- Freeradius-Users - lists.freeradius.org

Book About Free-Radius Configurations
by INACIO ALVES 17 Nov '09

17 Nov '09

Hello, I have some days out, but I'm back. I would like know if exists any book with examples and explications about freeRadius configurations and the RADIUS protocol. What you thinks about the book http://www.amazon.com/AAA-Network-Security-Mobile-Access/dp/0470011947/ref=… Thanks, Inácio Alves http://www.polluxweb.com/inacioalves/site

2 1

acct-delay-time appears to be off
by Steven Staples 17 Nov '09

17 Nov '09

I have been looking at this, and scratching my head. It appears as if the (timestamp -(minus) acct-delay-time) does not always = the actual start time of the session. From my observation, and log reading script, I have found that there could be a +/- 1 second variance in either the timestamp, or the acct-delay-times. Could this be the router sending it's time, and the radius box intercepting it at a possible rounding up or down to the next second? Is there a way to use the microseconds to ensure that these values are accurate all the time? Basically, what I am trying to achieve, is that when I insert into my 'MySQL' database that it's updating the proper start record on 'Interim-Update' or 'Stop' records, and not creating a new start record for it when it's just off by 1 second or so. Is there possibly a better way to create a unique key, rather than what I am currently using as a unique group of fields: Framed-ip-address + nas-ip-address + user-name + acct-session-id + ((timestamp - acct-delay-time) - acct-session-time) Steven Staples

2 1

bug in rlm_ldap authorization password handling?
by John Dennis 17 Nov '09

17 Nov '09

I'm a little confused by how rlm_ldap is handing passwords. First let me state what I believe to be true, if I'm wrong on any of these assumptions please correct me. Authentication modules need access to either the cleartext password or hashed password, it is the role of the authorization modules to insert the password information into the *config* list of the request. The authentication modules will extract the password information from the config list during the authentication phase. The password attribute inserted into the config list during authorization is *never* PW_USER_PASSWORD, because this is the attribute supplied by the client in the request. Rather the authorization modules *may* insert into the *config* list one of (PW_CLEARTEXT_PASSWORD, PW_MD5_PASSWORD, PW_SMD5_PASSWORD, PW_CRYPT_PASSWORD, PW_SHA_PASSWORD, PW_NT_PASSWORD, etc.) These will then be used by the authentication modules. rlm_mschap needs the ntlm hash (PW_NT_PASSWORD), if that is not in the config list then it computes it from the cleartext password (PW_CLEARTEXT_PASSWORD) found in the config list. Is the above correct? If so then it seems to me rlm_ldap is doing something wrong in it's authorization routine. rlm_authorize() searches for the password attribute which may be multi-valued (typically the attribute name is userPassword from the posix objectclass) If found it adds PW_USER_PASSWORD to the config list, but PW_USER_PASSWORD does not belong in the config list, it's a request attribute, it should have been PW_CLEARTEXT_PASSWORD (with a caveat which follows). Here's the caveat, it's possible to indicate the password hash type by prepending {type} to the password string where type is typically one of (clear, crypt, md5, sha, nt, etc). This behavior is turned on by the auto_header configuration variable in raddb/modules/ldap, which for some reason is undocumented in raddb/modules/ldap, Why? FWIW, auto_header defaults to "no". However if auto_header is enabled then guess what? The attribute added to the config is one of the correct password attributes (e.g. PW_CLEARTEXT_PASSWORD, PW_NT_PASSWORD, etc.) But if and only if the password value returned is prepended with {type}, if it isn't prepended then it skips the password attribute rather than using the *default* of PW_CLEARTEXT_PASSWORD. (Our LDAP gurus believe the interpretation of userPassword without a prefix is clear text). So ... It seems as if you're storing a clear text password without a prefix in the userPassword attribute (or whatever attribute rlm_ldap is configured for) you'll never update the config list wtih PW_CLEARTEXT_PASSWORD in authorize and the subsequent authentication modules may fail as a consequence if they are depending on having access to the clear text password. Or am I just missing something? It seems to be there are three bugs: 1) inserting PW_USER_PASSWORD into config instead of PW_CLEARTEXT_PASSWORD 2) not documenting auto_header 3) if auto_header is enabled not defaulting to clear text if no prefix is supplied. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

3 2

Re: Freeradius-Users Digest, Vol 55, Issue 74
by Gilbert Lo 17 Nov '09

17 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

freeradius a openser installation
by toqeer ali 17 Nov '09

17 Nov '09

Hi all, I am new to freeradius i am facing a problem when starting the service freeradius after including the path of dictionary.radius in dictionary main file of freeradius. i am getinng this error. please help Error: Errors reading dictionary: dict_init: No ATTRIBUTE "Sip-Method" defined for VALUE "Other" -- Toqeer Ali Syed Red Hat Certified Engineer mob: +92 321 9059916

1 0

RE: Freeradius-Users Digest, Vol 55, Issue 73
by Peter Carlstedt 17 Nov '09

17 Nov '09

By the way I forgot to ask, is there anywhere I can read about this kind of things? I want to get a good understanding on how outer and inner tunnels work and what they do. Don´t think I´ve seen anything about it on the Freeradius wiki...or may I be blind? :) Best regards/ Peter > ????????????????? > http://card.mail.cn.yahoo.com/ >

1 0

RE: RE: Problems to do an SSID based authentication(tnt@kalik.net)
by Peter Carlstedt 17 Nov '09

17 Nov '09

> Hi Ivan! It worked! Woho! ^^ Thank you very much for your help =), of course alan to =) Now I will probably get a ton of more problems in my walk towards a good setup. =) Best regards/ Peter Carlstedt > >

1 0

Multiple forests
by John 17 Nov '09

17 Nov '09

Hi, We are using freeRADIUS-1.1.6 talk to active-directory (multiple DOMAINs: "A.com" and "sub.A.com"). We use rlm_ldap module Global catalog port to get attributes from ADs. It works fine. Now a forest(e.g. "B.com", "sub.B.com" ...) that is trust with domain "A.com". I can not get attributes from forest "B.com". How to get attribute from forest "B.com" ? Any commnet is welcome. Thanks. John ___________________________________________________________ 好玩贺卡等你发，邮箱贺卡全新上线！ http://card.mail.cn.yahoo.com/

2 2

freeradius and openser
by toqeer ali 17 Nov '09

17 Nov '09

I am configuring Freeradius server with openser... By default there is openser dictionary file that the path of that file should be included in freeradius master dictionary file... now i am confuse that command $INCLUDE {path of the openser dictioanry file} how will i include that over the network in dictionary file of Freeradius... if i copy the openser dictionary to the same system of Freeradius and then include path then still it gives error . Bsically my openser and Freeradius are on diffrent systems Any clue ? -- Toqeer Ali Syed Red Hat Certified Engineer mob: +92 321 9059916

1 0

RE: RE: Problems to do an SSID based authentication
by Peter Carlstedt 17 Nov '09

17 Nov '09

> ------------------------------ > > Message: 3 > Date: Mon, 16 Nov 2009 10:03:22 +0000 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: Problems to do an SSID based authentication > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20091116100322.GB5662(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > I am trying to do an SSID based authentication per user. > > What I mean is that i try in the users.conf file to check for which SSID the users is trying to use to login and if it is wrong it shall do an reject for that user. > > > > The problem is that i dont succeed with this so I thought it does not hurt to ask the ones who knows. > > My users.conf file looks like this: > > > Peter Cleartext-Password := "kaffe" , Called-Station-Id == "04-0B-6B-33-62-35:raket" > > Jens Cleartext-Password := "kaffe" , Called-Station-Id == "02-0B-6B-33-62-35:3" > > so Peter can only connect from 04-0B-6B-33-62-35:raket and > Jens can only get on from 02-0B-6B-33-62-35:3 ? > > okay - where is your log from 'radiusd -X' ? > > alan > > Hi Alan! The logs from my radius -X is following: rad_recv: Access-Request packet from host 192.168.118.10 port 42531, id=97, length=194 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x02020009014a656e73 Message-Authenticator = 0x12ec684d2cb511be9cf431ceeae1a5c8 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry Jens at line 92 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 97 to 192.168.118.10 port 42531 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b5e336db4711a92c3e7dc829 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 46429, id=98, length=316 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b5e336db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x0203007119800000006716030100620100005e03014b01325d9b7522753ffde3bdcb960b88f167535ca9ec96ffa88e3f5577fc7b4c000018002f00350005000ac013c014c009c00a00320038001300040100001d0000000900070000046a656e73000a0006000400170018000b00020100 Message-Authenticator = 0xbb5e04e25bd1a69911623d1fa6fc555e NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 113 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 103 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0062], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 98 to 192.168.118.10 port 46429 EAP-Message = 0x0104040019c00000089b160301002a0200002603014b013261232f65081c0647ecdd136d4ba6d37a900ca54c63b1b42d0f9f08ec7a00002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039313131313133323535335a170d3130313131313133323535335a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d5187e7bc255b26ddc283d48c5dcada8d45ed681856a7f9964de908c976390f87aae337b8f13cb67c519e95fbc0236cb71ce6cf1a0053a679a2fae47334b EAP-Message = 0xea63f5d29523c2f790377a0f7cb808d1074d9dfd6eb6edb07b4244089b2c50ffb516d69ad94a252aa72af8fa371165337209dd7a5bc0701ca910f54d0de7e8cf202bae28ebdf3b68682b2f1de412b1b59152b1b747187c9a2d97fcea02d853f59e0c311bc87629914ce11a408218ff0cf921a48bc972da546c99ebf0a566e3604700c2315631113c160eb770f7632f47ccec74feefeede6352656ad5c918b7ea13eb6f6e11fbe331be19d787a2f5e9b2a1cea1a353190c6b3736a45051e2be8bb0910203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010029d7cb5c38650e56d0 EAP-Message = 0xe1db3d87bb0b9a1a034fd23fdc928795988fae1c3b2d262a84fa06284b4a506ba315d584b6a6eed742d6e3e92f2df7194fa8b1c5f53a5d2f18f595eab97e219a024b5753a6ea48eabe8106c5c28ffb2b124c02bd19f56771f35014de4569e7f720951ded3033591943c853049bb4a245cef1270593e844e6e0a4d442023fa1cb17874b4f734963a6eece8ca51d5d253e539027eb5ef96eecb0c4d6163045767728dac1a444712e50bdba71ab058c09b35fbade6d3d30c779acfccca0e260cde86d2d15c4bffe47584863ad94965d3584805bce24d9228198b5c78b761fd3d6b89b25a2430c731ee485840ecbac95171a03f2b0d77346c40004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b4e436db4711a92c3e7dc829 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 41440, id=99, length=209 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b4e436db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x020400061900 Message-Authenticator = 0xc16a7984a9f721ee6d94d31f7659a249 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 99 to 192.168.118.10 port 41440 EAP-Message = 0x010503fc194000a95ceefb4e6190af300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039313131313133323535335a170d3130313131313133323535335a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a5e320972e46e5b85513eac3a27f6505180668b395d4ffdebbe5458f615bb40d7ee9ae7c614be07ef57a43ec1127f128b45d58221b60d1838612c614bb26c99fdbb8c08c2cc4ecaae11df4f657241eb6b8e7a8d0317d7e00f45f2f5bc50ce9e835d3b61101a0fbe8c989d012bf8d7b EAP-Message = 0x8cf31f35ca2bdc11512934f57fb4a9eb7e95b35e47b609b98a818fdeb8df415bd2574b9a907497521a446fd14969b20de542ae7abc809b56cf0e927b54b2a5519708125a38067897ffa35428799384416cb9028c0e777c6268009f696e67f2c747f9a7c09ef0cb3873ce6e22b148d43f0ad28018311d625f85820115d75358d0c7f79c534fff1552d8cde0e514b9b7554b0203010001a381fb3081f8301d0603551d0e041604148a192d95e8fb6f6ba1f6554ccf4e2bd534ff14143081c80603551d230481c03081bd80148a192d95e8fb6f6ba1f6554ccf4e2bd534ff1414a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900a95ceefb4e6190af300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100a3ccd6974415ace1b6b6cce8b3c02dde0d00a6aee049f97c5a5e460849a40ef10e697d8a27e1b7c4bbe6122d145c9a7202d059a831c1563e973e76edb22c927d276199b16bba81a5a8301119debfc3957d9d EAP-Message = 0xba5e475db5bc4553 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b7e536db4711a92c3e7dc829 Finished request 3. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 40388, id=100, length=209 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b7e536db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x020500061900 Message-Authenticator = 0xde1528468a95c4082d87b885c07692c0 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 100 to 192.168.118.10 port 40388 EAP-Message = 0x010600b519003ed1cdfb8ce78c8b13e8c9d49553950dba115cafd7a3d3b93b0811bcc48f642f85e57b50ef7e8b45884e991ed7d0c7c69974877b6a931e94e2b1c18241af3f56e898cdb6bf5694cf634aaed5728ab48884f93efe217772425cb71b9be6cf27aaea718f270d33593165e215533f99daf1e5a542c9052a6ecb35ccfcdd4a4c02d7d8d6d2baa96840f6498c506d054bd3023a6c1f719d133364e1eeea225c9724dc6dba0de411f816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b6e636db4711a92c3e7dc829 Finished request 4. Going to the next request Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 49250, id=101, length=541 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b6e636db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x02060150198000000146160301010610000102010010da40c2277f97a716be9418364b5d036b2a1a438427372a3179fcb8f45d4f59e8f81cc24e5c03785cdd6e7e33b9472c294099bb429c2c07045b19bbff7ae2743f3ed3fa2a34a011e574d64f397990cc9cb3e308d556f4120545fd635471309e8f45b67549279c41e73bb92e817d67172a6b15b0c8da5118469fa5bcd4539916582b4dd8e678da06deeddf6bcede7de238449c9601f1efce3f23e9534c68e2a897d705e32f388f7ea3412ab5b90e85c6b508d2f04eb257e22b5c39f7fafef009a921184fbf1193c173fcb3c656cc93ee6f668c60f2fedb92897e0d558f49d8d656c76acd0a28a5a9 EAP-Message = 0x7a95a196ccf65f220a7130f1a338a8509b848359491e67d11403010001011603010030c85bc66fdd1fc7aef16588704d5a25cdca879ac3585be0e73d728e1aa18bb4cb2b6a5f030a417088af50b29ab56d3fc5 Message-Authenticator = 0xc3a9938ec998ab0398c5709115ad2bdf NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 101 to 192.168.118.10 port 49250 EAP-Message = 0x0107004119001403010001011603010030f5dceab2b5b355a2312fe20092d891872280be1ba05a477e51657ccadb327d91249380718ec8a006eb278245f449ed2d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b1e736db4711a92c3e7dc829 Finished request 5. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 41427, id=102, length=209 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b1e736db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x020700061900 Message-Authenticator = 0x77f82d817673e2f1d72bdf70771fe83d NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 102 to 192.168.118.10 port 41427 EAP-Message = 0x0108002b1900170301002006e1b5d62349a17609d76b94114fff9f2c956820f402a63434ebe33c0ab23254 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b0e836db4711a92c3e7dc829 Finished request 6. Going to the next request Waking up in 4.2 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 46562, id=103, length=246 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b0e836db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x0208002b19001703010020cbfe496129842adde6abe7771cdf82d089fab1b8692359688c355d1abd7fe18d Message-Authenticator = 0x51bd0d083ea0991de4ba0666c3bf3f7d NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - Jens [peap] Got tunneled request EAP-Message = 0x02080009014a656e73 server { PEAP: Got tunneled identity of Jens PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to Jens Sending tunneled request EAP-Message = 0x02080009014a656e73 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "Jens" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 222 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Reject Auth-Type = Reject, rejecting user Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 103 to 192.168.118.10 port 46562 EAP-Message = 0x0109002b19001703010020f22961f4b8fc8ef302e9d02a6ff60318dc7009c8c6b95edda5d0b74179b60ba9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b3e936db4711a92c3e7dc829 Finished request 7. Going to the next request Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 41030, id=104, length=246 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b3e936db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x0209002b1900170301002049d78ce8e977e9c3a54ef1cb5206e2f30a857981ca29de1d574ae788718f8397 Message-Authenticator = 0x10d7ce191f17a6482ce049589e279cd0 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Jens attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 41030, id=104, length=246 Waiting to send Access-Reject to client 192.168.118.0/24 port 41030 - ID: 104 Waking up in 0.6 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 41030, id=104, length=246 Waiting to send Access-Reject to client 192.168.118.0/24 port 41030 - ID: 104 Waking up in 0.3 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 104 to 192.168.118.10 port 41030 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.0 seconds. Cleaning up request 1 ID 97 with timestamp +46 Cleaning up request 2 ID 98 with timestamp +46 Waking up in 0.1 seconds. Cleaning up request 3 ID 99 with timestamp +46 Waking up in 0.2 seconds. Cleaning up request 4 ID 100 with timestamp +47 Waking up in 0.1 seconds. Cleaning up request 5 ID 101 with timestamp +47 Waking up in 0.1 seconds. Cleaning up request 6 ID 102 with timestamp +47 Cleaning up request 7 ID 103 with timestamp +47 Waking up in 1.0 seconds. To be able to get the log from start I had to stop the radius server while the windows machine tried to do to a authorization a second time since it does it three times before it accepts the fact it can't authorize. Best regards/ Peter > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 55, Issue 68 > ************************************************ _________________________________________________________________ Windows Live: Keep your friends up to date with what you do online. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1