- Freeradius-Users - lists.freeradius.org

About fFreeradius with Active Directory
by Aziz YÜCELEN 09 Jul '10

09 Jul '10

Hi I have a freeradius server and it authenticate user in users file but I want to use Active directory.Is server must join any domain for using Active Directory ?Thanks. _________________________________________________________________ Windows Live Hotmail: Arkadaşlarınız Facebook'taki güncellemelerinizi doğrudan Hotmail®'den alır. http://www.microsoft.com/windows/windowslive/see-it-in-action/social-networ…

1 0

how to setup in fedora ?
by Abraham Varricatt 09 Jul '10

09 Jul '10

Hello, I just flashed a linksys with dd-wrt and now I'm trying to setup a freeradius server on a Fedora system. For the life of me, I can't figure out what to do next on the system. I've installed freeradius by running - "sudo yum install freeradius" on my Fedora, but what do I do next? The online wiki hasn't been too helpful with fedora-specific info. I'm hoping to setup a dialupadmin interface and manage things from there. I don't want to hold hands here, but could someone give me a hint on what I should be looking into next ? Puzzled, Abraham V.

3 6

Re: PEAP/MSCHAPv2, Post-Auth-Type REJECT {} of inner-tunnel is neverentered for access reject
by Fads Afds 09 Jul '10

09 Jul '10

Dear Alan, Thanks for your prompt reply and helpful information. I tried to get the error-message of inner-tunnel by running sql query in "Post-Auth-Type Reject {} of default. The message field in radpostauth table is empty. The query seems cannot access %{inner.control:My-Err-Message} attribute. My question is: Can sql in default (outer session) access innner-server control attribute when the login is rejected? If the answer is no, would you hint me how I can get & log the error message of inner-session? Thanks again. After your reply, I include: 1. The warning message: 2. sql query for radpostauth 3. content of authorize section of file /etc/raddb/sites-available/default 4. radiusd -X debug message for access-reject case ------------Alan's reply --------------------------------------- Fads Afds wrote: > Hi Fellows, > > I have configured FreeRadius 2.1.8 running on SLES 11 for PEAP/MSCHAPv2. MySQL is used for user database. I have tested using "eapol_test" and win/XP SP3 supplicant. > Accounting data can be received & stored to radacct table. > Inner-server can successfully accept user with accumulated session time quota not exceeded and reject user with accumulated session time quota exceeded. > My problem: > I expect to store accept or reject log with rejecting message to radpostauth table. > For access-accept case, sql inside post-auth {} of inner-tunnl is invoked and logging message is written to radpostauth table as expected. > For access-reject cases (username not existed in db, wrong username, accumulated session time quota exceeded, etc), Post-Auth-Type REJECT {} of inner-tunnel is never entered. What is wrong? Any help? Thanks in advance. The server does not currently run the "Post-Auth-Type Reject" when in the inner tunnel. Instead, it is run in the default virtual server, outside of the tunnel. Alan DeKok. - -----------Alan's reply ends ------------------------------ -------------1. The warning message ------- [sql] WARNING: Unknown module "inner.control" in string expansion "%{inner.control:My-Err-Message}', -------------1. ends -------------------------- ------2. sql query for radpostauth ------------------ postauth_query = "INSERT INTO ${postauth_table} \ (ID, username, password, nas_ip, auth_result, reply_message, authdate) \ VALUES (NULL, \ '%{User-Name}', \ aes_encrypt('NA', 'abc123456def'), \ '%{NAS-IP-ADDRESS}', \ '%{reply:Packet-Type}', \ '%{inner.control:My-Err-Message}', \ '%S')" -----------------2. ends ----------------------------- -----3. content of Post-Auth-Type Reject{} section of file /etc/raddb/sites-available/default --------------- Post-Auth-Type REJECT { sql reply_log attr_filter.access_reject } ----3. ends ------------------------------------------ ----4. radiusd -X message for rejected case------------------------------ Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 158.182.118.234 port 43514, id=159, length=168 User-Name = "visit04" NAS-IP-Address = 158.182.118.234 NAS-Port = 1 NAS-Identifier = "158.182.118.234" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "34159EE8BD35" Called-Station-Id = "000B8609D780" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0201000c0176697369743034 Aruba-Essid-Name = "BU-Guest" Aruba-Location-Id = "SRH-S906" Message-Authenticator = 0x5fbf723681bafb64473bda5fb613e4b4 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "visit04", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Flushing SSL sessions (of #0) [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 159 to 158.182.118.234 port 43514 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2451839f24539a76dd46fbeb200155bb Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 158.182.118.234 port 43514, id=160, length=310 User-Name = "visit04" NAS-IP-Address = 158.182.118.234 NAS-Port = 1 NAS-Identifier = "158.182.118.234" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "34159EE8BD35" Called-Station-Id = "000B8609D780" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0202008819800000007e16030100790100007503014c36b96bd9a767fea76af8ea1ad3b3fe170ef44198d94e94e1d7f4d45eb7d95300003ac00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a0009000300080033003900160015001401000012000a00080006001700180019000b00020100 State = 0x2451839f24539a76dd46fbeb200155bb Aruba-Essid-Name = "BU-Guest" Aruba-Location-Id = "SRH-S906" Message-Authenticator = 0x807c6e2d452be6f72076f30aae603e1e +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "visit04", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 136 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 126 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0079], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 004a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 084d], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 160 to 158.182.118.234 port 43514 EAP-Message = 0x0103040019c0000008aa160301004a0200004603014c36b97de42d2baf0dfe1eaffecf9e25722e8e8bc582f3a8297b4a4096de4ea420747bba71baba01650b81ddf7414a3fb3d5ac2e003f9d20859ffc9ec61dd8fe59002f00160301084d0b0008490008460003a8308203a43082028ca003020102020101300d06092a864886f70d010104050030818c310b300906035504061302434e310b300906035504081302484b310c300a06035504071303656475310d300b060355040a1304484b42553127302506092a864886f70d0109011618726f6f7440667267756573742e686b62752e6564752e686b312a302806035504031321484b425520477565 EAP-Message = 0x737420434120636572742028363462697420736572766572293020170d3130303632343033353835305a180f32303530303631343033353835305a308182310b300906035504061302434e310b300906035504081302484b310d300b060355040a1304484b4255312e302c06035504031325484b42552047756573742073657276657220636572746966696361746520283634626974293127302506092a864886f70d0109011618726f6f7440667267756573742e686b62752e6564752e686b30820122300d06092a864886f70d01010105000382010f003082010a0282010100c7649ee337738ce465aec9a12a375bd4d76fc3c2f50ac701065d1433 EAP-Message = 0x22c38dd78776d5ad0cb747a32f6b512dce6d26cccffefd49cf1517670305c6cb6eee0b70c86cb259383ca439bf011e8d8689cd17c41e99498256f13e6f14282b8eeef46f95e742d40254b69d7270d1d349e8cd41cff1dc98ea38fb494ea6007aed1575391d69e9f1c230fea9125f09a28d544282e9520e4c5987f54ff43f94567991d6172f98bfd3a200aeb07e60345e40caff2f1f34c52e77707e3321a774bc7601827ccbd723e044ee635de38dc174e37aea2640f5dbacb3454bd89bd2e03b81031365232fe8f014c069983950f75aa8fdcce7a9ee52d57dc7fec1512a57fabb3b993b0203010001a317301530130603551d25040c300a06082b0601 EAP-Message = 0x0505070301300d06092a864886f70d01010405000382010100192613ffaf84004131ad7ce0d3da7b42d8a594371b96058ea7dc28554921dfd279076ad03cbf83ab81d7d3ac909202e97a3c22fdad6eee38f2961ef4e9cc9398c5e4bd8a0f41c9174d4fa44a1e77e95c887c065197300ea90c8ffc1d32c898c4e137b6a74834c769d7be8008fea4b3ca9c5a33505b588fd93fa440584d00f8c0c11d62bd886037289e5f27cec1039a4c311a04a7cf75b9ed578b840c66993dea65d31adf591ffc290d98d6565e70a1d3d45ae3f0c877c5104d1def8c23a79f38c92731165bfb2a84759f2c6c07e15ff75e4fe6f99e67dac4fc5ca7bf6cbdf849c44b77f6 EAP-Message = 0x614977256b1dcde1b92a76f3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2451839f25529a76dd46fbeb200155bb Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 158.182.118.234 port 43514, id=161, length=180 User-Name = "visit04" NAS-IP-Address = 158.182.118.234 NAS-Port = 1 NAS-Identifier = "158.182.118.234" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "34159EE8BD35" Called-Station-Id = "000B8609D780" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020300061900 State = 0x2451839f25529a76dd46fbeb200155bb Aruba-Essid-Name = "BU-Guest" Aruba-Location-Id = "SRH-S906" Message-Authenticator = 0xc129a38994a204510116e4a413e3fd4f +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "visit04", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 161 to 158.182.118.234 port 43514 EAP-Message = 0x010403fc1940d8d084a884e20a2a165c46af33618c22000498308204943082037ca003020102020900a00b0c8b6ee723bb300d06092a864886f70d010105050030818c310b300906035504061302434e310b300906035504081302484b310c300a06035504071303656475310d300b060355040a1304484b42553127302506092a864886f70d0109011618726f6f7440667267756573742e686b62752e6564752e686b312a302806035504031321484b425520477565737420434120636572742028363462697420736572766572293020170d3130303632343033353833335a180f32303530303631343033353833335a30818c310b30090603550406 EAP-Message = 0x1302434e310b300906035504081302484b310c300a06035504071303656475310d300b060355040a1304484b42553127302506092a864886f70d0109011618726f6f7440667267756573742e686b62752e6564752e686b312a302806035504031321484b4255204775657374204341206365727420283634626974207365727665722930820122300d06092a864886f70d01010105000382010f003082010a0282010100c001917da3c962085a616702fa98c2bd794c7edfa3a1f038258e018a126e736e3a61ae5120b956ab0566a9258b889d66e616e2d702b1a0f5ec79b1b484a9a9ec5ff3ba49d31895a6073ac132c9aa28f3e9906d0a6e3c24e852 EAP-Message = 0x621586b8db41ce111ebf2befc143a5cc9d562d020594fe407135ec1c068dd0303eca75e5c5dd9cab898af3e870072ea3eca78602644eea0bac0c5619925b56aba1b1c1fc4c48fded87cdcf44d1b99a2c1f534e8b88e4a35f9d1ffa8a50cdb402743516a0cbce2a4796459501875ec225357d4a362202e15ee12a0154f018e5b84a5e5884c268d3154ed41f7b78ea2f6df852e07bdd50a55c26467bcaf75c41d393bc78b27fb5170203010001a381f43081f1301d0603551d0e04160414c134ca58d9d8f09b9207417630a08266b192ef523081c10603551d230481b93081b68014c134ca58d9d8f09b9207417630a08266b192ef52a18192a4818f3081 EAP-Message = 0x8c310b300906035504061302434e310b300906035504081302484b310c300a06035504071303656475310d300b060355040a1304484b42553127302506092a864886f70d0109011618726f6f7440667267756573742e686b62752e6564752e686b312a302806035504031321484b42552047756573742043412063657274202836346269742073657276657229820900a00b0c8b6ee723bb300c0603551d13040530030101ff300d06092a864886f70d010105050003820101000d81bb75569e9ce10ee1cc274ce224d6d175d681f14079bdb2953b179dc9e15eedecd08f8d61f1759f3bb4c97458573e0b9b6b6be66954fc48d713a54ad949e99d806a EAP-Message = 0x400957b5cd394c74 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2451839f26559a76dd46fbeb200155bb Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 158.182.118.234 port 43514, id=162, length=180 User-Name = "visit04" NAS-IP-Address = 158.182.118.234 NAS-Port = 1 NAS-Identifier = "158.182.118.234" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "34159EE8BD35" Called-Station-Id = "000B8609D780" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020400061900 State = 0x2451839f26559a76dd46fbeb200155bb Aruba-Essid-Name = "BU-Guest" Aruba-Location-Id = "SRH-S906" Message-Authenticator = 0x840c9d88dbf3256afd4525a35ea49bd4 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "visit04", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 162 to 158.182.118.234 port 43514 EAP-Message = 0x010500c4190012c062cd3163799ab42c262a3b39ee4aadeba8ca0584 be4afc188b998b5b79ebc112998a4791842e212835761d44b5202634a16bdc8886be5a2a6ddef1be 58fd73726f412c140197da3a29fc44aa1b67361c18f9f72312826067f64edc638e6a8b5511cd2c9e d88cb6de9ef5c6c909025dc37b4abdc9fdc643561bb06b1e07e30de728a7e8a4dc07dda92896b897 6fedf2623b70b61a7757012cb421a8c76616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2451839f27549a76dd46fbeb200155bb Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 158.182.118.234 port 43514, id=163, le ngth=512 User-Name = "visit04" NAS-IP-Address = 158.182.118.234 NAS-Port = 1 NAS-Identifier = "158.182.118.234" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "34159EE8BD35" Called-Station-Id = "000B8609D780" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0205015019800000014616030101061000010201003bf0a1c7ffabbf d264a9ed58e54032fa600764768552751ec7f53062cd5a9ebaa52c46c6d6473f0ca33765d222a337 0309fd496e403f48ffa250620d87d7e2b53adff292a0fe7aa59ce6c6a894c9a9f251310c58d2798e 462eaef1dd00f79a31fb4074edfeb033e90924c3f8d236a5155f28b1a3f99c6ec692afccca487db4 4f9a9044c7d837eebf3da89c3f8f4f441b1e7f89b8eb9ae31e4ace331184697e1becff07f91fae76 6b7db43ab8665fbf2fee0a1e60dc06b4da5372041ed4c3f0e8644c5833201b9fa612988d54f2909f 6a0c4378a46a93fb1c589f62dfe98b51d639aa10afc5cdfe22 EAP-Message = 0x4c6390331da2262fadc0868cc2a68da17c72dc060fbeb7d814030100 0101160301003054624df5fcb87f023583a20ff07bded2d37e6bade2f35680bb627a67a08c3715fb e34c1eab20dd678bebe49473239609 State = 0x2451839f27549a76dd46fbeb200155bb Aruba-Essid-Name = "BU-Guest" Aruba-Location-Id = "SRH-S906" Message-Authenticator = 0x305bb4b0e144e78dc6a57741b74fcc54 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "visit04", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data SSL: adding session 747bba71baba01650b81ddf7414a3fb3d5ac2e003f9d20859ffc9ec61d d8fe59 to cache [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 163 to 158.182.118.234 port 43514 EAP-Message = 0x0106004119001403010001011603010030eb029049a915c4eed9864c 22405237450831a8c271e7d0df2892e87916cd8c988d2f45f0d8295ee9b3a28fecb0b9cb26 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2451839f20579a76dd46fbeb200155bb Finished request 4. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 159 with timestamp +1 Cleaning up request 1 ID 160 with timestamp +1 Cleaning up request 2 ID 161 with timestamp +1 Cleaning up request 3 ID 162 with timestamp +1 Cleaning up request 4 ID 163 with timestamp +1 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 44979, id=0, length=118 User-Name = "time1" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000a0174696d6531 Message-Authenticator = 0x92f180fdc088db77ec99a79a3853e8df +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "time1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 127.0.0.1 port 44979 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x916bee87916af76dd5fdb5b529c56e9d Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 44979, id=1, length=235 User-Name = "time1" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201006d198000000063160301005e0100005a03014c36b9940675bc 6559c07769a84fd3181a44bc79b9976f0ae1362e9afe4bb177000032003900380035008800870084 00160013000a00330032002f00450044004100050004001500120009001400110008000600030201 00 State = 0x916bee87916af76dd5fdb5b529c56e9d Message-Authenticator = 0x8be06fd650f109fc2ad4ec626bcf639c +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "time1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 109 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 99 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005e], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 004a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 084d], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 1 to 127.0.0.1 port 44979 EAP-Message = 0x0102040019c000000abc160301004a0200004603014c36b9948fd417 c358d194f7f033ae8cc5ff244d77ca8166fc6881b774d94ef32044540d0f50e26d1444cb5ce1d6f3 d574fbc20b1cddb9a708567434fa1bebc167003901160301084d0b0008490008460003a8308203a4 3082028ca003020102020101300d06092a864886f70d010104050030818c310b3009060355040613 02434e310b300906035504081302484b310c300a06035504071303656475310d300b060355040a13 04484b42553127302506092a864886f70d0109011618726f6f7440667267756573742e686b62752e 6564752e686b312a302806035504031321484b425520477565 EAP-Message = 0x73742043412063657274202836346269742073657276657229302017 0d3130303632343033353835305a180f32303530303631343033353835305a308182310b30090603 5504061302434e310b300906035504081302484b310d300b060355040a1304484b4255312e302c06 035504031325484b4255204775657374207365727665722063657274696669636174652028363462 6974293127302506092a864886f70d0109011618726f6f7440667267756573742e686b62752e6564 752e686b30820122300d06092a864886f70d01010105000382010f003082010a0282010100c7649e e337738ce465aec9a12a375bd4d76fc3c2f50ac701065d1433 EAP-Message = 0x22c38dd78776d5ad0cb747a32f6b512dce6d26cccffefd49cf151767 0305c6cb6eee0b70c86cb259383ca439bf011e8d8689cd17c41e99498256f13e6f14282b8eeef46f 95e742d40254b69d7270d1d349e8cd41cff1dc98ea38fb494ea6007aed1575391d69e9f1c230fea9 125f09a28d544282e9520e4c5987f54ff43f94567991d6172f98bfd3a200aeb07e60345e40caff2f 1f34c52e77707e3321a774bc7601827ccbd723e044ee635de38dc174e37aea2640f5dbacb3454bd8 9bd2e03b81031365232fe8f014c069983950f75aa8fdcce7a9ee52d57dc7fec1512a57fabb3b993b 0203010001a317301530130603551d25040c300a06082b0601 EAP-Message = 0x0505070301300d06092a864886f70d01010405000382010100192613 ffaf84004131ad7ce0d3da7b42d8a594371b96058ea7dc28554921dfd279076ad03cbf83ab81d7d3 ac909202e97a3c22fdad6eee38f2961ef4e9cc9398c5e4bd8a0f41c9174d4fa44a1e77e95c887c06 5197300ea90c8ffc1d32c898c4e137b6a74834c769d7be8008fea4b3ca9c5a33505b588fd93fa440 584d00f8c0c11d62bd886037289e5f27cec1039a4c311a04a7cf75b9ed578b840c66993dea65d31a df591ffc290d98d6565e70a1d3d45ae3f0c877c5104d1def8c23a79f38c92731165bfb2a84759f2c 6c07e15ff75e4fe6f99e67dac4fc5ca7bf6cbdf849c44b77f6 EAP-Message = 0x614977256b1dcde1b92a76f3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x916bee879069f76dd5fdb5b529c56e9d Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 44979, id=2, length=132 User-Name = "time1" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200061900 State = 0x916bee879069f76dd5fdb5b529c56e9d Message-Authenticator = 0xd8afe5a5dd1ff493ea23d2bdcdf9ccde +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "time1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to 127.0.0.1 port 44979 EAP-Message = 0x010303fc1940d8d084a884e20a2a165c46af33618c22000498308204 943082037ca003020102020900a00b0c8b6ee723bb300d06092a864886f70d010105050030818c31 0b300906035504061302434e310b300906035504081302484b310c300a0603550407130365647531 0d300b060355040a1304484b42553127302506092a864886f70d0109011618726f6f744066726775 6573742e686b62752e6564752e686b312a302806035504031321484b425520477565737420434120 636572742028363462697420736572766572293020170d3130303632343033353833335a180f3230 3530303631343033353833335a30818c310b30090603550406 EAP-Message = 0x1302434e310b300906035504081302484b310c300a06035504071303 656475310d300b060355040a1304484b42553127302506092a864886f70d0109011618726f6f7440 667267756573742e686b62752e6564752e686b312a302806035504031321484b4255204775657374 204341206365727420283634626974207365727665722930820122300d06092a864886f70d010101 05000382010f003082010a0282010100c001917da3c962085a616702fa98c2bd794c7edfa3a1f038 258e018a126e736e3a61ae5120b956ab0566a9258b889d66e616e2d702b1a0f5ec79b1b484a9a9ec 5ff3ba49d31895a6073ac132c9aa28f3e9906d0a6e3c24e852 EAP-Message = 0x621586b8db41ce111ebf2befc143a5cc9d562d020594fe407135ec1c 068dd0303eca75e5c5dd9cab898af3e870072ea3eca78602644eea0bac0c5619925b56aba1b1c1fc 4c48fded87cdcf44d1b99a2c1f534e8b88e4a35f9d1ffa8a50cdb402743516a0cbce2a4796459501 875ec225357d4a362202e15ee12a0154f018e5b84a5e5884c268d3154ed41f7b78ea2f6df852e07b dd50a55c26467bcaf75c41d393bc78b27fb5170203010001a381f43081f1301d0603551d0e041604 14c134ca58d9d8f09b9207417630a08266b192ef523081c10603551d230481b93081b68014c134ca 58d9d8f09b9207417630a08266b192ef52a18192a4818f3081 EAP-Message = 0x8c310b300906035504061302434e310b300906035504081302484b31 0c300a06035504071303656475310d300b060355040a1304484b42553127302506092a864886f70d 0109011618726f6f7440667267756573742e686b62752e6564752e686b312a302806035504031321 484b42552047756573742043412063657274202836346269742073657276657229820900a00b0c8b 6ee723bb300c0603551d13040530030101ff300d06092a864886f70d010105050003820101000d81 bb75569e9ce10ee1cc274ce224d6d175d681f14079bdb2953b179dc9e15eedecd08f8d61f1759f3b b4c97458573e0b9b6b6be66954fc48d713a54ad949e99d806a EAP-Message = 0x400957b5cd394c74 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x916bee879368f76dd5fdb5b529c56e9d Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 44979, id=3, length=132 User-Name = "time1" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0x916bee879368f76dd5fdb5b529c56e9d Message-Authenticator = 0xea8dbecd0bbfd3fd3a2ecfa044306feb +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "time1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 3 to 127.0.0.1 port 44979 EAP-Message = 0x010402d6190012c062cd3163799ab42c262a3b39ee4aadeba8ca0584 510b5f850ecbe4afc188b998b5b79ebc112998a4791842e212835761d44b5202634a16bdc8886be5 a2a6ddef1becbbaa64117a58fd73726f412c140197da3a29fc44aa1b67361c18f9f72312826067f6 4edc638e6a8b5511cd2c9eff129e700e0d88cb6de9ef5c6c909025dc37b4abdc9fdc643561bb06b1 e07e30de728a7e8a4dc07dda92896b8975d7907b85b66fedf2623b70b61a7757012cb421a8c76616 0301020d0c00020900808fcc5daaf65ec4b9ed53a13aa5563c3a857d7b01a0935ce18302cbbd8117 bdcee617438d810d33e6737c2b63ad1b1e728d85e9aa9c155d EAP-Message = 0x84c5499240de4a0574ca81181dd71a196f1dccceee978f8380d16b7e 6019d903f2d5ed2428b8649b958dbd4a5c52b8f99989c064eb651266552a0b7eab32727454b2eee7 89c78aee3b000102008006712a5b381bc117e45cbd7fab4a3f79b5de212697b11ea7050ea92387e2 bd8f55f1fcaed363ad2e59ac6ba4e20a502f5d9e320a4e67aa8a59c032fa7b1fa7c88ebf4f45a365 e247503763959d230aeba6d365560776fb3f1a37c7768df257ec6b8e874bbcc8725cc5cc3aabbf5a a607b1ddb9aadc912084a35431ffd12d72280100567b7a139ef0b540f469f3152ea29b1279ce2c0b e37d8b0589af62c0feabc70a4b75e169fbe19eaed05d94fd35 EAP-Message = 0x0487fa6a7fb0deb69a9441ff459df22b562e61aea5b6d6a925ebddd2 734c0f91be9589c39f74308377167856c63654257d3b82c3e1cd1dc2078af6428cd457be9f4f16f7 8a57f6726e9008ae8a91446703c2409b24f8c1dc43824cec7d78baeb1c4bdedd15e6e7d646c11261 1e5f2fca452578637f56d7f8bc7fb70a5046bc5855a58c1a478b3a0d815d5a7a679dcda704ee07e0 f998917389ac127708a67b52b700b8d6fcd2e2b07b12255a72e7daa1641063f71fd4071d842283ac dcf4f8cbafeb53d34c08874d672b4d0ed135e0948d32e316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x916bee87926ff76dd5fdb5b529c56e9d Finished request 8. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 44979, id=4, length=334 User-Name = "time1" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400d01980000000c6160301008610000082008033eddf5661f7ab ee16b84267fd8caedf21933f4765a74e0225225c1a0f0fa34073f798a1c6fb78d1d8cce2a7233f96 c0e46dee307cbcc4fafbfeefed0cee3d4ace2cda38f588d621182cf7784b5cfadf4ae002cb1229fe 3c25cf8a84d651b9f1a48d5c653f24078908b3f76eabcbaf0336110ea6b5ce43bce7e9806b21f497 e11403010001011603010030c0fad5b2a8620a03c368f400561a18aa1ef9c47c812975c1200ee4d9 1b6f7ab876a8328439a8d6c46b92a9d9675d5ab6 State = 0x916bee87926ff76dd5fdb5b529c56e9d Message-Authenticator = 0xcb67ce8cdef834a019f0bc172be79567 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "time1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data SSL: adding session 44540d0f50e26d1444cb5ce1d6f3d574fbc20b1cddb9a708567434fa1b ebc167 to cache [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 4 to 127.0.0.1 port 44979 EAP-Message = 0x010500411900140301000101160301003023d4aff3b00678962d4461 db9937f233d330e52eb786e7f491bf95a2ff34e61403a6af4475b47928a9a9dc5ed504a7db Message-Authenticator = 0x00000000000000000000000000000000 State = 0x916bee87956ef76dd5fdb5b529c56e9d Finished request 9. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 44979, id=5, length=132 User-Name = "time1" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061900 State = 0x916bee87956ef76dd5fdb5b529c56e9d Message-Authenticator = 0x6368b75534fe339b5807873da362c3ad +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "time1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 5 to 127.0.0.1 port 44979 EAP-Message = 0x0106002b19001703010020875473c93e0b7cb56d652eb5fe471f11d9 35542130e98f57a3704a1b29200490 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x916bee87946df76dd5fdb5b529c56e9d Finished request 10. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 44979, id=6, length=222 User-Name = "time1" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020600601900170301002031960254e6cb92dd55e739f57bf9821c52 1ba47d45a525945bf075364b02362c1703010030430376a22471040f6ae116593bc609d44298483d 275e06234fb07925c512cc8e21911dc9580157366992019cd0648de2 State = 0x916bee87946df76dd5fdb5b529c56e9d Message-Authenticator = 0xba24b8aee8858b6bfe01e4a0996df0d7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "time1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - time1 [peap] Got tunnled request EAP-Message = 0x0206000a0174696d6531 server (null) { PEAP: Got tunneled identity of time1 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to time1 Sending tunneled request EAP-Message = 0x0206000a0174696d6531 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "time1" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" server inner-tunnel { +- entering group authorize {...} ++[mschap] returns noop [suffix] No '@' in User-Name = "time1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 6 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail -%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20100709 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expan ds to /var/log/radius/radacct/127.0.0.1/auth-detail-20100709 [auth_log] expand: %t -> Fri Jul 9 13:54:28 2010 ++[auth_log] returns ok [sql] expand: %{User-Name} -> time1 [sql] sql_set_user escaped user --> 'time1' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: (SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' and attribute != 'Cleartext-Password') UNION (SEL ECT id, username, attribute, aes_decrypt(value,'abc123456def'), op FROM radcheck WHERE username = '%{SQL-User-Name}' and attribute = 'Cleartext-Password') ORDER BY id -> (SELECT id, username, attribute, value, op FROM radcheck WHERE usern ame = 'time1' and attribute != 'Cleartext-Password') UNION (SELECT id, username, attribute, aes_decrypt(value,'abc123456def'), op FROM radcheck WHERE username = 'time1' and attribute = 'Cleartext-Password') ORDER BY id rlm_sql_mysql: query: (SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'time1' and attribute != 'Cleartext-Password') UNION (SELECT id, username, attribute, aes_decrypt(value,'abc123456def'), op FROM radcheck WHE RE username = 'time1' and attribute = 'Cleartext-Password') ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radrepl y WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE usern ame = 'time1' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'time1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE user name = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'time1' ORDER BY prior ity rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHE RE username = 'time1' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++? if (!(control:Cleartext-Password)) ?? Evaluating (control:Cleartext-Password) -> TRUE ? Converting !TRUE -> FALSE ++? if (!(control:Cleartext-Password)) -> FALSE ++? elsif ((reply:acct_expiration) && ("%{reply:acct_expiration}" < "%D") ) ?? Evaluating (reply:acct_expiration) -> TRUE expand: %{reply:acct_expiration} -> 29991231 expand: %D -> 20100709 ?? Evaluating ("%{reply:acct_expiration}" < "%D") -> FALSE ++? elsif ((reply:acct_expiration) && ("%{reply:acct_expiration}" < "%D") ) -> FALSE ++? elsif ((reply:acct_expiration) && (reply:1st_login_date) && (reply:ticket_e xpiration) && ("%{reply:1st_login_date}" != "29991231") && ("%{reply:ticket_expi ration}" < "%D") ) ?? Evaluating (reply:acct_expiration) -> TRUE ?? Evaluating (reply:1st_login_date) -> TRUE ?? Evaluating (reply:ticket_expiration) -> TRUE expand: %{reply:1st_login_date} -> 20100601 ?? Evaluating ("%{reply:1st_login_date}" != "29991231") -> TRUE expand: %{reply:ticket_expiration} -> 20100830 expand: %D -> 20100709 ?? Evaluating ("%{reply:ticket_expiration}" < "%D") -> FALSE ++? elsif ((reply:acct_expiration) && (reply:1st_login_date) && (reply:ticket_e xpiration) && ("%{reply:1st_login_date}" != "29991231") && ("%{reply:ticket_expi ration}" < "%D") ) -> FALSE rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{ User-Name}'' [noreset_time_counter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNam e='time1' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNa me='time1'}' [noreset_time_counter] sql_xlat [noreset_time_counter] expand: %{User-Name} -> time1 [noreset_time_counter] sql_set_user escaped user --> 'time1' [noreset_time_counter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='time1' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='time 1' [noreset_time_counter] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/ sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName=' time1' [noreset_time_counter] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [noreset_time_counter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct W HERE UserName='time1'} -> 205 rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user time1, check_item=20, counter=205 ++[noreset_time_counter] returns reject ++? if (reject) ? Evaluating (reject) -> TRUE ++? if (reject) -> TRUE ++- entering if (reject) {...} +++[control] returns reject ++- if (reject) returns reject Invalid user (rlm_sqlcounter: Maximum never usage time reached): [time1/<via Aut h-Type = EAP>] (from client localhost port 0 cli 02-00-00-00-00-01 via TLS tunne l) } # server inner-tunnel [peap] Got tunneled reply code 3 1st_login_date := "20100601" acct_expiration := "29991231" ticket_days := "90" ticket_expiration := "20100830" Reply-Message = "Your maximum never usage time has been reached" [peap] Got tunneled reply RADIUS code 3 1st_login_date := "20100601" acct_expiration := "29991231" ticket_days := "90" ticket_expiration := "20100830" Reply-Message = "Your maximum never usage time has been reached" [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 6 to 127.0.0.1 port 44979 EAP-Message = 0x0107003b190017030100300a7bc9169f55617f8b9404f23c70a22ec0 351e07fa46e1f17ec51bf9edddc23df774d9da16c92de9e5a5eb8ae95eaace Message-Authenticator = 0x00000000000000000000000000000000 State = 0x916bee87976cf76dd5fdb5b529c56e9d Finished request 11. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 44979, id=7, length=222 User-Name = "time1" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0207006019001703010020e87fc62cb04cb5a8db18300f4f10d851de 97490da264270001365b5b2474578517030100309b29d0ffe622d696ca430fd4b2c7a86c0040aaa1 70818dc976eeb7338151522559da71fff0361565af9fb778cccf58b8 State = 0x916bee87976cf76dd5fdb5b529c56e9d Message-Authenticator = 0x0132e061daaf8f9d3ae6d187066d3f04 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "time1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. SSL: Removing session 44540d0f50e26d1444cb5ce1d6f3d574fbc20b1cddb9a708567434fa 1bebc167 from the cache [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [time1/<via Auth-Type = EAP>] (from client localhost port 0 cli 02-00-00-00-00-01) Using Post-Auth-Type Reject +- entering group REJECT {...} [sql] expand: %{User-Name} -> time1 [sql] sql_set_user escaped user --> 'time1' [sql] WARNING: Unknown module "inner.control" in string expansion "%{inner.contr ol:My-Err-Message}', '%S')" [sql] expand: INSERT INTO radpostauth (ID, username, password, nas_ip, auth_result, reply_message, authdate) VALUES (NULL, '%{User-Name}', aes_encrypt('NA', 'abc123456def'), '%{NAS-IP-ADD RESS}', '%{reply:Packet-Type}', '%{inner.control:My-Err-Message}', '%S') -> INSERT INTO radpostauth (ID, username, passw ord, nas_ip, auth_result, reply_message, authdate) VAL UES (NULL, 'time1', aes_enc rypt('NA', 'abc123456def'), '127.0.0.1', 'Access-Reject', '', '2010-07-09 13:54:28') [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (ID, username, password, nas_ip, auth_result, reply_message, authdate) VALUES (NULL, 'time1', aes_encrypt('NA', 'abc123456def'), '127.0.0.1', 'Access-Reject', '', '2010- 07-09 13:54:28') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radpostauth (ID, us ername, password, nas_ip, auth_result, reply_message, authdate) VALUES (NULL, 'time1', aes_encrypt('NA', 'abc123456def'), '127.0.0.1', 'Access-Reject', '', '2010-07-09 13:54:28') rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detai l-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/reply-detail-20100709 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d exp ands to /var/log/radius/radacct/127.0.0.1/reply-detail-20100709 [reply_log] expand: %t -> Fri Jul 9 13:54:28 2010 ++[reply_log] returns ok [attr_filter.access_reject] expand: %{User-Name} -> time1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 12 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 12 Sending Access-Reject of id 7 to 127.0.0.1 port 44979 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 5 ID 0 with timestamp +24 Cleaning up request 6 ID 1 with timestamp +24 Cleaning up request 7 ID 2 with timestamp +24 Cleaning up request 8 ID 3 with timestamp +24 Cleaning up request 9 ID 4 with timestamp +24 Cleaning up request 10 ID 5 with timestamp +24 Cleaning up request 11 ID 6 with timestamp +24 ----4. ends -------------------------

2 1

Re: Radius authenticate user but user still getting invalid credential message
by Alan DeKok 09 Jul '10

09 Jul '10

Toure Mamadou wrote: > Hi, > All i've reboot my NAS. And since my user is getting invalid username and > password allthougth I can that they are authenticated in the radius log. If the RADIUS server is returning Access-Accept, then the issue isn't with the RADIUS server. Alan DeKok.

1 0

reject_delay less than 1 second
by Benjamin Marvin 09 Jul '10

09 Jul '10

Good day! I'd like to set "reject_delay" in radiusd.conf (freeradius 2.1.8) to something less than 1 second but greater than 0. The comments suggest only whole numbers are supported, but will a (quoted?) decimal value work? Thanks! -Benjamin

2 1

Problem with realms
by Bill Larson 08 Jul '10

08 Jul '10

I am sure the solution to my problem is simple however I can't figure it out. This is my user blarson Auth-Type := Local, Cleartext-Password == "testing" Service-Type = Framed-User, Session-Timeout = 18000, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-MTU = 1006, Idle-Timeout = 1200, Ascend-Idle-Limit = 1200, Framed-Compression = Van-Jacobsen-TCP-IP, Port-Limit = 1, Slipstream-Auth = "true", Ascend-Maximum-Channels = "1" This is my realm realm compu.net { type = radius authhost = LOCAL accthost = LOCAL } This is the debug Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 40159, id=207, length=69 User-Name = "blarson(a)compu.net" User-Password = "testing" NAS-IP-Address = 216.248.35.2 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "compu.net" for User-Name = "blarson(a)compu.net" rlm_realm: Found realm "compu.net" rlm_realm: Adding Stripped-User-Name = "blarson" rlm_realm: Adding Realm = "compu.net" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated users: Matched entry DEFAULT at line 17394 users: Matched entry DEFAULT at line 17457 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type REJECT rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [blarson(a)compu.net/testing] (from client localhost port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> blarson(a)compu.net attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 207 to 127.0.0.1 port 40159 Reply-Message = "Invalid or unauthorized account" Waking up in 4.9 seconds. Cleaning up request 0 ID 207 with timestamp +3 Ready to process requests. As you can see it's not stripping the realm before checking in the users file. So the user is not matched in the users file. What have I done wrong? Questions, suggestions, and fixes welcome

4 5

LDAP: Causes of Failed binding
by Sergio Belkin 08 Jul '10

08 Jul '10

Hi, How does freeradius consider that "Bind as user failed" Thanks in advance!! -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 1

Double-up of radacct entries anmd radacct entries with UserName empty
by Hanno Schupp 08 Jul '10

08 Jul '10

Dear All, I am running freeradius 2.10 with mysql for some time now, currently on Ubuntu 9.10, NASes are various router models running Openwrt and Coova-Chilli. I am having trouble with my radacct table. Which creates some 80k entries per annum. For about 1% of users it contains doubled up entries (entries with same AcctSessionId and same AcctUniqueId) and also lots of entries with the Username being empty (as opposed to either filled or Null). Example extract from radacct: RadAcctId AcctSessionId AcctUniqueId UserName Realm NASIPAddress NASPortId NASPortType AcctStartTime AcctStopTime AcctSessionTime AcctAuthentic ConnectInfo_start ConnectInfo_stop AcctInputOctets AcctOutputOctets CalledStationId CallingStationId AcctTerminateCause ServiceType FramedProtocol FramedIPAddress AcctStartDelay AcctStopDelay xascendsessionsvrkey 202678 4c2c5c7200000002 b50051a7f2d0e210 jasdoxur7 192.168.182.1 2 Wireless-802.11 2010-07-01 21:14:47 2010-07-02 01:12:18 14251 8100124 28550967 00-15-6D-DA-E0-59 00-13-02-89-7D-8E Lost-Carrier 192.168.182.25 0 0 203366 4c2ce6de00000001 584e51b205634c34 jasdoxur7 192.168.182.1 1 Wireless-802.11 2010-07-02 07:10:24 2010-07-02 10:38:35 12491 8620576 48189131 00-15-6D-DA-E0-59 00-13-02-89-7D-8E Lost-Carrier 192.168.182.2 0 0 203370 4c2ce6de00000001 584e51b205634c34 jasdoxur7 192.168.182.1 1 Wireless-802.11 2010-07-02 07:10:24 2010-07-02 10:38:35 12491 8620576 48189131 00-15-6D-DA-E0-59 00-13-02-89-7D-8E Lost-Carrier 192.168.182.2 0 0 203374 4c2ce6de00000001 584e51b205634c34 jasdoxur7 192.168.182.1 1 Wireless-802.11 2010-07-02 07:10:24 2010-07-02 10:38:35 12491 8620576 48189131 00-15-6D-DA-E0-59 00-13-02-89-7D-8E Lost-Carrier 192.168.182.2 0 0 203378 4c2ce6de00000001 584e51b205634c34 jasdoxur7 192.168.182.1 1 Wireless-802.11 2010-07-02 07:10:24 2010-07-02 10:38:35 12491 8620576 48189131 00-15-6D-DA-E0-59 00-13-02-89-7D-8E Lost-Carrier 192.168.182.2 0 0 204458 4c2dd9a900000006 e3dbcb6e1e8d44dc jasdoxur7 192.168.182.1 6 Wireless-802.11 2010-07-03 00:26:33 2010-07-03 01:28:16 3702 6564061 23169066 00-15-6D-DA-E0-59 00-13-02-89-7D-8E User-Request 192.168.182.28 0 0 204462 4c2dd9a900000006 e3dbcb6e1e8d44dc jasdoxur7 192.168.182.1 6 Wireless-802.11 2010-07-03 00:26:33 2010-07-03 01:28:16 3702 6564061 23169066 00-15-6D-DA-E0-59 00-13-02-89-7D-8E User-Request 192.168.182.28 0 0 204466 4c2dd9a900000006 e3dbcb6e1e8d44dc jasdoxur7 192.168.182.1 6 Wireless-802.11 2010-07-03 00:26:33 2010-07-03 01:28:16 3702 6564061 23169066 00-15-6D-DA-E0-59 00-13-02-89-7D-8E User-Request 192.168.182.28 0 0 204470 4c2dd9a900000006 e3dbcb6e1e8d44dc jasdoxur7 192.168.182.1 6 Wireless-802.11 2010-07-03 00:26:33 2010-07-03 01:28:16 3702 6564061 23169066 00-15-6D-DA-E0-59 00-13-02-89-7D-8E User-Request 192.168.182.28 0 0 204474 4c2dd9a900000006 e3dbcb6e1e8d44dc jasdoxur7 192.168.182.1 6 Wireless-802.11 2010-07-03 00:26:33 2010-07-03 01:28:16 3702 6564061 23169066 00-15-6D-DA-E0-59 00-13-02-89-7D-8E User-Request 192.168.182.28 0 0 204478 4c2dd9a900000006 e3dbcb6e1e8d44dc jasdoxur7 192.168.182.1 6 Wireless-802.11 2010-07-03 00:26:34 2010-07-03 01:28:16 3702 6564061 23169066 00-15-6D-DA-E0-59 00-13-02-89-7D-8E User-Request 192.168.182.28 0 0 205110 4c2e6be700000002 1bbe9ab0e9e6321b jasdoxur7 192.168.182.1 2 Wireless-802.11 2010-07-03 10:54:33 2010-07-03 11:14:45 1212 585059 2206797 00-15-6D-DA-E0-59 00-13-02-89-7D-8E Lost-Carrier 192.168.182.6 0 0 205950 4c2f201400000007 390a572eaaf851c9 jasdoxur7 192.168.182.1 7 Wireless-802.11 2010-07-03 23:37:55 2010-07-04 00:13:48 2153 4465894 50532205 00-15-6D-DA-E0-59 00-13-02-89-7D-8E Session-Timeout 192.168.182.23 Here an extract of the sqltrace.log, which shows how the UserName is empty: UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '6120', acctinputoctets = '0' << 32 | '16465104', acctoutputoctets = '0' << 32 | '23727469' WHERE acctsessionid = '4c32447800000001' AND username = 'gencafot7' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '16200', acctinputoctets = '0' << 32 | '182914', acctoutputoctets = '0' << 32 | '433400' WHERE acctsessionid = '4c321df600000001' AND username = '' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.3', acctsessiontime = '16202', acctinputoctets = '0' << 32 | '996451', acctoutputoctets = '0' << 32 | '1129794' WHERE acctsessionid = '4c321e0000000003' AND username = '' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '6300', acctinputoctets = '0' << 32 | '16584022', acctoutputoctets = '0' << 32 | '25293355' WHERE acctsessionid = '4c32447800000001' AND username = 'gencafot7' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '16380', acctinputoctets = '0' << 32 | '186746', acctoutputoctets = '0' << 32 | '438333' WHERE acctsessionid = '4c321df600000001' AND username = '' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.3', acctsessiontime = '16382', acctinputoctets = '0' << 32 | '1008639', acctoutputoctets = '0' << 32 | '1151346' WHERE acctsessionid = '4c321e0000000003' AND username = '' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '6480', acctinputoctets = '0' << 32 | '16587316', acctoutputoctets = '0' << 32 | '25294477' WHERE acctsessionid = '4c32447800000001' AND username = 'gencafot7' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '6480', acctinputoctets = '0' << 32 | '16587316', acctoutputoctets = '0' << 32 | '25294477' WHERE acctsessionid = '4c32447800000001' AND username = 'gencafot7' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '16560', acctinputoctets = '0' << 32 | '187646', acctoutputoctets = '0' << 32 | '438707' WHERE acctsessionid = '4c321df600000001' AND username = '' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.3', acctsessiontime = '16562', acctinputoctets = '0' << 32 | '1019098', acctoutputoctets = '0' << 32 | '1160739' WHERE acctsessionid = '4c321e0000000003' AND username = '' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '6660', acctinputoctets = '0' << 32 | '16588043', acctoutputoctets = '0' << 32 | '25295061' WHERE acctsessionid = '4c32447800000001' AND username = 'gencafot7' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '16740', acctinputoctets = '0' << 32 | '187820', acctoutputoctets = '0' << 32 | '438707' WHERE acctsessionid = '4c321df600000001' AND username = '' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.3', acctsessiontime = '16742', acctinputoctets = '0' << 32 | '1030191', acctoutputoctets = '0' << 32 | '1183588' WHERE acctsessionid = '4c321e0000000003' AND username = '' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '6840', acctinputoctets = '0' << 32 | '16588711', acctoutputoctets = '0' << 32 | '25295510' WHERE acctsessionid = '4c32447800000001' AND username = 'gencafot7' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '16920', acctinputoctets = '0' << 32 | '187820', acctoutputoctets = '0' << 32 | '438707' WHERE acctsessionid = '4c321df600000001' AND username = '' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.3', acctsessiontime = '16922', acctinputoctets = '0' << 32 | '1053695', acctoutputoctets = '0' << 32 | '1198212' WHERE acctsessionid = '4c321e0000000003' AND username = '' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '7020', acctinputoctets = '0' << 32 | '16589356', acctoutputoctets = '0' << 32 | '25295598' WHERE acctsessionid = '4c32447800000001' AND username = 'gencafot7' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '17100', acctinputoctets = '0' << 32 | '187820', acctoutputoctets = '0' << 32 | '438707' WHERE acctsessionid = '4c321df600000001' AND username = '' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.3', acctsessiontime = '17102', acctinputoctets = '0' << 32 | '1065444', acctoutputoctets = '0' << 32 | '1226533' WHERE acctsessionid = '4c321e0000000003' AND username = '' AND nasipaddress = '192.168.182.1'; UPDATE radacct SET framedipaddress = '192.168.182.2', acctsessiontime = '7200', acctinputoctets = '0' << 32 | '16591820', acctoutputoctets = '0' << 32 | '25298149' WHERE acctsessionid = '4c32447800000001' AND username = 'gencafot7' AND nasipaddress = '192.168.182.1'; My sql statements are standard dialup.conf, with Simultaneous Use Checking Queries and Case Sensitive User queries switched on. What could cause the doubled up radacct entries and what might cause the empty UserName radacct updates? Any advice welcome. Thanks

2 1

Proxy accounting and leaving an entry in the local freeradius MySQL DB
by Emilio Inthamoussu 08 Jul '10

08 Jul '10

Dear all, We have a platform with freeRadius 1.1.4 (I know, it´s a bit old J). It is connected to a MySQL database where the accounting requests are saved. The freeRadius is configured to proxy the accounting requests of one specific realm, but we also need that those accounting requests remain saved in our MySQL database, besides being sent to an external server. We were looking for information about this particular issue, but we only found that when proxying the requests, a file (no the DB) is written. Somebody know how to do proxy and also save an entry in the local database? Thanks for your help!! Emilio

2 1

rlm_exec
by Hubert Kupper 08 Jul '10

08 Jul '10

Hello, I have installed freeradius 2.1.9-0 on a SLES 11 64 bit machine. When I try to start with freeradius -X then I get the following error: radiusd: #### Instantiating modules #### instantiate { /etc/raddb/radiusd.conf[1384]: Failed to link to module 'rlm_exec': file not found I've searched the freeradius mailing archive but I didn't find an entry. Can anybody help me? Best regards Hubert

3 4