f42b40000000000000000c089c6a1e5b21d8d8671904d0c3003e6db1a66d3f2b7db28005353505f43435c4a48616c6c FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "(domain)\\(username)" State = 0xd2c630a7d2cc2a826808083c20a703b8 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "(domain)\(username)", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "(domain)" for User-Name = "(domain)\(username)" [ntdomain] Found realm "(domain)" [ntdomain] Adding Stripped-User-Name = "(username)" [ntdomain] Adding Realm = "(domain)" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok ++[control] returns ok [eap] EAP packet type response id 10 length 71 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] NT Domain delimeter found, should we have enabled with_ntdomain_hack? [mschap] Told to do MS-CHAPv2 for (domain)\(username) with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 220 to 10.40.2.11 port 32769 EAP-Message = 0x010b002b19001703010020ae3ca0fedfe440153cb7b49364e200704bf8486f1399f0b4ea8ba62cccb9efa1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa900c63aa10bdfd5a3d2ff9a18384d61 Finished request 8. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 10.40.2.11 port 32769, id=221, length=218 User-Name = "(domain)\\(username)" Calling-Station-Id = "00-24-D7-29-45-30" Called-Station-Id = "00-1D-70-02-20-70:(domain)" NAS-Port = 29 NAS-IP-Address = 10.40.2.11 NAS-Identifier = "Cisco_b2:3f:03" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020b002b1900170301002078eaf4d8bdc40da5bfc684b788aa859165524f3e8da0fc61999428c2c89cf710 State = 0xa900c63aa10bdfd5a3d2ff9a18384d61 Message-Authenticator = 0x4940f9f48b205143a5ba104ea9da0d72 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "(domain)\(username)", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> (domain)\(username) attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 221 to 10.40.2.11 port 32769 EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 2.7 seconds. Cleaning up request 0 ID 212 with timestamp +6 Cleaning up request 1 ID 213 with timestamp +6 Cleaning up request 2 ID 214 with timestamp +6 Cleaning up request 3 ID 215 with timestamp +6 Cleaning up request 4 ID 216 with timestamp +6 Cleaning up request 5 ID 217 with timestamp +6 Waking up in 1.2 seconds. Cleaning up request 6 ID 218 with timestamp +8 Cleaning up request 7 ID 219 with timestamp +8 Cleaning up request 8 ID 220 with timestamp +8 Waking up in 1.0 seconds. Cleaning up request 9 ID 221 with timestamp +8 Ready to process requests.

2 1

samba > 3.0.33
by Casartello, Thomas 13 Jan '11

13 Jan '11

Has anyone gotten freeradius EAP-MSCHAPV2 authentication to work properly in samba versions beyond 3.0.30? On samba 3.3.8 I still get the same type of error I'd get as if I didn't have the xpextensions on my cert (Even though I do.) No response to access-challenge. If I go back to 3.0.30 it immediately works....Starting to run into a problem because 3.0.30 won't work will 2008 r2 domain controllers. Again my cert does have the xpextensions. And it does this to all clients,, not just Microsoft. Here's the end of my debug: [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=tomtom [mschap] expand: %{mschap:NT-Domain} -> ADS [mschap] expand: --domain=%{%{mschap:NT-Domain}:-ADS} -> --domain=ADS [mschap] mschap2: d3 [mschap] Creating challenge hash with username: tomtom [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=ba19d84bdab789ef [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=27a757e4b32c51011216ac7fff78219563fc14af067f3d05 Exec-Program output: NT_KEY: D988C0C63F2D4C8034172DCBEB7B317F Exec-Program-Wait: plaintext: NT_KEY: D988C0C63F2D4C8034172DCBEB7B317F Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010c00331a030b002e533d33333133453034393739353130383137303633423342413033324339383343383832413937323736 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f8a0cb23e86164f4ea2f66ef66aa4ed [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010c00331a030b002e533d33333133453034393739353130383137303633423342413033324339383343383832413937323736 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f8a0cb23e86164f4ea2f66ef66aa4ed [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 17 to 172.20.4.253 port 32769 EAP-Message = 0x010c005b19001703010050e5f53b91a3b5214c1a0f1ee21b46045f6992732a92d882e4359ed17b1dfffcb69d20d4645caa74a94ea448cd54c76c041c642d05801fa0a4f830247b30f9723884d6fbaa35f6b11398741f833bc68f08 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xedeb59b2eae740f09f949186981dc8bc Finished request 10. Going to the next request Waking up in 4.7 seconds. Cleaning up request 3 ID 10 with timestamp +11 Cleaning up request 4 ID 11 with timestamp +11 Cleaning up request 5 ID 12 with timestamp +11 Cleaning up request 6 ID 13 with timestamp +11 Cleaning up request 7 ID 14 with timestamp +11 Cleaning up request 8 ID 15 with timestamp +11 Waking up in 0.1 seconds. Cleaning up request 9 ID 16 with timestamp +11 Cleaning up request 10 ID 17 with timestamp +11 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xedeb59b2eae740f0 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A Westfield State College (413) 572-8245 Red Hat Certified Technician (RHCT) Cisco Certified Network Associate (CCNA)

3 9

Re: Freeradius GUI Interfaces Available?
by Jim Rice 13 Jan '11

13 Jan '11

Shameless bump. My apologies for the newbie question, but my searches have all been circular. I just want to know if dialup-admin is all that is available on the Open Source side for GUI based administration of FreeRadius? Please, and thank you! --- On Wed, 1/12/11, Jim Rice <jmrice6640(a)yahoo.com> wrote: > From: Jim Rice <jmrice6640(a)yahoo.com> > Subject: Freeradius GUI Interfaces Available? > To: freeradius-users(a)lists.freeradius.org > Date: Wednesday, January 12, 2011, 11:47 AM > New to freeradius list. > Greetings. > > Can someone direct me to more information about Radius GUI > Interfaces? > > Is dialup-admin all there is? (Does not seem to be > included in rpm pkg.) > freeradius2-2.1.7-7.el5 (CentOS 5) > > Thanks. > >

3 2