- Freeradius-Users - lists.freeradius.org

MSCHAP vs MSCHAPv2 for VPN
by freeradius＠corwyn.net 13 Oct '10

13 Oct '10

Using freeradius 2.1.8, I have a sonicwall firewall that authenticates VPN users against the freeradius server. The VPN clients are the native MSFT VPN client. When the client is configured for L2TP, MS-CHAP, the client connects. When the client is configured for L2TP MSChapv2, the client fails to connect with an error "It was not possible to verify the identity of the server" As I understand it, the difference between mschapv1 and v2 is that the server sends back an authentication response. Seems like that handshake isn't working out? I know I've missed something somewhere. . . radiusd -xX: rad_recv: Access-Request packet from host 192.168.104.1 port 3873, id=22, length=124 User-Name = "rsteeves" MS-CHAP-Challenge = 0x68dd158c5082247cfe49fecd9520386a MS-CHAP2-Response = 0x010005edd3135eca19372073504d57f8a4b30000000000000000ab31aff8b876e703bb4141ddc19afff921f6a358cd80b94b NAS-IP-Address = x.x.x.x NAS-Port = 0 Wed Oct 13 14:50:57 2010 : Info: server server_vpn { Wed Oct 13 14:50:57 2010 : Info: +- entering group authorize {...} Wed Oct 13 14:50:57 2010 : Info: ++[preprocess] returns ok Wed Oct 13 14:50:57 2010 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Wed Oct 13 14:50:57 2010 : Info: ++[mschap] returns ok Wed Oct 13 14:50:57 2010 : Debug: [ldap] Entering ldap_groupcmp() Wed Oct 13 14:50:57 2010 : Info: [files] expand: OU=Enterprise,DC=int,DC=example,DC=com -> OU=Enterprise,DC=int,DC=example,DC=com Wed Oct 13 14:50:57 2010 : Info: [files] expand: %{Stripped-User-Name} -> Wed Oct 13 14:50:57 2010 : Info: [files] ... expanding second conditional Wed Oct 13 14:50:57 2010 : Info: [files] expand: %{User-Name} -> rsteeves Wed Oct 13 14:50:57 2010 : Info: [files] expand: (&(sAMAccountname=%{%{Stripped-User-Name}:-%{User-Name}})(objectClass=person)) -> (&(sAMAccountname=rsteeves)(objectClass=person)) Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=example,DC=com, with filter (&(sAMAccountname=rsteeves)(objectClass=person)) Wed Oct 13 14:50:57 2010 : Error: [ldap] ldap_search() failed: LDAP connection lost. Wed Oct 13 14:50:57 2010 : Info: [ldap] Attempting reconnect Wed Oct 13 14:50:57 2010 : Debug: [ldap] attempting LDAP reconnection Wed Oct 13 14:50:57 2010 : Debug: [ldap] closing existing LDAP connection Wed Oct 13 14:50:57 2010 : Debug: [ldap] (re)connect to dc.int.example.com:389, authentication 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] bind as CN=_UserID,OU=Service Accounts,OU=Special User Accounts,OU=Enterprise,DC=int,DC=example,DC=com/wvyjCHCd2LJHcNrmpr0I to dc.int.example.com:389 Wed Oct 13 14:50:57 2010 : Debug: [ldap] waiting for bind result ... Wed Oct 13 14:50:57 2010 : Debug: [ldap] Bind was successful Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=example,DC=com, with filter (&(sAMAccountname=rsteeves)(objectClass=person)) Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Oct 13 14:50:57 2010 : Info: [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))) Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=example,DC=com, with filter (&(cn=VPN_Users)(|(&(objectClass=GroupOfNames)(member=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom)))) Wed Oct 13 14:50:57 2010 : Debug: [ldap] object not found Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in CN=Rick Steeves,OU=IS,OU=Users,OU=Enterprise,DC=int,DC=example,DC=com, with filter (objectclass=*) Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in CN=VPN_Users,OU=Security Groups,OU=Enterprise,DC=int,DC=example,DC=com, with filter (cn=VPN_Users) Wed Oct 13 14:50:57 2010 : Debug: rlm_ldap::ldap_groupcmp: User found in group VPN_Users Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Oct 13 14:50:57 2010 : Info: [files] users: Matched entry DEFAULT at line 11 Wed Oct 13 14:50:57 2010 : Info: ++[files] returns ok Wed Oct 13 14:50:57 2010 : Info: [ldap] performing user authorization for rsteeves Wed Oct 13 14:50:57 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> Wed Oct 13 14:50:57 2010 : Info: [ldap] ... expanding second conditional Wed Oct 13 14:50:57 2010 : Info: [ldap] expand: %{User-Name} -> rsteeves Wed Oct 13 14:50:57 2010 : Info: [ldap] expand: (&(sAMAccountname=%{%{Stripped-User-Name}:-%{User-Name}})(objectClass=person)) -> (&(sAMAccountname=rsteeves)(objectClass=person)) Wed Oct 13 14:50:57 2010 : Info: [ldap] expand: OU=Enterprise,DC=int,DC=example,DC=com -> OU=Enterprise,DC=int,DC=example,DC=com Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=example,DC=com, with filter (&(sAMAccountname=rsteeves)(objectClass=person)) Wed Oct 13 14:50:57 2010 : Info: [ldap] looking for check items in directory... Wed Oct 13 14:50:57 2010 : Info: [ldap] looking for reply items in directory... Wed Oct 13 14:50:57 2010 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Wed Oct 13 14:50:57 2010 : Info: [ldap] user rsteeves authorized to use remote access Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Oct 13 14:50:57 2010 : Info: ++[ldap] returns ok Wed Oct 13 14:50:57 2010 : Info: ++? if (Huntgroup-Name == "VPN_Huntgroup") Wed Oct 13 14:50:57 2010 : Info: ? Evaluating (Huntgroup-Name == "VPN_Huntgroup") -> TRUE Wed Oct 13 14:50:57 2010 : Info: ++? if (Huntgroup-Name == "VPN_Huntgroup") -> TRUE Wed Oct 13 14:50:57 2010 : Info: ++- entering if (Huntgroup-Name == "VPN_Huntgroup") {...} Wed Oct 13 14:50:57 2010 : Info: +++? if (Ldap-Group == "VPN_Users") Wed Oct 13 14:50:57 2010 : Debug: [ldap] Entering ldap_groupcmp() Wed Oct 13 14:50:57 2010 : Info: expand: OU=Enterprise,DC=int,DC=example,DC=com -> OU=Enterprise,DC=int,DC=example,DC=com Wed Oct 13 14:50:57 2010 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))) Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=example,DC=com, with filter (&(cn=VPN_Users)(|(&(objectClass=GroupOfNames)(member=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom)))) Wed Oct 13 14:50:57 2010 : Debug: [ldap] object not found Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in CN=Rick Steeves,OU=IS,OU=Users,OU=Enterprise,DC=int,DC=example,DC=com, with filter (objectclass=*) Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in CN=VPN_Users,OU=Security Groups,OU=Enterprise,DC=int,DC=example,DC=com, with filter (cn=VPN_Users) Wed Oct 13 14:50:57 2010 : Debug: rlm_ldap::ldap_groupcmp: User found in group VPN_Users Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Oct 13 14:50:57 2010 : Info: ? Evaluating (Ldap-Group == "VPN_Users") -> TRUE Wed Oct 13 14:50:57 2010 : Info: +++? if (Ldap-Group == "VPN_Users") -> TRUE Wed Oct 13 14:50:57 2010 : Info: +++- entering if (Ldap-Group == "VPN_Users") {...} Wed Oct 13 14:50:57 2010 : Info: ++++[ok] returns ok Wed Oct 13 14:50:57 2010 : Info: +++- if (Ldap-Group == "VPN_Users") returns ok Wed Oct 13 14:50:57 2010 : Info: +++ ... skipping else for request 2: Preceding "if" was taken Wed Oct 13 14:50:57 2010 : Info: ++- if (Huntgroup-Name == "VPN_Huntgroup") returns ok Wed Oct 13 14:50:57 2010 : Info: Found Auth-Type = MSCHAP Wed Oct 13 14:50:57 2010 : Info: +- entering group MS-CHAP {...} Wed Oct 13 14:50:57 2010 : Info: [mschap] Told to do MS-CHAPv2 for rsteeves with NT-Password Wed Oct 13 14:50:57 2010 : Info: [mschap] expand: --username=%{mschap:User-Name} -> --username=rsteeves Wed Oct 13 14:50:57 2010 : Info: [mschap] No NT-Domain was found in the User-Name. Wed Oct 13 14:50:57 2010 : Info: [mschap] expand: --domain=%{mschap:NT-Domain:-int.example.com} -> --domain= Wed Oct 13 14:50:57 2010 : Info: [mschap] mschap2: 68 Wed Oct 13 14:50:57 2010 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=39232bda5539ec44 Wed Oct 13 14:50:57 2010 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=ab31aff8b876e703bb4141ddc19afff921f6a358cd80b94b Wed Oct 13 14:50:57 2010 : Debug: Exec-Program output: NT_KEY: DDE9BB9EA12ED17BE5F358CB53EE6A8F Wed Oct 13 14:50:57 2010 : Debug: Exec-Program-Wait: plaintext: NT_KEY: DDE9BB9EA12ED17BE5F358CB53EE6A8F Wed Oct 13 14:50:57 2010 : Debug: Exec-Program: returned: 0 Wed Oct 13 14:50:57 2010 : Info: [mschap] adding MS-CHAPv2 MPPE keys Wed Oct 13 14:50:57 2010 : Info: ++[mschap] returns ok Wed Oct 13 14:50:57 2010 : Auth: Login OK: [rsteeves] (from client VPN_Fay port 0) Wed Oct 13 14:50:57 2010 : Info: +- entering group post-auth {...} Wed Oct 13 14:50:57 2010 : Info: ++[exec] returns noop Wed Oct 13 14:50:57 2010 : Info: } # server server_vpn Sending Access-Accept of id 22 to 192.168.104.1 port 3873 Reply-Message := "Authorized Users Only" MS-CHAP2-Success = 0x01533d39353639333834444241444635364135383445383643433543433231384234303431383736343144 MS-MPPE-Recv-Key = 0x18fe4b2752e2b4ff2cc2f0d951f26c42 MS-MPPE-Send-Key = 0xe25177ef572676aa3f9883443c93fbc1 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Wed Oct 13 14:50:57 2010 : Info: Finished request 2. Wed Oct 13 14:50:57 2010 : Debug: Going to the next request Wed Oct 13 14:50:57 2010 : Debug: Waking up in 4.9 seconds. Wed Oct 13 14:51:02 2010 : Info: Cleaning up request 2 ID 22 with timestamp +991 Wed Oct 13 14:51:02 2010 : Info: Ready to process requests. Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

2 1

freeradius 2.1.10 DHCP not responding
by Zietz, Marco 13 Oct '10

13 Oct '10

Hi, I'm playing with freeradius acting as DHCP-server - which is a magnificent idea! Got a little problem getting it up and running. Already checked any comments in sources, list archive, recent git patches related to dhcp and my favourite search engine. Also used two different machines with other nic's. Used ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.10.tar.bz2 and followed directions in raddb/sites-enabled/dhcp. Configure, make and make install with no errors/warnings. But radiusd does not react to any DHCP-discover. I can see the discovers coming in via tcpdump but radiusd -X remains quiet: ============================= linux:/usr/local/src# tcpdump -vvvni eth0 tcpdump: WARNING: eth0: no IPv4 address assigned tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 17:19:09.548866 vlan 72, p 0, IP (tos 0x0, ttl 64, id 17503, offset 0, flags [none], proto UDP (17), length 377) 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from bc:05:43:41:1d:8d, length 349, xid 0x7e969d44, Flags [none] (0x0000) Client-Ethernet-Address bc:05:43:XX:1d:8d [|bootp] 17:19:00.583066 vlan 73, p 0, IP (tos 0x0, ttl 64, id 2146, offset 0, flags [none], proto UDP (17), length 373) 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from bc:05:43:41:1d:8e, length 345, xid 0x48413368, Flags [none] (0x0000) Client-Ethernet-Address bc:05:43:XX:1d:8e [|bootp] ============================= linux:/usr/local# /usr/local/sbin/radiusd -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Oct 13 2010 at 16:06:27 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/dhcp.net2 including configuration file /usr/local/etc/raddb/sites-enabled/dhcp.net1 including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server dhcp { # from file /usr/local/etc/raddb/sites-enabled/dhcp.net2 modules { Module: Checking dhcp DHCP-Discover {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "ok" from file /usr/local/etc/raddb/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Checking dhcp DHCP-Request {...} for more modules to load Module: Checking dhcp (null) {...} for more modules to load /usr/local/etc/raddb/sites-enabled/dhcp.net2[123]: No name specified for Post-Auth-Type block } # modules } # server server dhcp { # from file /usr/local/etc/raddb/sites-enabled/dhcp.net1 modules { Module: Checking dhcp DHCP-Discover {...} for more modules to load Module: Checking dhcp DHCP-Request {...} for more modules to load Module: Checking dhcp (null) {...} for more modules to load /usr/local/etc/raddb/sites-enabled/dhcp.net1[123]: No name specified for Post-Auth-Type block } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "dhcp" ipaddr = 192.168.73.10 port = 67 } listen { type = "dhcp" ipaddr = 192.168.72.10 port = 67 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on dhcp interface vlan73 address 192.168.73.10 port 67 as server dhcp Listening on dhcp interface vlan72 address 192.168.72.10 port 67 as server dhcp Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ============================= linux:/usr/local/etc/raddb/sites-available# egrep -v "^$|^[[:space:]]*#" dhcp.net1 server dhcp { listen { ipaddr = 192.168.72.10 port = 67 type = dhcp interface = vlan72 broadcast = yes } dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update reply { DHCP-Domain-Name-Server = XXX.65.0.XXX DHCP-Domain-Name-Server = XXX.65.31.XXX DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 192.168.72.1 DHCP-IP-Address-Lease-Time = 400 DHCP-DHCP-Server-Identifier = 192.168.72.10 } ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = XXX.65.0.XXX DHCP-Domain-Name-Server = XXX.65.31.XXX DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 192.168.72.1 DHCP-IP-Address-Lease-Time = 400 DHCP-DHCP-Server-Identifier = 192.168.72.10 } ok } dhcp { reject } } =================================== Any hint appreciated! If you need extra info let me know. Thank you for your help! Cheers Marco

3 2

Calling-Station-Id Empty value
by Moayad Mohammad 13 Oct '10

13 Oct '10

Dears, I am using freeradius with wichorus ASN-GW (WiMAX), I have problem with Calling-Station-Id value The ASN-GW sent Calling-Station-Id in binary format like this "\000&\031\001\000K" I checked the debug radius -X result and I found the AAA got the correct value for Calling-Station-Id but when insert it to database it's will be empty value like Calling-Station-Id='' (Empty Value) What's the problem? And how can insert the Calling-Station-Id value to radacct table? The SQL statement for accounting_start_query for example is: accounting_start_query = "INSERT into ${acct_table1} (AccStatusType, AcctSessionId, AcctUniqueId, UserName, \ NASIPAddress, NASPortId, NASPortType, WiMAXGMTTimezoneoffset, WiMAXBSId, EventTimestamp, CallingStationId, \ AcctStartTime, AcctStopTime, AcctSessionTime, AcctInputOctets, \ AcctOutputOctets, AcctTerminateCause, FramedIPAddress ) \ select '%{Acct-Status-Type}', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%{WiMAX-GMT-Timezone-offset}', \ '%{WiMAX-BS-Id}', '%{Event-Timestamp}', '%{Calling-Station-Id}', '%S', '0', '0', '0', '0','', \ '%{Framed-IP-Address}' from dual where not exists (select * from ${acct_table1} where UserName='%{SQL-User-Name}' and AcctSessionId='%{Acct-Session-Id}' \ and AcctStartTime='%S')" Regards, Moayad

2 1

Autz-Type examples and parse error
by Harry Hoffman 13 Oct '10

13 Oct '10

Hi All, I'm following along with the docs for Autz-Type in freeradius-2.1.8, specifically the section about selecting between multiple instances of a module. In users.conf I have: DEFAULT Realm == "siteone.edu", Autz-Type := siteone_ldap, Auth-Type := siteone_ldap In sites-enabled/default I have: authorize{ preprocess chap mscap suffix ntdomain Autz-Type siteone_ldap{ siteone_ldap } ... } authenticate{ ... Auth-Type siteone_ldap { siteone_ldap } } In proxy.conf I have: realm "siteone.edu" { authhost = LOCAL accthost = LOCAL } When I run radiusd -XC I get the following parse error: /etc/raddb/users[205]: Parse error (check) for entry DEFAULT: Unknown value siteone_ldap for attribute Autz-Type Errors reading /etc/raddb/users As far as I can tell I'm following the example verbatim. Can someone shed some light on why I'm getting the parse error? Below if full debug output: [root@avocet raddb]# radiusd -XC FreeRADIUS Version 2.1.8, for host i386-redhat-linux-gnu, built on Jan 19 2010 at 18:23:59 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/siteone_ntlm_auth including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/siteone_ldap including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm siteone.edu { authhost = LOCAL accthost = LOCAL } realm siteone { authhost = LOCAL accthost = LOCAL } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Skipping instantiation of expiration Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Skipping instantiation of mschap Module: Linked to module rlm_ldap Module: Skipping instantiation of ldap Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/radius.siteone.edu-key.pem" certificate_file = "/etc/raddb/certs/radius.siteone.edu-cert.pem" CA_file = "/etc/pki/tls/cert.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Instantiating ntdomain realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } /etc/raddb/users[205]: Parse error (check) for entry DEFAULT: Unknown value siteone_ldap for attribute Autz-Type Errors reading /etc/raddb/users /etc/raddb/modules/files[7]: Instantiation failed for module "files" /etc/raddb/sites-enabled/inner-tunnel[111]: Failed to find module "files". /etc/raddb/sites-enabled/inner-tunnel[34]: Errors parsing authorize section.

3 5

Re: jradius 1.1.3
by David Bird 13 Oct '10

13 Oct '10

awesome.. Thanks! > David Bird wrote: > > Be sure to upgrade your rlm_jradius ! (probably the most common issue we > > hear about; I submitted a patch a while back, but haven't followed it > > up) > > I'll get it into 2.1.11. > > Alan DeKok. > >

1 0

Removing domain name in freeradius
by Mark Holmes 13 Oct '10

13 Oct '10

Hi all, Currently when users connect to our WLAN they enter their username thus:- firstname.lastname(a)mydomain.ox.ac.uk Is there a way I can strip everything after the @ out (ie the domain) - so they are forced to authenticate against the domain I specify. At the moment in my test environment, as long as I DONT specify the domain it works - so I'm looking to strip out the domain name if they DO specify it. Cheers, Mark

5 10

jradius 1.1.3
by David Bird 13 Oct '10

13 Oct '10

Hello, For those using rlm_jradius, there is a new release of the JRadius server: http://www.coova.org/JRadius Be sure to upgrade your rlm_jradius ! (probably the most common issue we hear about; I submitted a patch a while back, but haven't followed it up) Get it from (also included in java distro): http://dev.coova.org/svn/cjradius/trunk/freeradius/rlm_jradius/ There have also been improvements with the RADIUS simulator/client in supporting RadSec, EAP-TLS, EAP-TTLS/PAP, and PEAP. Screen shots and basic info: http://coova-docs.s3.amazonaws.com/JRadiusSimulator.pdf Cheers, David

2 1

Netscreen 208 and Freeradius
by Ramzi Abdallah 13 Oct '10

13 Oct '10

Hi, I am trying to configure netscreen 208 firewall to authenticate and account for users traffic when they login via the captive portal. I have installed freeradius 2.1.9 on Fedora core 13. in the /etc/raddusers I added the bellow entry for rsa rsa Cleartext-Password := "nopass" Service-Type = Framed-User in the /etc/raddb/clients.conf I added client 193.188.129.33 { nastype = other secret = 12345 shortname = vdk-u-nsaaa when user rsa logs in to the captive portal the authentication is successful however user rsa still can not access the internet rad_recv: Access-Request packet from host 193.188.129.33 port 49715, id=1, length=49 User-Name = "rsa" User-Password = "nopass" NAS-IP-Address = 193.188.129.33 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rsa", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry rsa at line 70 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "nopass" [pap] Using clear text password "nopass" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 1 to 193.188.129.33 port 49715 Service-Type = Framed-User Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 1 with timestamp +135 Ready to process requests. thank you for your help Regards, Ramzi

3 2

EAP-TLS authentication allows me to authenticate with invalid certificate.
by Terry Simons 13 Oct '10

13 Oct '10

Hi, I'm running into an issue where FreeRADIUS allows an invalid certificate (one not signed by my configured CA) to successfully authenticate to EAP-TLS. There's a message in the log that clearly indicates that the CA wasn't found (--> verify error:num=20:unable to get local issuer certificate) , yet my authentication succeeds. I'm using FreeRADIUS version 2.1.10 with a largely default configuration (home-grown certificates). I want this authentication to fail because the certificate that the client is using was not signed by the CA that I have configured with the CA_file directive, therefore it should be considered an invalid EAP-TLS attempt. Has anyone seen this before? I couldn't find any related messages in the FreeRADIUS archive. Thanks, Here's the log: rad_recv: Access-Request packet from host 192.168.19.12 port 1035, id=39, length=189 User-Name = "AutomationUser" NAS-IP-Address = 192.168.19.12 NAS-Identifier = "honeybutter" NAS-Port = 0 Called-Station-Id = "00-19-77-1F-8A-D1:HiveAP120-WPA2" Calling-Station-Id = "00-25-00-43-5E-13" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000013014175746f6d6174696f6e55736572 Message-Authenticator = 0xebf0b398f32dc38984552b06634ef90e # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "AutomationUser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [opendirectory] The host 192.168.19.12 does not have an access group. ++[opendirectory] returns ok ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 39 to 192.168.19.12 port 1035 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd2fcae5dd2fda306cc163ff247674563 Finished request 37. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.19.12 port 1035, id=40, length=352 User-Name = "AutomationUser" NAS-IP-Address = 192.168.19.12 NAS-Identifier = "honeybutter" NAS-Port = 0 Called-Station-Id = "00-19-77-1F-8A-D1:HiveAP120-WPA2" Calling-Station-Id = "00-25-00-43-5E-13" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100a40d800000009a16030100950100009103014cb5184f29200ee95888008e509e4cf7d61e39b9688acd0a179f3f12fd982b03000056c00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a00170019000101000012000a00080006001700180019000b00020100 State = 0xd2fcae5dd2fda306cc163ff247674563 Message-Authenticator = 0xbaf4c3763aa24c9f8ecb1bc1695bfbe4 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "AutomationUser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 164 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [opendirectory] The host 192.168.19.12 does not have an access group. ++[opendirectory] returns ok ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 154 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0095], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 069f], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00af], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 40 to 192.168.19.12 port 1035 EAP-Message = 0x010204000dc000000787160301002a0200002603014cb5183db33a52670f42ebf1dd1d323435c9d1727572176f37deae32bcdf256400002f00160301069f0b00069b0006980002cf308202cb30820234a003020102020101300d06092a864886f70d010105050030819c310b3009060355040613025553311330110603550408130a43616c69666f726e69613112301006035504071309437570657274696e6f31143012060355040a130b4170706c652c20496e632e3110300e060355040b1307436f6d6d735141311530130603550403130c4175746f6d6174696f6e43413125302306092a864886f70d010901161674657272792e73696d6f6e7340 EAP-Message = 0x6170706c652e636f6d301e170d3130313031303033313233365a170d3230313030393033313233365a3081a0310b3009060355040613025553311330110603550408130a43616c69666f726e69613112301006035504071309437570657274696e6f31143012060355040a130b4170706c652c20496e632e3110300e060355040b1307436f6d6d73514131193017060355040313104175746f6d6174696f6e5365727665723125302306092a864886f70d010901161674657272792e73696d6f6e73406170706c652e636f6d30819f300d06092a864886f70d010101050003818d00308189028181009c863c44ddc7f8e2d9153ce65d246a4576e7cad0 EAP-Message = 0x693a37f44cf8e71fbd4010fb0287128c6e4a5eae040a9d806ba510d76026c536a6e44a1341630f76a472f3a324aff010ccf26e168a523e9dac5b131512b6534209c4ddf0059e456767fef96ab15996e3e9e6d8c06aed16032ed09ec81a79e5cf2fcad21d43f93a382ef64afd0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100b3ab384f900eb95db0b5f932639f532d7993d262e5d4f95b0caf2f6778dc3f7ead0361033974828f3a564aa7642760c93c5f3293c69f4f13ed309bee53a0dcee4a07d59994d34a7e51ddef376f87c8ab8614f9e14dd233d1c7f7cb3af4dc571b EAP-Message = 0x2c456a6e2a857a132a9d26d2acc4be820b7c6265a0b541f3f31067a8ce921b7a0003c3308203bf30820328a003020102020900aee0069109e88a1e300d06092a864886f70d010105050030819c310b3009060355040613025553311330110603550408130a43616c69666f726e69613112301006035504071309437570657274696e6f31143012060355040a130b4170706c652c20496e632e3110300e060355040b1307436f6d6d735141311530130603550403130c4175746f6d6174696f6e43413125302306092a864886f70d010901161674657272792e73696d6f6e73406170706c652e636f6d301e170d3130313031303033303831335a170d32 EAP-Message = 0x30313030393033303831335a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd2fcae5dd3fea306cc163ff247674563 Finished request 38. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.19.12 port 1035, id=41, length=194 User-Name = "AutomationUser" NAS-IP-Address = 192.168.19.12 NAS-Identifier = "honeybutter" NAS-Port = 0 Called-Station-Id = "00-19-77-1F-8A-D1:HiveAP120-WPA2" Calling-Station-Id = "00-25-00-43-5E-13" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200060d00 State = 0xd2fcae5dd3fea306cc163ff247674563 Message-Authenticator = 0xa475a2642ff359874a9fc61a5522e311 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "AutomationUser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [opendirectory] The host 192.168.19.12 does not have an access group. ++[opendirectory] returns ok ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 41 to 192.168.19.12 port 1035 EAP-Message = 0x0103039b0d800000078730819c310b3009060355040613025553311330110603550408130a43616c69666f726e69613112301006035504071309437570657274696e6f31143012060355040a130b4170706c652c20496e632e3110300e060355040b1307436f6d6d735141311530130603550403130c4175746f6d6174696f6e43413125302306092a864886f70d010901161674657272792e73696d6f6e73406170706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100eba6920d4e7026b5b56be1ffe4a92657531f57f5ec3151a3b08536f2c15ac37e6ca83945576dc7fa534379f00849d14f3ccb630c0cceff EAP-Message = 0x7c032eeedceda81ede4979d9c11aa32b94e13d2c55911c8910d74fe834a062c563b76f66377ba558adf01c29ad786385dcf067324f087f4e62f9bce9f1a15c0238d7068e6bff2436910203010001a382010530820101301d0603551d0e041604143d14bac4f677ed18b87223f0ef167fa28fb245a03081d10603551d230481c93081c680143d14bac4f677ed18b87223f0ef167fa28fb245a0a181a2a4819f30819c310b3009060355040613025553311330110603550408130a43616c69666f726e69613112301006035504071309437570657274696e6f31143012060355040a130b4170706c652c20496e632e3110300e060355040b1307436f6d6d EAP-Message = 0x735141311530130603550403130c4175746f6d6174696f6e43413125302306092a864886f70d010901161674657272792e73696d6f6e73406170706c652e636f6d820900aee0069109e88a1e300c0603551d13040530030101ff300d06092a864886f70d010105050003818100e533646f2f3626e199b1617ea96c40568f8c210f770373587881beb74e8c5b439c6b43e075567d0fba0bcfdcf62e70bdca8240ca0156ea160648f09650898f1e4569aaccd3108a95d94a07f59f60b127626399f132d34825e5100c9986d7754d2a45b743d8b75037f032cb30e071a1128486e433f69a6039f6c06926a88e777716030100af0d0000a70301024000a100 EAP-Message = 0x9f30819c310b3009060355040613025553311330110603550408130a43616c69666f726e69613112301006035504071309437570657274696e6f31143012060355040a130b4170706c652c20496e632e3110300e060355040b1307436f6d6d735141311530130603550403130c4175746f6d6174696f6e43413125302306092a864886f70d010901161674657272792e73696d6f6e73406170706c652e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd2fcae5dd0ffa306cc163ff247674563 Finished request 39. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.19.12 port 1035, id=42, length=1274 User-Name = "AutomationUser" NAS-IP-Address = 192.168.19.12 NAS-Identifier = "honeybutter" NAS-Port = 0 Called-Station-Id = "00-19-77-1F-8A-D1:HiveAP120-WPA2" Calling-Station-Id = "00-25-00-43-5E-13" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020304360d800000042c16030102d60b0002d20002cf0002cc308202c830820231a003020102020102300d06092a864886f70d010105050030819b310b3009060355040613025553311330110603550408130a43616c69666f726e69613112301006035504071309437570657274696e6f31143012060355040a130b4170706c652c20496e632e3110300e060355040b1307436f6d6d735141311430120603550403130b526f7474656e4170706c653125302306092a864886f70d010901161674657272792e73696d6f6e73406170706c652e636f6d301e170d3130313031323138333633355a170d3230313031313138333633355a30819e310b3009 EAP-Message = 0x060355040613025553311330110603550408130a43616c69666f726e69613112301006035504071309437570657274696e6f31143012060355040a130b4170706c652c20496e632e3110300e060355040b1307436f6d6d735141311730150603550403130e4175746f6d6174696f6e557365723125302306092a864886f70d010901161674657272792e73696d6f6e73406170706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100db2c1fc69d20a42a3101c93df6d6db4fab40fb77fdefd5334ba3ccfca3032417aefb71deb9ef75f51182010940a03c618ca1a879af099d1470fc8d8fcfd3d4d9cc3d1672bb7f EAP-Message = 0xed5c015ef660cbdb2f75eae83c658683164773db3ba34782fbba6ead164839b6b555c94fc355d24228545474a2d7a4ae732982ebffdaf3bb20fd0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010105050003818100505a1fcf9aa9fc38d3cc0fb6f6e2edfe0ab50af4aa358726dfd784e69461e3f0c539360a94995cce8bf85bf4f1cc53bd8eda704b135a698e89d157d042d602d1f78c2bbb4a3f2cc2fb9113b9d03f71f731c71cd9360ef4f762403e7c14fcd112401c7217321dbc1d2fb8b2168c0651c2eaade2f1292f4a7c5f8904a2c1844cfd16030100861000008200801ef0cf7c185512 EAP-Message = 0x86b4f42b2374ad3345f22e10c90614b872fa5688df1621c9acadc08593d71659adf9cce1550e199d0e0da86d99e25bab70888873d38f07f42e0c4a344fb5d3fc5788de9cacf4c182fb06fd176afd9a65d9297bea1e73acd3ffa6dfbc70e1014a2c7f6cf8f3d5342d96aaa32a1311b89e455586816c7b57564516030100860f0000820080a9de35c71327f318ebb962597c6f6503e073afe5aa279c1822463224fe189022c50ec10a915947ae451e3d39d798106d9ff5bfe7600ad6ce0da735ba4613898facdb2889ac642ed2efc1ca6e81b79594678e055fba42fddd1d16634b85b641587d349fe39e127080b9f8695a962c8ca0480f7b52cf6cbafa1e EAP-Message = 0x5ff67080001aa11403010001011603010030a11644efce0b94b9179c2e9aa9eb472e0869267e0bf174beae262e5f4e4bd0583db05bd6bf51fba61ba940eca8e658b0 State = 0xd2fcae5dd0ffa306cc163ff247674563 Message-Authenticator = 0x2a124c92c4da145bbd47a068a71f4293 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "AutomationUser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [opendirectory] The host 192.168.19.12 does not have an access group. ++[opendirectory] returns ok ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 1068 [tls] Length Included [tls] eaptls_verify returned 11 [tls] <<< TLS 1.0 Handshake [length 02d6], Certificate --> verify error:num=20:unable to get local issuer certificate [tls] TLS_accept: SSLv3 read client certificate A [tls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [tls] TLS_accept: SSLv3 read client key exchange A [tls] <<< TLS 1.0 Handshake [length 0086], CertificateVerify [tls] TLS_accept: SSLv3 read certificate verify A [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [tls] <<< TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 read finished A [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [tls] TLS_accept: SSLv3 write change cipher spec A [tls] >>> TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 write finished A [tls] TLS_accept: SSLv3 flush data [tls] (other): SSL negotiation finished successfully SSL Connection Established [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 42 to 192.168.19.12 port 1035 EAP-Message = 0x010400450d800000003b14030100010116030100308aeb9012d08c6b2e742f6f6defcbe397ce58cb4911aeeba0c6c2ac6d4e45b941898218a5e1bf55e35ed26ee1a29b3464 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd2fcae5dd1f8a306cc163ff247674563 Finished request 40. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.19.12 port 1035, id=43, length=194 User-Name = "AutomationUser" NAS-IP-Address = 192.168.19.12 NAS-Identifier = "honeybutter" NAS-Port = 0 Called-Station-Id = "00-19-77-1F-8A-D1:HiveAP120-WPA2" Calling-Station-Id = "00-25-00-43-5E-13" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400060d00 State = 0xd2fcae5dd1f8a306cc163ff247674563 Message-Authenticator = 0x34e48ce176b27309dbd3b53091ad3816 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "AutomationUser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [opendirectory] The host 192.168.19.12 does not have an access group. ++[opendirectory] returns ok ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake is finished [tls] eaptls_verify returned 3 [tls] eaptls_process returned 3 [tls] Adding user data to cached session [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 43 to 192.168.19.12 port 1035 MS-MPPE-Recv-Key = 0x08d815790ebfb9a13cc81f79b0c756c8126e52f63338fd882c458eb019a48533 MS-MPPE-Send-Key = 0x1bc9637fd958191a0127c04a9b84812644caba495fcfc5ec3d3b02edc08fd72e EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "AutomationUser" Finished request 41. Going to the next request Waking up in 4.7 seconds. rad_recv: Accounting-Request packet from host 192.168.19.12 port 1031, id=44, length=169 Acct-Session-Id = "4CB26D4B-0000007B" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "AutomationUser" NAS-IP-Address = 192.168.19.12 NAS-Identifier = "honeybutter" NAS-Port = 0 Called-Station-Id = "00-19-77-1F-8A-D1:HiveAP120-WPA2" Calling-Station-Id = "00-25-00-43-5E-13" NAS-Port-Type = Wireless-802.11 Connect-Info = "11ng" Vendor-26928-Attr-1 = 0x00000000 # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.19.12,NAS-IP-Address = 192.168.19.12,Acct-Session-Id = "4CB26D4B-0000007B",User-Name = "AutomationUser"' [acct_unique] Acct-Unique-Session-ID = "246d28e49e4f15d2". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "AutomationUser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.19.12/detail-20101012 [detail] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.19.12/detail-20101012 [detail] expand: %t -> Tue Oct 12 19:23:57 2010 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> AutomationUser ++[radutmp] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> AutomationUser attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 44 to 192.168.19.12 port 1031 Finished request 42. Cleaning up request 42 ID 44 with timestamp +371 Going to the next request Waking up in 4.7 seconds.

2 1

Defining an Auth-Type based on a realm
by Mathew Rowley 12 Oct '10

12 Oct '10

Is there a typical way to set an Auth-Type := Kerberos¹ when a user is part of a specific realm? For testing purposes, I am able to add this to the users¹ file: DEFAULT Auth-Type := Kerberos But, will need something based on realm in the future.

3 5