- Freeradius-Users - lists.freeradius.org

Password Encryption
by rrperez 10 Aug '10

10 Aug '10

Freeradius2 + OpenLDAP for Wifi Authentication I'm having a problem with the password decryption for radius with ldap entries that have an encrypted password. Is there a way to map the attribute so that the radius can read/decrypt the password on ldap directory? -- View this message in context: http://old.nabble.com/Password-Encryption-tp29393526p29393526.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

Virtual Servers Localhost
by Etienne Philip Pretorius 10 Aug '10

10 Aug '10

Hello List, I need to make localhost select the correct virtual server based on a custom attribute that is passed to Freeradius. I have three virtual servers, and I use scripts to inject radius accounting packets into the radius server and I would like to ideally select the correct virtual server based on this custom attribute. For the other clients, I use their ip address and the dynamic_clients to populate FreeRADIUS-Client-Virtual-Server as per the dynmaic-sql-clients example. If not possible, could someone please give me a suggestion to an alternate solution to achieve the same result. I do not think that the attributes gets processed before the client gets checked, so I am in a chicken and egg scenario at the moment. Kind Regards, Etienne Pretorius

2 1

LDAP Check Items Do Not Match
by Asin Silva 10 Aug '10

10 Aug '10

Hi All, I use freeradius version 2.1.3 and LDAP to authenticate ADSL users. I have a requirement to compare the NAS-Port-Id in the user request to the one in the LDAP. But when I test it, radius debug output says "Pairs do not match. Rejecting user.". But the values in the request and LDAP are same. I have attached the debug output. Asin

1 0

User Information
by Christian Rahl 09 Aug '10

09 Aug '10

I am working on trying to get information from connections such as Mac-Address and last connected IP from the device. Once we get this information I would like to add this to the radius database, either in the radpostauth or radacct. I am completely new to radius so not to sure about if I need to add it to a script or have to create my own database for the information and my own script. Christian Rahl

1 0

sql nas and accounting
by Jiann-Ming Su 09 Aug '10

09 Aug '10

Two questions: 1. Does listing clients in the nas database table support virtual servers? If so, what field do I enter that info in and do I need to update the SQL query used in dialup.conf? 2. How do I get sql accounting to work? That is, how do configure freeradius to update the radacct table? Right now, freeradius process seems to be rejecting accounting requests: "Ignoring request to accounting address * port 1813 from unknown client..." The"unknown client" works fine for authentication. Thanks for any tips.

1 1

how to enable session resumption in fr?
by WWF 09 Aug '10

09 Aug '10

dear all, hi! Now I use fr 2.19 for wimax. The CPE asks for session resumption in TTLS-MACHAPv2. like this: Mon Aug 9 16:14:16 2010 : Info: [eap] Request found, released from the list Mon Aug 9 16:14:16 2010 : Info: [eap] EAP/ttls Mon Aug 9 16:14:16 2010 : Info: [eap] processing type ttls Mon Aug 9 16:14:16 2010 : Info: [ttls] Authenticate Mon Aug 9 16:14:16 2010 : Info: [ttls] processing EAP-TLS Mon Aug 9 16:14:16 2010 : Info: [ttls] eaptls_verify returned 7 Mon Aug 9 16:14:16 2010 : Info: [ttls] Done initial handshake Mon Aug 9 16:14:16 2010 : Info: [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] Mon Aug 9 16:14:16 2010 : Info: [ttls] <<< TLS 1.0 Handshake [length 0010], Finished Mon Aug 9 16:14:16 2010 : Info: [ttls] TLS_accept: SSLv3 read finished A Mon Aug 9 16:14:16 2010 : Info: [ttls] (other): SSL negotiation finished successfully Mon Aug 9 16:14:16 2010 : Debug: SSL Connection Established Mon Aug 9 16:14:16 2010 : Debug: SSL Application Data Mon Aug 9 16:14:16 2010 : Info: [ttls] eaptls_process returned 3 Mon Aug 9 16:14:16 2010 : Info: [ttls] Skipping Phase2 due to session resumption Mon Aug 9 16:14:16 2010 : Info: [ttls] FAIL: Forcibly stopping session resumption as it is not allowed. Mon Aug 9 16:14:16 2010 : Info: [eap] Freeing handler Mon Aug 9 16:14:16 2010 : Info: ++[eap] returns reject Mon Aug 9 16:14:16 2010 : Info: Failed to authenticate the user. Mon Aug 9 16:14:16 2010 : Info: Using Post-Auth-Type Reject Mon Aug 9 16:14:16 2010 : Info: +- entering group REJECT {...} Mon Aug 9 16:14:16 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> B8616F001F47 Mon Aug 9 16:14:16 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Aug 9 16:14:16 2010 : Info: ++[attr_filter.access_reject] returns updated Mon Aug 9 16:14:16 2010 : Info: Delaying reject of request 69 for 1 seconds Mon Aug 9 16:14:16 2010 : Debug: Going to the next request Mon Aug 9 16:14:16 2010 : Debug: Waking up in 0.9 seconds. Mon Aug 9 16:14:17 2010 : Info: Sending delayed reject for request 69 Sending Access-Reject of id 3 to 25.25.25.25 port 36867 EAP-Message = 0x043c0004 Message-Authenticator = 0x00000000000000000000000000000000 But , if I enabled session resumption by setting it in eap.conf by: # # Enable it. The default is "no". # Deleting the entire "cache" subsection # Also disables caching. # # You can disallow resumption for a # particular user by adding the following # attribute to the control item list: # # Allow-Session-Resumption = No # # If "enable = no" below, you CANNOT # enable resumption for just one user # by setting the above attribute to "yes". # enable = yes then I got: Mon Aug 9 16:55:26 2010 : Info: [eap] EAP/ttls Mon Aug 9 16:55:26 2010 : Info: [eap] processing type ttls Mon Aug 9 16:55:26 2010 : Info: [ttls] Authenticate Mon Aug 9 16:55:26 2010 : Info: [ttls] processing EAP-TLS Mon Aug 9 16:55:26 2010 : Info: [ttls] Received TLS ACK Mon Aug 9 16:55:26 2010 : Info: [ttls] ACK handshake is finished Mon Aug 9 16:55:26 2010 : Info: [ttls] eaptls_verify returned 3 Mon Aug 9 16:55:26 2010 : Info: [ttls] eaptls_process returned 3 Mon Aug 9 16:55:26 2010 : Info: [ttls] Saving response in the cache Mon Aug 9 16:55:26 2010 : Info: [ttls] WARNING: No information to cache: session caching will be disabled for this session. Mon Aug 9 16:55:26 2010 : Info: [eap] Freeing handler Mon Aug 9 16:55:26 2010 : Info: ++[eap] returns ok Mon Aug 9 16:55:26 2010 : Info: +- entering group post-auth {...} Mon Aug 9 16:55:26 2010 : Info: ++[exec] returns noop Mon Aug 9 16:55:26 2010 : Info: expand: %{User-Name} -> 1109d0389bf34a72981580a304b50f3b Mon Aug 9 16:55:26 2010 : Info: ++[reply] returns noop Mon Aug 9 16:55:26 2010 : Info: [wimax] MIP-RK = 0x61c8c180fc45a070ca34e0d84e905c23329eec7d5ae69fe3f037d0b404988c7fec960a3dfcebba7615bf1a616ae527f699c87a93e29d66dc79f7fb02208fc1c1 Mon Aug 9 16:55:26 2010 : Info: [wimax] MIP-SPI = 29e23a18 Mon Aug 9 16:55:26 2010 : Info: [wimax] WARNING: WiMAX-IP-Technology not found in reply. Mon Aug 9 16:55:26 2010 : Info: [wimax] WARNING: Not calculating MN-HA keys Mon Aug 9 16:55:26 2010 : Info: ++[wimax] returns updated Mon Aug 9 16:55:26 2010 : Info: expand: %{EAP-MSK} -> Mon Aug 9 16:55:26 2010 : Info: expand: %{User-Name} -> 1109d0389bf34a72981580a304b50f3b Mon Aug 9 16:55:26 2010 : Info: expand: %{md5:%{User-Name}} -> 879d5828deac9e6abd6b86721968d541 Mon Aug 9 16:55:26 2010 : Info: ++[reply] returns updated Sending Access-Accept of id 7 to 25.25.25.25 port 36867 And when resumption: Mon Aug 9 16:53:46 2010 : Info: [eap] Request found, released from the list Mon Aug 9 16:53:46 2010 : Info: [eap] EAP/ttls Mon Aug 9 16:53:46 2010 : Info: [eap] processing type ttls Mon Aug 9 16:53:46 2010 : Info: [ttls] Authenticate Mon Aug 9 16:53:46 2010 : Info: [ttls] processing EAP-TLS Mon Aug 9 16:53:46 2010 : Info: [ttls] eaptls_verify returned 7 Mon Aug 9 16:53:46 2010 : Info: [ttls] Done initial handshake Mon Aug 9 16:53:46 2010 : Info: [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] Mon Aug 9 16:53:46 2010 : Info: [ttls] <<< TLS 1.0 Handshake [length 0010], Finished Mon Aug 9 16:53:46 2010 : Info: [ttls] TLS_accept: SSLv3 read finished A Mon Aug 9 16:53:46 2010 : Info: [ttls] (other): SSL negotiation finished successfully Mon Aug 9 16:53:46 2010 : Debug: SSL Connection Established Mon Aug 9 16:53:46 2010 : Debug: SSL Application Data Mon Aug 9 16:53:46 2010 : Info: [ttls] eaptls_process returned 3 Mon Aug 9 16:53:46 2010 : Info: [ttls] Skipping Phase2 due to session resumption Mon Aug 9 16:53:46 2010 : Info: [ttls] WARNING: No information in cached session! Mon Aug 9 16:53:46 2010 : Info: [eap] Freeing handler Mon Aug 9 16:53:46 2010 : Info: ++[eap] returns reject Mon Aug 9 16:53:46 2010 : Info: Failed to authenticate the user. Mon Aug 9 16:53:46 2010 : Info: Using Post-Auth-Type Reject Mon Aug 9 16:53:46 2010 : Info: +- entering group REJECT {...} Mon Aug 9 16:53:46 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 5e6b5185dcc44c0db5e23c6f0668c7a6 Mon Aug 9 16:53:46 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Aug 9 16:53:46 2010 : Info: ++[attr_filter.access_reject] returns updated Mon Aug 9 16:53:46 2010 : Info: Delaying reject of request 109 for 1 seconds Mon Aug 9 16:53:46 2010 : Debug: Going to the next request I don't know how to set the following: # You can disallow resumption for a # particular user by adding the following # attribute to the control item list: # # Allow-Session-Resumption = No It seems this attr can't be added into the access-xxx messages. How can I do to enable session resumption in fr?

2 1

how to configure a proxy radius server but the username doesn't have any realm ?
by freddychu 09 Aug '10

09 Aug '10

Hi, I want to configure a proxy radius server and the username doesn't have any realm, just like 'tom'. So I configure realm NULL section in proxy.conf file, but it doesn't work, the error message in radiusd terminal when redius server received the accounting message: Proxying request 0 to home server 218.83.175.155 port 1813 The message can't be proxy to myProxyPool_1, I don't understand why the home server become 218.83.175.155. Can anybody help me? How to configure it ? proxy.conf file: #home server 1 home_server myProxyServer_1 { type = auth+acct ipaddr = 192.168.1.111 port = 1812 secret = testing123 require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 10 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } #home server 2 home_server myProxyServer_2 { type = auth+acct virtual_server = localserver } # home server pool 1 home_server_pool myProxyPool_1{ type = fail-over home_server = myProxyServer_1 home_server = myProxyServer_2 } #realm realm chuanwei.com { auth_pool = myProxyPool_1 acct_pool = myProxyPool_1 nostrip } realm NULL { authhost = myProxyPool_1 accthost = myProxyPool_1 secret = testing123 } Freddy

2 1

FreeRadius + LDAP on WPA2
by rrperez＠apc.edu.ph 09 Aug '10

09 Aug '10

FreeRadius 2.1.7 with OpenLDAP as backend for Wireless Network I have configured the radius and ldap server on the same machine which is a virtual machine by the way. I have this problem when running the radtest on localhost and also I'm having a problem with the communication between the server and the access point because they don't respond to each other. I really need help, ASAP... Here is the debug in local radtest: rad_recv: Access-Request packet from host 127.0.0.1 port 51734, id=11, length=58 User-Name = "etaban" User-Password = "s3cur1ty" NAS-IP-Address = 127.0.0.1 NAS-Port = 2 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "etaban", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 191 ++[files] returns ok [ldap] performing user authorization for etaban [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> etaban [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=etaban) [ldap] expand: dc=testldap1,dc=test,dc=corpoff -> dc=testldap1,dc=test,dc=corpoff rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.96.100.206:389, authentication 0 rlm_ldap: bind as / to 10.96.100.206:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=testldap1,dc=test,dc=corpoff, with filter (uid=etaban) [ldap] looking for check items in directory... rlm_ldap: userPassword -> Cleartext-Password == "s3cur1ty" rlm_ldap: userPassword -> User-Password == "s3cur1ty" [ldap] looking for reply items in directory... [ldap] user etaban authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} rlm_eap: EAP-Message not found [eap] Malformed EAP Message ++[eap] returns fail Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> etaban attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 11 to 127.0.0.1 port 51734 Waking up in 4.9 seconds. Cleaning up request 0 ID 11 with timestamp +9 Ready to process requests.

3 6

Can't connect through Access Point
by Ron Perez 09 Aug '10

09 Aug '10

Here is the debug when I try to connect to the wireless network with freeradius2. rad_recv: Access-Request packet from host 10.96.100.205 port 1095, id=0, length=127 User-Name = "rrperez" NAS-IP-Address = 10.96.100.205 Called-Station-Id = "0014bf8abbc5" Calling-Station-Id = "0016e3cdc0a3" NAS-Identifier = "0014bf8abbc5" NAS-Port = 46 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000c017272706572657a Message-Authenticator = 0x4f2ba1b95873a9bf8b13863f1ce6d52f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rrperez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry rrperez at line 93 ++[files] returns ok [ldap] performing user authorization for rrperez [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> rrperez [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=rrperez) [ldap] expand: dc=testldap1,dc=test,dc=corpoff -> dc=testldap1,dc=test,dc=corpoff rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testldap1,dc=test,dc=corpoff, with filter (uid=rrperez) [ldap] looking for check items in directory... rlm_ldap: userpassword -> Cleartext-Password == "p@ssw0rd" rlm_ldap: userPassword -> User-Password == "p@ssw0rd" [ldap] looking for reply items in directory... [ldap] user rrperez authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 10.96.100.205 port 1095 EAP-Message = 0x010200160410b26f8606d20313bfb074702fb88c12dc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x472a339647283709d04328c11ec504b2 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.96.100.205 port 1097, id=0, length=139 User-Name = "rrperez" NAS-IP-Address = 10.96.100.205 Called-Station-Id = "0014bf8abbc5" Calling-Station-Id = "0016e3cdc0a3" NAS-Identifier = "0014bf8abbc5" NAS-Port = 46 Framed-MTU = 1400 State = 0x472a339647283709d04328c11ec504b2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060319 Message-Authenticator = 0x2d96e463cb33f53668e660cc806f5396 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rrperez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry rrperez at line 93 ++[files] returns ok [ldap] performing user authorization for rrperez [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> rrperez [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=rrperez) [ldap] expand: dc=testldap1,dc=test,dc=corpoff -> dc=testldap1,dc=test,dc=corpoff rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testldap1,dc=test,dc=corpoff, with filter (uid=rrperez) [ldap] looking for check items in directory... rlm_ldap: userpassword -> Cleartext-Password == "p@ssw0rd" rlm_ldap: userPassword -> User-Password == "p@ssw0rd" [ldap] looking for reply items in directory... [ldap] user rrperez authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 10.96.100.205 port 1097 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x472a339646292a09d04328c11ec504b2 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.96.100.205 port 1099, id=0, length=251 User-Name = "rrperez" NAS-IP-Address = 10.96.100.205 Called-Station-Id = "0014bf8abbc5" Calling-Station-Id = "0016e3cdc0a3" NAS-Identifier = "0014bf8abbc5" NAS-Port = 46 Framed-MTU = 1400 State = 0x472a339646292a09d04328c11ec504b2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0203007619800000006c16030100670100006303014c60485419960635d1ade97d45e42d310da2c1bd2228f6a268e4c8d2725deccc000018002f00350005000ac009c00ac013c0140032003800130004010000220000000c000a0000077272706572657a000a00080006001700180019000b00020100 Message-Authenticator = 0xfb781696d1e2b68de3ca4be44368e6ba +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rrperez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 118 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 108 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0067], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0847], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 10.96.100.205 port 1099 EAP-Message = 0x0104040019c000000884160301002a0200002603014c5ef69f90cc66244e85fa9ea030af56c83a42baaf970ef5afd98d6a5c23a1af00002f0016030108470b00084300084000039e3082039a30820282a003020102020101300d06092a864886f70d010104050030818e310b3009060355040613025048310f300d060355040813064d616e696c61310e300c0603550407130550617361793111300f060355040a1308534d205072696d653123302106092a864886f70d0109011614706572657a2e32726f6e40676d61696c2e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d31 EAP-Message = 0x30303830353231343433315a170d3131303830353231343433315a3079310b3009060355040613025048310f300d060355040813064d616e696c613111300f060355040a1308534d205072696d65312330210603550403131a4578616d706c65205365727665722043657274696669636174653121301f06092a864886f70d01090116127272706572657a406170632e6564752e706830820122300d06092a864886f70d01010105000382010f003082010a0282010100c6e7ab6d35efefbf0f386233076f46ad36cbbd54ddc07f0488bee8c4db14c0fe37a0ea6818d01ebbd3b409769818e4036bfc962238f8475d6583da6ac2512363845f5fb04d9d EAP-Message = 0xbd5b53e9c2ef6647a4b8dd02daceb3066d9a9ae26cd11a8300b9d53c043f09b33b53354bdbcf6ce4d0b1a8e4770eb537f583c6ebce6487ffa1dc2b1c4cc541aa04e98fae7a73336ee461bdbdc0909080852e47fc49b64b146ad18cbafaf350647f19758c5e781d6bd8882f6d8e136f87b1f3e013342b79c05deef124b9c800c2461cb265ae547aa5c299facd146c391c91abcd5e0f03aac4cba67d9b5a86ff440e52850806b7c9b7f45ba4f4bcecb86bb5bb5f9dba3453e974fb0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003820101004aac0765701c5185080a5fb6e5363b88b5 EAP-Message = 0xc7390b7836e78f8547c84ee349ca8b9d6a71e78cdf38ed81af871098700b1c03aa6970cd9a14107ec7aa9f4a84409a359a2c87c5eb09cca8b35d7c55ac7f2ee3db355438c00c50a5a0c96e5b6b850db681772588de4ca7035e033fa00f2c6091b1fbbdc232bc4374b1e653d08a9bdc91f5bdedc1f21ab134093737c8972f0ddd6c53bb535ba2808f59563caddf2c14f684f1856e78a49f8e6009495f1ec9115fc41f5fe3786444758c65121b714422aef588fa496d876beade61319aa7c4812908f4aeb34a13692a725fd11a5cd9a065daca5c078bf289686c7038c6e77fb9410b320bd5a62d7e3994d4353531cf7b00049c3082049830820380a00302 EAP-Message = 0x0102020900e6d6f0b5c23c70 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x472a3396452e2a09d04328c11ec504b2 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.96.100.205 port 1101, id=0, length=139 User-Name = "rrperez" NAS-IP-Address = 10.96.100.205 Called-Station-Id = "0014bf8abbc5" Calling-Station-Id = "0016e3cdc0a3" NAS-Identifier = "0014bf8abbc5" NAS-Port = 46 Framed-MTU = 1400 State = 0x472a3396452e2a09d04328c11ec504b2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0x2e5b1abd57419deda1b17bc06072af82 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rrperez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 10.96.100.205 port 1101 EAP-Message = 0x010503fc1940a5300d06092a864886f70d010105050030818e310b3009060355040613025048310f300d060355040813064d616e696c61310e300c0603550407130550617361793111300f060355040a1308534d205072696d653123302106092a864886f70d0109011614706572657a2e32726f6e40676d61696c2e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3130303830353231343433315a170d3131303830353231343433315a30818e310b3009060355040613025048310f300d060355040813064d616e696c61310e300c0603550407130550617361793111300f06 EAP-Message = 0x0355040a1308534d205072696d653123302106092a864886f70d0109011614706572657a2e32726f6e40676d61696c2e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c377b277cfce89da192b6975f0e2c6f2860fd64da3fd80309a1ea8bb2ef91fa0d004899dfb920f5bd5bba909cc537b86d0ac729985a36c6c7bb562a02aeb6cbbadbd25c73240631e24c7bc66d8bcc423848426c6094bebdca51e781a251f99361eb4885aaa88541eabb41ccf08250ccfa82eb3f18b3ba6025f53e1994f0e9a5f81 EAP-Message = 0x96ab436778d1b5b28ffa1d177836b9584f8228ae3f38eb1b255e5ecc9ffdb5fd5f41ed8f88d07fb1865be3b978d27fd8f5de8a5f66814c415f2f81948713e5475d61ff81076a6c12afd11a2b4efb8114e2dee083866a63775065a83aecaa60f96d32d41db2651e6523d1dda4968768503b77957ed302e70148af04bea6b33d0203010001a381f63081f3301d0603551d0e04160414eb114a719ea71a316c157f42cb959cbe3d7ad1453081c30603551d230481bb3081b88014eb114a719ea71a316c157f42cb959cbe3d7ad145a18194a4819130818e310b3009060355040613025048310f300d060355040813064d616e696c61310e300c0603550407 EAP-Message = 0x130550617361793111300f060355040a1308534d205072696d653123302106092a864886f70d0109011614706572657a2e32726f6e40676d61696c2e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900e6d6f0b5c23c70a5300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100560f8590dfda5419fd715a32a3c02c7dfea64b4f7ab3f1d76173a6206a9919d372f97837051eba6b10fa29e2f813863875f2f260ce5e7935ddc4267fb7b6230d9c2b4cdaaf825e25b4910d895ed0355c1860eb0cb62961ee54228efe26aa5315820139132002a30d07 EAP-Message = 0xbd4b27e772945483 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x472a3396442f2a09d04328c11ec504b2 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.96.100.205 port 1103, id=0, length=139 User-Name = "rrperez" NAS-IP-Address = 10.96.100.205 Called-Station-Id = "0014bf8abbc5" Calling-Station-Id = "0016e3cdc0a3" NAS-Identifier = "0014bf8abbc5" NAS-Port = 46 Framed-MTU = 1400 State = 0x472a3396442f2a09d04328c11ec504b2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0x748755f79dc28feaac6975d483fb2606 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rrperez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 10.96.100.205 port 1103 EAP-Message = 0x0106009e19006f0fd8a5dc5276fa83706f679780f3e60b36f5b3489d5551b7dc0590f2ddf6959d4ba9550b38329c20dce0ab3182205608a19b3d2964953695b467af4cd29ade6a679b18dfa5492a4286fe5b2a13c12d8305450e32b2441a68b97f9701655d60ad7d399f3b693b9562b3353d3bd5d730cab42857c0e5edb72fde0d9b70eeb03dd0afd787e1ceede01810d2c9e83bdc16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x472a3396432c2a09d04328c11ec504b2 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.96.100.205 port 1105, id=0, length=139 User-Name = "rrperez" NAS-IP-Address = 10.96.100.205 Called-Station-Id = "0014bf8abbc5" Calling-Station-Id = "0016e3cdc0a3" NAS-Identifier = "0014bf8abbc5" NAS-Port = 46 Framed-MTU = 1400 State = 0x472a3396432c2a09d04328c11ec504b2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600061900 Message-Authenticator = 0x31c7e07cdcbfbce9826ce983e511159b +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rrperez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 10.96.100.205 port 1105 EAP-Message = 0x010700061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x472a3396422d2a09d04328c11ec504b2 Finished request 7. Going to the next request Waking up in 4.7 seconds. Cleaning up request 2 ID 0 with timestamp +50 Cleaning up request 3 ID 0 with timestamp +50 Cleaning up request 4 ID 0 with timestamp +50 Cleaning up request 5 ID 0 with timestamp +50 Cleaning up request 6 ID 0 with timestamp +50 Cleaning up request 7 ID 0 with timestamp +51 Ready to process requests. I don't know where is the error why I can't connect to the network, need help ASAP...

1 0

Different users file per virtual server
by Cory Johnson 07 Aug '10

07 Aug '10

Is there a way to have seperate "users" files per virtual server? The location of the users file appears to be specified in modules/files. I can only seem to load modules from the global radiusd.conf, so each server uses the same users file. My goal is to use a different users file based on the IP of the client. -CJ

3 4