- Freeradius-Users - lists.freeradius.org

Freeradius + MySql + Wireless Clients without certificates
by Esteban TALAVERA 14 Sep '10

14 Sep '10

Hi I´ll like to know if there is a way to configurates a Radius server + Mysql to authenticate Wireless clients via a Cisco AP without certificates (EAP TLS), only a username and password Thanks -- *Esteban Talavera*

5 10

passing VLAN tag to clients
by matteo＠crs4.it 14 Sep '10

14 Sep '10

Hello, I'm using Freeradius 2.1.8 on Fedora 13 with EAP-TTL and PAP with inner authentication with OpenLDAP as backend. Everything is working fine, but the problem is that I haven't an OpenLDAP "Radius oriented", that is there is no VLAN info in my LDIFs. So, is there a way, external to the authentication process, to pass the vlan tag to the clients so that the ports they're attached to might join the correct vlan? Thanks a lot ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

Details of attrbiutes in SQL Table
by Robin 14 Sep '10

14 Sep '10

Hi, I already installed & run FreeRADIUS in my server successfully (FreeRADIUS with CenterOS, Mikrotik RouterOS). I knew usage of some attributes in SQL tables. For example, Insert into TABLE radgroupcheck, add a group name and attribute - Simultaneous-Use:=1 to limit only 1 user to login. Etc. In wiki or manuals or configuration files (sql.conf/dialup.conf/scheme.sql), I haven’t found details of instructions, how many attributes can be used and how do it write? I wish to know how to do, for example as below: - How to add a record to “radreply” table to set any attributes? (ex. Set timeout length to user) - How to add a record to “”radcheck” table to set any attributes? (ex. Set poolname to user) …. Thank you very much! Robin

1 0

Re: use freeRadius client to connect a java application
by Noura Kossentini 14 Sep '10

14 Sep '10

Hi I proposed to use TinyRadius but they refused it. they consider it (contamination risk AND the IPR risk ) So they opt to FreeRadius Client. It's a C library, had to be used from a Java application, it would need to be called either via JNI, or simply linked into a small C main program and then spawned from Java as an external process. I'm a beginner in c development [?]. someone can help me to do this?? thanks in advance 2010/8/31 Michael Lecuyer <mjl(a)iterpacis.org> > Sorry, I was looking at the client in the freeradius server source. > > Now I'm looking at the same source you are looking at. > > > On 2010-08-31 4:37 AM, Noura Kossentini wrote: > >> i downloaded freeradius-client-1.1.6 and in radiusclient.c I found this >> copyright >> >> /* >> * Copyright (c) 2004 Maxim Sobolev <sobomax(a)FreeBSD.org> >> * All rights reserved. >> * >> * Redistribution and use in source and binary forms, with or without >> * modification, are permitted provided that the following conditions >> * are met: >> * 1. Redistributions of source code must retain the above copyright >> * notice, this list of conditions and the following disclaimer. >> * 2. Redistributions in binary form must reproduce the above copyright >> * notice, this list of conditions and the following disclaimer in the >> * documentation and/or other materials provided with the distribution. >> * >> >> Please send me the link to download free radius client you speak about >> >> In this case (radiusclient is a BSD copyright) can I use JNI?? and how? >> >> thanks >> >> 2010/8/30 Michael Lecuyer <mjl(a)iterpacis.org <mailto:mjl@iterpacis.org>> >> >> >> So our production must be supported on all platforms so I think >> that >> using JNI is the good solution. >> >> >> The radius client is not written in a form suitable for JNI. That is >> to say its not modular in the sense most Java programs are. The >> main() function is the only way to call radclient. The radclient >> main() sets all the internal structures up based on the command line >> arguments. >> >> I've just noticed that the FreeRadius radclient.c is released as the >> GNU General Public License which you can't use with your product. >> You might go with tinyradius (LGPL). There are probably other free >> RADIUS clients written in other languages (python, perl). >> >> /* >> * radclient.c General radius packet debug tool. >> * >> * Version: $Id$ >> * >> * This program is free software; you can redistribute it and/or >> modify >> * it under the terms of the GNU General Public License as >> published by >> * the Free Software Foundation; either version 2 of the License, or >> * (at your option) any later version. >> >> >> On 2010-08-30 8:45 AM, Noura Kossentini wrote: >> >> Hi >> >> Thanks for your detailed answer. >> So our production must be supported on all platforms so I think >> that >> using JNI is the good solution. >> Please can you help me on how to use the JNI with freeradius >> client?? >> >> thanks >> >> >> 2010/8/27 Michael Lecuyer <mjl(a)iterpacis.org >> <mailto:mjl@iterpacis.org> <mailto:mjl@iterpacis.org >> >> <mailto:mjl@iterpacis.org>>> >> >> >> The radclient is limited to CHAP, PAP, and Digest >> authentication >> methods. It can send MSCHAP and MSCHAPV2 if you write the >> code to >> build the request (NT-Response & Challenge) and so on (not >> trivial >> to get right). >> >> Otherwise you can direct your attributes to send to the >> Runtime.exec() >> >> Here's some example code for running the radclient: >> >> import java.io.*; >> >> public class RunRadClient >> { >> public static void main(String[] a) >> { >> try { >> RunRadClient t = new RunRadClient(); >> t.go(a); >> } catch (Exception e) { >> e.printStackTrace(); >> } >> } >> >> private void go(String[] a) throws Exception >> { >> >> try { >> //./radclient -c 2 -i 23 -s -x -f /tmp/radattr >> 192.168.1.187 auth axltest >> String path = >> "/usr/src/freeradius/src/main/radclient"; >> >> String[] cmd = { >> path, >> "-c", "1", // Send on packet. >> "-i", "22", // Packet id (change this each time) >> "-s", // Display summary information. >> "192.168.1.187", // Server >> "auth", // Authentication packet. >> "axltest" // Secret >> }; >> >> // Attributes: >> StringBuffer sb = new StringBuffer(); >> sb.append("NAS-IP-Address=192.168.1.187\n"); >> sb.append("NAS-Port =1\n"); >> sb.append("User-Name=michael\n"); >> sb.append("Chap-Password=test\n"); >> >> Process p = Runtime.getRuntime().exec(cmd); >> >> // For our purposes stdin, stdout, and >> stderr are >> reversed in sense because >> // they relate to the exec'd process. >> BufferedReader stderr = new BufferedReader( new >> InputStreamReader(p.getErrorStream())); >> BufferedReader stdout = new BufferedReader( new >> InputStreamReader(p.getInputStream())); >> BufferedWriter stdin = new BufferedWriter( new >> OutputStreamWriter(p.getOutputStream())); >> >> // Build the attributes as a StringBuilder >> and write >> them to stdout. >> stdin.write(sb.toString(), 0, sb.length()); >> stdin.flush(); >> stdin.close(); >> >> p.waitFor(); >> int exitValue = p.exitValue(); >> if (exitValue != 0) >> { >> System.out.println("Error running >> command, >> exit = " + exitValue); >> } >> String line; >> while ((line = stdout.readLine()) != null) >> { >> System.out.println(line); >> } >> } catch (Exception e) { >> System.err.println("Exec failed" + >> e.getMessage()); >> e.printStackTrace(); >> } >> >> } >> } >> >> The result is this, which must be parsed to extract any >> response >> attributes and to get the packet status. >> >> Sending Access-Request of id 100 to 192.168.1.187 port 1812 >> NAS-IP-Address = 192.168.1.187 >> NAS-Port = 1 >> User-Name = "michael" >> CHAP-Password = 0x64234c1d14fde1c04c8590c13b8c9aa181 >> rad_recv: Access-Accept packet from host 192.168.1.187 port >> 1812, >> id=100, length=85 >> Reply-Message = "Howdy." >> Cisco-Attr-0 = 0x683332332d63757272656e63793d555344 >> Cisco-Attr-0 = 0x436973636f2d586d69742d526174653d3939 >> Framed-IP-Address = 192.123.231.123 >> >> Total approved auths: 1 >> Total denied auths: 0 >> Total lost auths: 0 >> >> >> >> >> On 2010-08-27 9:24 AM, Noura Kossentini wrote: >> >> Hi >> >> thanks for quick answer. >> Can you help me on how to use JNI with freeradius client?? >> >> >> 2010/8/27 Michael Lecuyer <mjl(a)iterpacis.org >> <mailto:mjl@iterpacis.org> >> <mailto:mjl@iterpacis.org <mailto:mjl@iterpacis.org>> >> <mailto:mjl@iterpacis.org <mailto:mjl@iterpacis.org> >> >> <mailto:mjl@iterpacis.org <mailto:mjl@iterpacis.org>>>> >> >> >> >> You have two methods: JNI (Java native interface) to >> call the >> Freeradius client or purchase a very good Java >> RADIUS Client API >> from AXLRadius.com >> >> >> On 2010-08-27 7:05 AM, Noura Kossentini wrote: >> >> Hi, >> >> In our company it's forbidden to use products >> with GPL >> License. >> So I ca >> not use Jradius client to connect my client >> application to a >> radius server. >> >> Since that FreeRadius is distributed under BSD, >> it's >> allowed to >> me to >> use this library. >> >> My queqtion is can you help me on how can I >> connect and >> authenticate my >> java application to a radius server using >> FreeRadius >> client?? >> >> Thanks in advance >> >> Regards >> Noura >> >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> >> >> >> >> >> >> >

2 2

Login Incorrect !
by Paulo Maia 14 Sep '10

14 Sep '10

Hi guys , Im trying to authenticate freeradius against passwd , but i keep getting Login Incorrect error , im doing EAP/PEAP mschapv2 I dont know what im missing I can perform a radtest with sucess . Here is the ouput rad_recv: Access-Request packet from host 192.168.0.1 port 2048, id=187, length=232 User-Name = "momo" NAS-Port = 0 Called-Station-Id = "00-22-B0-45-DF-69:SapoNet" Calling-Station-Id = "00-22-FB-73-31-DA" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02080050190017030100201c877f9482d13faf8e1619e14f1e0d909fa7983b184bb9f05c95a6cb6a845796170301002049a23598867fa02bfcf83108e8cb2130d7ebda59dd41304c300ea048c8bfa68d State = 0xad18a6f8aa10bf33ac12d56bfa8b4024 Message-Authenticator = 0xc8a9f7c084d0b839d9340a38c5e328aa +- entering group authorize {...} ++[preprocess] returns ok ++[unix] returns updated [eap] EAP packet type response id 8 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [momo/<via Auth-Type = EAP>] (from client SapoNet port 0 cli 00-22-FB-73-31-DA) Delaying reject of request 26 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 26 Sending Access-Reject of id 187 to 192.168.0.1 port 2048 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1.0 seconds. Here is the conf main { user = "root" group = "root" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.1 { require_message_authenticator = no secret = "teste123" shortname = "SapoNet" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } } # modules } # serverlisten { type = "auth" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on proxy address * port 1814 Ready to process requests. Hope somebody can help me out ! Thanks , radiusd: #### Opening IP addresses and Ports #### Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 dh_key_length = 512 verify_depth = 0 radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients ####

3 2

How to determine packet-type in proxy-reply
by Chidanand Gangur 14 Sep '10

14 Sep '10

Hi, I am using freeRADIUS verison 2.1.9. I am trying to add some attribute in proxy-reply, I want to do it only if it is Access-Accept packet. I am trying to achieve it using unlang. I have tried following options and none of them have worked if (%{proxy-reply:Packet-Type} == 2) { } if(proxy-reply:Packet-Type == "Access-Accept"){ } if(reply:Packet-Type == "Access-Accept"{ } if(proxy-reply:Packet-Type == "2"){ } Tue Sep 14 06:34:14 2010 : Info: +- entering group post-proxy {...} Tue Sep 14 06:34:14 2010 : Info: ++? if (proxy-reply:Packet-Type == "2") Tue Sep 14 06:34:14 2010 : Info: (Attribute proxy-reply:Packet-Type was not found) I have read there is meta-attribute as Packet-Type but do not know how to access it, please point me to document which explains meta-attribute or suggest me how do I access packet-type -- Chidanand Gangur Pune.

2 3

interpret check-Item and change reply-item to set VLAN
by Michael Bathe 14 Sep '10

14 Sep '10

Hallo Liste, is there any how_to or solution to interpret the ldap checkItem and change the replyItem (I think in inner-tunnel)? f.e.: If the checkItem match one of 'sec11', 'Sec11', 'SEC11'... the replyItem should be set to '111'. ldap.attrmap: checkItem Tunnel-Private-Group-Id sectionNetwork replyItem Tunnel-Private-Group-Id sectionNetwork the following in users file wont work: DEFAULT Tunnel-Private-Group-Id == "sec11" Tunnel-Private-Group-Id=111, Reply-Message += "changed " DEFAULT Auth-Type == EAP Tunnel-Medium-Type = "IEEE-802", Tunnel-Type = "VLAN", Reply-Message += "Access success for %{User-Name}.", Fall-Through = no I use FreeRADIUS Version 2.1.6, for host i386-pc-solaris2.8, openLDAP, 802.1x with mschapv2. This works fine for me. radiusd -X output: ... rlm_ldap: performing search in dc=domain,dc=de, with filter (uid=user) checking if remote access for user is allowed by uid looking for check items in directory... rlm_ldap: sectionNetwork -> Tunnel-Private-Group-Id:0 == "sec11" rlm_ldap: sambaNTPassword -> NT-Password == <removed> rlm_ldap: sambaLMPassword -> LM-Password == <removed> looking for reply items in directory... rlm_ldap: sectionNetwork -> Tunnel-Private-Group-Id:0 = "sec11" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ... ++[eap] returns ok } # server inner-tunnel Got tunneled reply code 2 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Reply-Message = "Access success for user." Tunnel-Private-Group-Id:0 = "sec11" EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user" Got tunneled reply RADIUS code 2 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Reply-Message = "Access success for user." Tunnel-Private-Group-Id:0 = "sec11" EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user" Tunneled authentication was successful. SUCCESS Saving tunneled attributes for later ++[eap] returns handled ... Sending Access-Accept of id 131 to 10.0.0.12 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Reply-Message = "Access success for user." Tunnel-Private-Group-Id:0 = "sec11" User-Name = "user" MS-MPPE-Recv-Key = 0x611ed2d5955bded1d3302045c5930fd4aad610a0b6f5aa1045ba0477f12b7eee MS-MPPE-Send-Key = 0xc38e1cad9590596e3902a46a40706ad8bde70f05bde110698b631b503c00f51b EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 10. ... thanks and beste Gruesse Michael

3 3

a lot of memory inuse
by Strong, Mark 14 Sep '10

14 Sep '10

Hi Guys, I have free radius 2.1.6, and it has quite a chunk of memory inuse at the moment, are there any known issues with this version and memory leaks? It's running on CentOS 4.7 32 bit, compiled with this version of MySQL 5.0.20a-0.rhel4 (which isn't standard on CentOS 4.7). I started with this source rpm freeradius-2.1.6-2.fc10.src.rpm And has handled 430,000 requests since it started approx one month ago. Regards Mark Strong

1 0

ippool and cache-size
by Konstantin Chekushin 14 Sep '10

14 Sep '10

Hi all. I have a question about rlm_ippool and cache-size option. Info from description: cache-size: The gdbm cache size for the db files. Should be equal to the number of ip's available in the ip pool. Also, note the cache size matches the number of IP's in your pool. More is OK but wasteful, less is very bad. My pool size is 32k. And I'm using this pool only for fallback issue. So, I'll need it rarely in the future. If cache-size = 32768, then radiusd process takes all memory. "Mon Sep 13 12:33:46 2010 : Error: Couldn't fork: Cannot allocate memory" If cache-size = 16384 : top: PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                 3061 freerad   20   0  304m 261m 1080 S    0 52.1   0:00.00 radiusd radiusd takes 261m! :-[ ] So, here is my question. If I'll use default cache-size =800, and at some point radius will start using this pool, what will happen if all 800 ip-addresses will be taken? Will the system slowdown, or if there will be a segmentation fault or something else? Why is "less is very bad"?

2 3

Cisco AP + MySql + EAPTLS
by Esteban TALAVERA 14 Sep '10

14 Sep '10

Hi I have installed freeradius recently with MySQL and tested with success to authenticate VTY session en cisco routers and switches. However, my configuration with EAP_TLS is not working properly. I use a Cisco AP I create and copy the certificates to a Windows XP SP3 laptop to test if everything is OK, but in "freeradius -X" mode I got a lot of message and none give me the reason of the problem. The AP says authentication failed and the Radius server sends the challenge an wait, and later clean all request an "becomes" ready to process requests. here is a portion of the output of the radius activity Its appears that certificates are accepted, but XP stations continue trying to authenticated THANKS ===================================== rad_recv: Access-Request packet from host 10.10.10.5 port 1645, id=16, length=176 User-Name = "prueba1@mydomain" Framed-MTU = 1400 Called-Station-Id = "a8b1.d422.d432" Calling-Station-Id = "0019.d20c.4ed4" Service-Type = Login-User Message-Authenticator = 0x7c4ac4a412db3b9cfba443de50792eed EAP-Message = 0x0202001b01707275656261314062616e636f706c617a612e636f6d NAS-Port-Type = Wireless-802.11 NAS-Port = 19153 NAS-Port-Id = "19153" NAS-IP-Address = 10.10.10.5 NAS-Identifier = "AP_CISCO" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "mydomain.com" for User-Name = "prueba1@mydomain" [suffix] No such realm "mydomain" ++[suffix] returns noop [eap] EAP packet type response id 2 length 27 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> prueba1@mydomain [sql] sql_set_user escaped user --> 'prueba1@mydomain' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'prueba1@mydomain' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'prueba1@mydomain' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'TI' ORDER BY id [sql] User found in group TI [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'TI' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 16 to 10.10.10.5 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x765770697654693c62d8b4b34c9394a6 Finished request 0. Going to the next request . . ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 70 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0041], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 05c7], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 0082], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 18 to 10.10.10.5 port 1645 . . . [tls] --> verify return:1 [tls] TLS_accept: SSLv3 read client certificate A [tls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [tls] TLS_accept: SSLv3 read client key exchange A [tls] <<< TLS 1.0 Handshake [length 0086], CertificateVerify [tls] TLS_accept: SSLv3 read certificate verify A [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [tls] <<< TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 read finished A [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [tls] TLS_accept: SSLv3 write change cipher spec A [tls] >>> TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 write finished A [tls] TLS_accept: SSLv3 flush data [tls] (other): SSL negotiation finished successfully SSL Connection Established [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 20 to 10.10.10.5 port 1645 EAP-Message = 0x010700900099090099099999010001011603010020164176d954d98c1d1daf5753815c720f6ef0f6e55dc05b2d682f44342e259e66 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7657706972507d3c62d8b4b34c9394a6 Finished request 4. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 16 with timestamp +7 Cleaning up request 1 ID 17 with timestamp +7 Cleaning up request 2 ID 18 with timestamp +7 Cleaning up request 3 ID 19 with timestamp +7 Cleaning up request 4 ID 20 with timestamp +7 Ready to process requests. ===================================== -- *Esteban Talavera* * *

2 1