- Freeradius-Users - lists.freeradius.org

Authenticating again LDAP, specific group
by Cory Johnson 03 Aug '10

03 Aug '10

Greetings, I am running FreeRADIUS 2.1.8 on Ubuntu 8.04, attempting to use the ldap module. I only want to authenticate users in a certain group. These groups exist in LDAP as a "posixGroup" with a "memberUID" list. As I have it configured currently, I get an "Access-Accept" for any user in the directory. The ldap module is configured as such: ldap { server = "192.168.1.99" identity = "cn=admin,dc=corp,dc=example,dc=com" password = s3cret basedn = "dc=corp,dc=example,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_attribute = NOC groupmembership_filter = (&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}})) } I've also seen recomendations to add something like this to the users file: DEFAULT LDAP-Group == NOC Service-Type = Administrative-User Now I can see the service-type displayed when I do a radtest using the username/password of users in the "NOC" group, but I still see an "Access-Accept" for users who are not in the group. How can I make the server reject users that aren't in the NOC group? Any hints would be fantastic.

2 1

Duplicate home server
by Cody Ritts 03 Aug '10

03 Aug '10

Hello all, I am running FreeRADIUS Version 2.1.8 (built from freebsd ports) I feel like I am missing something blatantly obvious, but just cannot seem to figure it out. Maybe I am just not understanding the documentation. I am setting up a new server with a realm to direct some of it's requests to two existing radius servers (redundant). This is what I think is the relevant part of my proxy.conf: home_server radius1 { type = auth+acct ipaddr = xx.xx.144.5 port = 1645 secret = testing123 } home_server radius2 { type = auth+acct ipaddr = xx.xx.145.5 port = 1645 secret = testing123 } home_server_pool my_server_pool { type = fail-over home_server = radius1 home_server = radius2 } realm mydomain.com { pool = my_server_pool } But when I start the server, 'radiusd -X' dies reporting: /usr/local/etc/raddb/proxy.conf[744]: Duplicate home server ( Line 144 refers to this line "home_server radius2 {" ) As soon as I remove one of the "home_server = radius2" lines from the pool, the server will start fine. Also if I change the ports on my home_server configs, the server will start. Is this not the correct way to setup redundant realm proxying? Thank you in advance, Cody

2 2

Quick IPv6 related questions
by Panagiotis Georgopoulos 03 Aug '10

03 Aug '10

Hello all, I am running FreeRadius 2.1.8 with two NAS clients and a couple of end devices being authenticated successfully with EAP-TTLS. My setup was running just fine on IPv4 and I would like to jump to IPv6. My first trial seems ok, but not ideal, so here are my IPv6 related questions : a) Why am I seeing in my radius -X output lines as the following : ++[detail] returns ok [unix] IPv6 is not supported! ++[unix] returns noop rlm_radutmp: IPv6 not supported! ++[radutmp] returns noop What could trigger that "IPv6 is not supported" output? Is there something that might be going wrong, because clients get authenticated successfully as far as I can tell but I am afraid that something else might be broken. b) My FreeRadius machine has "an easy to remember" IPv6 address e.g. 2001:a::1 and NAS clients are using this to send packets to FR. However it seems that FR is configuring another IPv6 address from the router advertisements that it gets from the access network. The problem is that when this happens FR replies to NAS with packets coming from the autoconfigured address as source and thus breaks the setup as NAS are waiting packets from 2001:a::1. Is there a way to force FR to generate packets coming from the manually configured IP (2001:a::1) ? c) Is there a plan to get a dual stack FreeRadius? It would be really advantageous to be able to run FreeRadius in both ipv4 and ipv6 at the same time. Thanks a lot in advance, Panos

3 5

windows users having trouble authenticating
by Sallee, Stephen (Jake) 03 Aug '10

03 Aug '10

I have a working FreeRADIUS server that will authenticate linux clients happily, however my windows clients are unable to authenticate. Here is a snippet -------------------------------------------------- +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 7 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [test1@umhb] (from client Sanderford port 129 cli 00-17-C4-F0-75-C8) Using Post-Auth-Type Reject -------------------------------------------------- As you can see the problem seems to lie in the TLS section, but I have followed all the HOWTOs I can find on installing and configuring the server cert. but to no avail. How do I tell the FreeRADIUS box to trust its own certificate? The cert was generated and signed on the FreeRADIUS box. Also as a side note, the linux users are able to authenticate by typing in domain\username, but doing this on a windows box shows very strange things in the radius log, and fails to authenticate. Is there a way to make both operating systems behave the same? Otherwise my windows clients must use the username@domain convention, once I get that working :) Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

5 15

Freeradius 2.1.9 digest authentication problem
by alexb＠arctel.ru 03 Aug '10

03 Aug '10

Hello, trying to test digest authentication (freeradius 2.1.9). After uncommenting 'digest' in sites-available/default 'radiusd -X' starts fine. but after I added (according to 'man rlm_digest') to users file: test Auth-Type := Digest, User-Password = "test" Reply-Message = "Hello, test with digest" 'radius -X' shows [root@host raddb]# /usr/local/sbin/radiusd -X FreeRADIUS Version 2.1.9, for host i686-pc-linux-gnu, built on Aug 3 2010 at 18:19:48 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } /usr/local/etc/raddb/users[137]: Parse error (check) for entry test: Unknown value Digest for attribute Auth-Type Errors reading /usr/local/etc/raddb/users /usr/local/etc/raddb/modules/files[7]: Instantiation failed for module "files" /usr/local/etc/raddb/sites-enabled/inner-tunnel[111]: Failed to load module "files". /usr/local/etc/raddb/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. [root@host raddb]# Maybe, I missed something? Thank You -- Alexander Belov

4 10

Freeradius 2.1.9 stop working
by BELLIERE Eric 03 Aug '10

03 Aug '10

Thanks Alan. Then if it is a bug I will have to upgrade? or do you have a patch? you send me the link for GIT.freeradius.org but what must I do to correct this problem? For the log rotate I will add kill -HUP `cat /var/run/radiusd/radiusd.pid` in postrotate. Like this : /var/log/radius/radius.log { daily rotate 4 create missingok postrotate kill -HUP `cat /var/run/radiusd/radiusd.pid` compress } Must I put this KILL -HUP for each log to rotate? (/var/log/radius/radacct/*/detail, /var/log/radius/checkrad.log, ...) or only for radius.log ? Thanks Eric Bellière -----Original Message----- From: freeradius-users-bounces+eric.belliere=mail.mobistar.be(a)lists.freeradius.org [mailto:freeradius-users-bounces+eric.belliere=mail.mobistar.be@lists.freera dius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Tuesday 3 August 2010 12:00 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 64, Issue 7 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Freeradius 2.1.9 stop working (Alan DeKok) 2. Re: Freeradius/Samba Client rejected our response (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Tue, 03 Aug 2010 11:43:34 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Freeradius 2.1.9 stop working To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4C57E4C6.8060102(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 BELLIERE Eric wrote: > My problem is that for unknow reason the radiusd process stopped alone > this make a problem for us. > > The Both Radiuses are doing the same. Sometimes the radiusd is no more > working and I need to restart it with /etc/init.d/radiusd start It might be bug #35. Try using the v2.1.x branch from http://git.freeradius.org. > I have another problem : When the logrotate is doing his job then the > log radius.log stay empty and I need to restart or kill -HUP the radiusd > process. That's how log rotation should work: change the log file, and HUP the server. The previous behavior was non-standard for Unix daemons, and therefore wrong. Alan DeKok. ------------------------------ Message: 2 Date: Tue, 03 Aug 2010 11:53:53 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Freeradius/Samba Client rejected our response To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4C57E731.7060300(a)deployingradius.com> Content-Type: text/plain; charset=windows-1252 Lionne Stangier wrote: > Hi, > > I have some problem problems with the authentication and need help. > > The authentication fail at the authenticate part, while doing peap. > The ntlm_auth success, I don?t understand the failure. > Why do the client rejected the response? It's a Samba bug. https://bugzilla.samba.org/show_bug.cgi?id=6563 There was a message yesterday about this issue. Alan DeKok. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 64, Issue 7 ***********************************************

2 1

Freeradius/Samba Client rejected our response
by Lionne Stangier 03 Aug '10

03 Aug '10

Hi, I have some problem problems with the authentication and need help. The authentication fail at the authenticate part, while doing peap. The ntlm_auth success, I don’t understand the failure. Why do the client rejected the response? +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Client rejected our response. The password is probably incorrect. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} Lionne Stangier Debug: -------------------------------------------------------------------------- FreeRADIUS Version 2.1.9, for host i686-pc-linux-gnu, built on Aug 3 2010 at 09:49:25 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.125.1 { require_message_authenticator = no secret = "radiustest" shortname = "localhost" } client 192.168.125.0/24 { require_message_authenticator = no secret = "radiustest" shortname = "private-network-1" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/wlan_allesklar_com.pem" certificate_file = "/usr/local/etc/raddb/certs/wlan_allesklar_com.pem" CA_file = "/usr/local/etc/raddb/certs/wlan_allesklar_com.pem" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.125.1 port 1220, id=0, length=131 User-Name = "lstangier" NAS-IP-Address = 192.168.125.1 Called-Station-Id = "0016b61397d9" Calling-Station-Id = "00166f09d8c6" NAS-Identifier = "0016b61397d9" NAS-Port = 23 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000e016c7374616e67696572 Message-Authenticator = 0x721c637cdc152aebda7df82a66bb4a06 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "lstangier", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.125.1 port 1220 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x461df117461ce8b18920a7ab6722162b Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.125.1 port 1222, id=0, length=215 User-Name = "lstangier" NAS-IP-Address = 192.168.125.1 Called-Station-Id = "0016b61397d9" Calling-Station-Id = "00166f09d8c6" NAS-Identifier = "0016b61397d9" NAS-Port = 23 Framed-MTU = 1400 State = 0x461df117461ce8b18920a7ab6722162b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005019800000004616030100410100003d03014c57d7475c50e4f97ec48fa10a11baf7bcd8b0859a218d336c5e58ed6975a49000001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xe65fe63d5edbc20797bac90803ef3119 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "lstangier", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 044e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.125.1 port 1222 EAP-Message = 0x0102040019c00000048b160301002a0200002603014c57d7330b59b4712c6cbf7f7cc6b83c9eac1d1930e9f300c956e3e475dd3f9000000400160301044e0b00044a0004470004443082044030820328a003020102021066343e292e2a1539f26cf66e0c74e854300d06092a864886f70d0101050500305e310b300906035504061302555331153013060355040a130c5468617774652c20496e632e311d301b060355040b1314446f6d61696e2056616c6964617465642053534c31193017060355040313105468617774652044562053534c204341301e170d3130303732313030303030305a170d3131303732313233353935395a3081b6311b3019 EAP-Message = 0x060355040a0c12776c616e2e616c6c65736b6c61722e636f6d313b3039060355040b0c32476f20746f2068747470733a2f2f7777772e7468617774652e636f6d2f7265706f7369746f72792f696e6465782e68746d6c31223020060355040b0c195468617774652053534c31323320636572746966696361746531193017060355040b0c10446f6d61696e2056616c696461746564311b301906035504030c12776c616e2e616c6c65736b6c61722e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c8906089f4bf446a0b624f33a4ee2230e1c34d0a781f3fb7aa2e292f6b8a74201e99a5bdeeecd9cbf8b3 EAP-Message = 0x792a2a286cce2366e696aee3cb50d77e0a04617116a964b9e5a54f3aa12a322b8c609ed390aef7567e15223d60a204b38ba84300cf2a66d8882668559f2b0c6f7f84e1fce76260660c19e0b342c35c80927692b74d9fb4ba2e16e2420ec06d8889f18f987a1927eec445172a40b07d3ea504b5239a43780fa5eedf586479badfee3b23d58b80915473f175bf5749e68a9e7803b9ac1fbe664c9a986062f89c895c86a44a4a5f84aef3f8e737b3e9aaba01677c14d467c41388a0cc9e9acdfcba553d2211299834804248c88f50b59d58ac29f0ef7bef0203010001a381a030819d300c0603551d130101ff04023000303a0603551d1f04333031302fa0 EAP-Message = 0x2da02b8629687474703a2f2f7376722d64762d63726c2e7468617774652e636f6d2f54686177746544562e63726c301d0603551d250416301406082b0601050507030106082b06010505070302303206082b0601050507010104263024302206082b060105050730018616687474703a2f2f6f6373702e7468617774652e636f6d300d06092a864886f70d0101050500038201010083ca999be5ac403d2d6acb9989bb66e6b7129e819ab7b9e3c3e97b6659c7ca8a53e948a8d401f6c4b6fe7ca3f0ebba288249d661f714cbd08636ddbbad531c0fd84125fd95c6aef8b07acba08ead5080920d9f611bc07f6ba09963a775678a8d3879dbfa7955fb48 EAP-Message = 0xcd7cf0c490b00b6edfe8e381 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x461df117471fe8b18920a7ab6722162b Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.125.1 port 1224, id=0, length=141 User-Name = "lstangier" NAS-IP-Address = 192.168.125.1 Called-Station-Id = "0016b61397d9" Calling-Station-Id = "00166f09d8c6" NAS-Identifier = "0016b61397d9" NAS-Port = 23 Framed-MTU = 1400 State = 0x461df117471fe8b18920a7ab6722162b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200061900 Message-Authenticator = 0x653ad00a0e6b3788dadce74ba6a230ba +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "lstangier", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.125.1 port 1224 EAP-Message = 0x0103009b1900108361ef4da0cad599346b68e361b4ee3b90a9add43f3db6ba49bcfefcc85e801910df66abd267b4da81f83c8248636a9497aed25128e42ec1e2ef9e6791fa8d63fc07e0fc9d15ed73a877868165358b481503afb892d0fb04f7ac880ae548da8e84a324bfc65af3bebaf1a8c92edd0e6b5e4edccfb172b80d5822f52af8dce8c9277b82c33a424a0933ef3b16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x461df117441ee8b18920a7ab6722162b Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.125.1 port 1226, id=0, length=457 User-Name = "lstangier" NAS-IP-Address = 192.168.125.1 Called-Station-Id = "0016b61397d9" Calling-Station-Id = "00166f09d8c6" NAS-Identifier = "0016b61397d9" NAS-Port = 23 Framed-MTU = 1400 State = 0x461df117441ee8b18920a7ab6722162b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02030140198000000136160301010610000102010015e264207dfe376b245998352f2fa0c887bee18050e1e241599ed877676731ead85b5e0abeb9c4fa0e379d327d748f90731682c6df7e4c8a017212144400d8738889dab9b33804099e6589d3e3e3d43115090e027a650abebce29213225df869279bcc5a1ad6aa1630cdca4d09868f23426c091ffae3eb06971546c98806a92640c6455f4ce7fecab0d84cf4f77dc47ed8fadcb24cb364c68f6235e91bc1f2729347836371353d5e63a3e961b825723d09f22540a691633c0b45ad9195700de0fa3923bb5855373002010e06f8d6a995c4993fa7273121a64e4797c93916319e4d1e64d64801be77 EAP-Message = 0x273bef186d3f1ef0b7523e51f89d3676567f847479476ea21403010001011603010020de36cb4a90b15014f538cd3753398f5d9eb80f81a510c29a09d0600ed2e92578 Message-Authenticator = 0xe9b968d3a985b59584b3d63ac03a8666 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "lstangier", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.125.1 port 1226 EAP-Message = 0x01040031190014030100010116030100203aae01a2dd5b525b4640d3542fcca232dd9fc8054dfd9e5d64919b035c62e6c1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x461df1174519e8b18920a7ab6722162b Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.125.1 port 1228, id=0, length=141 User-Name = "lstangier" NAS-IP-Address = 192.168.125.1 Called-Station-Id = "0016b61397d9" Calling-Station-Id = "00166f09d8c6" NAS-Identifier = "0016b61397d9" NAS-Port = 23 Framed-MTU = 1400 State = 0x461df1174519e8b18920a7ab6722162b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0x6308333027017c3fc6b29d6b47e54ed4 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "lstangier", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.125.1 port 1228 EAP-Message = 0x010500201900170301001568adeeabefd4961a1417e3ecc4ae9e15fabcf77de4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x461df1174218e8b18920a7ab6722162b Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.125.1 port 1230, id=0, length=172 User-Name = "lstangier" NAS-IP-Address = 192.168.125.1 Called-Station-Id = "0016b61397d9" Calling-Station-Id = "00166f09d8c6" NAS-Identifier = "0016b61397d9" NAS-Port = 23 Framed-MTU = 1400 State = 0x461df1174218e8b18920a7ab6722162b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500251900170301001a9c469109b10a413691e477130172fcb2e8cb456b3adfb4b4756c Message-Authenticator = 0xa5ae3651f63316d5dde828f792657501 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "lstangier", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 37 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - lstangier [peap] Got tunneled request EAP-Message = 0x0205000e016c7374616e67696572 server { PEAP: Got tunneled identity of lstangier PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to lstangier Sending tunneled request EAP-Message = 0x0205000e016c7374616e67696572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "lstangier" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "lstangier", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 5 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010600231a0106001e10ad58ef7b49bf166023638482aaf158e96c7374616e67696572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcee4b934cee2a3efc9b8c22ea0ff466d [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010600231a0106001e10ad58ef7b49bf166023638482aaf158e96c7374616e67696572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcee4b934cee2a3efc9b8c22ea0ff466d [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.125.1 port 1230 EAP-Message = 0x0106003a1900170301002fdc8db20c88bfe83f5f316efd84c82ff4639e4ed661f2ee5a8ee08f48c317bf3daa74701fab1d9cc1686560b57eb60c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x461df117431be8b18920a7ab6722162b Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.125.1 port 1232, id=0, length=226 User-Name = "lstangier" NAS-IP-Address = 192.168.125.1 Called-Station-Id = "0016b61397d9" Calling-Station-Id = "00166f09d8c6" NAS-Identifier = "0016b61397d9" NAS-Port = 23 Framed-MTU = 1400 State = 0x461df117431be8b18920a7ab6722162b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0206005b19001703010050baedaf2e7120faea6ad707b63452ea76aae2725647282651084a8e62cde7c13b5bc470a1db8b56fb6900530fb1c0d7b7df0bb0c8ae29db0a7258c373c54eb9bef74f6b7f3e9c8d2e598a23505ccdf481 Message-Authenticator = 0x9f0bd366ca6c6c78b15eb679267694ea +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "lstangier", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 91 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020600441a0206003f31e13fc4b5eb6fe8a2af4641c4178cedd4000000000000000094e80e71c71ce50316323fc4a0cc6092cbaba398c233d77c006c7374616e67696572 server { PEAP: Setting User-Name to lstangier Sending tunneled request EAP-Message = 0x020600441a0206003f31e13fc4b5eb6fe8a2af4641c4178cedd4000000000000000094e80e71c71ce50316323fc4a0cc6092cbaba398c233d77c006c7374616e67696572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "lstangier" State = 0xcee4b934cee2a3efc9b8c22ea0ff466d server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "lstangier", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 6 length 68 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for lstangier with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: %{User-Name:-None} -> lstangier [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=lstangier [mschap] mschap2: ad [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=eb6c255ee452e709 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=94e80e71c71ce50316323fc4a0cc6092cbaba398c233d77c Exec-Program output: NT_KEY: BBF443E906E29B17DA376A23E2C1FABF Exec-Program-Wait: plaintext: NT_KEY: BBF443E906E29B17DA376A23E2C1FABF Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010700331a0306002e533d36464242373937443043393144393734343931413738393046423436443443334546463444334246 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcee4b934cfe3a3efc9b8c22ea0ff466d [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010700331a0306002e533d36464242373937443043393144393734343931413738393046423436443443334546463444334246 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcee4b934cfe3a3efc9b8c22ea0ff466d [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.125.1 port 1232 EAP-Message = 0x0107004a1900170301003f4f26af72eae2a8ef7d7b1d3201c7d5e1671d30c758b19ea46bf362ce1a870d4ed48ddd9181aa87285a83cb80a99087377741ce26c5b2f9c6e2b0199f1d5c17 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x461df117401ae8b18920a7ab6722162b Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.125.1 port 1234, id=0, length=164 User-Name = "lstangier" NAS-IP-Address = 192.168.125.1 Called-Station-Id = "0016b61397d9" Calling-Station-Id = "00166f09d8c6" NAS-Identifier = "0016b61397d9" NAS-Port = 23 Framed-MTU = 1400 State = 0x461df117401ae8b18920a7ab6722162b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0207001d19001703010012d24e2ec365bcd6dd624a52dcf50ee26dabbe Message-Authenticator = 0x8d0a06a1042f3905f49b582a3aba0dea +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "lstangier", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 29 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020700061a03 server { PEAP: Setting User-Name to lstangier Sending tunneled request EAP-Message = 0x020700061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "lstangier" State = 0xcee4b934cfe3a3efc9b8c22ea0ff466d server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "lstangier", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. } # server inner-tunnel [peap] Got tunneled reply code 2 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "lstangier" [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "lstangier" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.125.1 port 1234 EAP-Message = 0x010800261900170301001bfa167b8f79912c8bf624fac1fb5c5b256ee9b7742a771decc74704 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x461df1174115e8b18920a7ab6722162b Finished request 7. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.125.1 port 1236, id=0, length=173 User-Name = "lstangier" NAS-IP-Address = 192.168.125.1 Called-Station-Id = "0016b61397d9" Calling-Station-Id = "00166f09d8c6" NAS-Identifier = "0016b61397d9" NAS-Port = 23 Framed-MTU = 1400 State = 0x461df1174115e8b18920a7ab6722162b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800261900170301001be274637abbb384c23085fb88bd719e9ada6cfdc5e96c35d2b145ad Message-Authenticator = 0x8dd38f1e0af568955d140d94225c234f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "lstangier", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Client rejected our response. The password is probably incorrect. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> lstangier attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 0 to 192.168.125.1 port 1236 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 0 with timestamp +18 Cleaning up request 1 ID 0 with timestamp +18 Cleaning up request 2 ID 0 with timestamp +18 Cleaning up request 3 ID 0 with timestamp +18 Cleaning up request 4 ID 0 with timestamp +19 Cleaning up request 5 ID 0 with timestamp +19 Cleaning up request 6 ID 0 with timestamp +19 Cleaning up request 7 ID 0 with timestamp +19 Waking up in 1.0 seconds. Cleaning up request 8 ID 0 with timestamp +19 Ready to process requests.

2 2

Freeradius 2.1.9 stop working
by BELLIERE Eric 03 Aug '10

03 Aug '10

Hello. We have installed 2 FreeRAdius 2.1.9 on RedHat Servers. The Freeradius are doing proxying and everything is working well (duplicate accounting also) My problem is that for unknow reason the radiusd process stopped alone this make a problem for us. The Both Radiuses are doing the same. Sometimes the radiusd is no more working and I need to restart it with /etc/init.d/radiusd start I have another problem : When the logrotate is doing his job then the log radius.log stay empty and I need to restart or kill -HUP the radiusd process. Is someone already have this problem? Is there a bug? Server 1 : [root@chinchilla radius]$uname -a Linux chinchilla 2.6.18-194.8.1.el5PAE #1 SMP Wed Jun 23 11:16:22 EDT 2010 i686 i686 i386 GNU/Linux radmin> show version FreeRADIUS Version 2.1.9, for host i686-redhat-linux-gnu, built on Jul 26 2010 at 13:51:35 Server2 : [root@cheetah radius]$uname -a Linux cheetah 2.6.18-194.3.1.el5PAE #1 SMP Sun May 2 04:42:25 EDT 2010 i686 i686 i386 GNU/Linux radmin> show version FreeRADIUS Version 2.1.9, for host i686-redhat-linux-gnu, built on Jun 22 2010 at 21:23:08 Thanks, <http://k-village/team_members/who_s_who/kpeople01.asp?login=ebellier> Eric Bellière Operation & Integration Expert ITNO/ISO/ISIO/LSS Mobistar NV/SA Avenue Jean Mermoz 32 6041 Gosselies cid:image003.jpg@01C961E5.77656AB0 Tel: +32 (0)2 745 7997 GSM: +32(0)495 55 1343

2 1

is there any book available for freeradius ??
by ashish edkee 03 Aug '10

03 Aug '10

Hi, I am new to using freeradius and hence pardon my ignorance :) I googled to check if theres any book which explains the deployment of freeradius but no success. Is there any book available or forums and READMEs are the only source ? Thanks, Ashish

3 3

Samba Bug #6563
by Colantuoni, Robert 02 Aug '10

02 Aug '10

Our AD team recently upgraded their servers from Windows 2003 to 2008 and broke the Samba 3.0.34 installation we had been using for ntlm_auth. We couldn't get this version of Samba to join the upgraded servers, so we were forced to look into patching Samba 3.5.4 (latest) to fix the issue where ntlm_auth returns an invalid NT_KEY. I believe this issue has been open for about 2 years and hasn't moved much in the Samba bug list: https://bugzilla.samba.org/show_bug.cgi?id=6563 A committer named Volker Lendecke suggested that the source was SamLogonEx... by using SamLogon instead, you can get around the issue. This seems to stem from the SamLogonEx function using session keys versus credentials... but I'd like to ask a windows/samba expert for a better opinion. I've attached a patch to the bug report above which adds the --force-samlogon option to winbind. If winbind is started without this flag, it operates "normally" and we get an invalid NT_KEY returned. If it's started with the flag, the issue is resolved. We've been running this in production and haven't run into any issues with a few thousand 802.1x users. I hope this helps a few people who have been stuck in Samba purgatory. Rob Colantuoni

2 1