- Freeradius-Users - lists.freeradius.org

mac authentication
by Raymond Norton 18 Aug '10

18 Aug '10

I have a working set up using wpa2 with freeradius and ldap. I need to set up host authentication instead of user authentication. I am using LAM to manage ldap and have added a couple host accounts, but I keep getting a login page from the hotspot. The problem could be a config issue on any device, but I am curious if there is a config change I need to make on freeradius to accommodate passing mac addresses to ldap rather than user credentials? (I want to use ldap for authentication instead of adding the host info to the config of freeradius.) Raymond

2 2

FreeRadius on MacOS X Server
by Andreas Hubert 18 Aug '10

18 Aug '10

Hi all, I need help with the freeradius 2.1.3 in MacOS X Server. At the Apple discussion forum I don't get any answer. :( Using this version: radiusd: FreeRADIUS Version 2.1.3, for host i386-apple-darwin10.0, built on Feb 11 2010 at 02:25:02 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. In short terms, Apple is trying to make it easy, with the serveradmin you can just add an Apple Airport and it will be configured automatically for radius authentication with the open directory server. If I then try to connect to the WLAN, I see this message in the RADIUS log: Fri Aug 13 14:46:50 2010 : Auth: rlm_opendirectory: User <ahu> is authorized. Fri Aug 13 14:46:59 2010 : Error: rlm_eap: No EAP session matching the State variable. I also activated the debug mode and it came out this: radiusd: #### Opening IP addresses and Ports #### Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.214.100 port 65527, id=35, length=162 User-Name = "ahu" NAS-IP-Address = 192.168.214.100 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-38-07:Andreas Huberts Netzwerk" Calling-Station-Id = "00-25-00-41-AD-F3" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x02eb000801616875 Message-Authenticator = 0xbf4e12e4c08fe497d93f036e78d9629d rlm_opendirectory: The host 192.168.214.100 does not have an access group. rlm_opendirectory: User <ahu> is authorized. Sending Access-Challenge of id 35 to 192.168.214.100 port 65527 EAP-Message = 0x01ec00061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7643105976af05ff18e41e4ad6d190e3 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.214.100 port 65527, id=36, length=336 User-Name = "ahu" NAS-IP-Address = 192.168.214.100 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-38-07:Andreas Huberts Netzwerk" Calling-Station-Id = "00-25-00-41-AD-F3" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x02ec00a415800000009a16030100950100009103014c65432b508949d3aa234f3918396b1fcd3fc7210ed299f0517fadf848a1e035000056c00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a00170019000101000012000a00080006001700180019000b00020100 State = 0x7643105976af05ff18e41e4ad6d190e3 Message-Authenticator = 0x8d68f17c3a5ee3cd61864c91fddc73be Sending Access-Challenge of id 36 to 192.168.214.100 port 65527 EAP-Message = 0x01ed035a158000000350160301002a0200002603014c65432bf1c8143b2611d52b71758554023eb6d883ed38f8b702c5fefdc1f92200002f0016030103130b00030f00030c00030930820305308201eda003020102020101300b06092a864886f70d01010530313122302006035504030c197873657276652d706172612d312e63656e73686172652e6465310b3009060355040613024445301e170d3039303932353134353334335a170d3130303932353134353334335a30313122302006035504030c197873657276652d706172612d312e63656e73686172652e6465310b300906035504061302444530820122300d06092a864886f70d01010105 EAP-Message = 0x000382010f003082010a0282010100b4b403f2e1b82e661ad564ed3b1c3953e5a71d922072239d7d0a739a2642ebb8dc193e610c34f4d06def71c8a9c081f37d6ef34d470eaed391cb21c2363c32c9712844156aed85a0a839d93452113fb915fc70ad9bce2f0d11a70c71311c125e6f66e6d6373cbbd2553d088f60db92e59d168d87c28309f73e10f5485fd5c2c60451297ec618f4261e9441ab4e7992cfc72b1f555e7a3597936dcc894601a5c2168e3a672febc7e69a343045ac62bc8d0fb5f7d87a93a99e4c9f18e24e281b5ea6c5533b4785c1954f35fdecfa64a3017af4f9ae8331eb7245d8912ae70750320cb801673874a568b25ad5c3a586 EAP-Message = 0x6e9dd6c58969b5dbeaa46a208e9208ce0dcd0203010001a32a3028300e0603551d0f0101ff04040302029430160603551d250101ff040c300a06082b06010505070301300d06092a864886f70d01010505000382010100262f875e3f0a16e09ca6df3ce3fafe205f9d943c1dfeba61376d4a5920413e6b0d4624c76544e015c8816ae1dca1aa840eb46eb692477976e9a782f035f2b96a0c4e214c42593bebd70d72e3c08afe877de86d9257a4395dfaabbc3ce8cf76f22bbfa4b4726821763f14dca93d707ebd916f36bddb0dadda01ceb37fc84175c5ee15701b0f4627d7f46beb3b39e4b9ab2ec881677c36ec591f2d39e998dc69c14a8983e14575 EAP-Message = 0x83749dba69683b8f0974b4744e39aa1dba0cf926299a0d3f6e674d90fc70398fb49e2523dbbb00dcd54da3ec354dab350c190b5f3b7b2b2e032f63bf898e8ba323724abc12b4baad64938e8d1baebafebf9715debd36a2f7c59816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7643105977ae05ff18e41e4ad6d190e3 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.214.100 port 65527, id=37, length=510 User-Name = "ahu" NAS-IP-Address = 192.168.214.100 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-38-07:Andreas Huberts Netzwerk" Calling-Station-Id = "00-25-00-41-AD-F3" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x02ed015015800000014616030101061000010201003cab4843d2e07fc6be3d8b609e4395e7e8d5384784d6d5167707d57acef126ef7ddc80bc88a4b8f5f62b8835d29067c57e8df4bf447dedc7901e912503e6b6282fe347ecaef6e444d1a1604a7aab2e06b10cd8c3b38dfdb8bc81e29f65eb8adc9477d68b85c228a592ccef185805be2f0bba92fe1958463313524f300aac5254e0638e7dfdfcacc4e1b0c52059cf01976a2aa0b26840002494217b09341b868d71f4d6a8ee9ba71016e6fa19234f6e3e51d6676a92b942fcb0b214aa662d1ee46b49cd8ecf9c6a7983806d666cf879408500c3317630b192645a397edf5a36099d41b3a4fa10c2ff EAP-Message = 0x720b129c78752985cb0a418707b6eef0374ac4d38d144f7a14030100010116030100300150ef833c69851dae48a01e85bb4873fbec4399dc0b7c132a9953846b3e91139f90a88397a05d1ee2550874bac964fd State = 0x7643105977ae05ff18e41e4ad6d190e3 Message-Authenticator = 0xd4d3f8e0f2568572259589129bc719af Sending Access-Challenge of id 37 to 192.168.214.100 port 65527 EAP-Message = 0x01ee004515800000003b1403010001011603010030bbda33956ff9087b5291d1bf33e7bd7783b7e5a8334901c991146359bea1295b708aacf8a4f66486889750fe3f6c8969 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7643105974ad05ff18e41e4ad6d190e3 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.214.100 port 65527, id=37, length=510 Sending Access-Challenge of id 37 to 192.168.214.100 port 65527 Waking up in 1.9 seconds. Ready to process requests. rad_recv: Access-Request packet from host 192.168.214.100 port 65527, id=37, length=510 User-Name = "ahu" NAS-IP-Address = 192.168.214.100 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-38-07:Andreas Huberts Netzwerk" Calling-Station-Id = "00-25-00-41-AD-F3" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x02ed015015800000014616030101061000010201003cab4843d2e07fc6be3d8b609e4395e7e8d5384784d6d5167707d57acef126ef7ddc80bc88a4b8f5f62b8835d29067c57e8df4bf447dedc7901e912503e6b6282fe347ecaef6e444d1a1604a7aab2e06b10cd8c3b38dfdb8bc81e29f65eb8adc9477d68b85c228a592ccef185805be2f0bba92fe1958463313524f300aac5254e0638e7dfdfcacc4e1b0c52059cf01976a2aa0b26840002494217b09341b868d71f4d6a8ee9ba71016e6fa19234f6e3e51d6676a92b942fcb0b214aa662d1ee46b49cd8ecf9c6a7983806d666cf879408500c3317630b192645a397edf5a36099d41b3a4fa10c2ff EAP-Message = 0x720b129c78752985cb0a418707b6eef0374ac4d38d144f7a14030100010116030100300150ef833c69851dae48a01e85bb4873fbec4399dc0b7c132a9953846b3e91139f90a88397a05d1ee2550874bac964f State = 0x7643105977ae05ff18e41e4ad6d190e3 Message-Authenticator = 0xd4d3f8e0f2568572259589129bc719af rlm_eap: No EAP session matching the State variable. [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request Waking up in 0.9 seconds. Sending Access-Reject of id 37 to 192.168.214.100 port 65527 Waking up in 4.9 seconds. Ready to process requests. Does anyone know what could be wrong here? I hope I can find here some helpful people here rather than in the Apple discussion forum, where nobody know deeply stuff. Thanks Andreas

3 16

users file question
by Aqdas Muneer 18 Aug '10

18 Aug '10

hello, I have setup a freeradius server version 2.1.7 using ldap for authentication. What i'm having trouble understanding is that in my users file i have a local user called admin. The default user account (for ldap) is listed before the admin account in the users file. since i have not configured Fall-Through i would expect the admin account to not be accessible if ldap query fails, but it is accessible. is my assumption wrong? here is the output from my user file. DEFAULT Huntgroup-Name == "network-admin", Ldap-Group == "networkadmins" Service-Type := NAS-Prompt-User, cisco-avpair := "shell:priv-lvl=15", # Auth-Type := LDAP admin Cleartext-Password := "Bl@rd3Ry" Service-Type := NAS-Prompt-User, cisco-avpair := "shell:priv-lvl=15" DEFAULT Auth-Type := Reject Reply-Message := "Access Denied. Your attemp has been logged."

2 5

NAS-Identifier instead of IP address
by tyllerd 18 Aug '10

18 Aug '10

Hi. I would like to know if its possible to rather define clients with NAS-Identifier & secret instead of IP address & secret. Because some NASes are behind ADSL connections with dynamic IP's I think this would be a lot better that having a client 0.0.0.0/0 and secret key. Is this possible to do? Regards. -- View this message in context: http://old.nabble.com/NAS-Identifier-instead-of-IP-address-tp29442681p29442… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

WLAN SSID:
by Armin Meier 18 Aug '10

18 Aug '10

Hello! I configured freeradius to authenticate my WLAN Clients over Active Directory. Depending on the Group Membership. Also i configured multiple SSIDs on my WLAN switch, so a client request in freeradis debug output includes the following Attributes: rad_recv: Access-Request packet from host 172.21.254.100 port 32775, id=40, length=402 Acct-Multi-Session-Id = "00-0F-61-50-B7-B0-00-21-5C-40-BD-77-4C-6B-A5-8B-00-04-72-98" Acct-Session-Id = "4295d4b3-00000118" NAS-Port = 275 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "msm710" NAS-IP-Address = 172.21.254.101 Framed-MTU = 1496 User-Name = "myDomain\\myUser" Calling-Station-Id = "00-21-5C-40-BD-77" Called-Station-Id = "00-0F-61-50-B7-B0" Service-Type = Framed-User EAP-Message = 0x0277002d1900170301002293ed3bcfbb751eb66e4c737a442b8a2cf55f4a7812bfc8829d4a00049e221bce4309 State = 0x50052ead557237c49cf458a2fbedd583 Colubris-AVPair = "ssid=guest-wlan" Colubris-AVPair = "incoming-vlan-id=152" Colubris-AVPair = "group=internal" Colubris-AVPair = "vsc-unique-id=1" Colubris-AVPair = "phytype=IEEE802dot11g" Colubris-Attr-250 = 0x00000002 Colubris-Attr-249 = 0xac157909 Message-Authenticator = 0x8d9162f11111ae7f047641224f07213a My goal is to move authorized users depending on the SSID to a different VLAN, i tried the following in the "hints" file, but that does not work, can somebody help me? DEFAULT Colubris-AVPair =~ ".*guest-wlan.*" Reply-Message = "Hints", Framed-Protocol = "PPP", Service-Type = "Framed", Tunnel-Type := "VLAN", Tunnel-Medium-Type := "IEEE-802", Tunnel-Private-Group-Id := "120" I Expected that the Attributes set in the "hints" file and the ones set in the "users" file are merged in the reply from freeradius, but that seems not so.

2 1

Recommendation
by Paul Dugas 18 Aug '10

18 Aug '10

I've got an OpenLDAP directory using the SMB-LDAP schema and tools. Also have a FreeRadius 1.x instance setup to support authentication of PPTP users on my m0n0wall machine. The system has worked fine for a few years. I'm now looking to setup WPA2-Enterprises WiFi access and am looking for direction. I see there are lots of protocol options but I'm not sure of the merits of one over another. I do not completely understand the implications of my LDAP directory on the decision either. What I'm really looking for at this point is foe someone to recommend the right approach for my installation. I'm looking to use WPA2-Enterprises and accounts stored in my existing LDAP directory. I need to support primarily WinXP wireless clients but I also need my Linux (Fedora) machines to work as well as a few smartphones (Blackberry, iPhone, etc). Thanks in advance for any direction. Paul

4 10

Logging for Assets and Customers
by Christian Rahl 18 Aug '10

18 Aug '10

I am trying to have the ability to log all logins with very specific information so that we can track customer and asset access. I would like this information to be added to the radius mysql in a separate table. This information would include MAC address, last IP, and if possible the last NAS IP. All I really need to know is how to get a script to run with the radius so that it requests that information, or just pulls that information from the connection. Any ideas on how to do this would be extremely helpful. Thank you, Christian RIT Applied Networking and System Admin Rochester Institute of Technology Email: Rahl.Christian(a)gmail.com

3 2

Interesting issue with mapping accounts
by Natr Brazell 17 Aug '10

17 Aug '10

On my juniper gear I have 3 tiered profiles (tier1,2 and 3) each with varying permissions (tier3=SuperUser and tier1=readonly). Using LDAP I map specific users to these profiles so when bob.smith logs in I pass the the VSA Juniper-Local-User-Name = tier3 from the radius server and bob.smith logs in. Accounting data is logged as bob.smith too. Here's the wierd part. If bob goes home in the evening and doesn't log out of a router, the accounting log shows bob.smith (STOP) after a certain amount of time however the accounting log show 'tier3' still logged in. Any ideas? N

2 2

curious network problem
by Antony King 17 Aug '10

17 Aug '10

Hi all, I'm a bit of a radius noob, so if what I'm trying to do is daft for whatever reason, please be gentle!! I'm trying to set up a radius server as part of a WPA2 enterprise project. It is using EAP/TTLS/MSCHAPv2 to authenticate. On my test system ('goodserver'), an Ubuntu box, with freeradius 2.1.7 compiled from source as per the advice here : http://www.linuxinsight.com/building-debian-freeradius-package-with-eap-tls- ttls-peap-support.html, it all works fine, with local and remote clients. I've tested this using eapol_test, using a command line like this: goodserver# eapol_test -c e2.conf -alocalhost -p1812 -s testing123 -r0 and: remoteserver# eapol_test -c e2.conf -agoodserver -p1812 -s radiustest -r0 e2.conf contains this: network={ ssid="radius" key_mgmt=WPA-EAP eap=TTLS identity="john" anonymous_identity="anonymous" password="password1" phase2="autheap=MSCHAPv2" } It also works fine from several wrt54GL boxes running Tomato. The 'live' server is a centos5.5 box. I've tried with the standard freeradius2 package (version 2.1.7) and a version compiled from SRPMS in case there was a problem with ttls in that version. The configuration was copied over from the test server, with new keys generated but otherwise unchanged. Locally, it authenticates correctly, using the first of the two commands above. If I try and authenticate from a remote system (eg, a NAS or my test server), it refuses to do the ttls negotiation. Here's a snippet from radiusd -X the live server for a request from localhost that worked: [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_checkval: Item Name: Calling-Station-Id, Value: 02-00-00-00-00-01 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 and here's the equivalent bit when a remote system tries to authenticate: [eap] EAP packet type response id 0 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_checkval: Item Name: Calling-Station-Id, Value: 02-00-00-00-00-01 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.21.126 port 50659 EAP-Message = 0x010100160410e0e066ae00aed2f10a808e81c37dd0c7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x919a3359919b374cb07bfc1d3989d37e Finished request 25 The rest of the conversation up to that point is broadly the same; I've attached the failing log below, followed by a working log. Any suggestions would be greatly appreciated. Thanks, Antony. ----------------------------------------------------------------------------------------------- Complete failing radiusd -X log in response to a remote system attempting authentication: rad_recv: Access-Request packet from host 192.168.21.126 port 50659, id=0, length=126 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0x6182aca4f8b2133d63750c2c5b131ada +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_checkval: Item Name: Calling-Station-Id, Value: 02-00-00-00-00-01 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.21.126 port 50659 EAP-Message = 0x010100160410e0e066ae00aed2f10a808e81c37dd0c7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x919a3359919b374cb07bfc1d3989d37e Finished request 25. Going to the next request Waking up in 4.10 seconds. rad_recv: Access-Request packet from host 192.168.21.126 port 50659, id=0, length=126 Sending duplicate reply to client DLCorpWifi port 50659 - ID: 0 Sending Access-Challenge of id 0 to 192.168.21.126 port 50659 Waking up in 1.9 seconds. Cleaning up request 25 ID 0 with timestamp +4166 Ready to process requests. rad_recv: Access-Request packet from host 192.168.21.126 port 50659, id=0, length=126 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0x6182aca4f8b2133d63750c2c5b131ada +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_checkval: Item Name: Calling-Station-Id, Value: 02-00-00-00-00-01 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.21.126 port 50659 EAP-Message = 0x010100160410d17a481031648eca7f569291c54870de Message-Authenticator = 0x00000000000000000000000000000000 State = 0x071c3844071d3c871a2285f50d0acb26 Finished request 26. Going to the next request Waking up in 4.10 seconds. Cleaning up request 26 ID 0 with timestamp +4175 Ready to process requests. rad_recv: Access-Request packet from host 192.168.21.126 port 50659, id=0, length=126 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0x6182aca4f8b2133d63750c2c5b131ada +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_checkval: Item Name: Calling-Station-Id, Value: 02-00-00-00-00-01 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.21.126 port 50659 EAP-Message = 0x010100160410aa54044e0e0cb1cd7777116d6144c4ee Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2ca616d12ca7120eb7710be2baae4a1b Finished request 27. Going to the next request Waking up in 4.10 seconds. Cleaning up request 27 ID 0 with timestamp +4187 Ready to process requests. ------------------------------------------------------------------------------------------------------- Working, in response to local host connecting (v. long; nothing else follows this log): rad_recv: Access-Request packet from host 127.0.0.1 port 40609, id=0, length=126 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0x04b6832eda3285bbbb19315b80ef55fe +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_checkval: Item Name: Calling-Station-Id, Value: 02-00-00-00-00-01 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 127.0.0.1 port 40609 EAP-Message = 0x0101001604104719a5bc40cadd5a795acdb21621fbd4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x477b7bc0477a7f2c045f14d9c1a56447 Finished request 28. Going to the next request Waking up in 4.10 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 40609, id=1, length=136 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060315 State = 0x477b7bc0477a7f2c045f14d9c1a56447 Message-Authenticator = 0xf671acc6defc96d16952a12c015f3a22 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_checkval: Item Name: Calling-Station-Id, Value: 02-00-00-00-00-01 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 127.0.0.1 port 40609 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x477b7bc046796e2c045f14d9c1a56447 Finished request 29. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 40609, id=2, length=233 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200671500160301005c0100005803014c617c16799c78a7843fb1ab5ef8f34074de17caa903f6bcd27cc3a3811b6d5400003000390038003500160013000a00330032002f006600050004006300620015001200090065006400140011000800060003020100 State = 0x477b7bc046796e2c045f14d9c1a56447 Message-Authenticator = 0x87c543835903394ea8132d7e486c9e2f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 103 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 005c], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 08a7], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 127.0.0.1 port 40609 EAP-Message = 0x0103040015c000000af6160301002a0200002603014c617c1627ac6923c328501dd4adc933dbd1dd2b3a9546732b1d7f2267da002f0000390116030108a70b0008a30008a00003cc308203c8308202b0a003020102020101300d06092a864886f70d010104050030819e310b3009060355040613024742310e300c060355040813054275636b73311630140603550407130d4d696c746f6e204b65796e6573311b3019060355040a13124469636b4c6f76657474204c696d697465643130302e06092a864886f70d0109011621637573746f6d65722e737570706f727440736f6c7574696f6e747261782e636f6d311830160603550403130f444c2043 EAP-Message = 0x6f72702057696669204341301e170d3130303830393135313132385a170d3131303830393135313132385a308196310b3009060355040613024742310e300c060355040813054275636b73311b3019060355040a13124469636b4c6f76657474204c696d69746564312830260603550403131f444c20436f72702057696669205365727665722043657274696669636174653130302e06092a864886f70d0109011621637573746f6d65722e737570706f727440736f6c7574696f6e747261782e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100bedf6054159aea65a8a695396bacdc1d974e65733dcfd796 EAP-Message = 0x0248a9e9546f56b97dc4f07432ae8d266b92448955c265dd9412540e2dc3ee2b52a10afefe5ca57caf95a4b8b345014e55c160bb6acc2fa0cec266481136bad3c9129e305e4c18288ee2c1d53adeee44eaf5ccd2c6e2f9ba564924abb0221f092584649eef3fbdae99acc85dbfb92671eea4a75b77165d839839ce5273d848447bd3ce8d4754ac120ec21ae52684d6c99e00ff32fba95de651bf9ac3322295991a4efc34837c9c4b84c7276cabc5208242bac363c14190abaefea25dc21c6b6b245e142db83fc2fe0731e07908131d9eea8974fd80468182696bae8dc17b3f53f6273caf03b2c39f0203010001a317301530130603551d25040c300a06 EAP-Message = 0x082b06010505070301300d06092a864886f70d010104050003820101008037667a1c225b5a66f520ded7c0aad48dfa2a7909acc0fe7596c2bbc76980b303439a63c6f6d440bb0dba639fd6bad64cf44c95ec275b325fa94782dada64863829ce8e69558c7fdad914eb7ffcb01f673138264cb8b97765e4c72a42b63008c1dc5c3af27f6852d1cc79d48aa6570381a29251b7e3004b40f0c2adad46b49c49e2761ff779045a4fc09cd0ef62f752d7b79dd89d4391b73002ed23d48ad2626e7d9b2519627b651214d3beeb386a013afbcc80db1a4d556f90b0a3d878a0a131a71ba0749dd1ab33eb4a7dff4608ed76bea3f2470075f0c54bb24384c281c1 EAP-Message = 0xe58944ac63d2975e3b97e153 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x477b7bc045786e2c045f14d9c1a56447 Finished request 30. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 40609, id=3, length=136 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061500 State = 0x477b7bc045786e2c045f14d9c1a56447 Message-Authenticator = 0x8a5a3ea0028bf651f2df7463b91662c6 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 127.0.0.1 port 40609 EAP-Message = 0x0104040015c000000af61c8f7f592f7ab2ccae17af97fbc0802e3ed139b50004ce308204ca308203b2a003020102020900c216fdd8064c8f67300d06092a864886f70d010105050030819e310b3009060355040613024742310e300c060355040813054275636b73311630140603550407130d4d696c746f6e204b65796e6573311b3019060355040a13124469636b4c6f76657474204c696d697465643130302e06092a864886f70d0109011621637573746f6d65722e737570706f727440736f6c7574696f6e747261782e636f6d311830160603550403130f444c20436f72702057696669204341301e170d3130303830393135313132385a170d31 EAP-Message = 0x31303830393135313132385a30819e310b3009060355040613024742310e300c060355040813054275636b73311630140603550407130d4d696c746f6e204b65796e6573311b3019060355040a13124469636b4c6f76657474204c696d697465643130302e06092a864886f70d0109011621637573746f6d65722e737570706f727440736f6c7574696f6e747261782e636f6d311830160603550403130f444c20436f7270205769666920434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c9a7d7b0c22afe853ddde7d62c7e7d62e8e6fb58ca3f42bc9a172d092c31db0a81637df6df1b182e510a727de8dede EAP-Message = 0x63d4f3b1fb031e74a5d3ca54804daaad8ec8a6e8b61a7f26d60837728585e1b81267856ead58a99383b29cac7cd0ed2dcd80fcdefc632a22fd23624911d61b1d4860d944c45b0d656780ac6738fec67393dad97c752f24a41cb07871ebe4871412efb5d772b60ad78abda5a86974105a85afc07fd0b07fac3ad25a0fd5c996829c92d04510704e5499220c6c0cffd16534a0a8a7dd16a26d610752f9a7b3c19371f7b516b3709d6ef5c9a2bf3ed266ad39363e8fa1bec9696731c5819ecb24be71c3c0e33afa44e0bb02b4682233a5efd10203010001a382010730820103301d0603551d0e041604141779973a1c8275d38bf2ae85104840cc4c66a5db EAP-Message = 0x3081d30603551d230481cb3081c880141779973a1c8275d38bf2ae85104840cc4c66a5dba181a4a481a130819e310b3009060355040613024742310e300c060355040813054275636b73311630140603550407130d4d696c746f6e204b65796e6573311b3019060355040a13124469636b4c6f76657474204c696d697465643130302e06092a864886f70d0109011621637573746f6d65722e737570706f727440736f6c7574696f6e747261782e636f6d311830160603550403130f444c20436f72702057696669204341820900c216fdd8064c8f67300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010098a389b111 EAP-Message = 0x267f86354017bdf0d1364e56 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x477b7bc0447f6e2c045f14d9c1a56447 Finished request 31. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 40609, id=4, length=136 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400061500 State = 0x477b7bc0447f6e2c045f14d9c1a56447 Message-Authenticator = 0xbeae0b09b1f478a6024e94690946d257 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 4 to 127.0.0.1 port 40609 EAP-Message = 0x01050314158000000af62f839804528c2c36733b0f4b1be32ddf1437b06ed574e4034c508b4f0715fe00aea2acf4da03a466d4ec9714bd5232bf6248580d805c2ad67c9f661b102e098a42ab9334de2a06dd18286533421452fe8d6d9ccaabc4fa4a187e78da6d960cac06ff2ed01e73f301d4aa6e587a91cdebe48466176d00709d7813adc612b85a28b10f96f2b110c5709e44b6623fbcaf8b98df3b25ed3c2b4f7957c19f57bd5a73dc7ef5ba98318a8020414072b92ae39c24affdd4cef31ff8453f609adb0ffe954201e2bcb7c8340c85e6d023e352ea7bf06ec3cd197bdc07c061d8a25fa9ee9c4e57ce40df181239beb692ea02fc4416030102 EAP-Message = 0x0d0c0002090080d8264a88509791af361c920288ca80bdefe6356030baff37a9211040829bf96bf568771e0810595535138454a565c371e3c9cef554bb0a7f7fcd607725217edfbde18c78b5815a92b981b06b4109aebd2d90f7588751f0e58f75f363cde714513035815e4ccbae0d649a336e4604a43726d48dcbf27698b9bb17df0f3810754b00010200800e730b494dc26929d4250ac808d9febd2df11c716a70a5fd5affbfa2e3721aeca6a2f639db80dad65edc4bfe66c53d03aa1f957acb320734771f8d374577599d664cffa9e11ac91ed0dbe91037f179772dc259c7e0d525ad74feb00590f32f6db70f3eb61483fa66ed0ffec8bcebb7f564 EAP-Message = 0xeaa5e9f4dfbe70d3134c905d37ae400100bcd7647152d75cae2cec848d8c675f0fb19afb0a0206cac9bc559ed466eab29fef4e1d4c3bdf243270caccb56b1b6049a7e2d871d73b9dc052dc24a75240aabae05e720653d8908909d679603f59a8ae961a9abc4b3c34017a6a60b2aa7a90976b343f02b009f7c521c9d599cc43fb60cbbd2be8a87b6244114d95ccb39ab2260e39a1e3a88171762ec8df7e2bc27ac2a4a3953cfd8e87cbeec46c33f8c365ba3c5bf50ccc7d33e72c95d518f9b05d1a87ee8766c9fcf9a4645ebab066be528eb04dc8583b79630ce06778248b2ecb186747b69e9ad61143ac176a11727ac1a7767475672dcb6d0e3287f0c4 EAP-Message = 0x212be90de4d2b3b88b052fda51aaa5265876d91b16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x477b7bc0437e6e2c045f14d9c1a56447 Finished request 32. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 40609, id=5, length=334 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500cc1500160301008610000082008017d3473998861d471e8a7125150176e85ad9190047165df6a9650e37511a87ca0ad5702afc58300fdc4372f2d4222075e66a99ba5728ef112242dfee2f1a939574f61aa0d423fde273926d4ec28497edec4c00fb49aef75dfb55500463977773f04cb9caf3aa1fdd91d22797af6fadd1b45380b9bfd5a57b52d1625bcdca3fb914030100010116030100309a74bcec40bb520eb89bc1c4f24211dad1deb921a1d2941a7765bc531c68a9dd846f20d74569542f199b5ad17cb78ab0 State = 0x477b7bc0437e6e2c045f14d9c1a56447 Message-Authenticator = 0x69d5a46a5c6a53682299121763f2e593 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 5 to 127.0.0.1 port 40609 EAP-Message = 0x0106004515800000003b14030100010116030100304dd32091564ace4e9f439585f7b2037506116f180b29547f4f26dcafdb055d2261240055af25fe853cc0b0ec57427320 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x477b7bc0427d6e2c045f14d9c1a56447 Finished request 33. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 40609, id=6, length=226 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0206006015001703010020654ab2b04ef6aff22c11a82934844467db9e7db9eca4f3bce07d5ae466c60b451703010030af83c86cfe02487714a46b3f5076faa5038334cc26007de1b30eb5106034d44bd44f9bacb7486b87b6530c5aedc81242 State = 0x477b7bc0427d6e2c045f14d9c1a56447 Message-Authenticator = 0xde150bf24e63308295b94abafcfd200a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x02000009016a6f686e FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Got tunneled identity of john [ttls] Setting default EAP type for tunneled EAP session. [ttls] Sending tunneled request EAP-Message = 0x02000009016a6f686e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> john [sql] sql_set_user escaped user --> 'john' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id - > SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'john' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id - > SELECT id, username, attribute, value, op FROM radreply WHERE username = 'john' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'john' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 02-00-00-00-00-01 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [ttls] Got tunneled reply code 11 EAP-Message = 0x010100160410e55cf3f132e3bba89b3bdc0633cedb0b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x92db1d3d92da196b3735f5d4a01a13b3 [ttls] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 6 to 127.0.0.1 port 40609 EAP-Message = 0x0107004f1580000000451703010040d29825cbb4797eb9115c92c74145da6968e0e8704769fa4f8acfc6947c5cdf1f34360e7302a69801840005f1ecd037d79dd7d5cf80bea521fc45c72b34349b55 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x477b7bc0417c6e2c045f14d9c1a56447 Finished request 34. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 40609, id=7, length=242 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020700701500170301002050be57d2358f8e3cc50822d5fbaedf0fa237f294a3ea37416f3f3b43bbc608a51703010040dff4c3ac6a2688dfb044010d698bb6d16dda40f2973049b92b428bd680e971426cedaeb78b23afe71025991a883986dbef648b7e70f7ca3211b8befbf08f6f16 State = 0x477b7bc0417c6e2c045f14d9c1a56447 Message-Authenticator = 0xab5852a76ba14a733dc5a7e8263f09c7 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 112 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x020100160410bd122de2634f7b6bd701b2cc91adcdb7 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x020100160410bd122de2634f7b6bd701b2cc91adcdb7 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "john" State = 0x92db1d3d92da196b3735f5d4a01a13b3 NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 1 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> john [sql] sql_set_user escaped user --> 'john' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id - > SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'john' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id - > SELECT id, username, attribute, value, op FROM radreply WHERE username = 'john' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'john' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 02-00-00-00-00-01 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. } # server inner-tunnel [ttls] Got tunneled reply code 2 EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "john" [ttls] Got tunneled Access-Accept [eap] Freeing handler rlm_eap_ttls: Freeing handler for user john ++[eap] returns ok +- entering group post-auth {...} [reply_log] expand: /var/log/freeradius/radacct/%{Client-IP- Address}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/reply- detail-20100810 [reply_log] /var/log/freeradius/radacct/%{Client-IP-Address}/reply- detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/reply- detail-20100810 [reply_log] expand: %t -> Tue Aug 10 17:19:34 2010 ++[reply_log] returns ok [sql] expand: %{User-Name} -> anonymous [sql] sql_set_user escaped user --> 'anonymous' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap- Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'anonymous', '', 'Access-Accept', '2010-08-10 17:19:34') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'anonymous', '', 'Access- Accept', '2010-08-10 17:19:34') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 7 to 127.0.0.1 port 40609 MS-MPPE-Recv-Key = 0x1e4491c233d0270c4f3bc4829f088dfbc8dcd8ba6541683752b76e424ffea8de MS-MPPE-Send-Key = 0x64317ca56d6213c2e04813b157c9e923ed8d33b7dd0f6a8fd51aacb8c5bd790c EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous" Finished request 35. Going to the next request Waking up in 4.9 seconds. Cleaning up request 28 ID 0 with timestamp +4232 Cleaning up request 29 ID 1 with timestamp +4232 Cleaning up request 30 ID 2 with timestamp +4232 Cleaning up request 31 ID 3 with timestamp +4232 Cleaning up request 32 ID 4 with timestamp +4232 Cleaning up request 33 ID 5 with timestamp +4232 Cleaning up request 34 ID 6 with timestamp +4232 Cleaning up request 35 ID 7 with timestamp +4232 Ready to process requests.

3 6

rlm_eap: Handler failed in EAP/peap
by Javier Richard Quinto Ancieta 17 Aug '10

17 Aug '10

Hello, I have problems with my FreeRADIUS (Installed )Version 1.1.3. The problem is when I use EAP-PEAP, msCHAPv2 for clients Windows and a Server LDAP in Debian. I have Installed freeradius using EAP-PEAP and in the radius.conf is of the next form: ldap { server = "direcc_IP_LDAP" #identity = "cn=admin,dc=inictel,dc=raap,dc=pe" identity = "uid=user6,cn=admin,dc=inictel,dc=raap,dc=pe" password = inictel basedn = "dc=inictel,dc=raap,dc=pe" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # filter = "(uid=%u)" groupname_attribute = radiusGriupName groupmembership_attribute = radiusGroupName base_filter = "(objectclass=radiusprofile)" access_attr = "radiusFilterId" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap authtype=ldap ldap_connections_number = 5 ... } And in the file slapd.conf is of the next form: database hdb # The base of your directory in database #1 suffix "dc=inictel,dc=raap,dc=pe" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. rootdn "cn=admin,dc=inictel,dc=raap,dc=pe" rootpw inictel # Where the database file are physically stored for database #1 directory "/var/lib/ldap" --------------------- In vim /etc/raddb/users is the next form: #DEFAULT Auth-Type = System # Fall-Through = 1 DEFAULT Auth-Type = LDAP Fall-Through = 1 #userX User-Password == passX # Auth-Type := LOCAL The clients.conf is Ok, and when I do radiusd -X is OK, and I tested of the next form: [root@localhost raddb]# radtest user6 inictel 127.0.0.1 10 testing123 Sending Access-Request of id 247 to 127.0.0.1 port 1812 User-Name = "user6" User-Password = "inictel" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=247, length=64 Filter-Id = "Enterasys:version=1:policy=Enterprise User" So everything is ok there but when I want authenticate a supplicant since my laptop, I have problems: rlm_ldap: - authorize rlm_ldap: performing user authorization for user6 radius_xlat: '(uid=user6)' radius_xlat: 'dc=inictel,dc=raap,dc=pe' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=inictel,dc=raap,dc=pe, with filter (uid=user6) rlm_ldap: checking if remote access for user6 is allowed by radiusFilterId rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFilterId as Filter-Id, value Enterasys:version=1:policy=Enterprise User & op=11 rlm_ldap: user user6 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 274 modcall: leaving group authorize (returns updated) for request 274 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 274 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK * rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 274 modcall: leaving group authenticate (returns invalid) for request 274 auth: Failed to validate the user. Delaying request 274 for 1 seconds Finished request 274* Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 200.37.45.97:1645, id=65, length=216 Sending Access-Reject of id 65 to 200.37.45.97 port 1645 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 267 ID 58 with timestamp 4c696b6c Cleaning up request 268 ID 59 with timestamp 4c696b6c Cleaning up request 269 ID 60 with timestamp 4c696b6c Cleaning up request 270 ID 61 with timestamp 4c696b6c I can't authenticate my supplicant, Could you help me please Thank You!. -- Quinto Ancieta Javier Richard jquinto(a)inictel-uni.edu.pe, richardqa(a)gmail.com telf: 9931-78569-5213902-3461808-533 Remember: Nothing is impossible, because the dreams of yesterday are the hopes of today and tomorrow can become a reality.

2 1