- Freeradius-Users - lists.freeradius.org

WPA Certificate Question
by Mike Diggins 03 Feb '10

03 Feb '10

I was able to get freeradius 2.1.3 and wireless WPA working, likely due to the fact that FreeRadius was mostly configured for me (thanks ;) ). I’m a little confused about the certificate that is required in the process, and what the relationship is with the client, the Wireless Controller and the FreeRadius server. The README file states: “ In general, you should use self-signed certificates for 802.1x (EAP) authentication.” Why self signed versus CA signed? Ideally I would like my clients to not be questioned about the certificate at all. Is that even possible with WPA? If I purchase a CA signed cert, would that eliminate the requirement on the client to acknowledge the certificate or import it? -Mike

6 14

pfSense + PPTP + FreeRADIUS + LDAP
by Fabio Rampazzo Mathias 02 Feb '10

02 Feb '10

Helo there, I'm relative new to freeradius, and i'm trying to configure a PPTP VPN on pfSense, authenticating in a FreeRADIUS with LDAP module. But, I'm getting the following error : Found Auth-Type = LDAP WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user. The authorize process works fine, but the authentication not. I can't find "Auth-Type = Local" as it says. This is my access request : rad_recv: Access-Request packet from host 192.168.7.1 port 2067, id=132, length=182 NAS-Identifier = "yoda" NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "189.102.177.232" User-Name = "fmathias" MS-CHAP-Challenge = 0xbb1e68338ed8f5047a5224fc502acaf9 MS-CHAP2-Response = 0x0100e017671426d787073d90dcb6a30ab3550000000000000000a5d5fa96e3770592a1df0039fcc812ea53a3684636f16cb3 I've tried many of google searches troubleshooting MS-CHAP problems and most of them is saying me to get a Cleartext-Password entry on my database. But I can't consider this an option, because the security of my accounts in LDAP would be extremely compromised. Can you help me? Thanks in advance, Fábio Rampazzo Mathias

2 4

Re: using Oracle with FreeRADIUS - I need a clue
by William Bulley 02 Feb '10

02 Feb '10

According to Alan DeKok <aland(a)deployingradius.com> on Tue, 02/02/10 at 14:29: > > > If Oracle support in FreeRADIUS is meant to at least include logging > > of session records, if RADIUS requests arrive at two FreeRADIUS server > > instances (say, primary and backup/failover), say Acct-Start to server > > "A" and the corresponding Acct-Stop to server "B" for the same RADIUS > > session, would both accounting log records end up in the same Oracle > > table (assuming both server "A" and server "B" are configured to send > > session logs to an Oracle instance on server "C")? > > That's a database replication issue, not a FreeRADIUS confi question. Just to clarify, given a server "C" running an instance of Oracle, and given the two FreeRADIUS boxes "A" and "B", if they both are configured to "talk" to Oracle on server "C" (just what that means is left as an exercise for me), there is nothing preventing a Acct-Start record from a RADIUS session 123 from server "A" _plus_ a Acct-Stop record from the same session 123 from server "B" being directed to the Oracle server "C", correct? This scenario hypothetizes the unlikely circumstance where server "A" is unavailable after the session 123 Acct-Start is received and hence the Acct-Stop fails-over to server "B". Given all that, it does seem to boil down to an Oracle issue, but I had to start here for FreeRADIUS. Next step: ask some Oracle expert about updating this one table, in real time, from two _different_ connections. Thanks for your timely reply. Regards, web... -- William Bulley Email: web(a)umich.edu 72 characters width template ----------------------------------------->|

2 1

Freeradius replacing Cisco ACS in an Active Directory Environment (Wifi PEAP+MSCHAP and other uses)
by George Shearer 02 Feb '10

02 Feb '10

Ugh. Please ignore my previous post to the list, gmail 'plain text' mode ate most of the message. All, this is my attempt at giving back to the freeradius community. Maybe others will find my configuration useful in their efforts. I'm a network guy, and I do quite a bit of consulting work for various companies. I have a customer in particular who (prior to this) wasusing a very out-of-date Cisco ACS Server, and couldn't afford the renewal/licensing fees to bring it uptodate. They are using Microsoft's Active Directory on Windows Server 2000 as the primary database for all identities/passwords. The goals of this configuration are: 1. Provide AAA for administrative access to network devices (mostly, SSH access to Cisco routers/switches/firewalls) 2. Provide AAA for 802.11 WLAN users who are using Windows XP and "Wireless Zero" clients. (Cisco 1231 series access points) 3. Provide AAA for VPN Users who use cisco Secure VPN client from remote locations (cisco 3000 series concentrators) The freeradius server itself will run on a CentOS 5.4 Linux box. The company doesn't like "make install" application installs (nor do I), so I simply grabbed the SRPM from the Fedora project's KOJI build server for the latest freeradius, and built it. This process is outside the scope of this particular posting, as I want to focus on Freeradius itself. The Fedora spec file builds multiple binary packages that you can install based on what you want to do with freeradius. These are the packages I'm using: freeradius-utils-2.1.8-2 freeradius-2.1.8-2 freeradius-ldap-2.1.8-2 The company has one Active Directory forest, and one subdomain. Users exist under both. So, for this configuration, we'll call the primary zone COMPANY.COM and SUB.COMPANY.COM <http://SUB.COMPANY.COM>. Both domains must be queried for authorization & authentication. The following rules apply for access: 1. User must exist within the AD forest. (as defined by my LDAP search parameters) 2. User must be a member of a particular group (defined by the Users file) for certain types of access: a) For administrative access to network device, the user must be a member of the group networkteam. b) Access to use the VPN, user must be a member of the group vpnusers. c) Access to the Wireless network, user must be a member of group wifiusers. VPN and Network-Admin users achieve both Authorization and Authentication using nothing more than the rlm_ldap module. Wireless users do not use ldap at all, but instead, they use the eap and mschap modules. The mschap module is configured to use ntlm_auth which requires samba's winbind to be configured on the backend. It took me some time (and I will not admit how much time) to figure out how to make this all work. I blame most of this on the fact that freeradius has been around a long time, and as result there's lots of obsolete documentation out there for google to find. I believe this configuration uses mostly uptodate syntax, however I'm always interested in advice on improvements. Interestingly, this process gave me quite a case of dejavu. I wrote a combination tacacs/radius server WAY back when the Livingston Portmaster 2 series was king of dialup. Many sers on the livingston mailing list used my source code. This really made me feel old. :( Anyway, on to the good stuff: Annoyances: 1. Cisco does not support command accounting via Radius. Only Tacacs. Why? They want you to buy ACS ! Sorry Cisco, I love ya, but.. cmon! 2. Cisco PIX/ASA do not support radius for command authorization. So, you have to type 'enable' and your AD account password AGAIN. 3. Cisco 1231-series access points running IOS 12.3(8)JED or earlier do not include NAS-Port-Type in subsequent password attempts for SSH access. So, you only get one shot at typing your password right when you SSH for admin access into a WAP. It'll ask you for your password again, and it'll try to get approval from your Radius server, however, it will not include the port type in the request. So freeradius will not classify the request in the proper huntgroup. Unfortunately, you may think you just keep fat fingering your password, so you just keep trying. This will eventually get your AD account locked and you'll have to bug the windows guys to re-enable it. :) 4. Cisco 3000 platform does not support AAA for admin access.. again, only with tacacs. I know, I know, this platform is OLD, but... you have to admit, it has to be one of the most reliable platforms cisco has ever sold. It's hard to say goodbye. radiusd.conf --------------------------------------------------------------------------------------------- # freeradius config for a typical company using Active Directory for password management # George Shearer (doc at lame dot org) # Primary uses: # 1. AAA for admin access to network devices (ldap) # 2. AAA for user access to 802.11 Wireless Networks (WPA2-Enterprise / EAP-PEAP / EAP-MSCHAPv2) # 3. AAA for remote user access to VPN (ldap) name = radiusd # Locations prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid # Security #chroot = /path/to/chroot/directory user = radiusd group = radiusd security { max_attributes = 200 reject_delay = 1 status_server = yes } # Network hostname_lookups = yes proxy_requests = no listen { type = auth ipaddr = ip-addr-of-eth0 port = 1812 } listen { type = acct ipaddr = ip-addr-of-eth0 port = 1813 } listen { type = control socket = ${run_dir}/${name}.sock mode = ro } # Performance max_request_time = 10 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no regular_expressions = yes extended_expressions = yes thread pool { start_servers = 5 max_servers = 15 min_spare_servers = 3 max_spare_servers = 5 max_requests_per_server = 0 } # Logging log { destination = syslog syslog_facility = authpriv stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no } # freeradius modules modules { # Create unique acct ID's per session -- so tell network devices to use common id's and let radiusd handle acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } preprocess { huntgroups = ${confdir}/huntgroups } detail { detailfile = ${radacctdir}/%{Huntgroup-Name}/detail-%Y%m%d detailperm = 0600 header = "%t" } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } ldap { server = "ip-addr-of-domain-contoller" port = 3268 # Global Catalog port not LDAP. This allows combined searches of both SUB.MYCOMPANY.COM and MYCOMPANY.COM identity = "CN=myqueryacct,OU=System Accounts,DC=mycompany,DC=com" password = "mypassword" basedn = "DC=mycompany,DC=com" filter = "(&(objectCategory=person)(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}))" groupname_attribute = "cn" groupmembership_filter = "(&(objectClass=group)(member=%{control:Ldap-UserDn}))" groupmembership_attribute = memberOf ldap_connections_number = 3 timeout = 4 timelimit = 3 net_timeout = 1 directory_mappings = ${confdir}/ldap.attrmap } eap { default_eap_type = peap timer_expire = 60 max_sessions = 500 ignore_unknown_eap_types = no tls { cert_dir = ${confdir}/certs rsa_key_length = 2048 dh_key_length = 2048 private_key_password = password-for-my-encrypted-key private_key_file = ${cert_dir}/combined-cert-and-key-file.pem certificate_file = ${private_key_file} CA_file = ${cert_dir}/my-ca-cert-file.pem dh_file = ${cert_dir}/dh random_file = ${cert_dir}/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" cache { enable = yes lifetime = 24 max_entries = 500 } } peap { default_eap_type = mschapv2 } mschapv2 { } } mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{mschap:User-Name}:-None} --domain=%{%{mschap:NT-Domain}:-EDLENDING} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} --require-membership-of=wifiusers" } radutmp { filename = ${logdir}/radutmp username = %{%{Stripped-User-Name}:-%{User-Name}} case_sensitive = yes check_with_nas = yes perm = 0600 } realm ntdomain { format = prefix delimiter = "\\" } } instantiate { } authorize { preprocess eap { ok = return updated = return } # The eap {} stuff above prevents your ldap server from being used for wireless users. Since we handle this via ntlm, no need to bug ldap. # also, the ntdomain stuff isnt even needed because the mschap module has variables to do the stripping built in.. ntdomain files ldap } authenticate { Auth-Type LDAP { ldap } Auth-Type MS-CHAP { mschap } eap } preacct { preprocess update request { NAS-Port = 1 # Cisco ASA's annoyingly do not include NAS-Port for administrative logins. This breaks radwho. The # above statement forces Nas-Port to be '1' if it doesn't already exist. } ntdomain acct_unique } accounting { detail radutmp } session { radutmp } # Realms (domains) realm MYCOMPANY { authhost = LOCAL accthost = LOCAL type = radius } realm SUB { authhost = LOCAL accthost = LOCAL type = radius } realm NULL { authhost = LOCAL accthost = LOCAL type = radius realm = MYCOMPANY } # Include our clients $INCLUDE clients.conf --------------------------------------------------------------------------------------------- huntgroups # All devices that network-admins want to log into for administrative access # Cisco sends "Virtual" for type on most things I've tried for SSH access network-admin NAS-IP-Address == ipaddr1, NAS-Port-Type == "Virtual" network-admin NAS-IP-Address == ipaddr2, NAS-Port-Type == "Virtual" network-admin NAS-IP-Address == ipaddr3, NAS-Port-Type == "Virtual" network-admin NAS-IP-Address == ipaddr4, NAS-Port-Type == "Virtual" # Cisco 1200 series WAPs # Since I handle AAA for wireless via ntlm_auth (not LDAP), this group isnt even necessary # However you could expand upon my config and use this group to create a seperate # accounting file, or various other uses. wireless NAS-IP-Address == ipaddr1, NAS-Port-Type == "Wireless-802.11" wireless NAS-IP-Address == ipaddr2, NAS-Port-Type == "Wireless-802.11" wireless NAS-IP-Address == ipaddr3, NAS-Port-Type == "Wireless-802.11" # Cisco 3000 Concentrators # These also send "VirtuaL" as type for users connecting via IPsec. Unfortunately, # the 3000 platform does not support radius AAA for administrative access :( vpn NAS-IP-Address == ipaddr1, NAS-Port-Type == "Virtual" vpn NAS-IP-Address == ipaddr2, NAS-Port-Type == "Virtual" --------------------------------------------------------------------------------------------- users # this 'locally managed' account matches the same account thats in the local configs on the devices # various scripts use this account for things like downloading configs or whatever. And its not in # active directory. It also has a limited security level. admin Huntgroup-Name == "network-admin", Cleartext-Password := "localadminaccountpw" Service-Type := NAS-Prompt-User, cisco-avpair := "shell:priv-lvl=2" # This drops all users who are a member of the 'networkteam' group right into an "enabled" prompt # Unfortunately, PIX/ASA's do not support this cisco-avpair on Radius, so you'll still type 'enable' # but when you're asked for a password, you'll give your AD account password again as opposed to # the real enable password. The only time you should need the real enable password for any device # is when the radius server is down DEFAULT Huntgroup-Name == "network-admin", Ldap-Group == "networkteam" Service-Type := NAS-Prompt-User, cisco-avpair := "shell:priv-lvl=15", Auth-Type := LDAP DEFAULT Huntgroup-Name == "vpn", Ldap-Group == "vpnusers" Auth-Type := LDAP DEFAULT Auth-Type := Reject Reply-Message := "Access Denied. Your attempt has been logged.", --------------------------------------------------------------------------------------------- Cisco IOS based device config: (relevant parts, anyway) aaa new-model aaa authentication login networkteam group radius local-case aaa authentication login wifi-access group radius aaa authorization exec default group radius local aaa accounting session-duration ntp-adjusted aaa accounting exec default start-stop group radius aaa accounting network default start-stop group radius aaa session-id common ! ! Obviously you dont need the wireless stuff for non-access points dot11 ssid OURSSID authentication open eap wifi-access authentication key-management wpa accounting default ! ! The "accounting-default" statement is what causes IOS to send accounting packets for that SSID radius-server host my-radius-server auth-port 1812 acct-port 1813 key myradiuskey ! line con 0 login authentication networkteam line vty 0 15 login authentication networkteam --------------------------------------------------------------------------------------------- Cisco ASA/PIX config: username admin password whatever aaa-server radius protocol radius max-failed-attempts 3 aaa-server radius (INSIDE) host my-radius-server timeout 3 key slxradkey2010 authentication-port 1812 accounting-port 1813 aaa authentication ssh console radius LOCAL aaa authentication enable console radius LOCAL aaa authentication serial console radius LOCAL aaa authentication telnet console radius LOCAL aaa authentication http console radius LOCAL aaa accounting ssh console radius aaa accounting telnet console radius aaa accounting serial console radius

1 0

using Oracle with FreeRADIUS - I need a clue
by William Bulley 02 Feb '10

02 Feb '10

When I have used FreeRADIUS in the past, it has been in the traditional "users" file model - that is, very simplistic installation. To date, I have not used FreeRADIUS with Oracle. Is the Oracle support in FreeRADIUS mature, or developmental, in its current state? I cannot determine this answer from a search of the mailing list archives dating back a couple of years. In addition to authentication using Oracle, is the Oracle support also meant for FreeRADIUS configuration, or session logging (accnt, auth, etc.), or some combination of the above? If Oracle support in FreeRADIUS is meant to at least include logging of session records, if RADIUS requests arrive at two FreeRADIUS server instances (say, primary and backup/failover), say Acct-Start to server "A" and the corresponding Acct-Stop to server "B" for the same RADIUS session, would both accounting log records end up in the same Oracle table (assuming both server "A" and server "B" are configured to send session logs to an Oracle instance on server "C")? It has been a while since I used FreeRADIUS, so a pointer to the RTFM would also be an acceptable answer. Thanks in advance. Regards, web... -- William Bulley Email: web(a)umich.edu 72 characters width template ----------------------------------------->|

2 1

how to generate chap-password chap-challenge on radius
by Alisson 02 Feb '10

02 Feb '10

hi, I need to use chap-password and chap-challenge to authenticate mikrotik on radius and i'm trying to use some pear extensions to do it... but mikrotik use passwords like this password=1 CHAP-Challenge = 0xad2c7efe802ea7bea94e270404eb01ae CHAP-Password = 0x000ad48b2d944948e8014118aeb4e56923 and on pear crypt-chap it generates ChallResp : 641af097fc49501791740dcf0684c0e2 expected : 8f028814450d66d94c72331ef455a172 -- Att. Alisson F. Gonçalves Sistemas de Informação - UFGD

2 3

Freeradius replacing Cisco ACS in an Active Directory Environment
by George Shearer 02 Feb '10

02 Feb '10

Hi All. This is my attempt at giving back to the freeradius community. Maybe others will find my configuration useful in their efforts. I'm a network guy, and I do quite a bit of consulting work for various companies. I have a customer in particular who (prior to this) was using a very out-of-date Cisco ACS Server, and couldn't afford the renewal/licensing fees to bring it uptodate. They are using Microsoft's Active Directory on Windows Server 2000 as the primary database for all identities/passwords. The goals of this configuration are: 1. Provide AAA for administrative access to network devices (mostly, SSH access to Cisco routers/switches/firewalls) 2. Provide AAA for 802.11 WLAN users who are using Windows XP and "Wireless Zero" clients. (Cisco 1231 series access points) 3. Provide AAA for VPN Users who use cisco Secure VPN client from remote locations (cisco 3000 series concentrators) The freeradius server itself will run on a CentOS 5.4 Linux box. The company doesn't like "make install" application installs (nor do I), so I simply grabbed the SRPM from the Fedora Project's KOJI build server for the latest freeradius, and built it. This process is outside the scope of this particular posting, as I want to focus on Freeradius itself. The Fedora spec file builds multiple binary packages that you can install based on what you want to do with freeradius. These are the packages I'm using: freeradius-utils-2.1.8-2 freeradius-2.1.8-2 freeradius-ldap-2.1.8-2 The company has one Active Directory forest, and one subdomain. Users exist under both. So, for this configuration, we'll call the primary zone COMPANY.COM and SUB.COMPANY.COM. Both domains must be queried for authorization & authentication. The following rules apply for access: 1. User must exist within the AD forest. (as defined by my LDAP search parameters) 2. User must be a member of a particular group (defined by the Users file) for certain types of access: a) For administrative access to network device, the user must be a member of the group networkteam. b) Access to use the VPN, user must be a member of the group vpnusers. c) Access to the Wireless network, user must be a member of group wifiusers. VPN and Network-Admin users achieve both Authorization and Authentication using nothing more than the rlm_ldap module. Wireless users do not use ldap at all, but instead, they use the eap and mschap modules. The mschap module is configured to use ntlm_auth which requires samba's winbind to be configured on the backend. It took me some time (and I will not admit how much time) to figure out how to make this all work. I blame most of this on the fact that freeradius has been around a long time, and as a result there's lots of obsolete documentation out there for google to find. I believe this configuration uses mostly uptodate syntax, however I'm always interested in feedback on how to do things better. Interestingly.. this whole process brought back a case of severe dejavu for me. I wrote a combination tacacs/radius server WAY back in the day when the Livingston Portmaster 2 series was king of dialup. Many users on the livingston mailing list used my source code. This really made me feel old. :( Anyway, on to the good stuff.

1 0

freeRadius LDAP auth using WPA-EAP on 802.11
by José Campos 02 Feb '10

02 Feb '10

Hello everyone. I have this problem. I cant get my ldap users authenticate throw radius. I have my AP configure to use WPA-EAP and pointing to my radius server. I think that the radiusd X output is sufficient for you to understand what roung is: ######################## FreeRADIUS Version 2.1.7, for host i386-redhat-linux-gnu, built on Sep 15 2009 at 11:31:29 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 172.22.0.21 { ipaddr = 172.22.0.21 require_message_authenticator = no secret = "test" shortname = "mypc" nastype = "other" } client AP1-E1 { ipaddr = 192.168.70.70 require_message_authenticator = no secret = "test" shortname = "AP1-E1" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "xxx.xxx.xxx.xxx" port = 389 password = "123456" identity = "uid=borat,dc=xpto,dc=pt" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=xpto,dc=pt" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8782e88 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. ################################### When I try connect with wireless using radius I get a bunch o debug, but I think this is relevant: The follow lines tend to repeated over and over. ######################################## rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=xpto,dc=pt, with filter (uid=myLDAPuser) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user myLDAPuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.70.70 port 1026 EAP-Message = 0x010100160410f14661baee3d7327186dd431deff0370 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x38f703bb38f607a3224364ff73a6f80d Finished request 1. ######################################## Atentamente, José Campos

2 5

radiusd -X with timestamps?
by freeradius＠corwyn.net 02 Feb '10

02 Feb '10

Is there any way to get timestamps to display when running radiusd -X? I get them when running as a service, but then I don't get the same detail in radius.log Rick Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

3 2

autz-type according ldap server
by cd 02 Feb '10

02 Feb '10

I have a little problem but I think it's because autz-type is badly configured I have 2 ldaps (ldap_peda and ldap_admin) users account works fine on each servers but machine accounts work only on ldap_peda when a computer boot freeradius logs says +++[ldap_admin] returns ok [...] ++[ldap_peda] returns notfound (it s normal) but it says Sending Access-Accept with autz-type ldap_peda and not ldap_admin So machine is in the wrong vlan What do I miss ? my users file #### IT S FOR MACHINE ACCOUNT AUTH DEFAULT Autz-Type := ldap_peda Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=20, Reply-Message="ok_hostpeda" DEFAULT Autz-Type := ldap_admin Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=10, Reply-Message="ok_hostadmin" #### IT S FOR USERS ACCOUNT AUTH DEFAULT ldap_peda-Ldap-Group=="Eleves" Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=20, Reply-Message="okeleves" DEFAULT ldap_peda-Ldap-Group=="professeurs" Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=20, Reply-Message="okprofs" DEFAULT ldap_admin-Ldap-Group=="administratifs" Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=10, Reply-Message="admin" FreeRADIUS Version 2.1.7, for host i486-pc-linux-gnu, built on Oct 5 2009 at 14:59:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/control-socket group = freerad user = freerad including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" virtual_server = "inner-tunnel" } client 192.168.10.254 { require_message_authenticator = no secret = "momo" shortname = "Nortel" nastype = "other" virtual_server = "inner-tunnel" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes } Module: Linked to module rlm_ldap Module: Instantiating ldap_admin ldap ldap_admin { server = "192.168.10.2" port = 389 password = "" identity = "" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "o=gouv,c=fr" filter = "(uid=%{mschap:User-Name})" base_filter = "(objectclass=radiusprofile)" password_attribute = "user-Password" auto_header = no access_attr = "uid" access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(&(objectClass=posixGroup)(memberUid=%{mschap:User-Name}))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 15 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap_admin-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap_admin-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap_admin rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x8176838 Module: Instantiating ldap_peda ldap ldap_peda { server = "192.168.20.2" port = 389 password = "" identity = "" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "o=gouv,c=fr" filter = "(uid=%{mschap:User-Name})" base_filter = "(objectclass=radiusprofile)" password_attribute = "user-Password" auto_header = no access_attr = "uid" access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(&(objectClass=posixGroup)(memberUid=%{mschap:User-Name}))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 15 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap_peda-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap_peda-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap_peda rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x8177e58 Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "mschapv2" timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/ssl/certs/eole.key" certificate_file = "/etc/ssl/certs/eole.crt" CA_file = "/etc/ssl/certs/ca.crt" dh_file = "/etc/ssl/dh" random_file = "/dev/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } Listening on authentication address * port 1812 Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=239, length=122 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xf9beb36136492c7928eb9131e2fb21ca NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" EAP-Message = 0x020b001201686f73742f70632d61646d696e server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 11 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.20.2:389, authentication 0 rlm_ldap: bind as / to 192.168.20.2:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.10.2:389, authentication 0 rlm_ldap: bind as / to 192.168.10.2:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 239 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x010c00271a010c002210d92b9fd31dccad929fdb3f2ca05a6646686f73742f70632d61646d696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee25aff54b96dea318012fe73d9 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=240, length=128 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x21826287328e18d53b013ad8b9b196f1 NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee25aff54b96dea318012fe73d9 EAP-Message = 0x020c00060319 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 12 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 240 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x010d00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee25bfe57b96dea318012fe73d9 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=241, length=202 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x6939b9798b27d12e96581c83e621324d NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee25bfe57b96dea318012fe73d9 EAP-Message = 0x020d005019800000004616030100410100003d03014b6829d4ba7efe234d701d03c5952b9eb8ead51c8105eb946369aacc24e8430000001600040005000a000900640062000300060013001200630100 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 13 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0914], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 241 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x010e040019c000000951160301002a0200002603014b68298c6d7075b0b54fb873ef9fa975135522b70e535ab172d2d7a99533d73e0000040016030109140b00091000090d0004af308204ab30820393a003020102020120300d06092a864886f70d0101050500307a310b3009060355040613024652312f302d060355040a13264d696e69737465726520456475636174696f6e204e6174696f6e616c6520284d454e455352293111300f060355040b1308303732313537325431123010060355040b130961632d6e616e746573311330110603550403130a43412d70662d616d6f6e301e170d3130303130343135303632365a170d31333031303431 EAP-Message = 0x35303632365a30818d310b3009060355040613024652312f302d060355040a13264d696e69737465726520456475636174696f6e204e6174696f6e616c6520284d454e455352293111300f060355040b1308303732313537325431123010060355040b130961632d6e616e746573312630240603550403131d70662d616d6f6e2e30373231353732542e61632d6e616e7465732e667230820122300d06092a864886f70d01010105000382010f003082010a0282010100e4bed7c951596527195184c10821f2095377a90e673796557a48c155e02114854d78ef0a554f4508f9b65fabbbe13c41f336035031036c0406d1cfa48959aa70e6bbe935fa99 EAP-Message = 0x376c3784bbadd7617ab8ce3379b7b067a632c25ccbe005fcfc04e88fe73f53256aa16ee313b08ad0db3e843ab8c459e476f2e5d85779ccab883841a4b410efafa984bb03f2ae66f9bbdccc438edbf28b9ae2d2bfb99c72e37b6e9f43efec87f622bd64f50f281c42738a4d534b0588436d7bc05e2ebfd286f9f5202ca4ebd88d0b483f513f601ef41c0372e57e025264814e7c26d5cd550c14ceca6f04267766408a69cd9774a86d377dc39319419639f0ae531f64e65077ee310203010001a382012630820122300c0603551d130101ff04023000301d0603551d0e04160414d9d4f8e696b1018db9607d864c473313ecd52e533081ac0603551d2304 EAP-Message = 0x81a43081a18014323a4970ba53cf9fff2b2ce5436dd64e036b4cf7a17ea47c307a310b3009060355040613024652312f302d060355040a13264d696e69737465726520456475636174696f6e204e6174696f6e616c6520284d454e455352293111300f060355040b1308303732313537325431123010060355040b130961632d6e616e746573311330110603550403130a43412d70662d616d6f6e820900f600a779ca4a31f2300b0603551d0f0404030205a0301106096086480186f8420101040403020640302406096086480186f842010d04171615436572746966696361742073656c66207369676e65300d06092a864886f70d01010505000382 EAP-Message = 0x010100738b52410508dfb265 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee258fd57b96dea318012fe73d9 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=242, length=128 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xfb36b01671119b3c8b0224e2688bb6e0 NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee258fd57b96dea318012fe73d9 EAP-Message = 0x020e00061900 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 14 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 242 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x010f03fc19401182ca5390bea1fe88313c924d092dbd0cb475424af8c336fe26053d412f47c50fe19c560b380240cd0ffc099b2d1389efe8138320b9c39ff976bb256aa135220112ce2dcbda12a62d121874632f586a639ab589de66aab22d0c8be6b3038ef720750df0fc4a49d65fd28ac02cf66774b954084b383d2be00517d663023aee762e237709c22dfad7be540c986d88fb9e0cd1d07723dc5a1b86bac13bfc40ce7d6b640ab880491b96a5069e353e781586f8a1ed77c86e94b7eadb0ed3319ae20ace6a378133a7022b2080796dd1c122ac1f4a5c2e7257cdbff34956e38db82ab83ce720e860c087888c09c792fb0cd761cc6bf95f8d82ae EAP-Message = 0x000458308204543082033ca003020102020900f600a779ca4a31f2300d06092a864886f70d0101050500307a310b3009060355040613024652312f302d060355040a13264d696e69737465726520456475636174696f6e204e6174696f6e616c6520284d454e455352293111300f060355040b1308303732313537325431123010060355040b130961632d6e616e746573311330110603550403130a43412d70662d616d6f6e301e170d3130303130343135303632365a170d3133303130343135303632365a307a310b3009060355040613024652312f302d060355040a13264d696e69737465726520456475636174696f6e204e6174696f6e616c65 EAP-Message = 0x20284d454e455352293111300f060355040b1308303732313537325431123010060355040b130961632d6e616e746573311330110603550403130a43412d70662d616d6f6e30820122300d06092a864886f70d01010105000382010f003082010a0282010100c98d21324f37ff11d786d7c35d535d59aae2514ae1b9d0647cde3fb9f700505a1d945695c686888f85f5b36c083bee7d99d29dab7444ce49efa4a9802fa14565b1778f676baf779694fe8167ea4e3cf7cd350219e755c5389f981290b31d0414e7967d7f05b92bfbd52f188754f8a47e193638cf68927ca3c8bc307c860f3ef36b39bd3d10117cbe53837e3c60390357cb55a73c6f4b44 EAP-Message = 0x8ea1a5c9b451094d5c02f5e2e482071c7950df080d1f3644f47d9a7aefd6958e5eb5ebf2f93bdf1d65901ea2a3b9b110d16b808ef34a7c3374bb7263d077f063734d63b186b29928e17ef698ed7e4b2841387fc844cb07cc7eb4fd39de3ebc8e4fe0cf2eca4d1b93510203010001a381dc3081d930090603551d1304023000301d0603551d0e04160414323a4970ba53cf9fff2b2ce5436dd64e036b4cf73081ac0603551d230481a43081a18014323a4970ba53cf9fff2b2ce5436dd64e036b4cf7a17ea47c307a310b3009060355040613024652312f302d060355040a13264d696e69737465726520456475636174696f6e204e6174696f6e616c65 EAP-Message = 0x20284d454e455352 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee259fc57b96dea318012fe73d9 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=243, length=128 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xd8c323cc1c5dca53fdc26144184a55df NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee259fc57b96dea318012fe73d9 EAP-Message = 0x020f00061900 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 15 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 243 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x0110016b1900293111300f060355040b1308303732313537325431123010060355040b130961632d6e616e746573311330110603550403130a43412d70662d616d6f6e820900f600a779ca4a31f2300d06092a864886f70d0101050500038201010042fb00de5ab000702d477a4af2d066894ac9481a89afd607a8e4f870038ca1f2e4c2ccba76f8c8db937ccc0c1607694dc7316a32ac04f88035c99b3802c40e6af4381339b21229c22e4bab13c4c0d12039f5030c932283e00dd5855df9a1c8172e257e3a41ad6928431aeb93813578cf9208816cd75e3306b3a31e175f3f6fe054317296231e4d53ca9fd6879b03330265e555633dd78100c55681 EAP-Message = 0xdc1181d3cf04302e58287bbf7cbbd102ddceeb821787e736217180fd90a1f0690e40338cfa058c84dae4404611e2a04aebf9a5f09c28f3bba02bc2663707c320ff8f40f9b3f6455f1a683d5c2e9b67a4cdf327665ebcd7e24afd894e826f76f5125763470e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee25ee357b96dea318012fe73d9 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=244, length=444 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x9d064c122b5956c73615d6349ffcd178 NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee25ee357b96dea318012fe73d9 EAP-Message = 0x02100140198000000136160301010610000102010099e22fbe4a05d936accfcc683fd55f8b40700b04e65e3b78c86f9117140b263c154c7e549b412e66757099dcbb13dfb218779e04be85a67c741dddf6330b8873c677c47b0afbe278d88c68cfa0943459b196f5e12e02ed21271f9dbaa3289de2ce776cf3da2e30eea71308f185b2e7d4dbdd2ed4fc59316384ed6fa408dc96ec0a212a99cd89692a92b12717206fb0a3a0e8b9c70106f6840256733976809d3edb569081ba70d4bcaf6f65d6784eb7d457297c263f549c34f7f8db3f55eae388f086290d5bde0840af663c86a181464e1cc22b035e1434614f23ed4fc54ac3e39a404a2c71b3f0d3 EAP-Message = 0x22a99e4af56b9ca63a6dab50062bb096e513852043326d0a14030100010116030100204948fe1d6f1b3ecde1765601ef11cfd1936905e4f4948312a68781a0739e2666 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 16 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 244 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x01110031190014030100010116030100203700812b24e375749201076da0bd9b4c462587b2d818f14a726c9beb33feeb45 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee25fe257b96dea318012fe73d9 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=245, length=128 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xb9d8ae0e08e37f9d172f8e0eda4b780c NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee25fe257b96dea318012fe73d9 EAP-Message = 0x021100061900 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 17 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 245 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x0112002019001703010015b30cb528421556a6b7595ed3761ee6c1aaebee96dc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee25ce157b96dea318012fe73d9 Finished request 6. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=246, length=163 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xfe515d2dd1c0562720460ac87f8684ae NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee25ce157b96dea318012fe73d9 EAP-Message = 0x021200291900170301001e8f577a77f3936128a808f14d17c3fb56dd053088ce04a8319e069b68bc4e server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 18 length 41 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - host/pc-admin [peap] Got tunneled request EAP-Message = 0x0212001201686f73742f70632d61646d696e server inner-tunnel { PEAP: Got tunneled identity of host/pc-admin PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to host/pc-admin Sending tunneled request EAP-Message = 0x0212001201686f73742f70632d61646d696e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/pc-admin" NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User NAS-Port = 10 Framed-MTU = 1490 Calling-Station-Id = "00-0C-29-F7-CC-A0" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 18 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x011300271a01130022103abcb825a9f3a4a3ef8a850d3573308d686f73742f70632d61646d696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fb3bf1f5fa0a5401b55155387e6016c [peap] Got tunneled reply RADIUS code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x011300271a01130022103abcb825a9f3a4a3ef8a850d3573308d686f73742f70632d61646d696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fb3bf1f5fa0a5401b55155387e6016c [peap] Got tunneled Access-Challenge ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 246 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x0113003e190017030100337504bfcfdd2686dec869ab4dc942775c76ad373a4014d7994c954b743803351ee1570e54043d7b3a6432bf116c45b3e40b9ce9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee25de057b96dea318012fe73d9 Finished request 7. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=247, length=217 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x34be6f17afd410895671a689cdaa2ace NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee25de057b96dea318012fe73d9 EAP-Message = 0x0213005f19001703010054d9a59f27d7f3fd8667cf9248bddcc6d8335f836aacc87e5567c1c17962874c425a7e3b8a0e137606a9f01fec1c5f6381f4382d502c02eb469d8a2a73513c55f2ab6a1834e641162955910e9fd80293782b4fc76b server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 19 length 95 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x021300481a021300433186b47cb64903955b806163bb51c35db8000000000000000041a2daf3776d80fcf8208f4fe0e697184864cb49983d513800686f73742f70632d61646d696e server inner-tunnel { PEAP: Setting User-Name to host/pc-admin Sending tunneled request EAP-Message = 0x021300481a021300433186b47cb64903955b806163bb51c35db8000000000000000041a2daf3776d80fcf8208f4fe0e697184864cb49983d513800686f73742f70632d61646d696e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/pc-admin" State = 0x5fb3bf1f5fa0a5401b55155387e6016c NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User NAS-Port = 10 Framed-MTU = 1490 Calling-Station-Id = "00-0C-29-F7-CC-A0" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 19 length 72 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Found NT-Password [mschap] Told to do MS-CHAPv2 for host/pc-admin with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x011400331a0313002e533d30453146453344413437333434303035434445323936383045394344354246303233344539384235 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fb3bf1f5ea7a5401b55155387e6016c [peap] Got tunneled reply RADIUS code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x011400331a0313002e533d30453146453344413437333434303035434445323936383045394344354246303233344539384235 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fb3bf1f5ea7a5401b55155387e6016c [peap] Got tunneled Access-Challenge ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 247 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x0114004a1900170301003fcaee9ba310faf92efca265d1525ab6435017cd256d841401359551ef19eb8dab39eaa87f35a8c2e079554a0291898d709de59a87219a6217fbd3e57f456337 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee252e757b96dea318012fe73d9 Finished request 8. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=248, length=151 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xd0a4155dd2819c7764b212492c148338 NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee252e757b96dea318012fe73d9 EAP-Message = 0x0214001d19001703010012207c339d428fdb827f4aef0d36ae8ae833ad server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 20 length 29 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x021400061a03 server inner-tunnel { PEAP: Setting User-Name to host/pc-admin Sending tunneled request EAP-Message = 0x021400061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/pc-admin" State = 0x5fb3bf1f5ea7a5401b55155387e6016c NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User NAS-Port = 10 Framed-MTU = 1490 Calling-Station-Id = "00-0C-29-F7-CC-A0" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 20 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok WARNING: Empty section. Using default return values. } # server inner-tunnel [peap] Got tunneled reply code 2 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x03140004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "host/pc-admin" [peap] Got tunneled reply RADIUS code 2 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x03140004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "host/pc-admin" [peap] Tunneled authentication was successful. [peap] SUCCESS [peap] Saving tunneled attributes for later ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 248 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x011500261900170301001bf941565a3183097d130c6f900ea8d2b7449ccb3bdcccf59f96527b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee253e657b96dea318012fe73d9 Finished request 9. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=249, length=160 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x50f80e51813b38b0aa944eba89d37efa NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee253e657b96dea318012fe73d9 EAP-Message = 0x021500261900170301001be0562040c9bb550ba6720c9d0826df79e9fc5b58f7427160c7c9ad server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 21 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [peap] Using saved attributes from the original Access-Accept [eap] Freeing handler ++[eap] returns ok WARNING: Empty section. Using default return values. } # server inner-tunnel Sending Access-Accept of id 249 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" User-Name = "host/pc-admin" MS-MPPE-Recv-Key = 0x4cb00c191ad9ce2d5913f5218594324f3017e7efd7d209aa14b6b56b6a520f1a MS-MPPE-Send-Key = 0x48f134131000bba5b3f590233bc0e3d08e7d99b8f8806bb99b484ede6ce0b0b2 EAP-Message = 0x03150004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 10. Going to the next request Waking up in 4.7 seconds. Cleaning up request 0 ID 239 with timestamp +40 Cleaning up request 1 ID 240 with timestamp +40 Cleaning up request 2 ID 241 with timestamp +40 Cleaning up request 3 ID 242 with timestamp +40 Cleaning up request 4 ID 243 with timestamp +40 Cleaning up request 5 ID 244 with timestamp +40 Cleaning up request 6 ID 245 with timestamp +40 Cleaning up request 7 ID 246 with timestamp +40 Cleaning up request 8 ID 247 with timestamp +40 Cleaning up request 9 ID 248 with timestamp +40 Cleaning up request 10 ID 249 with timestamp +40 Ready to process requests.

1 1