- Freeradius-Users - lists.freeradius.org

rlm_chap clear text password not available
by Eric Eric 23 Feb '10

23 Feb '10

please help.It confused me ! I want to change authentication pap to chap. The users with clear passwords are in ldap server. but the is error with clear password in rlm-ldap radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded LDAP rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap-Dial-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap-Dial-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap-Dial rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90f2d90 Module: Instantiated ldap (ldap-Vpn) Module: Loaded always Module: Instantiated always (ok) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded detail Module: Instantiated detail (auth_log) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL Counter Module: Instantiated sqlcounter (monthly-Vpn) rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap-Vpn-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap-Vpn-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap-Vpn rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90fa4c8 Module: Instantiated ldap (ldap-Vpn) Module: Instantiated sqlcounter (monthly-Vpn) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Instantiated detail (detail) Module: Loaded SQL rlm_sql (sql-Vpn): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql-Vpn): Attempting to connect to radius@localhost:/vpnradius rlm_sql (sql-Vpn): starting 0 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql-Vpn): Connected new DB handle, #0 rlm_sql (sql-Vpn): starting 1 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql-Vpn): Connected new DB handle, #1 rlm_sql (sql-Vpn): starting 2 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql-Vpn): Connected new DB handle, #2 rlm_sql (sql-Vpn): starting 3 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql-Vpn): Connected new DB handle, #3 rlm_sql (sql-Vpn): starting 4 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql-Vpn): Connected new DB handle, #4 Module: Instantiated sql (sql-Vpn) Module: Instantiated detail (reply_log) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.2:1866, id=78, length=246 Acct-Session-Id = "120" NAS-IP-Address = 10.10.10.2 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 128 MS-RAS-Vendor = 311 MS-RAS-Version = "MSRASV5.20" NAS-Port-Type = Virtual Tunnel-Type:0 = PPTP Tunnel-Medium-Type:0 = IP Calling-Station-Id = "10.10.10.24" Tunnel-Client-Endpoint:0 = "10.10.10.24" Microsoft-Attr-35 = 0x4d5352415356352e3130 Microsoft-Attr-34 = 0x4d535241532d302d4955542d3834433132343936333646 User-Name = "test" CHAP-Challenge = 0x45c8e77e0465ea843dc5b419ccb3ca01 CHAP-Password = 0x008a7f35b2a09df3aa79b659a9909ca15f Message-Authenticator = 0x540b9a3a9a929db1621fd2cb4fa1b2cc rlm_chap: Setting 'Auth-Type := CHAP' rlm_ldap: - authorize rlm_ldap: performing user authorization for test rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to 10.10.10.27:389, authentication 0 rlm_ldap: bind as / to 10.10.10.27:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: checking if remote access for test is allowed by vpnAccess rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 0 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 1080000 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusSessionTimeout as Session-Timeout, value 10 & op=11 rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_chap: login attempt by "test" with CHAP password rlm_chap: Could not find clear text password for user test Login incorrect (rlm_chap: Clear text password not available): [test] (from client vpntist port 128 cli 10.10.10.24) I saw the problem in faq but I didn't find what is my mistake. The config is: in users : DEFAULT Client-IP-Address == 10.10.10.2 , Auth-Type := Vpn, Autz-Type := Vpn, Post-Auth-Type := Vpn, Session-type := Vpn in radius.conf: ldap ldap-Vpn{ .... password_attribute = userPassword password_header = "{clear}" } authorize { chap Autz-Type Vpn{ ldap-Vpn chap } } authenticate { Auth-Type CHAP { chap } Auth-Type Vpn{ chap } } .... what is my mistake? should I do any other config or change ? please any idea?

2 1

rlm-ldap error for chap
by Eric Eric 23 Feb '10

23 Feb '10

Hi I want to change authentication pap to chap. The users with clear passwords are in ldap server. but the is error with clear password in rlm-ldap radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded LDAP rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap-Dial-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap-Dial-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap-Dial rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90f2d90 Module: Instantiated ldap (ldap-Vpn) Module: Loaded always Module: Instantiated always (ok) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded detail Module: Instantiated detail (auth_log) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL Counter Module: Instantiated sqlcounter (monthly-Vpn) rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap-Vpn-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap-Vpn-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap-Vpn rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90fa4c8 Module: Instantiated ldap (ldap-Vpn) Module: Instantiated sqlcounter (monthly-Vpn) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Instantiated detail (detail) Module: Loaded SQL rlm_sql (sql-Vpn): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql-Vpn): Attempting to connect to radius@localhost:/vpnradius rlm_sql (sql-Vpn): starting 0 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql-Vpn): Connected new DB handle, #0 rlm_sql (sql-Vpn): starting 1 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql-Vpn): Connected new DB handle, #1 rlm_sql (sql-Vpn): starting 2 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql-Vpn): Connected new DB handle, #2 rlm_sql (sql-Vpn): starting 3 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql-Vpn): Connected new DB handle, #3 rlm_sql (sql-Vpn): starting 4 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql-Vpn): Connected new DB handle, #4 Module: Instantiated sql (sql-Vpn) Module: Instantiated detail (reply_log) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.2:1866, id=78, length=246 Acct-Session-Id = "120" NAS-IP-Address = 10.10.10.2 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 128 MS-RAS-Vendor = 311 MS-RAS-Version = "MSRASV5.20" NAS-Port-Type = Virtual Tunnel-Type:0 = PPTP Tunnel-Medium-Type:0 = IP Calling-Station-Id = "10.10.10.24" Tunnel-Client-Endpoint:0 = "10.10.10.24" Microsoft-Attr-35 = 0x4d5352415356352e3130 Microsoft-Attr-34 = 0x4d535241532d302d4955542d3834433132343936333646 User-Name = "test" CHAP-Challenge = 0x45c8e77e0465ea843dc5b419ccb3ca01 CHAP-Password = 0x008a7f35b2a09df3aa79b659a9909ca15f Message-Authenticator = 0x540b9a3a9a929db1621fd2cb4fa1b2cc rlm_chap: Setting 'Auth-Type := CHAP' rlm_ldap: - authorize rlm_ldap: performing user authorization for test rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to 10.10.10.27:389, authentication 0 rlm_ldap: bind as / to 10.10.10.27:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: checking if remote access for test is allowed by vpnAccess rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 0 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 1080000 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusSessionTimeout as Session-Timeout, value 10 & op=11 rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_chap: login attempt by "test" with CHAP password rlm_chap: Could not find clear text password for user test Login incorrect (rlm_chap: Clear text password not available): [test] (from client vpntist port 128 cli 10.10.10.24) I saw the problem in faq but I didn't find what is my mistake. The config is: in users : DEFAULT Client-IP-Address == 10.10.10.2 , Auth-Type := Vpn, Autz-Type := Vpn, Post-Auth-Type := Vpn, Session-type := Vpn in radius.conf: ldap ldap-Vpn{ .... password_attribute = userPassword password_header = "{clear}" } authorize { chap Autz-Type Vpn{ ldap-Vpn chap } } authenticate { Auth-Type CHAP { chap } Auth-Type Vpn{ chap } } .... what is my mistake? should I do any other config or change ?

3 2

Re: How long it take to auth in 802.1X/WPA-enterprise?
by JaeJong Baek 23 Feb '10

23 Feb '10

Thank you very much. Your comment and advice are very helpful to understand Radius mechanism I replaced the AP(Belkin54g) with new one(DWL-8200AP, D-Link). As a result, the delay time is reduced from 18 sec to 0.15 sec I measured the time stamp the captured packet-based on Network Monitor 3.1(M$) However, I'm not sure it depends on AP's feature or not. I have already installed VMware tools in that measuring, so networking configuration is ok. Lastly, concerned with "Looking up realm", Actually, I didn't know very well about this, I just use the user name like that style. Can you explain in detail? Best. ******************** Jaejong Baek 02-365-7966 ******************* Message: 3 Date: Thu, 18 Feb 2010 10:02:22 +0000 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: How long it take to auth in 802.1X/WPA-enterprise? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Cc: "freeradius-users-owner(a)lists.freeradius.org" <freeradius-users-owner(a)lists.freeradius.org> Message-ID: <20100218100222.GA11728(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > How long it take to auth in 802.1X/WPA-enterprise? depends on the system and what methods etc...but easily under 1 second here > In this simple network model, I have tried to auth using > EAP-TLS(self-certification) and it works good. > By the way, about 18 seconds are taken to auth as follow debug logs. > (confer the timestamp (1) and (2)) wheres the real authentication - ie Access-Accept return packet? do you have vmware tools on your ubuntu VMware hosted system - and therefore using vmxnet driver instead of the slow pcnet32 ? (lsmod | grep vmx) turn off any non-needed modules - eg are you ever going to use /etc/passwd for user accounts? if not, comment out the unix module whenever it appears.. likewise files, expiration, logintime etc..... make sure you are not going to be needign them though! ..also... > Wed Feb 17 21:37:00 2010 : Info: [suffix] Looking up realm > "xxxx.yyy.zz.vv" for User-Name = "kkk(a)xxxx.yyy.zz.vv" > Wed Feb 17 21:37:00 2010 : Info: [suffix] No such realm "xxxx.yyy.zz.vv" are you deliberately not dealing with this realm? are you expecting it to be sent elsewhere? alan

1 0

EAP-TTLS configuration with PAP inner
by Colin Byelong 23 Feb '10

23 Feb '10

Hi, Apologies if this has been asked before. I am trying to configure freeradius to replicate our current radius server, there are a couple of things that im not clear about. We tend to use a anonymous@realm identity for the EAP outer ID, in our current radius server this is defined in a users file and has the format of anonymous Encrypted-Password=nevermatch is there a similar thing in freeradius and where should this be defined ? In the eap.conf file under the ttls section it asks for " default_eap_type = tls" if I am using a pap password for the inner that comes from a ldap server should I comment this section out ? Or will the server ignore it ? Thanks Colin -- ----------------------------------------------------------------------- Colin Byelong Email: C.Byelong(a)ucl.ac.uk Senior Network Development Officer Network Group Information Systems Division University College London Gower Street Phone: 020 7679-2572 London WC1E 6BT ------------------------------------------------------------------------

2 5

(rlm_chap: Clear text password not available)
by Eric Eric 23 Feb '10

23 Feb '10

I want to change authentication pap to chap. The users with clear passwords are in ldap server. but the is error with clear password in rlm-ldap radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded LDAP rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap-Dial-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap-Dial-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap-Dial rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90f2d90 Module: Instantiated ldap (ldap-Vpn) Module: Loaded always Module: Instantiated always (ok) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded detail Module: Instantiated detail (auth_log) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL Counter Module: Instantiated sqlcounter (monthly-Vpn) rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap-Vpn-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap-Vpn-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap-Vpn rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90fa4c8 Module: Instantiated ldap (ldap-Vpn) Module: Instantiated sqlcounter (monthly-Vpn) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Instantiated detail (detail) Module: Loaded SQL rlm_sql (sql-Vpn): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql-Vpn): Attempting to connect to radius@localhost:/vpnradius rlm_sql (sql-Vpn): starting 0 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql-Vpn): Connected new DB handle, #0 rlm_sql (sql-Vpn): starting 1 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql-Vpn): Connected new DB handle, #1 rlm_sql (sql-Vpn): starting 2 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql-Vpn): Connected new DB handle, #2 rlm_sql (sql-Vpn): starting 3 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql-Vpn): Connected new DB handle, #3 rlm_sql (sql-Vpn): starting 4 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql-Vpn): Connected new DB handle, #4 Module: Instantiated sql (sql-Vpn) Module: Instantiated detail (reply_log) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.2:1866, id=78, length=246 Acct-Session-Id = "120" NAS-IP-Address = 10.10.10.2 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 128 MS-RAS-Vendor = 311 MS-RAS-Version = "MSRASV5.20" NAS-Port-Type = Virtual Tunnel-Type:0 = PPTP Tunnel-Medium-Type:0 = IP Calling-Station-Id = "10.10.10.24" Tunnel-Client-Endpoint:0 = "10.10.10.24" Microsoft-Attr-35 = 0x4d5352415356352e3130 Microsoft-Attr-34 = 0x4d535241532d302d4955542d3834433132343936333646 User-Name = "test" CHAP-Challenge = 0x45c8e77e0465ea843dc5b419ccb3ca01 CHAP-Password = 0x008a7f35b2a09df3aa79b659a9909ca15f Message-Authenticator = 0x540b9a3a9a929db1621fd2cb4fa1b2cc rlm_chap: Setting 'Auth-Type := CHAP' rlm_ldap: - authorize rlm_ldap: performing user authorization for test rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to 10.10.10.27:389, authentication 0 rlm_ldap: bind as / to 10.10.10.27:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: checking if remote access for test is allowed by vpnAccess rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 0 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 1080000 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusSessionTimeout as Session-Timeout, value 10 & op=11 rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_chap: login attempt by "test" with CHAP password rlm_chap: Could not find clear text password for user test Login incorrect (rlm_chap: Clear text password not available): [test] (from client vpntist port 128 cli 10.10.10.24) I saw the problem in faq but I didn't find what is my mistake. The config is: in users : DEFAULT Client-IP-Address == 10.10.10.2 , Auth-Type := Vpn, Autz-Type := Vpn, Post-Auth-Type := Vpn, Session-type := Vpn in radius.conf: ldap ldap-Vpn{ .... password_attribute = userPassword password_header = "{clear}" } authorize { chap Autz-Type Vpn{ ldap-Vpn chap } } authenticate { Auth-Type CHAP { chap } Auth-Type Vpn{ chap } } .... what is my mistake? should I do any other config or change ? please any idea?

1 0

Problem with eap-peap
by Trujillo Carmona, Antonio 23 Feb '10

23 Feb '10

Thank in advance and sorry for my english. Realy I have spend several day reading from internet (wiki.freeradius.org, deployingradius.com and google) Itry all the thing, including apply a hotfix from microsoft but I can't make it work. I use a debian backport version of freeradius radius-2:/etc/freeradius# freeradius -v freeradius: FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, built on Jan 3 2010 at 14:14:04 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. my files are: radius-2:/etc/freeradius# cat eap.conf # -*- text -*- ## ## eap.conf -- Configuration for EAP types (PEAP, TTLS, etc.) ## ## $Id$ ####################################################################### eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no max_sessions = 4096 tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = ***** private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random cipher_list = "DEFAULT" cache { enable = no lifetime = 24 # hours max_entries = 255 } } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } ----------------------------------------------- radius-2:/etc/freeradius# cat modules/mschap # -*- text -*- # # $Id$ # Microsoft CHAP authentication # # This module supports MS-CHAP and MS-CHAPv2 authentication. # It also enforces the SMB-Account-Ctrl attribute. # mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes authtype = MS-CHAP ntlm_auth = "/usr/bin/ntlm_auth \ --request-nt-key \ --username=%{mschap:User-Name:-None} \ --domain=%{mschap:NT-Domain:-HUVN} \ --challenge=%{mschap:Challenge:-00} \ --nt-response=%{mschap:NT-Response:-00}" } -------------------------------------------- radius-2:/etc/freeradius# cat sites-enabled/default ###################################################################### # # As of 2.0.0, FreeRADIUS supports virtual hosts using the # "server" section, and configuration directives. # # Virtual hosts should be put into the "sites-available" # directory. Soft links should be created in the "sites-enabled" # directory to these files. This is done in a normal installation. # # $Id $ # ###################################################################### authorize { #ntlm_auth preprocess #chap mschap suffix #ntdomain # eap { # ok = return # } eap #unix #files #expiration #logintime #pap } authenticate { Auth-Type MS-CHAP { mschap } eap } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess acct_unique suffix # ntdomain # files } # # Accounting. Log the accounting data. # accounting { detail radutmp # sql attr_filter.accounting_response } session { radutmp # sql } post-auth { exec # Post-Auth-Type REJECT { # attr_filter.access_reject # } } pre-proxy { } post-proxy { eap } --------------------------------------------------- The output of a debug session: Linux radius-2 2.6.26-2-amd64 #1 SMP Tue Jan 12 22:12:20 UTC 2010 x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Feb 18 09:17:57 2010 from 10.104.24.54 radius-2:~# freeradius -X FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, built on Jan 3 2010 at 14:14:04 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL{ } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "*******" nastype = "other" } client 10.104.16.128 { ipaddr = 10.104.16.128 require_message_authenticator = no secret = "******" shortname = "Nostracom" nastype = "other" } client 192.168.69.1 { ipaddr = 192.168.69.1 require_message_authenticator = no secret = "******" shortname = "Nostracom" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired" } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-HUVN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "*****" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=43, length=163 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x02010012014855564e5c6764787472756a6f Message-Authenticator = 0x7a690fbe4e69ed232adb1afdd61eb451 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 43 to 10.104.16.128 port 45236 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c3cd65c57a4c67a935e13b1f8 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=44, length=243 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x0202005019800000004616030100410100003d03014b7d355f9bf52e8c1779e6d1ef7add93b63615a7468de75e9cedc37734cb42ea00001600040005000a000900640062000300060013001200630100 State = 0x3cd4450c3cd65c57a4c67a935e13b1f8 Message-Authenticator = 0xb8c94b0c183743721d148fd2cc54e118 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 08a0], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 44 to 10.104.16.128 port 45236 EAP-Message = 0x0103038019c0000008dd160301002a0200002603014b7d3535617b3f06c7d3d6ee649ea0649f5c4514f3c355a63851a62eae88fcef0000040016030108a00b00089c0008990003ce308203ca308202b2a003020102020101300d06092a864886f70d010104050030819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e616461310d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e6573312530230603550403131c436572746966696361646f20696e7465726e6f20 EAP-Message = 0x64656c204855564e301e170d3130303231383131303535385a170d3131303231383131303535385a30819b310b30090603550406130245533112301006035504081309416e64616c75636961310d300b060355040a13044855564e313730350603550403132e70756572746168766e312e6875766e2e6469726179612e737370612e6a756e74612d616e64616c756369612e65733130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e657330820122300d06092a864886f70d01010105000382010f003082010a0282010100c9a0f9e752a29d36e20366b97df6d8bbae1c6b11c248 EAP-Message = 0x4e8a7ea13dbcdbb3397cc3551bca4317b8679c538ea5779bb256455ec5d26c8f96667cd42451ffadffe085cf807acd4f6766e6a50587a3e606921a657932f28bc4caf1b8b20de5da7dbbfc656cdbe70048743959573e6e2621131f1a6a7dd4284284d6425844a914165aa0f340b7f544d9faf5508acd1160671dce2c69d2a35d9398714c449bddd3ca981500b414c4b0b49f0995311ace024ba7eb5e266b6140d233aea138ec151c41e6c06085ac04837a5471e11274af01de2c5734d172dafc1cfaea87304ade8cecbf330204e702806cb5d562bd2656f43dc67bb3a36000ce69357bbbb4fe104fe6790203010001a317301530130603551d25040c30 EAP-Message = 0x0a06082b06010505070301300d06092a864886f70d01010405000382010100c8c0f7f55aa25c2518202181dd228e722a9890093284585289c10f6e1865f026114a38b545b2b8b39e11db1f4c4fb58053362835f18116ffd8800b21bef9197b1864ed09029c7edf3b18de94dc9ce886d83173962c156299079207020051552ef31d5735718832c9bdd3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c3dd75c57a4c67a935e13b1f8 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=45, length=169 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT802.11g" EAP-Message = 0x020300061900 State = 0x3cd4450c3dd75c57a4c67a935e13b1f8 Message-Authenticator = 0x0d2248a94a51fd9be68bca50c67b8429 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 45 to 10.104.16.128 port 45236 EAP-Message = 0x0104037c1940407a2d7aaa916a7af56d6e11f0f2122fb35582b8c6d9fadcfb531363fb6c9178e625574622c8210d6d0d9688b73435c60e6d01daee7d8bdbe6b6e56d965a49efcf5019bea2bf61a8ea2753e7c33dd1c2149d96e83ecd56311111e3a9f4a0c264f82e85e1074b496f03fff45f273cbab792fab85804deb8b4026fd343b2a98849f4ed25ef76f19b38837c804620091ba9022ca4ac8a9d0004c5308204c1308203a9a0030201020209008235595e0380a483300d06092a864886f70d010105050030819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e61646131 EAP-Message = 0x0d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e6573312530230603550403131c436572746966696361646f20696e7465726e6f2064656c204855564e301e170d3130303231383131303535385a170d3130303332303131303535385a30819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e616461310d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e65 EAP-Message = 0x73312530230603550403131c436572746966696361646f20696e7465726e6f2064656c204855564e30820122300d06092a864886f70d01010105000382010f003082010a0282010100d64bbd4ad1ec76d41f2ace6c442099ec85b405735600b46a821906475dc357b59c3edb22d05c5c22e7be1d99b1b847b30b95ec137d93bf8d652f6c14c3bf0665b702fee14eb64636fc50e3886483e3aacc75080d73f920da50529bb5103bb0de9c15d51c506c8920c1f8bcb3154b1359f6c00268940a7bfa3450bc9a0153cf04fddd5dc4f46067ec8f5183d3790f814570781e7c9d02f6f9e301e0b828f55edae4fc84390cdd3470b2f1f9a8558f28856ff253e9 EAP-Message = 0x5822c9ff96244b5e236006154a32c754fc01cdc883745964901b0e39f3ac6135a2a76dd351e9c4049e658ae2501f6221619b4a41d4acbf0c7f618168f6c04b5352d5b246ef2243fb63d359310203010001a382010430820100301d0603551d0e0416041454f9c12706d36e7282442b9838fce221ba5f26183081d00603551d230481c83081 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c3ed05c57a4c67a935e13b1f8 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=46, length=169 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x020400061900 State = 0x3cd4450c3ed05c57a4c67a935e13b1f8 Message-Authenticator = 0xe7a8886894f56a15a4e5dac3576cd04b +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 46 to 10.104.16.128 port 45236 EAP-Message = 0x010501f71900c5801454f9c12706d36e7282442b9838fce221ba5f2618a181a1a4819e30819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e616461310d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e6573312530230603550403131c436572746966696361646f20696e7465726e6f2064656c204855564e8209008235595e0380a483300c0603551d13040530030101ff300d06092a864886f70d010105050003820101005f562f88b85ff6fceaa39f3938ebe6 EAP-Message = 0x049eb9de52b47377c7896a46e87d244df4286d48d7f639856078ab9667b2bcee73921d017f66aeeee584acf6e5632a1b9ee18adc3a30679034580f348992803cfc4f7c8b49d518cab99093ba00db3e04ce612a01379a7443c8f38662f98801f58fc56bb574f6cb93314838c70f48d6089e2b03ca5efd96425a6d1205e244277ebf2856910f94e8027b681df32bb4e6247ce879c21ad5216fc7336aaec9dfd871e1f9690783c77dbfea0673c22a7bb282548be147de3f59074e1c21efbf586c07934fd3ae71e331b7c31fb5e15c83fdd52f44d6ee4a1d533a0c29a5f122610d4fbde8b8de8e361e6c79298aec559912533316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c3fd15c57a4c67a935e13b1f8 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=47, length=485 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x020501401980000001361603010106100001020100057a7c049e1e45ae4cdf01e672f90cdea597c9c86bf6f864a9b01e477f5d556b25c47bd19f8f22ef5905b86745dde3e454fd5aaa6c02379e47fdd9b2b0ac4d0777d8bcfc3e0e7c79986fac80eefc8bd9f9718229f4acd8bb53aa7d6e227f8aff3626cba1b13c1ca516ff8277e47a4291aa57c8da1381336cfaae51108058ca1d5e4c580fc242e1a9d5a35c2e37edc49063865fd29768d7952279c47fb9c8c17925e546e1723e10c781a9593d3e0c109d543462b2070930dfeb6dc3489259d73db520da2197ff47a960415b0c3a65db7837b980664e6ea5badf19ab9b0aa734a79bd73bb657bdf065 EAP-Message = 0x3da16cc050dde37f18a3011e5892db6e9f23a31aee647ed51403010001011603010020fc7cb78c3fcff4257432f413651ff1a68a331daa44063ee1ba7357d53c5c721f State = 0x3cd4450c3fd15c57a4c67a935e13b1f8 Message-Authenticator = 0xa0b751cab837d32aaade6144d6f08f2e +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 47 to 10.104.16.128 port 45236 EAP-Message = 0x010600311900140301000101160301002072ff86ea6e4c6cfc190a9297cf07fd15083137cd2f67edea5dd2f18e75102f06 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c38d25c57a4c67a935e13b1f8 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=48, length=169 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x020600061900 State = 0x3cd4450c38d25c57a4c67a935e13b1f8 Message-Authenticator = 0xc3f2a00bcc6e4f986a6aa4d573441d6a +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 48 to 10.104.16.128 port 45236 EAP-Message = 0x0107002019001703010015832012a10a36559544d2d55db5f540a35b44d27aa0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c39d35c57a4c67a935e13b1f8 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=49, length=204 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x020700291900170301001e2acbee97084e2e33afc6ef6db5c15e21dc7840292d08f56549fa5f953b01 State = 0x3cd4450c39d35c57a4c67a935e13b1f8 Message-Authenticator = 0x917540a49ced99b1188e2bc396e9b16b +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 41 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - HUVN\gdxtrujo [peap] Got tunneled request EAP-Message = 0x02070012014855564e5c6764787472756a6f server { PEAP: Got tunneled identity of HUVN\gdxtrujo PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to HUVN\gdxtrujo Sending tunneled request EAP-Message = 0x02070012014855564e5c6764787472756a6f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "HUVN\\gdxtrujo" server inner-tunnel { +- entering group authorize {...} ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010800271a0108002210108d0360de57661511ac8e07d44d5fa54855564e5c6764787472756a6f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3f15a23e3f94029084a6a7e3a6f63f8 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800271a0108002210108d0360de57661511ac8e07d44d5fa54855564e5c6764787472756a6f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3f15a23e3f94029084a6a7e3a6f63f8 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 49 to 10.104.16.128 port 45236 EAP-Message = 0x0108003e19001703010033d2f9963fe2a7c1570b905e3678ce7c0cc342fd75dee75aeef1fab414d1c6bc9087f988a525c3046586add694814100e03271cc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c3adc5c57a4c67a935e13b1f8 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=50, length=258 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x0208005f190017030100543af645994c32ed46321e5112cff49a097d65e4a8c10596daba1d5514e2fcebedeba22162932f16450175f7488236bcd243aeb981cebf39d532e62916477ef5555ab630072f0bc847a80ce9975b4051a215abe698 State = 0x3cd4450c3adc5c57a4c67a935e13b1f8 Message-Authenticator = 0x180916b71df70e8ab7d54867f9c22baa +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 95 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800481a020800433138fec6ce84b614e4f6a3957becea631b00000000000000003e1277f2d4835fc8a8de7dfae71b2890c6ef6d3841140af2004855564e5c6764787472756a6f server { PEAP: Setting User-Name to HUVN\gdxtrujo Sending tunneled request EAP-Message = 0x020800481a020800433138fec6ce84b614e4f6a3957becea631b00000000000000003e1277f2d4835fc8a8de7dfae71b2890c6ef6d3841140af2004855564e5c6764787472756a6f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "HUVN\\gdxtrujo" State = 0xe3f15a23e3f94029084a6a7e3a6f63f8 server inner-tunnel { +- entering group authorize {...} ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 72 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for gdxtrujo with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=gdxtrujo [mschap] expand: --domain=%{mschap:NT-Domain:-HUVN} -> --domain=HUVN [mschap] mschap2: 10 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=cacf5023c11e7ea7 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=3e1277f2d4835fc8a8de7dfae71b2890c6ef6d3841140af2 Exec-Program output: NT_KEY: 2A28DA9AD2160A673F22F87D37D8E9BC Exec-Program-Wait: plaintext: NT_KEY: 2A28DA9AD2160A673F22F87D37D8E9BC Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010900331a0308002e533d36453744323533424634333934323345424634454132444141413038424441414534373235363644 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3f15a23e2f84029084a6a7e3a6f63f8 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010900331a0308002e533d36453744323533424634333934323345424634454132444141413038424441414534373235363644 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3f15a23e2f84029084a6a7e3a6f63f8 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 50 to 10.104.16.128 port 45236 EAP-Message = 0x0109004a1900170301003f27dd660624182f35234bd9f80b3c7ad5c4ca8c538fc86c6bae1ba3991e4d3fd17f1a934ac2f7453801032ca9894b0d4a8687ceccbb61bb439c4c9fc642d244 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c3bdd5c57a4c67a935e13b1f8 Finished request 7. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 43 with timestamp +35 Cleaning up request 1 ID 44 with timestamp +35 Cleaning up request 2 ID 45 with timestamp +35 Cleaning up request 3 ID 46 with timestamp +35 Cleaning up request 4 ID 47 with timestamp +35 Cleaning up request 5 ID 48 with timestamp +35 Cleaning up request 6 ID 49 with timestamp +35 Cleaning up request 7 ID 50 with timestamp +35 Ready to process requests. -- Por favor, NO utilice formatos de archivo propietarios para el intercambio de documentos, como DOC y XLS, sino HTML, RTF, TXT, CSV o cualquier otro que no obligue a utilizar un programa de un fabricante concreto para tratar la información contenida en él. SALUD.

2 2

eap-ttls and eap-peap againts OpenLdap
by John smith 23 Feb '10

23 Feb '10

Hello I trying to setting up the next scenario: freeradius 2.1.7 with eap-peap (mschapv2) and eap-ttls-pap authentication againts and OpenLDAP with userpassword and Samba attributes. I've installed OpenLdap with samba and userPassword attributes : My username credentiales (uid=ohnith) sambaLMPassword: 90B5B9BABA2A661CAAD3B435B51404EE sambaNTPassword: 0499CCC684CBC2FC38F9C4A3627BCAFD userPassword: {MD5}bpVSyb2OYcjyd8ISIBYCNA== I' ve installed freeradius 2.1.7 with the default configuration My problem is when I try to authenticate using peap-mschapv2 I've read a lot mails about similar problems but i can't find the answer to it I send you the debug output Any suggestions? Thanks Nick Ohn

2 3

Fw: freeradius and ldap using chap
by Eric Eric 22 Feb '10

22 Feb '10

Hi I want to change authentication pap to chap. The users with clear passwords are in ldap server. The error is : rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". Login incorrect (rlm_chap: Clear text password not available): I saw the problem in faq but I didn't find what is my mistake. The config is: in users : DEFAULT Client-IP-Address == 10.10.10.2 , Auth-Type := Vpn, Autz-Type := Vpn, Post-Auth-Type := Vpn, Session-type := Vpn in radius.conf: ldap ldap-Vpn{ .... password_attribute = userPassword password_header = "{clear}" } authorize { chap Autz-Type Vpn{ ldap-Vpn chap } } authenticate { Auth-Type CHAP { chap } Auth-Type Vpn{ chap ldap-Vpn } } .... what is my mistake? should I do any other config or change in ldap.attrmap?

1 1

ldap machine account auth tutorial
by cd 21 Feb '10

21 Feb '10

hello I'm looking for a toturial ti authenticate XP machines accounts (ldap backend) on boot with freeradius here a computer LDAP entry dn: uid=pc-42ee2079$,ou=computer,ou=ressources,ou=test,o=coin,c=fr objectClass: top objectClass: account objectClass: posixAccount objectClass: sambaSamAccount cn: pc-42ee2079$ uid: pc-42ee2079$ uidNumber: 10006 gidNumber: 515 homeDirectory: /dev/null loginShell: /bin/false description: Computer gecos: Computer structuralObjectClass: account sambaSID: S-1-5-21-902432509-630223792-3260868441-1000 displayName: pc-42EE2079$ sambaAcctFlags: [W ] sambaNTPassword: 2A8BBB29BEF5F91B02AF687290ADB4F7 sambaPwdLastSet: 1262772595 should I put in ldap.attr checkItem Cleartext-Password sambaNTPassword or should I put in modules/ldap password_attribute = sambaNTPassword What must I put in users file, if I want that assign VLAN If authentification succeed ? thanks

7 6

attribute and tabla in the database
by felix 21 Feb '10

21 Feb '10

Hello community I am new using freeradius and I use the freeradius v 2.1 and I need to find some documentation that speaks specifically to what each attribute of each table within the database, I've searched in google but I only see general explanations, and nothing specific. I would appreciate if I could help. Thanks in advance Participe en la 15 Convención Científica de Ingeniería y Arquitectura, del 29 de noviembre al 3 de diciembre de 2010 La Ingeniería y la Arquitectura por un Futuro Sustentable Palacio de Convenciones, La Habana, Cuba http://www.cujae.edu.cu/eventos/convencion

3 2