- Freeradius-Users - lists.freeradius.org

(Fwd) Re: Accounting Log
by Breuer Nicolas 08 Nov '10

08 Nov '10

From: Alexandre Chapellon <alexandre.chapellon(a)mana.pf> I have the very same behaviour here on my FR2.1.6 setup with PGSQL accoutning. It produce noisy logs but nothing unacceptable. You can change this by not doing accouting for Stop Accounting packet that show up null session-time: in your acccouting section: if (Acct-Status-Type == Stop && Session-Time != 0) { sql_accounting_module_name } Maybe relying on Session-Time is not a good idea. Try finding out another relevant attribute. Cdt Nice idea, i will try :) Breuer Nicolas Network Supervisor Sales Executive BELCENTER sprl/bvba Avenue Henri Consciencelaan, 94 Bruxelles 1140 Brussel T. : +32 (0)2 403 04 60 F. : +32 (0)2 403 04 63 M. :+32 (0)486 50 27 87 E. : Nicolas.Breuer(a)Belcenter.biz W. : http://www.BelCenter.be | http://www.BelCenter.net

1 0

Authentication by domain of company
by zouzou 08 Nov '10

08 Nov '10

Hi, I am new to FreeRADIUS. I have two users: test1 test2 I would like to grant test1 access by this syntax of username ; Username: test1@domaine1 ( exp: domaine1= DRH) I would like to grant test2 access by this syntax of username; Username: test2@domaine2 ( exp: domaine1=DG) And I would not like to grant test1 access by this syntax of username Username: test1@domaine2 ( exp: domaine2= DG) Same for user test2 I wonder if FreeRADIUS is capable of handling , if freeradius handle it , please could you tell me how??? Best Regard. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-by-domain-of-company… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Accounting Log
by Breuer Nicolas 08 Nov '10

08 Nov '10

Hello All, We used the Freeradius 2.X version. We use the accounting SQL module and i remark something. When a user is rejected (Wrong password), i always have this error in radius.log Mon Nov 8 18:07:40 2010 : Auth: Login incorrect: [BCgXXX] Mon Nov 8 18:07:41 2010 : Info: [ACCOUNTING-01] stop packet with zero session length. Mon Nov 8 18:07:41 2010 : Info: rlm_sql (ACCOUNTING-02): Attempting to connect rlm_sql_mysql #13 Mon Nov 8 18:07:41 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #13 Mon Nov 8 18:07:41 2010 : Info: rlm_sql (ACCOUNTING-02): Connected new DB handle, #13 Mon Nov 8 18:07:41 2010 : Info: [ACCOUNTING-02] stop packet with zero session length. Accounting-01 thinks that stop packet with zero session length is an error and tried to connect to Accounting-02 sql server. Is it the correct behaviour ? Is it possible to remove this "logging". Thanks Breuer Nicolas Network Supervisor Sales Executive BELCENTER sprl/bvba Avenue Henri Consciencelaan, 94 Bruxelles 1140 Brussel T. : +32 (0)2 403 04 60 F. : +32 (0)2 403 04 63 M. :+32 (0)486 50 27 87 E. : Nicolas.Breuer(a)Belcenter.biz W. : http://www.BelCenter.be | http://www.BelCenter.net

4 3

S/KEY authentication on FreeRADIUS
by Victor Guk 08 Nov '10

08 Nov '10

Hi all Can you please tell whether it is possible to configure FreeRADIUS to authenticate users on the "S/KEY One-Time Password System", which is described in RFC 1760 (http://tools.ietf.org/html/rfc1760) Thank you so much.

3 5

Segmentation Fault
by Michel Musslin 08 Nov '10

08 Nov '10

Hello, I actually try to cross compile freeradius 2.0.9 for powerpc. Everything looks good during compilation, but we get "Segmentation Fault" on our host when executing "radiusd -X". Our setup is : - EGLIBC 2.9 - GCC 4.3.2 - Linux 2.6.31 Could you please help me to find a way to solve this problem. Here you can find strace and gdb log. Michel M. strace log : sendto(4, "\0\0\0\24\0\26\3\1L\321-\374\0\0\0\0\0\0\0\0", 20, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 20 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\0\0\0000\0\24\0\2L\321-\374\0\0\7$\2\10\200\376\0\0\0\1\0\10\0\1\177\0\0\1"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 288 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\0\0\0@\0\24\0\2L\321-\374\0\0\7$\n\200\200\376\0\0\0\1\0\24\0\1\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 128 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\0\0\0\24\0\3\0\2L\321-\374\0\0\7$\0\0\0\0\0\0\0\1\0\24\0\1\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 20 close(4) = 0 fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(4, 64), ...}) = 0 ioctl(1, TCGETS, {B115200 opost isig icanon echo ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x48001000 open("/usr/local/lib/rlm_exec.la", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0755, st_size=814, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x48002000 read(4, "# rlm_exec.la - a libtool librar"..., 4096) = 814 read(4, "", 4096) = 0 close(4) = 0 munmap(0x48002000, 4096) = 0 open("/usr/local/lib/libpthread.la", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib/libpthread.la", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/lib/libpthread.la", O_RDONLY) = -1 ENOENT (No such file or directory) access("/usr/local/lib/libpthread.so", R_OK) = -1 ENOENT (No such file or directory) access("/lib/libpthread.so", R_OK) = -1 ENOENT (No such file or directory) access("/usr/lib/libpthread.so", R_OK) = 0 futex(0x1016e378, FUTEX_WAKE_PRIVATE, 2147483647) = 0 open("/usr/lib/libpthread.so", O_RDONLY) = 4 read(4, "/* GNU ld script\n Use the shar"..., 512) = 219 close(4) = 0 open("/usr/local/lib/libresolv.la", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib/libresolv.la", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/lib/libresolv.la", O_RDONLY) = -1 ENOENT (No such file or directory) access("/usr/local/lib/libresolv.so", R_OK) = -1 ENOENT (No such file or directory) access("/lib/libresolv.so", R_OK) = -1 ENOENT (No such file or directory) access("/usr/lib/libresolv.so", R_OK) = 0 open("/usr/lib/libresolv.so", O_RDONLY) = 4 read(4, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\0.X\0\0\0004"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=92607, ...}) = 0 mmap(0x6ffcb000, 150532, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x6ffcb000 mprotect(0x6ffdd000, 61440, PROT_NONE) = 0 mmap(0x6ffec000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x11000) = 0x6ffec000 mmap(0x6ffee000, 7172, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x6ffee000 close(4) = 0 open("/etc/ld.so.cache", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=4841, ...}) = 0 mmap(NULL, 4841, PROT_READ, MAP_PRIVATE, 4, 0) = 0x48002000 close(4) = 0 open("/lib/libc.so.6", O_RDONLY) = 4 read(4, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\1\356T\0\0\0004"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=1733649, ...}) = 0 mmap(0x6fe4f000, 1487896, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x6fe4f000 mprotect(0x6ffa4000, 61440, PROT_NONE) = 0 mmap(0x6ffb3000, 20480, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x154000) = 0x6ffb3000 mmap(0x6ffb8000, 9240, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x6ffb8000 close(4) = 0 open("/lib/ld.so.1", O_RDONLY) = 4 read(4, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\1_x\0\0\0004"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=143055, ...}) = 0 mmap(0x6fe10000, 192148, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x6fe10000 mprotect(0x6fe2e000, 61440, PROT_NONE) = 0 mmap(0x6fe3d000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x1d000) = 0x6fe3d000 close(4) = 0 mprotect(0x6fe3d000, 4096, PROT_READ) = 0 mprotect(0x6ffb3000, 8192, PROT_READ) = 0 mprotect(0x6ffec000, 4096, PROT_READ) = 0 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ gbd-radiusd.log : * 1 process 1821 0x100da888 in add_to_global () Thread 1 (process 1821): #0 0x100da888 in add_to_global () No locals. #1 0x100db1e4 in dl_open_worker () No locals. #2 0x100d8fa0 in _dl_catch_error () No locals. #3 0x100da620 in _dl_open () No locals. #4 0x10096428 in dlopen_doit () No locals. #5 0x100d8fa0 in _dl_catch_error () No locals. #6 0x10096828 in _dlerror_run () No locals. #7 0x10096364 in __dlopen () No locals. #8 0x10074d34 in dlopen () No locals. #9 0x10074cdc in sys_dl_open (loader_data=<value optimized out>, filename=0x1027d5b8 "/usr/lib/libresolv.so") at ltdl.c:1115 module = <value optimized out> __FUNCTION__ = "sys_dl_open" #10 0x10071db8 in tryall_dlopen (handle=0xbff58570, filename=0x1027d5b8 "/usr/lib/libresolv.so", useloader=0x0) at ltdl.c:2487 cur = (lt_dlhandle) 0x1027d528 loader = (lt_dlloader *) 0x1027d1e8 saved_error = 0x101341fc "file not found" errors = <value optimized out> #11 0x10074b40 in find_handle_callback ( filename=0x1027d5b8 "/usr/lib/libresolv.so", data=0xbff58570, ignored=<value optimized out>) at ltdl.c:2844 notfound = 0 #12 0x10072b54 in foreach_dirinpath (search_path=<value optimized out>, base_name=0x1027d4d0 "libresolv.so", func=0x10074ae0 <find_handle_callback>, data1=0xbff58570, data2=0x0) at ltdl.c:2767 lendir = 9 dir_name = 0x1027d515 "/usr/lib" result = <value optimized out> filenamesize = 22 lenbase = 12 argz_len = 14 argz = 0x1027d510 "/lib" filename = 0x1027d5b8 "/usr/lib/libresolv.so" canonical = 0x1027d4f8 "/lib:/usr/lib" __PRETTY_FUNCTION__ = "foreach_dirinpath" __FUNCTION__ = "foreach_dirinpath" #13 0x10072d74 in find_handle (search_path=0x10134088 "/lib:/usr/lib", base_name=0x1027d4d0 "libresolv.so", handle=0xbff58570) at ltdl.c:2867 __FUNCTION__ = "find_handle" #14 0x10073d74 in try_dlopen (phandle=0xbff585d8, filename=0x1027d4b8 "libresolv.so") at ltdl.c:3438 saved_error = 0x101341fc "file not found" canonical = 0x1027d4d0 "libresolv.so" base_name = 0x1027d4d0 "libresolv.so" dir = 0x0 name = <value optimized out> errors = 0 newhandle = (lt_dlhandle) 0x1027d528 __PRETTY_FUNCTION__ = "try_dlopen" #15 0x10074a7c in lt_dlopenext (filename=<value optimized out>) at ltdl.c:3606 handle = (lt_dlhandle) 0x1027d528 tmp = 0x1027d4b8 "libresolv.so" len = 9 errors = <value optimized out> __FUNCTION__ = "lt_dlopenext" #16 0x100746e4 in try_dlopen (phandle=0xbff58678, filename=<value optimized out>) at ltdl.c:3011 file = <value optimized out> libdir = 0x1027cf58 "/usr/local/lib" deplibs = 0x1027cf10 " /usr/local/lib/libfreeradius-radius.la -lnsl -lresolv -lpthread" line = <value optimized out> line_len = <value optimized out> dlname = 0x0 old_name = 0x1027d3e0 "librlm_exec.a" installed = 1 saved_error = 0x0 canonical = 0x1027d3c0 "rlm_exec.la" base_name = <value optimized out> dir = 0x1027d5a0 "/usr/local/lib" name = 0x1027d3d0 "rlm_exec" errors = <value optimized out> newhandle = <value optimized out> __PRETTY_FUNCTION__ = "try_dlopen" #17 0x10074984 in lt_dlopenext (filename=<value optimized out>) at ltdl.c:3564 handle = (lt_dlhandle) 0x1027cf70 tmp = 0x1027d3b0 "rlm_exec.la" len = 8 errors = <value optimized out> __FUNCTION__ = "lt_dlopenext" #18 0x10012aac in find_module_instance (modules=<value optimized out>, instname=0x1019362c "exec", do_link=1) at modules.c:491 check_config_safe = <value optimized out> cs = (CONF_SECTION *) 0x10195bb0 name1 = <value optimized out> node = (module_instance_t *) 0x1027d290 myNode = { name = "exec\000\005¶`\020\031.\b\000\000\000\t¿õ\212@\020\000CÄ", '\0' <repeats 20 times>, "\020\022\006´\020\031/þ\000\000\000 \000\000\000\000\000\000\000\000¿õ\212@\000\000\000\000\000\000\000\000\020\026-ø¿õ\220Ø\020\026\000\000\020\026\000\000\020\026.\b\020\021þ\034\000\000\000\000\020\002Y¸\020\021\224\004\020\026\000\000\020\021\234h\020\026\000\000\020\032 ¿õ\212\200\020\026ã|\000\000\000\024\020\026-ø¿õ\212\220\020\026\000\000\020\026\000\000\020\026-ø¿õ\220Ø\020\026\000\000\020\026\000\000\020\0314\200¿õ\212p\000\000\000\000\020\021¶ä\020\031\017\210¿õ\212\220\020\005¶\020\002\000\000\000¿õ\212¨\020\031"..., entry = 0x10190f88, insthandle = 0x0, mutex = 0x0, cs = 0x10193480, dead = 270077832, mh = 0x1019362c} module_name = "rlm_exec\000õ\206À\020\tCd\000\000\000\000\020\031û\020¿õ\206à\020\t.à\020\026\000\000\020\026.\b\020\026\000\000\000\000\000ÿH\000\003s\020\031û\020¿õ\206ð\020\t;\204\000\000\000\000\020\031û\020¿õ\2070\020\tI°\020\026\000\000\020\026.\b¿õ\211@\000\000\000\000\020\031\017h¿õ\207X¿õ\207 \020\021\224\004¿õ\207X\020\031&\210¿õ\207@\020\005¶\020\002\000ã|¿õ\207X¿õ\207\200\020\021\224\004\020\031%Ð\020\026-ø¿õ\220Ø\020\026\000\000\020\026\000\000\020\026.\b\020\026\000\000¿õ\207Ø\020\031%Ð\020\026\000\000¿õ\211\030\020\031& \020\026;@\000\000\000\000"... __FUNCTION__ = "find_module_instance" #19 0x10012fec in setup_modules (reload=<value optimized out>, config=0x10190f88) at modules.c:1542 ci = (CONF_ITEM *) 0x10193608 name = 0x1019362c "exec" cs = (CONF_SECTION *) 0x10193540 modules = (CONF_SECTION *) 0x10193480 listener = <value optimized out> __FUNCTION__ = "setup_modules" #20 0x100106bc in read_mainconfig (reload=<value optimized out>) at mainconfig.c:959 p = 0x10190f68 "/usr/local/etc/raddb" cs = (CONF_SECTION *) 0x10190f88 statbuf = {st_dev = 2065, st_ino = 8163, st_mode = 16877, st_nlink = 7, st_uid = 0, st_gid = 0, st_rdev = 0, __pad2 = 0, st_size = 4096, st_blksize = 4096, st_blocks = 8, st_atim = { tv_sec = 1288775159, tv_nsec = 0}, st_mtim = {tv_sec = 1288780664, tv_nsec = 0}, st_ctim = {tv_sec = 1288780691, tv_nsec = 0}, __unused4 = 0, __unused5 = 0} cc = <value optimized out> buffer = "/usr/local/etc/raddb/radiusd.conf", '\0' <repeats 711 times>, "¿õ\217°", '\0' <repeats 12 times>, "¿õ\220ü\000\000\000!\000\000\000\000¿õ\220ø¿õ\220ð\020\006\226¤\020\006\235,\020\000\000\004", '\0' <repeats 80 times>, "¿õ\2200", '\0' <repeats 12 times>, "\020\026-\224\020\026éD¿õ\224\024\020\026öH¿õ\220 \020\ná\034", '\0' <repeats 32 times>, "\204\000\004h\020\026-ø¿õ\220°\020\026\000\000\020\t8è\000\000\000\000\020\026\000\000\000\000\000\000\020\026.°\020\021Ç\b\020\021Ë\214$\000\004l\020\026.°\020"... __FUNCTION__ = "read_mainconfig" #21 0x10015ac0 in main (argc=2, argv=0xbff59414) at radiusd.c:265 rcode = <value optimized out> argval = <value optimized out> spawn_flag = 0 dont_fork = 1 flag = 0 act = {__sigaction_handler = {sa_handler = 0, sa_sigaction = 0}, sa_mask = {__val = {0 <repeats 32 times>}}, sa_flags = 0, sa_restorer = 0}

2 1

Formatting SSHA1-Passwords
by inetjunkmail 08 Nov '10

08 Nov '10

How do I specify the salt when storing passwords as a salted SHA1 hash? For instance: SSHA-Password := <hash>:<salt> or SSHA-Password := <salt>,<hash> etc.

2 1

EAP-AKA support (urgent)
by dfds fds 08 Nov '10

08 Nov '10

Hi , I want to know , is freeradius supports EAP-AKA? if supports , can i get instructions to set up EAP-AKA in free radiusthanks in advance RegardsSrini

3 3

%RAD_REPLY hash problem
by Ana Gallardo 08 Nov '10

08 Nov '10

Hello, I'm working with Freeradius 2.1.10 I want to authorize an user usng a multivaluated attribute (Relaciones), so I use perl. The values of the attribute Relaciones are store in ldap. Nombre-Completo is another attribute store in ldap. "Relaciones" is a integer value. An user is authorize if have one attribute "Relaciones" with a positive value (no + sign). Relaciones, Nombre-Completo and Codigo-Reject are vendor specific attributes defined in /usr/share/freeradius/dictionary.rinuex My script perl is: # cat /etc/freeradius/perl/checkRelaciones.pm #!/usr/bin/perl use strict; use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); #use Data::Dumper; use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ sub authorize { my $refRelaciones; if (exists $RAD_REPLY{'Relaciones'} && defined $RAD_REPLY{'Relaciones'}){ $refRelaciones=$RAD_REPLY{'Relaciones'}; foreach (@{$refRelaciones}) { if ($_ =~ /^[0-9]{2}/) { return RLM_MODULE_OK; } } $RAD_REPLY{'Codigo-Reject'}=11; #Sin-Relacion } return RLM_MODULE_REJECT; } Everything works fine. My problem is that rlm_perl duplicate an attribute in %RAD_REPLY hash. Debug: rad_recv: Access-Request packet from host x.x.x.x port 56822, id=100, length=75 User-Name = "ana(a)unex.es" User-Password = "1111" Calling-Station-Id = "..." server rinuex { ... [ldap1] looking for check items in directory... [ldap1] ntPassword -> NT-Password == 0x3.. [ldap1] looking for reply items in directory... [ldap1] Relaciones -> Relaciones += "03" [ldap1] sn -> Nombre-Completo = "Ana Gallardo" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap1] user ana authorized to use remote access [ldap1] ldap_release_conn: Release Id: 0 ++++[ldap1] returns ok ... rlm_perl: Added pair User-Name = ana(a)unex.es rlm_perl: Added pair User-Password = 1111 rlm_perl: Added pair Intentos-Reject = 0 rlm_perl: Added pair SQL-User-Name = ana rlm_perl: Added pair Realm = unex.es rlm_perl: Added pair Stripped-User-Name = ana rlm_perl: Added pair Calling-Station-Id = ... rlm_perl: Added pair Nombre-Completo = Ana Gallardo rlm_perl: Added pair Relaciones = 03 rlm_perl: Added pair Relaciones = Ana Gallardo rlm_perl: Added pair NT-Password = 0x344... rlm_perl: Added pair Simultaneous-Use = 1 rlm_perl: Added pair Ldap-UserDn = ... ++[perl] returns ok ... ++[pap] returns ok ... } # server rinuex Sending Access-Accept of id 100 to x.x.x.x port 56822 Nombre-Completo = "Ana Gallardo" Relaciones += "03" Relaciones += "Ana Gallardo" Any ideas?? Sorry for my english and thank you in advance. ____________________ Ana Gallardo Gómez ____________________

2 4

EAP-PEAP fatal unknown_ca
by westwood 08 Nov '10

08 Nov '10

*freeradius2.1.8 1、 win7+protected EAP(peap)+wpa-enterprise (laptop name :leeyu-laptop) 2、 i have install ca.der on the win7 and winxp 3、 winxp+**protected EAP(peap)**+ca testing successfully, but win7 fails ERROR happened before win7 prompted me to enter username&&password.....,freeradius debug: * Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/freeradius//var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.1 port 3075, id=144, length=191 User-Name = "host/Leeyu-Laptop" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "00195b04c9e2" Calling-Station-Id = "001e659fc674" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001601686f73742f4c656579752d4c6170746f70 Message-Authenticator = 0x2cca1e2672315cf4764cc0fd2544dfe3 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [Capitek.com] No '@' in User-Name = "host/Leeyu-Laptop", looking up realm NULL [Capitek.com] No such realm "NULL" ++[Capitek.com] returns noop [eap] EAP packet type response id 0 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql_oracle] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_oracle] ... expanding second conditional [sql_oracle] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_oracle] expand: %{User-Name:-DEFAULT} -> host/Leeyu-Laptop [sql_oracle] expand: %{Stripped-User-Name:-%{User-Name:-DEFAULT}} -> host/Leeyu-Laptop [sql_oracle] sql_set_user escaped user --> 'host/Leeyu-Laptop' rlm_sql (sql_oracle): Reserving sql socket id: 18 [sql_oracle] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'host/Leeyu-Laptop' ORDER BY id [sql_oracle] User found in radcheck table [sql_oracle] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'host/Leeyu-Laptop' ORDER BY id [sql_oracle] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM radusergroup WHERE UserName='host/Leeyu-Laptop' rlm_sql (sql_oracle): Released sql socket id: 18 ++[sql_oracle] returns ok [bklist] No Max-Attempts defined. ++[bklist] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 144 to 192.168.0.1 port 3075 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x246ddb0b246cc225aad5e24c6756cf9c Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 3075, id=145, length=307 User-Name = "host/Leeyu-Laptop" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "00195b04c9e2" Calling-Station-Id = "001e659fc674" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201007e198000000074160301006f0100006b03014cd4fdcd261077436d24f643f2f64fd5b4c4cb53d980a2f2400f17f2fd6205e8000018002f00350005000ac013c014c009c00a00320038001300040100002aff0100010000000011000f00000c6c656579752d6c6170746f70000a0006000400170018000b00020100 State = 0x246ddb0b246cc225aad5e24c6756cf9c Message-Authenticator = 0x08b295f4b9501d45e89fda21cf14c8ad +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [Capitek.com] No '@' in User-Name = "host/Leeyu-Laptop", looking up realm NULL [Capitek.com] No such realm "NULL" ++[Capitek.com] returns noop [eap] EAP packet type response id 1 length 126 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 116 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 006f], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085c], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 145 to 192.168.0.1 port 3075 EAP-Message = 0x0102040019c0000008a016030100310200002d03014cd4fe1b8df7a54a84f7cb54ee98830b53c41dd5275195bb31ca2bdf975ff9d200002f000005ff01000100160301085c0b0008580008550003a7308203a33082028ba003020102020101300d06092a864886f70d0101040500308192310b300906035504061302434e3110300e060355040813074361706974656b3110300e060355040713074265696a696e6731153013060355040a130c4361706974656b20496e632e3120301e06092a864886f70d010901161161646d696e404361706974656b2e636f6d312630240603550403131d4361706974656b20436572746966696361746520417574 EAP-Message = 0x686f72697479301e170d3130313032333039333530305a170d3131313032333039333530305a307e310b300906035504061302434e3110300e060355040813074361706974656b31153013060355040a130c4361706974656b20496e632e312330210603550403131a4361706974656b205365727665722043657274696669636174653121301f06092a864886f70d010901161261646d696e40654361706974656b2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100cdaab3f206b6cfc36821760b21090968cca6f8342aeb2ad8d1dd45e93b419a2c635a196c4ed6474947d5093a914c84ee21111bf134a3 EAP-Message = 0x43f31ceede8c211b49965710ac8ce6e362addd4d741bdf59fa081bfe86fe3e43cf8289e8ed4e151da4460204318b808959194ba8196e0e6af6d15bd032b1d87a3a34ad2e62982cef6534d7b364afe0241ca534984b2d8d770795fed8e5857bd155a2cc7207d81012fe262344ff32882baa32713ebb2ed1b5d246bcee1dfc31faa51392a1b9578091814034b56bb39fa012062352b08aae929a508b4ec41fe06a071ed6216a360d14253023e52e327bf1b0ebdd2cf0e67b3edc72a134750781b41558f23b9e5cca09558d0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010045 EAP-Message = 0x3a993396c01ab3e963bd6f828ece8d30a9e4783015a3c2fff68c0ac81506ba39520977b7b2c111d64b0da28081fb018e6de7ee2f4ca76271ecff6f3e59b36825d9e1d5c3141fb8e05ff230e16de497169f25a7e62a207b0f231ca98a16154894e02cf279e59ed4f165149775a1eaaa52d6ed58f555684d84b0b3caca3227068bf2591434fce17120f5b4c90d687eb9d7b0e77007f98d4c7751432e2c5e71cfa7ff2ceb8f1a2a05f1e20e8a4d639b091a814059665db63b843c207d5c7e4ab13d572224fbb28fe822e1d1a316af5ecee361cffc24143ff40331b2eb5868d5f751299e7ef832297caf99c1f8a199442ee3e7f0375a492cebfde4c1729001 EAP-Message = 0x0ac70004a8308204a4308203 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x246ddb0b256fc225aad5e24c6756cf9c Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 3075, id=146, length=187 User-Name = "host/Leeyu-Laptop" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "00195b04c9e2" Calling-Station-Id = "001e659fc674" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200061900 State = 0x246ddb0b256fc225aad5e24c6756cf9c Message-Authenticator = 0xafa36e7177fb2841b5512080ba8fa1f6 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [Capitek.com] No '@' in User-Name = "host/Leeyu-Laptop", looking up realm NULL [Capitek.com] No such realm "NULL" ++[Capitek.com] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 146 to 192.168.0.1 port 3075 EAP-Message = 0x010303fc19408ca003020102020900a82c41eeeb4a4d37300d06092a864886f70d0101050500308192310b300906035504061302434e3110300e060355040813074361706974656b3110300e060355040713074265696a696e6731153013060355040a130c4361706974656b20496e632e3120301e06092a864886f70d010901161161646d696e404361706974656b2e636f6d312630240603550403131d4361706974656b20436572746966696361746520417574686f72697479301e170d3130313032333039333434365a170d3131313032333039333434365a308192310b300906035504061302434e3110300e060355040813074361706974656b EAP-Message = 0x3110300e060355040713074265696a696e6731153013060355040a130c4361706974656b20496e632e3120301e06092a864886f70d010901161161646d696e404361706974656b2e636f6d312630240603550403131d4361706974656b20436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100b2d3f0c5f84705f3b0aec33fdcc4d9a052e18fbe093c2a3e147725a85f48153b57bb2cdd3d664a2882e49283cb928f0d7433dbed09bc6f8ed1082bd63ed64e8d6325181bc1124cecb84b9a9e2a143b9fc7562848c826476367e476f530d7d320d774218490b24b0d54 EAP-Message = 0x0d725d80646614ed1ff8f074950ab5b3591857ea0a7a6b96ff6088f38ad60a9aec2afc811468d592ae6f0daa3505b4a771c76cb2e95c849b1606372f2d2eb2c860570eaa98d162f411c0fd6e620912f8f58a44a96376fa7ce14b576fe127a57810128fcd25e63706bb41dee082c5aeeba98d6d650276daa7520d0bd5280cc96c998d68cbe9e0ade80efb32e844b927418d9fdb96865ae90203010001a381fa3081f7301d0603551d0e04160414e411bcc416724dfec735b59ffe5b25952ffe185b3081c70603551d230481bf3081bc8014e411bcc416724dfec735b59ffe5b25952ffe185ba18198a48195308192310b300906035504061302434e3110 EAP-Message = 0x300e060355040813074361706974656b3110300e060355040713074265696a696e6731153013060355040a130c4361706974656b20496e632e3120301e06092a864886f70d010901161161646d696e404361706974656b2e636f6d312630240603550403131d4361706974656b20436572746966696361746520417574686f72697479820900a82c41eeeb4a4d37300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100359ee20c5583cf62b6e23e2986ffc80212677987b02b22ef7bf81e52c6a83ea14a09b12736a0c94d1f6f9fe6ba982abe033a1fab74b1398695263ad861a1ab176498c2ebadcca488a078893acf EAP-Message = 0x6d1762af9cc32f77 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x246ddb0b266ec225aad5e24c6756cf9c Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 3075, id=147, length=187 User-Name = "host/Leeyu-Laptop" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "00195b04c9e2" Calling-Station-Id = "001e659fc674" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0x246ddb0b266ec225aad5e24c6756cf9c Message-Authenticator = 0x09cd348a564b11f4a1a5ee3f8aad59a8 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [Capitek.com] No '@' in User-Name = "host/Leeyu-Laptop", looking up realm NULL [Capitek.com] No such realm "NULL" ++[Capitek.com] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 147 to 192.168.0.1 port 3075 EAP-Message = 0x010400ba1900f2af5e0bbbca5b63619eda4eafebcc8ce7dd49123dec621a9ee82327050c940e017b605759c85305c408f8e295be432e983bc762c496a9d45daa7044bfb8914236f4a38e213c5f16ac998128ca6f463e57823c7ed2e85ede9522f53be56f523460033146a70d509fa700ea0d7b139040adece74cd15c33064e4604d955a0cdbdfca05de47f8dd88d49935506ed4e61e8beb817af9ba7b135faa8ed6f63239f855d144a1887b38ee114f4a916030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x246ddb0b2769c225aad5e24c6756cf9c Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 3075, id=148, length=198 User-Name = "host/Leeyu-Laptop" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "00195b04c9e2" Calling-Station-Id = "001e659fc674" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0204001119800000000715030100020230 State = 0x246ddb0b2769c225aad5e24c6756cf9c Message-Authenticator = 0x540a124a43aaa2b5ab81e6c6c5ae9452 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [Capitek.com] No '@' in User-Name = "host/Leeyu-Laptop", looking up realm NULL [Capitek.com] No such realm "NULL" ++[Capitek.com] returns noop [eap] EAP packet type response id 4 length 17 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 7 [peap] Length Included [peap] eaptls_verify returned 11 *[peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation* [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} ++[bklist] returns noop [sql_oracle] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_oracle] ... expanding second conditional [sql_oracle] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_oracle] expand: %{User-Name:-DEFAULT} -> host/Leeyu-Laptop [sql_oracle] expand: %{Stripped-User-Name:-%{User-Name:-DEFAULT}} -> host/Leeyu-Laptop [sql_oracle] sql_set_user escaped user --> 'host/Leeyu-Laptop' [sql_oracle] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '<Crypted>', '%{reply:Packet-Type}', TO_DATE('%S','yyyy-mm-dd hh24:mi:ss')) -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'host/Leeyu-Laptop', '<Crypted>', 'Access-Reject', TO_DATE('2010-11-06 15:04:59','yyyy-mm-dd hh24:mi:ss')) rlm_sql (sql_oracle) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'host/Leeyu-Laptop', '<Crypted>', 'Access-Reject', TO_DATE('2010-11-06 15:04:59','yyyy-mm-dd hh24:mi:ss')) rlm_sql (sql_oracle): Reserving sql socket id: 17 rlm_sql (sql_oracle): Released sql socket id: 17 ++[sql_oracle] returns ok [attr_filter.access_reject] expand: %{User-Name} -> host/Leeyu-Laptop attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 148 to 192.168.0.1 port 3075 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 144 with timestamp +3 Cleaning up request 1 ID 145 with timestamp +3 Cleaning up request 2 ID 146 with timestamp +3 Cleaning up request 3 ID 147 with timestamp +3 Waking up in 1.0 seconds. Cleaning up request 4 ID 148 with timestamp +3 Ready to process requests. * winxp do not send its hostname to radius server,but win7 will...,and how this happened ?*

2 1

urgent help about login Auth: Login incorrect
by ann kok 07 Nov '10

07 Nov '10

Hi all I am using the NTRadping is fine for user. The radius log is showing "Auth: Login OK:" But when I try it via Lns, it won't work. It shows "Login incorrect" in the same user in NTRadping What is this problem? How can I check it? Thank you so much.

2 3