- Freeradius-Users - lists.freeradius.org

None
by workoutexcite＠yahoo.com 13 Sep '10

13 Sep '10

http://de3wpk.2010healthworld2.com/cap

1 0

help in troubleshooting PEAP authenticathion with XP client
by Stephane Brodeur 13 Sep '10

13 Sep '10

Hi, Can somebody indicates me if there is any log that can help me identifying the problem with my Windows XP client trying to authenticate to the radius server. I do not know how to interpret the RADIUS/DECODE: parse response no app start; FAIL since no communication was establish between the AP and the radius server. Thanks for your help Stephane The following is the debug output from the Ciso AP dot11_auth_dot1x_send_id_req_to_client: Sending identity request to 0012.f078.xxxx *dot11_auth_dot1x_send_id_req_to_client: Client 0012.f078.xxxx timer started for 30 seconds * dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,TIMEOUT) for 0012.f078.xxxx *dot11_auth_dot1x_send_client_fail: Authentication failed for 0012.f078.xxxx *%DOT11-7-AUTH_FAILED: Station 0012.f078.xxxx Authentication failed *dot11_auth_dot1x_send_id_req_to_client: Sending identity request to 0012.f078.xxxx *dot11_auth_dot1x_send_id_req_to_client: Client 0012.f078.xxxx timer started for 30 seconds * dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,EAP_START) for 0012.f078.xxxx * dot11_auth_dot1x_send_id_req_to_client: Sending identity request to 0012.f078.xxxx * dot11_auth_dot1x_send_id_req_to_client: Client 0012.f078.xxxx timer started for 30 seconds * dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,CLIENT_REPLY) for 0012.f078.xxxx *dot11_auth_dot1x_send_response_to_server: Sending client 0012.f078.xxxx data to server * dot11_auth_dot1x_send_response_to_server: Started timer server_timeout 60 seconds RADIUS/ENCODE(0000001A):Orig. component type = DOT11 *RADIUS: AAA Unsupported Attr: ssid [263] 14 *RADIUS: 4D 6F 6E 6F 6E 63 6C 65 5F 53 74 65 [test] *RADIUS: AAA Unsupported Attr: interface [156] 3 RADIUS: 32 [2] RADIUS(0000001A): Storing nasport 281 in rad_db RADIUS(0000001A): Config NAS IP: 10.5.104.22 RADIUS/ENCODE(0000001A): acct_session_id: 26 RADIUS(0000001A): sending RADIUS/DECODE: parse response no app start; FAIL RADIUS/DECODE: parse response; FAIL dot11_auth_dot1x_run_rfsm: Executing Action(SERVER_WAIT,SERVER_FAIL) for 0012.f078.xxxx dot11_auth_dot1x_send_response_to_client: Forwarding serve r message to client 0012.f078.xxxx dot11_auth_dot1x_send_response_to_client: Started timer client_timeout 30 seconds *dot11_auth_dot1x_send_client_fail: Authentication failed for 0012.f078.xxxx *dot11_auth_dot1x_send_id_req_to_client: Sending identity request to 0012.f078.xxxx dot11_auth_dot1x_send_id_req_to_client: Client 0012.f078.xxxx timer started for 30 seconds

2 1

Re: Ignoring EAP-Type/tls because we do not have OpenSSL,> support.
by Douglas Caro 13 Sep '10

13 Sep '10

Hi David and Alexander... thank you, so much... I've tried your tips, but it didn't work... # dpkg -l |grep freeradius ii freeradius 2.1.9+git a high-performance and highly configurable R ii freeradius-common 2.1.9+git FreeRADIUS common files ii freeradius-dialupadmin 2.1.9+git set of PHP scripts for administering a FreeR ii freeradius-ldap 2.1.9+git LDAP module for FreeRADIUS server ii freeradius-utils 2.1.9+git FreeRADIUS client utilities ii libfreeradius-dev 2.1.9+git FreeRADIUS shared library development files ii libfreeradius2 2.1.9+git FreeRADIUS shared library # dpkg -l |grep libssl ii libssl-dev 0.9.8g-15+lenny8 SSL development libraries, header files and ii libssl0.9.8 0.9.8g-15+lenny8 SSL shared libraries # freeradius -v freeradius: FreeRADIUS Version 2.1.9, for host i486-pc-linux-gnu, built on Sep 13 2010 at 09:40:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. The messages keep appearing Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Thanks Douglas

4 4

Freeradius + AD + WiFi + EAP
by Kleber Larroyd 13 Sep '10

13 Sep '10

FreeRADIUS Version 2.1.9, for host x86_64-redhat-linux-gnu Active Directory - Windows Server 2008 Windows Vista (WPA-TKIP / Protected EAP (PEAP)) Wireless Access Point - CISCO WAP4410N File /etc/raddb/eap.conf eap { .... default_eap_type = peap ... peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } } File /etc/raddb/users DEFAULT Auth-Type = ntlm_auth .... File /etc/raddb/modules/mschap mschap { ... with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" ... } File /etc/raddb/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAINTEST --username=%{mschap:User-Name} --password=%{User-Password}" } Files /etc/raddb/sites-enable/inner-tunnel and /etc/raddb/sites-enable/default authenticate { .... ntlm_auth ... } [root@radiusserver etc]# ntlm_auth --request-nt-key --domain=MYDOMAINTEST --username=testuser01 --password=test NT_STATUS_OK: Success (0x0) [root@radiusserver etc]# net join -U Administrator Enter Administrator's password: Using short domain name -- MYDOMAINTEST Joined 'RADIUSSERVER' to realm 'mydomaintest.com' [root@radiusserver /]# radtest testuser01 test localhost 0 teste123 Sending Access-Request of id 51 to 127.0.0.1 port 1812 User-Name = "testuser01" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=51, length=20 Have any idea ? Where can i find the solution ? When i trying connect (windows vista) freeradius server with wireless over access point i get this error: rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=189, length=189 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001401414e47454c4f4e495c63626f6c616e State = 0x6506f8af6507e17f97933c212e541ba3 Message-Authenticator = 0xbd99142be48ec558c3cbe5102cebc556 Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 1 length 20 Mon Sep 13 10:34:21 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:21 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:21 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:21 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:21 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] EAP Identity Mon Sep 13 10:34:21 2010 : Info: [eap] processing type tls Mon Sep 13 10:34:21 2010 : Info: [tls] Initiate Mon Sep 13 10:34:21 2010 : Info: [tls] Start returned 1 Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 189 to 192.168.155.194 port 2050 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed76fc17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 1. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=190, length=300 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202008319800000007916030100740100007003014c8e2884af2dbe79e59a780b7c801b6a6f024ab05ed1164311f8e2c438576298000018002f00350005000ac009c00ac013c01400320038001300040100002f00000014001200000f616e67656c6f6e695c63626f6c616e000a00080006001700180019000b00020100ff01000100 State = 0xd76dd84ed76fc17a0790fefec05add19 Message-Authenticator = 0x93bc32a345dce54fc50f7bbb50ca7e3f Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 2 length 131 Mon Sep 13 10:34:21 2010 : Info: [eap] Continuing tunnel setup. Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns ok Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:21 2010 : Info: [eap] EAP/peap Mon Sep 13 10:34:21 2010 : Info: [eap] processing type peap Mon Sep 13 10:34:21 2010 : Info: [peap] processing EAP-TLS Mon Sep 13 10:34:21 2010 : Debug: TLS Length 121 Mon Sep 13 10:34:21 2010 : Info: [peap] Length Included Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_verify returned 11 Mon Sep 13 10:34:21 2010 : Info: [peap] (other): before/accept initialization Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: before/accept initialization Mon Sep 13 10:34:21 2010 : Info: [peap] <<< TLS 1.0 Handshake [length 0074], ClientHello Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 read client hello A Mon Sep 13 10:34:21 2010 : Info: [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 write server hello A Mon Sep 13 10:34:21 2010 : Info: [peap] >>> TLS 1.0 Handshake [length 085e], Certificate Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 write certificate A Mon Sep 13 10:34:21 2010 : Info: [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 write server done A Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 flush data Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A Mon Sep 13 10:34:21 2010 : Debug: In SSL Handshake Phase Mon Sep 13 10:34:21 2010 : Debug: In SSL Accept mode Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_process returned 13 Mon Sep 13 10:34:21 2010 : Info: [peap] EAPTLS_HANDLED Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 190 to 192.168.155.194 port 2050 EAP-Message = 0x0103040019c0000008a216030100310200002d03014c8e285d2beeb4138d9eee394a996f4f9eca58f023b887efdda363a09db4bff300002f000005ff01000100160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3130303931333132343233355a170d3130313131323132343233355a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ee3a32108e4f3cbfaa7a92d4bd978ca40fc64b2a47661645c8b68d65044435a66076682fd05fa16778a5af94206ffc638de3ca5a2a99a7 EAP-Message = 0xc92a2cf32a0ee4b8318b2f6b48eed7145b30afb76af66a5ceb89811ae04a70d71efd284ddfacd426825d71a59a319b37da2bba0e088bb66183f25f6522af18a4fbd7104c308440dfd10444b93c8548363aa973a8a926a5dd2cdee98ab4334e76941732723504db3bc0d7f7ecbac57fe09389ef3472ad7b952baf531120d84c6e661360774007a6661c46e00344cec67a5626e1cb85d0a20d037aabb885560b01e2fbef6447971424dafda7b2b47a19a8ea30fa59cb5dfce23c3f2a52f1060bcb84f596fc54f37d8f970203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038201010011f6 EAP-Message = 0x5fe6dfff7362f46ed7015696230b784919f57eb0598b8cc5bc5aaafc91fb345324f2d8c409d3f4e89d7e16da467c611f98599c7e33ac6e6bea988f9dc1daad9102b4a4054f0cc9c6b1621088b3e2cc9d31f14adaea05d494919259f69778be393aab6efb9ddbb8d6a5949ae4c0231ff28820d4984cf5b319c9262a1fffc897ed56371008a993b0353d108a68b022384eb79b6b594d27f55fabc4215d96dde86b0e609bef9c04a2306c7c6b396ae07e9039815f0caec47148b6c5a8d5a353449e9d2b61a7f9c88dc86b90b94cfb3e98b1634da1923ba30d55e652d40c11c93eb5f6f1ee7827e134acbd4cc0f07d0b4d206e8df2fa9ecd78881348c1b157 EAP-Message = 0x2b0004ab308204a73082038f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed66ec17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 2. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=191, length=175 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0xd76dd84ed66ec17a0790fefec05add19 Message-Authenticator = 0x149802ee2e900a377b4953192fd43319 Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 3 length 6 Mon Sep 13 10:34:21 2010 : Info: [eap] Continuing tunnel setup. Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns ok Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:21 2010 : Info: [eap] EAP/peap Mon Sep 13 10:34:21 2010 : Info: [eap] processing type peap Mon Sep 13 10:34:21 2010 : Info: [peap] processing EAP-TLS Mon Sep 13 10:34:21 2010 : Info: [peap] Received TLS ACK Mon Sep 13 10:34:21 2010 : Info: [peap] ACK handshake fragment handler Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_verify returned 1 Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_process returned 13 Mon Sep 13 10:34:21 2010 : Info: [peap] EAPTLS_HANDLED Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 191 to 192.168.155.194 port 2050 EAP-Message = 0x010403fc1940a003020102020900fd77376b6dad365e300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3130303931333132343233355a170d3130313131323132343233355a308193310b3009060355040613024652310f300d0603550408130652616469757331 EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d154c97876aafffd6e2c38d8d030b168f8dce7c480ee5e1f2e70f69b644f539598e82c35141f1fc6df2202d717a8d212224f57bd0a0e5e4f6ad9f86ba16f00651842cbf6a8ab15fd2e788309304f5dc5abd95811697d400a611cb69d60e8957024bd0a4fc7ff1267 EAP-Message = 0xb00fc2f26e74c5858497e66019676175f2cf11049781681ba950f2f9e0fc51045f12655aab1cfc4001e7de1bf7ad11cd4ce5a56cfc64f479d1c3fa84ef41275203b542cf17a0c7ea5d00ebdee20c53a432e0568669d036073870a155f3fac928212cdd0e071c5ae65784c83b6ac840dc198d51c6a59c6b1f6273a8c6c8906e0011842b96391df406225ca95c01649e518e235865d44d4d4d0203010001a381fb3081f8301d0603551d0e04160414e3bc4886052780b7f5e868e9f8c2e8188ee3f8b23081c80603551d230481c03081bd8014e3bc4886052780b7f5e868e9f8c2e8188ee3f8b2a18199a48196308193310b300906035504061302465231 EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900fd77376b6dad365e300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100886a41b64009cfdda5cbf1a1acc3b762ae831896a64568f23615de741e3911de3e1539a9cb018be1f0907182306a6296b2ab29391b905e3376391ab24c830be031aefa5e3ebf9f2bbc4862 EAP-Message = 0xec4672b63eb34dbe Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed569c17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 3. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=192, length=175 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400061900 State = 0xd76dd84ed569c17a0790fefec05add19 Message-Authenticator = 0xd66c19cfcb0a9d15888c2f80c474a5de Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 4 length 6 Mon Sep 13 10:34:21 2010 : Info: [eap] Continuing tunnel setup. Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns ok Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:21 2010 : Info: [eap] EAP/peap Mon Sep 13 10:34:21 2010 : Info: [eap] processing type peap Mon Sep 13 10:34:21 2010 : Info: [peap] processing EAP-TLS Mon Sep 13 10:34:21 2010 : Info: [peap] Received TLS ACK Mon Sep 13 10:34:21 2010 : Info: [peap] ACK handshake fragment handler Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_verify returned 1 Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_process returned 13 Mon Sep 13 10:34:21 2010 : Info: [peap] EAPTLS_HANDLED Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 192 to 192.168.155.194 port 2050 EAP-Message = 0x010500bc1900a8c1e930adad128d2a178d8d7a4c345b4f7ddd981d87e3a364ef65216c0e6485d99f22a335b4c31daf8ff28bac0d0375c0c0d6695cbda1d70898a7e2dfb8ddb5a9df14270422a6820bf42284b766a88d819b3a1f33f4962446a852c8a88469e39707436d52148d4c1277c1dbc2c97b1377dc77dca0cfc3374eb968b54acd07df27089f3c611bfddb24c32dd17da21321da1ff5856723398f2d948e896a051e1cf7ebfd5f5989198f265898af4e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed468c17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 4. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=193, length=175 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061900 State = 0xd76dd84ed468c17a0790fefec05add19 Message-Authenticator = 0x25610017540304c1a783aa7777ba392b Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 5 length 6 Mon Sep 13 10:34:21 2010 : Info: [eap] Continuing tunnel setup. Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns ok Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:21 2010 : Info: [eap] EAP/peap Mon Sep 13 10:34:21 2010 : Info: [eap] processing type peap Mon Sep 13 10:34:21 2010 : Info: [peap] processing EAP-TLS Mon Sep 13 10:34:21 2010 : Info: [peap] Received TLS ACK Mon Sep 13 10:34:21 2010 : Info: [peap] ACK handshake fragment handler Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_verify returned 1 Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_process returned 13 Mon Sep 13 10:34:21 2010 : Info: [peap] EAPTLS_HANDLED Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 193 to 192.168.155.194 port 2050 EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed36bc17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 5. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=194, length=171 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001401414e47454c4f4e495c63626f6c616e Message-Authenticator = 0x7fb8c0c166efca06b16e7f0b2c11acc4 Mon Sep 13 10:34:23 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:23 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:23 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:23 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:23 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:23 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:23 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:23 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:23 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:23 2010 : Info: [eap] EAP packet type response id 0 length 20 Mon Sep 13 10:34:23 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:23 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:23 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:23 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:23 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:23 2010 : Info: [eap] EAP Identity Mon Sep 13 10:34:23 2010 : Info: [eap] processing type tls Mon Sep 13 10:34:23 2010 : Info: [tls] Initiate Mon Sep 13 10:34:23 2010 : Info: [tls] Start returned 1 Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 194 to 192.168.155.194 port 2050 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x08a4aa3d08a5b341b6a6388fbdc863a8 Mon Sep 13 10:34:23 2010 : Info: Finished request 6. Mon Sep 13 10:34:23 2010 : Debug: Going to the next request Mon Sep 13 10:34:23 2010 : Debug: Waking up in 3.3 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=195, length=189 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001401414e47454c4f4e495c63626f6c616e State = 0x08a4aa3d08a5b341b6a6388fbdc863a8 Message-Authenticator = 0xdf84203e0b11202af2cae40b8121d33f Mon Sep 13 10:34:23 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:23 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:23 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:23 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:23 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:23 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:23 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:23 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:23 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:23 2010 : Info: [eap] EAP packet type response id 1 length 20 Mon Sep 13 10:34:23 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:23 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:23 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:23 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:23 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:23 2010 : Info: [eap] EAP Identity Mon Sep 13 10:34:23 2010 : Info: [eap] processing type tls Mon Sep 13 10:34:23 2010 : Info: [tls] Initiate Mon Sep 13 10:34:23 2010 : Info: [tls] Start returned 1 Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 195 to 192.168.155.194 port 2050 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa14ba8cfa149b12d443c6d1514b556f1 Mon Sep 13 10:34:23 2010 : Info: Finished request 7. Mon Sep 13 10:34:23 2010 : Debug: Going to the next request Mon Sep 13 10:34:23 2010 : Debug: Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=196, length=175 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200060311 State = 0xa14ba8cfa149b12d443c6d1514b556f1 Message-Authenticator = 0x59b31ae92c6fc003dd396d83f1ae2595 Mon Sep 13 10:34:23 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:23 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:23 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:23 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:23 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:23 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:23 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:23 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:23 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:23 2010 : Info: [eap] EAP packet type response id 2 length 6 Mon Sep 13 10:34:23 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:23 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:23 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:23 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:23 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:23 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:23 2010 : Info: [eap] EAP NAK Mon Sep 13 10:34:23 2010 : Info: [eap] EAP-NAK asked for EAP-Type/leap Mon Sep 13 10:34:23 2010 : Info: [eap] processing type leap Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: Stage 2 Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: Issuing AP Challenge Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: Successfully initiated Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 196 to 192.168.155.194 port 2050 EAP-Message = 0x0103001f11010008ee1c3a6722d72f04414e47454c4f4e495c63626f6c616e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa14ba8cfa048b92d443c6d1514b556f1 Mon Sep 13 10:34:23 2010 : Info: Finished request 8. Mon Sep 13 10:34:23 2010 : Debug: Going to the next request Mon Sep 13 10:34:23 2010 : Debug: Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=197, length=216 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0203002f11010018e3ecbf5161bbb5bd4cac88fff440256581950b19d079df4c414e47454c4f4e495c63626f6c616e State = 0xa14ba8cfa048b92d443c6d1514b556f1 Message-Authenticator = 0xdff169f98e2fa8a9a0b0b17b022b9733 Mon Sep 13 10:34:23 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:23 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:23 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:23 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:23 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:23 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:23 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:23 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:23 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:23 2010 : Info: [eap] EAP packet type response id 3 length 47 Mon Sep 13 10:34:23 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:23 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:23 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:23 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:23 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:23 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:23 2010 : Info: [eap] EAP/leap Mon Sep 13 10:34:23 2010 : Info: [eap] processing type leap Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: No Cleartext-Password or NT-Password configured for this user Mon Sep 13 10:34:23 2010 : Info: [eap] Handler failed in EAP/leap Mon Sep 13 10:34:23 2010 : Info: [eap] Failed in EAP select Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns invalid Mon Sep 13 10:34:23 2010 : Info: Failed to authenticate the user. Mon Sep 13 10:34:23 2010 : Info: Using Post-Auth-Type Reject Mon Sep 13 10:34:23 2010 : Info: +- entering group REJECT {...} Mon Sep 13 10:34:23 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> MYDOMAINTEST\testuser01 Mon Sep 13 10:34:23 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Sep 13 10:34:23 2010 : Info: ++[attr_filter.access_reject] returns updated Mon Sep 13 10:34:23 2010 : Info: Delaying reject of request 9 for 1 seconds Mon Sep 13 10:34:23 2010 : Debug: Going to the next request Mon Sep 13 10:34:23 2010 : Debug: Waking up in 0.9 seconds. Mon Sep 13 10:34:24 2010 : Info: Sending delayed reject for request 9 Sending Access-Reject of id 197 to 192.168.155.194 port 2050 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000

4 3

radacct: detect accounting service
by John 13 Sep '10

13 Sep '10

I want to use 'radacct' to detect whether the accoounting aervice is alive or not. What kind Acct-Status-Type should I include in accounting message? Accouting-On or Accouting-start or others? Can you give some advice? John

2 2

After server rebuild the PEAP against Windows AD is not working any more!
by Difan Zhao 12 Sep '10

12 Sep '10

Hi experts, I'm getting really frustrated on this... I had the server rebuilt with REHL 5 and FreeRadius2.1.7. It was running REHL 4 with FreeRadius2.1.6. It looks like the server will send the last "challenge" and the client won't reply anymore... The ntlm_auth part should be working right because when I do "radtest 'gtcorp\\dzhao' <password> localhost 0 test123" it works fine... Sending Access-Request of id 119 to 127.0.0.1 port 1812 User-Name = "gtcorp\\dzhao" User-Password = "<password>" NAS-IP-Address = 10.26.105.105 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=119, length=41 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3" Tunnel-Preference:0 = 0 However it's not working when I have a laptop plugged in doing PEAP/802.1x with the same user account... The debug output is attached. Please help!! Thanks!!! Difan Zhao, M.Eng Network Engineer Guest-Tek Interactive Entertainment Inc. Email: difan.zhao(a)guest-tek.com Office: +1 (403) 509 1010 ext 3048 Cell: +1 (403) 689 7514 www.guest-tek.com INTERNET | MEDIA | VOICE The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

2 2

Construction of Response-Authenticator
by Theresa Otte 12 Sep '10

12 Sep '10

Hello, I use FreeRADIUS 2.1.8 on Ubuntu 10.4. For my course at university I have to write a program in which I need to re-calculate the response-authenticator (MD5(Code+ID+Length+Request-Auth.+Attributes+Secret)). Does anybody know how FreeRADIUS calculates it? Does it take the binary code of the message fields or an other encoding? When I try to re-calculate it, I never get the same Response-Authenticator as in the Access-Accept-Message. I'm programming with Python and using the libraries of scapy and hashlib. Perhaps anyone of you can help me. Thank you very much!

2 1

Disconnect idle user
by Yevgeny Kosarzhevsky 12 Sep '10

12 Sep '10

Hi, I am using pppd on linux nas. The client has connected, then after some time freeradius server has disappered on the network because of connection issue. The user disconnected when it was still down. Then, after freeradius came up the user wasn't able to login anymore because of simultaneous login check with error 691 on windows. Radius was reporting Reply-Message := "\r\nYou are already logged in - access denied\r\n\n" How to make radius stop thinking the user is connected (like if no Acct-Interim-Update messages received in specified time).

2 5

Re: Strange problem regarding PPTP and FreeRADIUS
by Ali Majdzadeh 12 Sep '10

12 Sep '10

Edvin, Hi Thanks for your response. FreeRADIUS is running on Debian Lenny and PopTop Server is running on a RedHat-based distribution. By the way, in pptpd's logs, I mentioned the following: /etc/radiusclient/radiusclient.conf: line 16: unrecognized keyword: radius_deadtime I know that pppd uses radius.so plugin to perform PAP, CHAP, MS-CHAP and MS-CHAPv2 authentication against a RADIUS server. Might this be the issue? Warm Regards Ali Majdzadeh Kohbanani 2010/9/12 Edvin Seferovic | Kolpinghaus St.Pölten <edvin.seferovic(a)kolp.at> > Might this be a PopTop issue? What platform are you using? > > >Please note those two highlighted lines, the User-Name is "\000ila" while > what I have used as the username is "ali". Also, NAS-IP-Address is somehow > >encrypted. > >I searched a lot, but I could not find any similar problem. Any ideas? > > Regards, > E.S. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 2

Strange problem regarding PPTP and FreeRADIUS
by Ali Majdzadeh 12 Sep '10

12 Sep '10

Hello All I have configured PopTop server to work with FreeRADIUS. pptpd is configured to use mschap-v2 and mppe-128 and I have enabled the corresponding module in FreeRADIUS. When I turn on the debugging mode of FreeRADIUS, I get the following: rad_recv: Access-Request packet from host 192.168.1.15 port 55483, id=227, length=153 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "\000ila" MS-CHAP-Challenge = 0x78b650db2a6af8bc8bc3435c7a385905 MS-CHAP2-Response = 0x6e009982bf378318ac706da61a063b70682d0000000000000000e3dbbe517ba9dc7a18dfe5660208bdc1f370b5d7836516f8 NAS-IP-Address = 0x0f01a8c0e85adab7e41be2bf081ce2bfb005dab7e41be2bf32 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Please note those two highlighted lines, the User-Name is "\000ila" while what I have used as the username is "ali". Also, NAS-IP-Address is somehow encrypted. I searched a lot, but I could not find any similar problem. Any ideas? Warm Regards Ali Majdzadeh Kohbanani

3 3