- Freeradius-Users - lists.freeradius.org

RE: radiusd does not logging while debug
by Harry Hoffman 22 Apr '10

22 Apr '10

Well, stderr in a foreground process is normally stdout. -----Original Message----- From: Johan Meiring <jmeiring(a)pcservices.co.za> Sent: Thursday, April 22, 2010 1:09 PM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: radiusd does not logging while debug On 2010/04/22 06:45 PM, Alan DeKok wrote: > kes-kes(a)yandex.ru wrote: >> Hi, FreeRadius. >> >> How to force radiusd -X to do logging to log file too? > > $ radiusd -X> /var/log/radius/radius.log 2>&1 > Or for both file and console. radiusd -X 2>&1 | tee /var/log/radius/radius.log -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: radiusd does not logging while debug
by Harry Hoffman 22 Apr '10

22 Apr '10

Maybe (so you both see and log): Radiusd -X | tee -a /var/log/radius/radius-debug.log -----Original Message----- From: Alan DeKok <aland(a)deployingradius.com> Sent: Thursday, April 22, 2010 12:45 PM To: ??????? ??????? <kes-kes(a)yandex.ru>; FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: radiusd does not logging while debug kes-kes(a)yandex.ru wrote: > Hi, FreeRadius. > > How to force radiusd -X to do logging to log file too? $ radiusd -X > /var/log/radius/radius.log 2>&1 Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Zombie Infestation of Log file
by Benjamin Marvin 22 Apr '10

22 Apr '10

Good day, I'm trying to figure out why my servers continue to be marked zombie, even though they continue to handle traffic. There appears to be no impact, just seemingly erroneous - or at least unexplained - log entries. I have three 2.1.8 servers that feeds accounting to a 4th server (via copy_acct_to_homeserver), running 1.1.7. The primary servers also sends some auth (via proxy) and lots of acct (some via proxy, but also via copy_acct_to_homeserver) to a pair of Cisco ACS servers. The radius.log file for the primary servers show they are marking the 4th and Cisco (upstream) servers as zombie quite regularly (but not simultaneously); they thankfully never get marked dead. All of these servers are attached to the same Ethernet Switch with a slight detour through a Router that does VLAN routing between them; The Cisco servers also proxy to various other servers outside my network. I have a debug output from one of the servers that I have studied at length; I recorded the debug for 6 minutes or so before one of the servers was marked zombie. This is from a production machine with a fair amount of traffic, so the debug file is 9MBs. I'm not sure if it would be appropriate to post it to the mailing list. I'd be happy to post it. Do you want specific excerpts, or the whole thing? I've set the response_window to as high as 60 seconds in the clients.conf file and I keep the zombie_period at 20 seconds. I've also turned off the status_check feature as 1.1.7 and Cisco ACS do not appear to support it. The clients.conf file says that after the response_window is up (so 60 seconds) and "a" response is not received, that the server is marked Zombie. Based on what I see, I'm interpreting this as meaning that if one response is not seen in 60 seconds, even if hundreds of other responses were successfully sent and received during those 60 seconds, then the server is marked Zombie. At this point the Zombie_Period kicks in, and the moment "any" successful response is received the server is marked as completely alive. In my case the Zombie_Period is canceled immediately (though sadly the log does not seem to show when Zombie ends.) Odd to me is that occasionally a primary server will mark the same upstream server as Zombie multiple times over a handful of seconds, but the other two primary servers rarely mark upstream servers dead near the same time. I cannot find in the debug, or in packet captures, where a response went missing for a full minute, so I'm trying to find out what is happening. My upstream servers do not appear taxed or unresponsive. Perhaps there is some sort of malformed response I should be looking for? I also get radutmp errors about a wrong NAS ID, though on brief analysis it doesn't appear related. Any suggestions to help track this down and eliminate the error messages is greatly appreciated. -Benjamin

4 5

Dynamic Vlan assigment 802.1x with cisco
by Guillermo Borrallo 22 Apr '10

22 Apr '10

Hi, I have a problem to change vlan on a Catalyst 2950 switch using the 802.1x protocol. The problem is that no changes to the vlan you specified. The authentication and validation of the user is correct, but does not change vlan. Freeradius User Configuration: steve Cleartext-Password := "testing" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 2 Switch 2950 configuration: aaa new-model aaa authentication login default local aaa authentication dot1x default group radius enable secret 5 $1$Hpyf$/AA8F3lVYES7KUq0abTqy. interface FastEthernet0/3 switchport mode access no ip address dot1x port-control auto interface Vlan1 ip address 192.168.250.250 255.255.255.0 no ip route-cache ip http server ip radius source-interface FastEthernet0/2 radius-server host 192.168.250.200 auth-port 1812 acct-port 1813 key password radius-server retransmit 3 no radius-server attribute nas-port privilege exec level 0 line show Right now, this created the vlan 1 and vlan 2 Thanks.Guillermo _________________________________________________________________ ¡Citas! ¡Ligues! ¿Salimos? ¿Cómo es tu pareja ideal? Búscala en el sitio nº1… ¡Regístrate ya! http://contactos.es.msn.com/?mtcmk=015352

3 4

DHCP with FreeRADIUS
by Jesús Jiménez 22 Apr '10

22 Apr '10

Hi, I'm having problems to configure the dhcp with freeradius (this is the first time :$) I have compiled it with the --with-dhcp option, and linked dhcp in sites-available. My dhcp server is 10.88.3.25 and the router is 10.88.3.1. I have only modified the dhcp configuration and the mac2ip file. This is the dhcp configuration: ______________________________________________ server dhcp { listen { ipaddr = * port = 67 type = "dhcp" interface = eth0 } dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update reply { DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.88.3.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.88.3.25 } mac2ip ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.88.3.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.88.3.25 DHCP-Gateway-IP-Address = 10.88.3.1 } mac2ip ok } dhcp { # send a DHCP NAK. reject } } _________________________________________________ I put the mac adress in mac2ip and it works, here is the file: fa:b3:77:de:25:6b,10.88.3.20 When I launch it in debug mode I have this exit: _________________________________________________ # freeradius -XX Tue Apr 20 13:26:13 2010 : Info: FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Apr 20 2010 at 13:19:48 Tue Apr 20 13:26:13 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Tue Apr 20 13:26:13 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Tue Apr 20 13:26:13 2010 : Info: PARTICULAR PURPOSE. Tue Apr 20 13:26:13 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Tue Apr 20 13:26:13 2010 : Info: GNU General Public License v2. Tue Apr 20 13:26:13 2010 : Info: Starting - reading configuration files ... Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/radiusd.conf Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/proxy.conf Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/clients.conf Tue Apr 20 13:26:13 2010 : Debug: including files in directory /etc/freeradius/modules/ Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/krb5 Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/always Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/realm Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/radutmp Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/digest Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/mac2vlan Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/perl Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/checkval Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/sradutmp Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/ldap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/expiration Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/ntlm_auth Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/preprocess Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/exec Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/pam Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/detail.example.com Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/passwd Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/echo Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/chap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/inner-eap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/policy Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/counter Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/smbpasswd Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/detail.log Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/unix Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/mschap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/etc_group Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/files Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/smsotp Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/wimax Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/acct_unique Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/cui Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/linelog Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/detail Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/sql_log Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/otp Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/pap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/mac2ip Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/ippool Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/expr Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/attr_filter Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/logintime Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/eap.conf Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/policy.conf Tue Apr 20 13:26:13 2010 : Debug: including files in directory /etc/freeradius/sites-enabled/ Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/sites-enabled/dhcp Tue Apr 20 13:26:13 2010 : Debug: main { Tue Apr 20 13:26:13 2010 : Debug: user = "freerad" Tue Apr 20 13:26:13 2010 : Debug: group = "freerad" Tue Apr 20 13:26:13 2010 : Debug: allow_core_dumps = no Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: including dictionary file /etc/freeradius/dictionary Tue Apr 20 13:26:13 2010 : Debug: main { Tue Apr 20 13:26:13 2010 : Debug: prefix = "/usr" Tue Apr 20 13:26:13 2010 : Debug: localstatedir = "/var" Tue Apr 20 13:26:13 2010 : Debug: logdir = "/var/log/freeradius" Tue Apr 20 13:26:13 2010 : Debug: libdir = "/usr/lib/freeradius" Tue Apr 20 13:26:13 2010 : Debug: radacctdir = "/var/log/freeradius/radacct" Tue Apr 20 13:26:13 2010 : Debug: hostname_lookups = no Tue Apr 20 13:26:13 2010 : Debug: max_request_time = 30 Tue Apr 20 13:26:13 2010 : Debug: cleanup_delay = 5 Tue Apr 20 13:26:13 2010 : Debug: max_requests = 1024 Tue Apr 20 13:26:13 2010 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Tue Apr 20 13:26:13 2010 : Debug: checkrad = "/usr/sbin/checkrad" Tue Apr 20 13:26:13 2010 : Debug: debug_level = 0 Tue Apr 20 13:26:13 2010 : Debug: proxy_requests = yes Tue Apr 20 13:26:13 2010 : Debug: log { Tue Apr 20 13:26:13 2010 : Debug: stripped_names = no Tue Apr 20 13:26:13 2010 : Debug: auth = no Tue Apr 20 13:26:13 2010 : Debug: auth_badpass = no Tue Apr 20 13:26:13 2010 : Debug: auth_goodpass = no Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: security { Tue Apr 20 13:26:13 2010 : Debug: max_attributes = 200 Tue Apr 20 13:26:13 2010 : Debug: reject_delay = 1 Tue Apr 20 13:26:13 2010 : Debug: status_server = yes Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Tue Apr 20 13:26:13 2010 : Debug: proxy server { Tue Apr 20 13:26:13 2010 : Debug: retry_delay = 5 Tue Apr 20 13:26:13 2010 : Debug: retry_count = 3 Tue Apr 20 13:26:13 2010 : Debug: default_fallback = no Tue Apr 20 13:26:13 2010 : Debug: dead_time = 120 Tue Apr 20 13:26:13 2010 : Debug: wake_all_if_all_dead = no Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: home_server localhost { Tue Apr 20 13:26:13 2010 : Debug: ipaddr = 127.0.0.1 Tue Apr 20 13:26:13 2010 : Debug: port = 1812 Tue Apr 20 13:26:13 2010 : Debug: type = "auth" Tue Apr 20 13:26:13 2010 : Debug: secret = "testing123" Tue Apr 20 13:26:13 2010 : Debug: response_window = 20 Tue Apr 20 13:26:13 2010 : Debug: max_outstanding = 65536 Tue Apr 20 13:26:13 2010 : Debug: require_message_authenticator = no Tue Apr 20 13:26:13 2010 : Debug: zombie_period = 40 Tue Apr 20 13:26:13 2010 : Debug: status_check = "status-server" Tue Apr 20 13:26:13 2010 : Debug: ping_interval = 30 Tue Apr 20 13:26:13 2010 : Debug: check_interval = 30 Tue Apr 20 13:26:13 2010 : Debug: num_answers_to_alive = 3 Tue Apr 20 13:26:13 2010 : Debug: num_pings_to_alive = 3 Tue Apr 20 13:26:13 2010 : Debug: revive_interval = 120 Tue Apr 20 13:26:13 2010 : Debug: status_check_timeout = 4 Tue Apr 20 13:26:13 2010 : Debug: irt = 2 Tue Apr 20 13:26:13 2010 : Debug: mrt = 16 Tue Apr 20 13:26:13 2010 : Debug: mrc = 5 Tue Apr 20 13:26:13 2010 : Debug: mrd = 30 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: home_server_pool my_auth_failover { Tue Apr 20 13:26:13 2010 : Debug: type = fail-over Tue Apr 20 13:26:13 2010 : Debug: home_server = localhost Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: realm example.com { Tue Apr 20 13:26:13 2010 : Debug: auth_pool = my_auth_failover Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: realm LOCAL { Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Loading Clients #### Tue Apr 20 13:26:13 2010 : Debug: client localhost { Tue Apr 20 13:26:13 2010 : Debug: ipaddr = 127.0.0.1 Tue Apr 20 13:26:13 2010 : Debug: require_message_authenticator = no Tue Apr 20 13:26:13 2010 : Debug: secret = "testing123" Tue Apr 20 13:26:13 2010 : Debug: nastype = "other" Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Instantiating modules #### Tue Apr 20 13:26:13 2010 : Debug: instantiate { Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_exec Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating exec Tue Apr 20 13:26:13 2010 : Debug: exec { Tue Apr 20 13:26:13 2010 : Debug: wait = no Tue Apr 20 13:26:13 2010 : Debug: input_pairs = "request" Tue Apr 20 13:26:13 2010 : Debug: shell_escape = yes Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_expr Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating expr Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_expiration Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating expiration Tue Apr 20 13:26:13 2010 : Debug: expiration { Tue Apr 20 13:26:13 2010 : Debug: reply-message = "Password Has Expired " Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_logintime Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating logintime Tue Apr 20 13:26:13 2010 : Debug: logintime { Tue Apr 20 13:26:13 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Tue Apr 20 13:26:13 2010 : Debug: minimum-timeout = 60 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Loading Virtual Servers #### Tue Apr 20 13:26:13 2010 : Debug: server dhcp { Tue Apr 20 13:26:13 2010 : Debug: modules { Tue Apr 20 13:26:13 2010 : Debug: Module: Checking dhcp DHCP-Discover {...} for more modules to load Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_passwd, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_passwd Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating mac2ip Tue Apr 20 13:26:13 2010 : Debug: passwd mac2ip { Tue Apr 20 13:26:13 2010 : Debug: filename = "/etc/freeradius/mac2ip" Tue Apr 20 13:26:13 2010 : Debug: format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" Tue Apr 20 13:26:13 2010 : Debug: delimiter = "," Tue Apr 20 13:26:13 2010 : Debug: ignorenislike = yes Tue Apr 20 13:26:13 2010 : Debug: ignoreempty = yes Tue Apr 20 13:26:13 2010 : Debug: allowmultiplekeys = no Tue Apr 20 13:26:13 2010 : Debug: hashsize = 100 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: rlm_passwd: nfields: 2 keyfield 0(DHCP-Client-Hardware-Address) listable: no Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_always, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_always Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating ok Tue Apr 20 13:26:13 2010 : Debug: always ok { Tue Apr 20 13:26:13 2010 : Debug: rcode = "ok" Tue Apr 20 13:26:13 2010 : Debug: simulcount = 0 Tue Apr 20 13:26:13 2010 : Debug: mpp = no Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: Module: Checking dhcp DHCP-Request {...} for more modules to load Tue Apr 20 13:26:13 2010 : Debug: Module: Checking dhcp (null) {...} for more modules to load Tue Apr 20 13:26:13 2010 : Error: /etc/freeradius/sites-enabled/dhcp[49]: No name specified for Post-Auth-Type block Tue Apr 20 13:26:13 2010 : Debug: } # modules Tue Apr 20 13:26:13 2010 : Debug: } # server Tue Apr 20 13:26:13 2010 : Debug: server { Tue Apr 20 13:26:13 2010 : Debug: modules { Tue Apr 20 13:26:13 2010 : Debug: } # modules Tue Apr 20 13:26:13 2010 : Debug: } # server Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Tue Apr 20 13:26:13 2010 : Debug: listen { Tue Apr 20 13:26:13 2010 : Debug: type = "auth" Tue Apr 20 13:26:13 2010 : Debug: ipaddr = * Tue Apr 20 13:26:13 2010 : Debug: port = 0 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: listen { Tue Apr 20 13:26:13 2010 : Debug: type = "acct" Tue Apr 20 13:26:13 2010 : Debug: ipaddr = * Tue Apr 20 13:26:13 2010 : Debug: port = 0 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: listen { Tue Apr 20 13:26:13 2010 : Debug: type = "dhcp" Tue Apr 20 13:26:13 2010 : Debug: ipaddr = * Tue Apr 20 13:26:13 2010 : Debug: port = 67 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: Listening on authentication address * port 1812 Tue Apr 20 13:26:13 2010 : Debug: Listening on accounting address * port 1813 Tue Apr 20 13:26:13 2010 : Debug: Listening on dhcp interface eth0 address * port 67 as server dhcp Tue Apr 20 13:26:13 2010 : Debug: Listening on proxy address * port 1814 Tue Apr 20 13:26:13 2010 : Info: Ready to process requests. ____________________________________________________ and when I receive a dhcp-discover I have this: ____________________________________________________ Received DHCP-Discover of id 2b60f030 from 0.0.0.0:68 to 255.255.255.255:67 0: 01 01 06 00 2b 60 f0 30 00 00 00 00 00 00 00 00 16: 00 00 00 00 00 00 00 00 00 00 00 00 fa b3 77 de 32: 25 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 128: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 144: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 176: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 192: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 208: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 224: 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 240: 35 01 01 37 0c 01 1c 02 03 0f 06 77 0c 2c 2f 1a 256: 79 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 272: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 288: 00 00 00 00 00 00 00 00 00 00 00 00 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 727773232 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = fa:b3:77:de:25:6b DHCP-Message-Type = DHCP-Discover DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Broadcast-Address DHCP-Parameter-Request-List = DHCP-Time-Offset DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Search DHCP-Parameter-Request-List = DHCP-Hostname DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Interface-MTU-Size DHCP-Parameter-Request-List = DHCP-Classless-Static-Route Tue Apr 20 13:29:27 2010 : Info: server dhcp { Tue Apr 20 13:29:27 2010 : Debug: Trying sub-section dhcp DHCP-Discover {...} Tue Apr 20 13:29:27 2010 : Info: +- entering group DHCP-Discover {...} Tue Apr 20 13:29:27 2010 : Info: ++[reply] returns noop Tue Apr 20 13:29:27 2010 : Info: ++[reply] returns noop Tue Apr 20 13:29:27 2010 : Info: [mac2ip] Added DHCP-Your-IP-Address: '10.88.3.20' to reply_items Tue Apr 20 13:29:27 2010 : Info: ++[mac2ip] returns ok Tue Apr 20 13:29:27 2010 : Info: ++[ok] returns ok Tue Apr 20 13:29:27 2010 : Info: } # server dhcp Sending DHCP-Offer of id 2b60f030 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 727773232 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 10.88.3.20 DHCP-Server-IP-Address = 10.88.3.25 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = fa:b3:77:de:25:6b DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.88.3.1 DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Domain-Name-Server = 80.58.0.33 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.88.3.25 0: 02 01 06 00 2b 60 f0 30 00 00 00 00 00 00 00 00 16: 0a 58 03 14 0a 58 03 19 00 00 00 00 fa b3 77 de 32: 25 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 128: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 144: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 176: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 192: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 208: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 224: 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 240: 35 01 02 01 04 ff ff ff 00 03 04 0a 58 03 01 06 256: 08 50 3a 00 21 50 3a 00 21 33 04 00 01 51 80 36 272: 04 0a 58 03 19 ff 00 00 00 00 00 00 00 00 00 00 288: 00 00 00 00 00 00 00 00 00 00 00 00 Error on call sendmsg: Invalid argument errno = 22. _____________________________________________________ It looks like it's sending the dhcp response but with tcpdump I can't see anything (of the response), the I decided to see the code and went to the call sendmsg in src/lib/udpfromto.c and change this: << return sendmsg(s, &msgh, flags); << >> int res = sendmsg(s, &msgh, flags); if (res == -1){ perror("Error on call sendmsg"); printf("errno = %d. \n", errno); exit(1); } return res; >> I think its something of the configuration. I someone can help me I'll be really grateful. Sorry for my english :D Jewi.

2 2

Re: Zombie Infestation of Log file‏
by Benjamin Marvin 22 Apr '10

22 Apr '10

> usually because the remote server is not listening on its accounting > port or not configured for accounting - the proxy in the middle > doesn't get a response so cant respond to you - hence zombie. I don't believe this is my problem. The debug and packet captures show all of the accounting packets are replied to within the Response_Window and Max_Request_Time frames. (5-10 seconds being at the extreme high end of response times.) -Benjamin

2 1

Re: Zombie Infestation of Log file‏
by Benjamin Marvin 22 Apr '10

22 Apr '10

Thank you both for your thoughts. I will implement the status_check = request option (in proxy.conf, sorry I mis-remembered it as client.conf) per your recommendations. I've also balanced out the response_window and max_request_time. Any other suggestions on where I should look to see why the servers are marking the upstream servers as Zombie? I failed to mention that the servers are marking only the accounting port on those servers as Zombie. Please let me know if you want the 9MB debug or if you have recommendations for making a smaller debug file. -Benjamin Josip Rodin wrote: >On Tue, Apr 20, 2010 at 10:59:04PM -0800, Benjamin Marvin wrote: >> I've also turned off the status_check feature as 1.1.7 and Cisco ACS do >> not appear to support it. You can configure a fake username && password for status checks. This *is* documented in raddb/proxy.conf. > Without status_check, you rely on the timeouts - revive_interval and > zombie_period. Which is much worse than status checks. > But, if you're talking to FR 1.1.7, that should be able to make it respond > negatively to a single fake user/domain, and then you can use that for > status_check = request on its clients. > > *Any* status_check is better on FR 2.x than none... speaking from horrible > experience... Yup. It's not that 2.x is bad without status checks, it's that there is *no way* for anyone to do "the right thing" without status checks. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

VLAN Attribute ?
by Fabien COMBERNOUS 21 Apr '10

21 Apr '10

Hi, I'm seting up a FreeRadius Server using SQL backend to store informations about NAS, Users and Groups. I search the Attribute to use to allow a group in a VLAN of my switch. My setup permit to authenticate a user and the group of the user. But what is the attribute to use in table radreply or radgroupreply to put the port of my switch in the good vlan ? Best regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group

3 4

PopTop
by Jonathan Hutchins 21 Apr '10

21 Apr '10

Is it possible to set up a new account on the wiki, or does that require an administrator? I wanted to mark the page http://wiki.freeradius.org/PopTop as obsolete and applying only to the 1.x versions of freeradius. These are the instructions I was originally folowing, and they distinctly do not work with 2.1.8. If anybody has a working 2.1.8 setup for PopTop I would greatly appreciate your advice.

8 30

ntlm_auth
by Jonathan Hutchins 21 Apr '10

21 Apr '10

Ok, disabled smbpasswd, enabled the existing config for ntlm_auth, updated the /path/to/ntlm_auth to /usr/bin/ntlm_auth, added freerad to the winbind_priv group, enabled domain on client. This _looks_ like it worked, but same errror in the pptp log: Apr 20 17:31:26 firewall pppd[2831]: MPPE required, but keys are not available. Possible plugin problem? Apr 20 17:31:26 firewall pppd[2831]: CHAP peer authentication succeeded for AABENSON\\jonathan Apr 20 17:31:26 firewall pppd[2831]: Connection terminated. FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 3 2010 at 15:51:52 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.10.1 { require_message_authenticator = no secret = "pearietnogide" shortname = "firewall" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = no require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Instantiating ntdomain realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.1 port 3128, id=97, length=145 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "AABENSON\\jonathan" MS-CHAP-Challenge = 0x10ae603c83702218973cf76e7616a4a9 MS-CHAP2-Response = 0x0100c61f9c7b3035a1d65ca7d8339cdb02c3000000000000000055045265592dcc4d2a20ea2f80d3d9b4bd05f3ca80ef1409 NAS-IP-Address = 24.123.100.82 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "AABENSON\jonathan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "AABENSON" for User-Name = "AABENSON\jonathan" [ntdomain] No such realm "AABENSON" ++[ntdomain] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 170 [files] users: Matched entry DEFAULT at line 185 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for jonathan with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: %{User-Name:-None} -> AABENSON\jonathan [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=AABENSON\jonathan [mschap] mschap2: 10 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=d58494fb70df17f6 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=55045265592dcc4d2a20ea2f80d3d9b4bd05f3ca80ef1409 Exec-Program output: NT_KEY: 4A9465E49615D38BDC6576747C1E80E3 Exec-Program-Wait: plaintext: NT_KEY: 4A9465E49615D38BDC6576747C1E80E3 Exec-Program: returned: 0 ++[mschap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 97 to 192.168.10.1 port 3128 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP MS-CHAP2-Success = 0x01533d33384332363646304441374444324239324434454333334341304636394434433146393044443732 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 97 with timestamp +9 Ready to process requests.

3 5