- Freeradius-Users - lists.freeradius.org

Hi,
by Axel Grimm 15 Mar '10

15 Mar '10

Hi i have little question. I use Freeradius with mysql an a dd-wrt Linksys Router as NAS. How can i setup a MAC Adress auth that user do not need login and Passwort ? THX Axel

2 1

Re: MS-CHAP2-Response is incorrect + invalid NT-Password
by omega bk 15 Mar '10

15 Mar '10

hello, i'm still stuck and don't know how to make it work i added in ldap.attrmap: checkItem Cleartext-Password userPassword checkItem NT-password userPassword but i stil have: [ldap] expand: %{User-Name} -> bernard [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=bernard) [ldap] expand: dc=example,dc=com -> dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=example,dc=com, with filter (cn=bernard) [ldap] Added User-Password = test in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> NT-Password == 0x7465737420 [ldap] userPassword -> Cleartext-Password == "test " [ldap] looking for reply items in directory... [ldap] user bernard authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} *[mschap] Invalid NT-Password [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect* ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject I don't understand why i still got an invalid NT-Password. thanks for your help

1 1

LDAP, old TCP connections, and retry
by Justin Steward 15 Mar '10

15 Mar '10

Hi Guys, A few quick questions on tweaking rlm_ldap for freeradius. Question 1: The LDAP server which the radius server attempts to connect to is located behind a firewall which kills TCP connections that have been idle for 30 minutes. FR then tries to do a lookup using a connection that has been open and idle for half an hour or more, and the firewall drops the now invalid connection. How can I force an idle timeout on LDAP connections in FR? Question 2: >From the information I have been given, it appears that if the connection times out, LDAP does not attempt to retry. Is there a way to force FR to make 1 or 2 attempts at retrying the connection before giving up on LDAP? The current situation is causing many headaches trying to log in, and the client is reluctant to relax their firewall for a number of reasons. Many Thanks, Justin Steward

2 4

Access-Reject packet from host 127.0.0.1 port 1812, id=29, length=34
by Suman Dash 14 Mar '10

14 Mar '10

Hi, I am unable to locally authenticate a user from users file. Below is the log : Server : rad_recv: Access-Request packet from host 127.0.0.1 port 37881, id=29, length=57 User-Name = "suman" User-Password = "hello" NAS-IP-Address = 20x.20x.20x.20x NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "suman", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry suman at line 90 [files] expand: Hello, %{User-Name} -> Hello, suman ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "hello" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> suman attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.10 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 29 to 127.0.0.1 port 37881 Reply-Message = "Hello, suman" Waking up in 4.9 seconds. Cleaning up request 2 ID 29 with timestamp +164 Ready to process requests. Radtest sudo radtest suman hello 127.0.0.1 0 testing123 Log Sending Access-Request of id 203 to 127.0.0.1 port 1812 User-Name = "suman" User-Password = "hello" NAS-IP-Address = 204.232.205.196 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=203, length=34 Reply-Message = "Hello, suman" Please let me know what i am doing wrong as i am a complete starter. Thanks and Regards Suman Dash

3 5

RE: fradius v2.1.7 Simultaneous-Use
by Mark 13 Mar '10

13 Mar '10

Hi list, I have been trying to find out more information regarding the use of the Simultaneous-Use option for FreeRadius. I have been checking google and most guides seem to point to /etc/raddb/sql.conf and to uncomment the appropriate lines. However, I have not been able to find the Simultaneous-Use option in on my radius server's sql.conf. Does anyone know if that may have been moved to somewhere else or did I miss something on the installation? The distro for the server in question is fedora11. Any help would be much appreciated. Kind regards, Mark

3 2

upgrade from 1.1.8 to 2.1.8 problem
by Roar Pettersen 13 Mar '10

13 Mar '10

Hi ! We have used FreeRadius 1.1.X with sucess for several years and it is time to upgrade to the vesion 2. In 1.1.8 we used "post_proxy_authorize = yes" in proxy.conf to read the users file after we got a access-accept from the home server. I know that the "post_proxy_authorize" is history in version 2.1.8. Could anybody tell me how to assign a static ip address after we get a access-accept ? I have read the example for the ippool, but I can't see how to assign static ip adress will work with ippol. This is the 1.1.8 config : proxy.conf : post_proxy_authorize = yes users : username(a)domain.com NAS-IP-Address == 10.0.0.1, Service-Type == Framed-User, User-Name := "username(a)domain.com" Framed-Protocol = PPP, Framed-IP-Address = 192.168.1.100, Framed-IP-Netmask = 255.255.255.255, Framed-MTU = 1392 -- Med vennlig hilsen / Regards; Roar Pettersen Universitetet i Bergen - The University of Bergen Nygardsgt. 5 - N-5020 BERGEN - Norway

2 1

Proxy and copy-acct-to-home-server
by Etienne Pretorius 12 Mar '10

12 Mar '10

Hello List, I am redoing our radius setup into FreeRadius 2.0.4 and I need some advise. Lets say I have 3 FreeRadius servers (A,B,C) and I would like to sync the accounting packet between them. On server A, I created copy-acct-to-home-server for B and C; On server B, I created copy-acct-to-home-server for A and C; On server C, I created copy-acct-to-home-server for A and B; Now in proxy.conf.... i need to define home_servers: On server A, created home_server B and home_server C (type=acct); On server B, created home_server A and home_server C (type=acct); On server C, created home_server A and home_server B (type=acct); But now on server_pool I seem to have an issue, I desire that A only sends copies to B and C - while B and C do not send those packets back to A or to each other respectively. Like wise with the other two servers ( ie when one of the servers I administer proxies a packet, the receiver should not proxy it any further ). How would I define this? Would I need one home_server_pool with both home_servers defined, but defined with what "type="? Mind if I use multiple pools then I need both in each of my realm statements... is that even allowed. Sorry for the vagueness... any assistance would be great Kind Regards, Etienne

2 12

MS-CHAP2-Response is incorrect
by omega bk 12 Mar '10

12 Mar '10

hello, just one question. (if you have time :-) ) my client is a windows xp wired 802.1x (native supplicant) i got user called bernard in opnldap database trying to authenticate my user through freeradius. i got this : ( my debug output il too large so i just put the error section) [ldap] performing user authorization for bernard [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> bernard [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=bernard) [ldap] expand: dc=example,dc=com -> dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=example,dc=com, with filter (cn=bernard) [ldap] Added User-Password = test in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Cleartext-Password == "test " [ldap] looking for reply items in directory... [ldap] user bernard authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop *Found Auth-Type = EAP* +- entering group authenticate {...} *[eap] Request found, released from the list* *[eap] EAP/mschapv2 [eap] processing type mschapv2* *[mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect **=> what does it mean ? ++[mschap] returns reject* [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. thank u so much.

1 0

Re: radiusd log filename
by Fred MAISON 12 Mar '10

12 Mar '10

OK, Alan, It's clear. Unfortunately, logrotate version on last RedHat/CentOS does not support YYYYMMDD dateext function I can find on Debian ... I will have to write a postrotate script to do it. Thanks a lot. Fred > Date: Fri, 12 Mar 2010 14:04:03 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: radiusd log filename > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4B9A3BC3.7020109(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Fred MAISON wrote: > > I would like to change daemon log filename to have a YYYYMMDD suffix, in > > order to have an automatic daily log rotation, but this does not seems > > to be supported, as log_file does not seems to expand variables as this > > can be done for request logs or acct detail. > > It doesn't support log file rotation like that. > > I suggest using "logrotate". > > Alan DeKok.

2 2

ldap authenticate object not found
by omega bk 12 Mar '10

12 Mar '10

hello i got my user "bernard" on my openldap database. see my ldapserch: radtest:# ldapsearch -x -b "dc=example,dc=com" uid=bernard # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: uid=bernard # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 #################################" but when i tried to authenticate bernard through freeradius i'ts fail. see the debug output. thank u so much guys. radtest:# freeradius -X FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Mar 10 2010 at 13:50:12 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.20.253 { require_message_authenticator = no secret = "testinglinagora" shortname = "labtest8021x" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "10.75.128.251" port = 389 password = "test" identity = "cn=manager,ou=admins,ou=radius,dc=example,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=users,ou=radius,dc=example,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" password_attribute = "userPassword" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "radiusGroupName" groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8171ff8 Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.20.253 port 1645, id=106, length=153 User-Name = "bernard" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1A-A1-64-BB-1A" Calling-Station-Id = "00-18-8B-B5-26-B7" EAP-Message = 0x0202000c016265726e617264 Message-Authenticator = 0xcc5fc5a87a81a474f4171b85e6789f3d Cisco-NAS-Port = "FastEthernet0/24" NAS-Port = 50024 NAS-Port-Type = Ethernet NAS-IP-Address = 192.168.20.253 +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "bernard", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: ou=users,ou=radius,dc=example,dc=com -> ou=users,ou=radius,dc=example,dc=com [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] ... expanding second conditional [files] expand: %{User-Name} -> bernard [files] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=bernard) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.75.128.251:389, authentication 0 [ldap] bind as cn=manager,ou=admins,ou=radius,dc=example,dc=com/test to 10.75.128.251:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=users,ou=radius,dc=example,dc=com, with filter (uid=bernard) [ldap] object not found rlm_ldap::ldap_groupcmp: search failed [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop [ldap] performing user authorization for bernard [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> bernard [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=bernard) [ldap] expand: ou=users,ou=radius,dc=example,dc=com -> ou=users,ou=radius,dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=users,ou=radius,dc=example,dc=com, with filter (uid=bernard) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 106 to 192.168.20.253 port 1645 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2b3e4ab22b3d5f3fba6933e793eadc35 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.20.253 port 1645, id=107, length=165 User-Name = "bernard" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1A-A1-64-BB-1A" Calling-Station-Id = "00-18-8B-B5-26-B7" EAP-Message = 0x020300060319 Message-Authenticator = 0xc84586b06705544163ffe219bcfddbce Cisco-NAS-Port = "FastEthernet0/24" NAS-Port = 50024 NAS-Port-Type = Ethernet State = 0x2b3e4ab22b3d5f3fba6933e793eadc35 NAS-IP-Address = 192.168.20.253 +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "bernard", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: ou=users,ou=radius,dc=example,dc=com -> ou=users,ou=radius,dc=example,dc=com [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] ... expanding second conditional [files] expand: %{User-Name} -> bernard [files] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=bernard) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 *[ldap] performing search in ou=users,ou=radius,dc=example,dc=com, with filter (uid=bernard) [ldap] object not found rlm_ldap::ldap_groupcmp: search failed* [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop [ldap] performing user authorization for bernard [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> bernard [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=bernard) [ldap] expand: ou=users,ou=radius,dc=example,dc=com -> ou=users,ou=radius,dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=users,ou=radius,dc=example,dc=com, with filter (uid=bernard) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for unsupported type PEAP [eap] No common EAP types found. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 107 to 192.168.20.253 port 1645 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 106 with timestamp +19 Waking up in 1.0 seconds. Cleaning up request 1 ID 107 with timestamp +19 Ready to process requests. *thanks for helping me*

4 9