- Freeradius-Users - lists.freeradius.org

reply to NAS not correct
by T.Robers＠heidelberg.de 29 Oct '09

29 Oct '09

Hi, my Enterasys-switche need the filter-id for policy enforcement. I've got a problem with 802.1X authentication. Here is the log: rad_recv: Access-Request packet from host 172.16.255.101 port 49169, id=171, length=190 User-Name = "DNT1\\testtom" Service-Type = Framed-User Called-Station-Id = "00-1F-45-19-9C-68" Calling-Station-Id = "00-1C-25-9B-0E-EB" NAS-Identifier = "D2_Zi31_Tom" NAS-IP-Address = 172.16.255.101 NAS-Port = 1 NAS-Port-Id = "ge.1.1" Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0x5a07edfa520df4edb36b506fccf290c2 EAP-Message = 0x020a001d1900170301001291f098b2e763cf55403eff0840390a3d3413 Message-Authenticator = 0xe6865e95c71f8c06d904dd297c05ee96 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.255.101/auth-detail-20091029 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.255.101/auth-detail-20091029 [auth_log] expand: %t -> Thu Oct 29 10:37:21 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DNT1\testtom", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "DNT1" for User-Name = "DNT1\testtom" [ntdomain] No such realm "DNT1" ++[ntdomain] returns noop [eap] EAP packet type response id 10 length 29 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00061a03 server { PEAP: Setting User-Name to DNT1\testtom Sending tunneled request EAP-Message = 0x020a00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DNT1\\testtom" State = 0xeb8ce38fea86f9b39b0a9d7efe7aaa3e server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "DNT1\testtom", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "DNT1" for User-Name = "DNT1\testtom" [ntdomain] No such realm "DNT1" ++[ntdomain] returns noop [eap] EAP packet type response id 10 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: Entering ldap_groupcmp() [files] expand: OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de -> OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de [files] expand: sAMAccountName=%{mschap:User-Name} -> sAMAccountName=testtom rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de, with filter sAMAccountName=testtom rlm_ldap: ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=Group)(member=%{control:Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=Group)(member=CN\3dTest\5c\2c Tom\2cOU\3dAbt11-2\2cOU\3dAmt11\2cOU\3dStadt Heidelberg\2cDC\3dheidelberg\2cDC\3dbw-online\2cDC\3dde))(&(objectClass= GroupOfUniqueNames)(uniquemember=CN\3dTest\5c\2c Tom\2cOU\3dAbt11-2\2cOU\3dAmt11\2cOU\3dStadt Heidelberg\2cDC\3dheidelberg\2cDC\3dbw-online\2cDC\3dde))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de, with filter (&(cn=WWW)(|(&(objectClass=Group)(member=CN\3dTest\5c\2c Tom\2cOU\3dAbt11-2\2cOU\3dAmt11\2cOU\3dStadt Heidelberg\2cDC\3dheidelberg\2cDC\3dbw-online\2cDC\3dde))(&(objectClass= GroupOfUniqueNames)(uniquemember=CN\3dTest\5c\2c Tom\2cOU\3dAbt11-2\2cOU\3dAmt11\2cOU\3dStadt Heidelberg\2cDC\3dheidelberg\2cDC\3dbw-online\2cDC\3dde)))) rlm_ldap: object not found rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=Test\, Tom,OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de, with filter (objectclass=*) rlm_ldap: performing search in CN=WWW,CN=Users,DC=heidelberg,DC=bw-online,DC=de, with filter (cn=WWW) rlm_ldap::ldap_groupcmp: User found in group WWW rlm_ldap: ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 215 ++[files] returns ok [ldap] performing user authorization for DNT1\testtom [ldap] expand: sAMAccountName=%{mschap:User-Name} -> sAMAccountName=testtom [ldap] expand: OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de -> OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de, with filter sAMAccountName=testtom [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user DNT1\testtom authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok Login OK: [DNT1\\testtom/<via Auth-Type = EAP>] (from client 172.16.255.101 port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 2 Filter-Id = "Enterasys:version=1:policy=Mitarbeiter" EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "DNT1\testtom" [peap] Got tunneled reply RADIUS code 2 Filter-Id = "Enterasys:version=1:policy=Mitarbeiter" EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "DNT1\testtom" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 171 to 172.16.255.101 port 49169 EAP-Message = 0x010b00261900170301001b0c226877915fee81581e5cdc61a6b02b5e53a364ba4d32a2 1da9bc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5a07edfa530cf4edb36b506fccf290c2 Finished request 9. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.255.101 port 49169, id=172, length=199 User-Name = "DNT1\\testtom" Service-Type = Framed-User Called-Station-Id = "00-1F-45-19-9C-68" Calling-Station-Id = "00-1C-25-9B-0E-EB" NAS-Identifier = "D2_Zi31_Tom" NAS-IP-Address = 172.16.255.101 NAS-Port = 1 NAS-Port-Id = "ge.1.1" Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0x5a07edfa530cf4edb36b506fccf290c2 EAP-Message = 0x020b00261900170301001b5a6a60533756d32c9aab5a829fc0e0d05373ab92630a5ae1 12e1f0 Message-Authenticator = 0x3292991eacc6e9d3d99d5deef6d8b813 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.255.101/auth-detail-20091029 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.255.101/auth-detail-20091029 [auth_log] expand: %t -> Thu Oct 29 10:37:21 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DNT1\testtom", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "DNT1" for User-Name = "DNT1\testtom" [ntdomain] No such realm "DNT1" ++[ntdomain] returns noop [eap] EAP packet type response id 11 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok Login OK: [DNT1\\testtom/<via Auth-Type = EAP>] (from client 172.16.255.101 port 1 cli 00-1C-25-9B-0E-EB) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 172 to 172.16.255.101 port 49169 MS-MPPE-Recv-Key = 0x2089d240da067af3cffeae5b2ae13568d1db0f6d9f4120a8680f3438d63b7a63 MS-MPPE-Send-Key = 0xa991c884f9db4ae9b6cf6c5965d4c3ea46aa3b16a039a9a288c87413fe6cf4f6 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "DNT1\testtom" Finished request 10. Going to the next request Waking up in 4.9 seconds. The correct Filter-ID "Enterasys:version=1:policy=Mitarbeiter" in [peap] is pushed, but the switch got "invalid role". Is the Filter-ID overridden by the next Accept ? My users file contains DEFAULT Ldap-Group == "WWW" Framed-Filter-Id := "Enterasys:version=1:policy=Mitarbeiter" Any ideas ?

2 1

FreeRADIUS Active Directory Integration HOWTO
by Eduardo Gui 28 Oct '09

28 Oct '09

Hi, I´m new user. Does anyone help-me with FreeRADIUS Active Directory Integration HOWTO<http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO> ? This paper is no more avaiable on site. Thanks -- Eduardo Gui

2 1

Problem with Retrieving some Attributes
by mozafar roshany 28 Oct '09

28 Oct '09

Hi all I know that RADIUS server does AAA. Suppose that I have an active session (I made one with radclient). Now, I want to get an attribute of that session (for example, Calling-Station-Id); My problem is that I don't know what packet type should I send to RADIUS server to get attributes. My freeradius version: 2.0.4 in Debian Lenny. Thanks for any comment.

3 3

Re: Running Multiple Freeradius Instances
by Gary Gatten 28 Oct '09

28 Oct '09

Most likely not, depends if your doing a bunch of sql,perl,etc. Check out virtual servers in 2.x ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org To: freeradius-users(a)lists.freeradius.org Sent: Tue Oct 27 21:47:25 2009 Subject: Running Multiple Freeradius Instances Will there be any performance issues if I run multiple instances of freeradius in the same server? Thanks, Asin <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

Running Multiple Freeradius Instances
by Asin Silva 28 Oct '09

28 Oct '09

Will there be any performance issues if I run multiple instances of freeradius in the same server? Thanks, Asin

1 0

how to require client certificate with PEAP
by Vieri 27 Oct '09

27 Oct '09

Hi, If I use EAP-TLS with a self-signed client certificate, I can connect my Windows XP clients to a WLAN. If I use PEAP alone, then my Windows XP clients connect to a WLAN with an Active Directory username. I'm trying to combine both EAP-TLS and PEAP but since I'm not a radius security guru then I'll rephrase what my goal is: I simply want to *require* that all wifi clients use PEAP *AND* have a self-signed client certificate installed on their system. That way, if I want to, I can revoke the certificates from the server. The Windows native clients are configured to use: Eap type: PEAP and have both root and client certificates installed. However, if I add the "EAP-TLS-Require-Client-Cert = Yes" option then I get this message in the log: rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate How should I configure Windows XP to send the client certificate? Thanks, Vieri PS: Here are the relevant config files and debug log: FreeRADIUS Version 2.0.5, for host x86_64-pc-linux-gnu, built on Oct 1 2008 at 12:36:40 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } } client 10.215.146.83 { require_message_authenticator = no secret = "F5jmE6xA" shortname = "FHMWIFI" } client 10.215.146.130 { require_message_authenticator = no secret = "F5jmE6x2B1_002369E349C4" shortname = "FHMWIFI_2B1" } client 10.215.146.131 { require_message_authenticator = no secret = "F5jmE6x2B2" shortname = "FHMWIFI_2B2" } client 127.0.0.1 { require_message_authenticator = no secret = "test-secret" shortname = "localhost" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=DOMAIN --require-membership-of=DOMAIN\WIFI_DATA --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/FHM/radius_server_keycert.pem" certificate_file = "/etc/raddb/certs/FHM/radius_server_keycert.pem" CA_file = "/etc/raddb/certs/FHM/cacert.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/FHM/dh" random_file = "/etc/raddb/certs/FHM/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=0, length=149 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201000d0176646970616f6c61 Message-Authenticator = 0xf151a5b172038670b96410e980c11a9e +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 10.215.146.130 port 2048 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd169f2ccd1486a8c87845ad869b9597 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=1, length=234 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202005019800000004616030100410100003d03014ae7044a5ceeabc159f74b8ed2feb126d9d32c4fab44dafe0b77f26644f5948f00001600040005000a000900640062000300060013001200630100 State = 0xcd169f2ccd1486a8c87845ad869b9597 Message-Authenticator = 0x47712f21f13ed9131ab3cc782b6ec2c3 +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0629], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00ae], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 1 to 10.215.146.130 port 2048 EAP-Message = 0x0103040019c000000730160301004a0200004603014ae703ff813c6a8c2753637ca23a92f71584c588bf275c391c3e1daecf66436d204a5386d862ca9653bd2f983f8c5f4b8931bac987724b4b488cb72dcd24395d8b00040016030106290b0006250006220002ef308202eb30820254a003020102020103300d06092a864886f70d010105050030819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d61746963613111300f06035504031308494e462d424c3037312b302906 EAP-Message = 0x092a864886f70d010901161c76646970616f6c6140686f73706974616c6d616e61636f722e6f7267301e170d3038313030313037333035345a170d3130313030313037333035345a3081c1310b30090603550406130245533111300f0603550408130842616c65617265733110300e060355040713074d616e61636f7231233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d6174696361312530230603550403131c494e462d424c30372e686f73706974616c6d616e61636f722e6f7267312b302906092a864886f70d010901161c76646970616f6c6140686f7370 EAP-Message = 0x6974616c6d616e61636f722e6f726730819f300d06092a864886f70d010101050003818d0030818902818100c175563d62c96736eaf125d1f813b922bbc022bd61752c11bf73aa92281eb0c03880a561acc3b8c5dd3623a2918f679549780fdda4e7412aaa5e939f970605cf97fa804326d9aa721220155f0f1f3f7047475599156eb32d5202ab66ca6507a2b7fd7ff1bcaa05581356e46d419e9c1a521c8acd0d4e8ab904b4c3d88a6430d90203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181008f0fb4808bb59368842a57300b06abeb8aac92c678107975d5eb5b82b17043e0 EAP-Message = 0xdc65b166dabfed56516c165b1ee39682537cb0a77c5e2225221a2d969e6f2bdcba3358385073e6099f05118c871a733e88e51a9099325319940565b66ec0909631170dd06bbfe03d1083410b5e86d4a4fa234673d2adf7ed5e2325875306be9c00032d3082032930820292a003020102020100300d06092a864886f70d010105050030819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d61746963613111300f06035504031308494e462d424c3037312b302906092a864886 EAP-Message = 0xf70d010901161c7664697061 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd169f2ccc1586a8c87845ad869b9597 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=2, length=160 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0xcd169f2ccc1586a8c87845ad869b9597 Message-Authenticator = 0x9156d0bbcbb15fb33e2ab3ea4292b2aa +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to 10.215.146.130 port 2048 EAP-Message = 0x0104034019006f6c6140686f73706974616c6d616e61636f722e6f7267301e170d3038313030313037313332315a170d3138303932393037313332315a30819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d61746963613111300f06035504031308494e462d424c3037312b302906092a864886f70d010901161c76646970616f6c6140686f73706974616c6d616e61636f722e6f726730819f300d06092a864886f70d010101050003818d00308189028181009b9f8138ff EAP-Message = 0xa8f822ea55f6b4e0ec4f42bc584ad9c67aca2d792174658401e2279f9dd16b9018064f453bdb56a3ac3f6160867da71487cf6aade8193daea8269810fffb166ad1fb5ee15dc0d76aefcaeaa525846065a830a196695aa50603b0320534c7926c92ee38ab4acc832afb23896a570746d8a0555e1d935e057d937fa90203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041434abcc538614877e3de13e96c731aa1f76906d50301f0603551d2304183016801434abcc538614877e3de13e96c731aa1f76906d50 EAP-Message = 0x300d06092a864886f70d0101050500038181008aee00f10f00d5dbd26e076782f2c09f839fd98b4d6d700d367f9f7c60c08b5d90602b8365589cf26a68db72966ee76835f228e36f98f32cad38f3a945a7c28bc8e563e978f4812fac4393fe76b5f7e1f2605a487a8df1a28ca43570adf299af5c51895efca84555b4c5802fee568d1ec71f9e28d64a3682ce9d926f6e1680d316030100ae0d0000a60301024000a0009e30819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d EAP-Message = 0x61746963613111300f06035504031308494e462d424c3037312b302906092a864886f70d010901161c76646970616f6c6140686f73706974616c6d616e61636f722e6f72670e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd169f2ccf1286a8c87845ad869b9597 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=3, length=353 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400c71980000000bd160301008d0b0000030000001000008200802b539bad48666ea42c7831663cf5933ecbf28567c7b0a6dd5546470f60a6afba31d8042deaf6ef3820b058a630e8bf4a8644f2abdde5f2f0957503a0e3f8eef6b12a03570c09a5d582860c93f617105c2d3256451a5860498cdd76af186b1ed799345d2c3e80edc1a7ca02cb910d3e7993a98281a8f3b3b668378f0091e656a914030100010116030100207701a054ddd92000a60ccaa64e4fbd791a8b2f09677288423ca07033b01da0b2 State = 0xcd169f2ccf1286a8c87845ad869b9597 Message-Authenticator = 0x44fe2e774d0214f2cecff86caa3dc9cb +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 199 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 189 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0007], Certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal handshake_failure TLS Alert write:fatal:handshake failure TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [vdipaola/<via Auth-Type = EAP>] (from client FHMWIFI_2B1 port 0 cli 00-22-43-13-64-79) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> vdipaola attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 3 to 10.215.146.130 port 2048 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=4, length=149 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201000d0176646970616f6c61 Message-Authenticator = 0xcb4b80f73ec67467832bdbf7fa3864a3 +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 4 to 10.215.146.130 port 2048 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3d11bdae3d3023b4dfe620935ea5874 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=5, length=234 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202005019800000004616030100410100003d03014ae7044aec15815e7b9e4ca16b10a876ee07a70d2c8b92e422fce359110efaeb00001600040005000a000900640062000300060013001200630100 State = 0xe3d11bdae3d3023b4dfe620935ea5874 Message-Authenticator = 0x53dd06ca2395384a2e23443de4cb550b +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0629], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00ae], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 5 to 10.215.146.130 port 2048 EAP-Message = 0x0103040019c000000730160301004a0200004603014ae704006bdac32802e3c809fc1e365b897171ed1beac6a6c1530a305b2019132081d81e2272840e4325ab2d1575e7d58672f021706c34a6d97ae9c1410a05b8ec00040016030106290b0006250006220002ef308202eb30820254a003020102020103300d06092a864886f70d010105050030819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d61746963613111300f06035504031308494e462d424c3037312b302906 EAP-Message = 0x092a864886f70d010901161c76646970616f6c6140686f73706974616c6d616e61636f722e6f7267301e170d3038313030313037333035345a170d3130313030313037333035345a3081c1310b30090603550406130245533111300f0603550408130842616c65617265733110300e060355040713074d616e61636f7231233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d6174696361312530230603550403131c494e462d424c30372e686f73706974616c6d616e61636f722e6f7267312b302906092a864886f70d010901161c76646970616f6c6140686f7370 EAP-Message = 0x6974616c6d616e61636f722e6f726730819f300d06092a864886f70d010101050003818d0030818902818100c175563d62c96736eaf125d1f813b922bbc022bd61752c11bf73aa92281eb0c03880a561acc3b8c5dd3623a2918f679549780fdda4e7412aaa5e939f970605cf97fa804326d9aa721220155f0f1f3f7047475599156eb32d5202ab66ca6507a2b7fd7ff1bcaa05581356e46d419e9c1a521c8acd0d4e8ab904b4c3d88a6430d90203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181008f0fb4808bb59368842a57300b06abeb8aac92c678107975d5eb5b82b17043e0 EAP-Message = 0xdc65b166dabfed56516c165b1ee39682537cb0a77c5e2225221a2d969e6f2bdcba3358385073e6099f05118c871a733e88e51a9099325319940565b66ec0909631170dd06bbfe03d1083410b5e86d4a4fa234673d2adf7ed5e2325875306be9c00032d3082032930820292a003020102020100300d06092a864886f70d010105050030819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d61746963613111300f06035504031308494e462d424c3037312b302906092a864886 EAP-Message = 0xf70d010901161c7664697061 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3d11bdae2d2023b4dfe620935ea5874 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=6, length=160 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0xe3d11bdae2d2023b4dfe620935ea5874 Message-Authenticator = 0xead1abea82985363d3d2e666620d5a8f +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 6 to 10.215.146.130 port 2048 EAP-Message = 0x0104034019006f6c6140686f73706974616c6d616e61636f722e6f7267301e170d3038313030313037313332315a170d3138303932393037313332315a30819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d61746963613111300f06035504031308494e462d424c3037312b302906092a864886f70d010901161c76646970616f6c6140686f73706974616c6d616e61636f722e6f726730819f300d06092a864886f70d010101050003818d00308189028181009b9f8138ff EAP-Message = 0xa8f822ea55f6b4e0ec4f42bc584ad9c67aca2d792174658401e2279f9dd16b9018064f453bdb56a3ac3f6160867da71487cf6aade8193daea8269810fffb166ad1fb5ee15dc0d76aefcaeaa525846065a830a196695aa50603b0320534c7926c92ee38ab4acc832afb23896a570746d8a0555e1d935e057d937fa90203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041434abcc538614877e3de13e96c731aa1f76906d50301f0603551d2304183016801434abcc538614877e3de13e96c731aa1f76906d50 EAP-Message = 0x300d06092a864886f70d0101050500038181008aee00f10f00d5dbd26e076782f2c09f839fd98b4d6d700d367f9f7c60c08b5d90602b8365589cf26a68db72966ee76835f228e36f98f32cad38f3a945a7c28bc8e563e978f4812fac4393fe76b5f7e1f2605a487a8df1a28ca43570adf299af5c51895efca84555b4c5802fee568d1ec71f9e28d64a3682ce9d926f6e1680d316030100ae0d0000a60301024000a0009e30819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d EAP-Message = 0x61746963613111300f06035504031308494e462d424c3037312b302906092a864886f70d010901161c76646970616f6c6140686f73706974616c6d616e61636f722e6f72670e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3d11bdae1d5023b4dfe620935ea5874 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=7, length=353 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400c71980000000bd160301008d0b000003000000100000820080507cda85493484789c84370b5f0ab6091ef3a32cd4adda122205be6f29b3dbc55a8a281c3366846d23b5c27d14ffc452d122b2474d68ab81b164cf232838cb99771d84abe0b10ed60eea32dafdb9669a3b91ca31ded6f782d51e269742bb990a65a9c48c4dd355c1df95634bd4c9f11bcd0e1bf49d9c81815930bec1d5468f671403010001011603010020088e08e9edfbf9b497197799a0d5cbac5cf19d8ccd39f06fddd39925627ed407 State = 0xe3d11bdae1d5023b4dfe620935ea5874 Message-Authenticator = 0xe7b1ae9786830318a972d990204a5dc4 +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 199 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 189 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0007], Certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal handshake_failure TLS Alert write:fatal:handshake failure TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [vdipaola/<via Auth-Type = EAP>] (from client FHMWIFI_2B1 port 0 cli 00-22-43-13-64-79) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> vdipaola attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 7 to 10.215.146.130 port 2048 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 7. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 0 with timestamp +23 Cleaning up request 1 ID 1 with timestamp +23 Cleaning up request 2 ID 2 with timestamp +23 Cleaning up request 3 ID 3 with timestamp +23 Cleaning up request 4 ID 4 with timestamp +24 Cleaning up request 5 ID 5 with timestamp +24 Cleaning up request 6 ID 6 with timestamp +24 Cleaning up request 7 ID 7 with timestamp +24 Ready to process requests. ---- default config file: authorize { preprocess update control { EAP-TLS-Require-Client-Cert = Yes } chap mschap suffix eap { ok = return } unix files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } ----- eap.conf config file: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/FHM/radius_server_keycert.pem certificate_file = ${certdir}/FHM/radius_server_keycert.pem CA_file = ${cadir}/FHM/cacert.pem dh_file = ${certdir}/FHM/dh random_file = ${certdir}/FHM/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } ----- mschap config file: mschap { with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=DOMAIN --require-membership-of=DOMAIN\\WIFI_DATA --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" }

2 1

Cisco AVpair(client-mac-address) and Calling-Station-Id attribute
by Egi Konomi 27 Oct '09

27 Oct '09

Hello, I am using freeradius 1.1.8 with a Cisco7301 router as a NAS, but the NAS does not send the Calling-Station-Id attribute, insted it uses "Cisco-AVPair = "client-mac-address=000f.ea20.e1ad"" They have changed this attribute in modern IOS versions. I want to know if there is a possibility to rewrite the : Cisco-AVPair = "client-mac-address=000f.ea20.e1ad" to "Calling-Station-Id = 000f.ea20.e1ad" Also, i am using some other NASes that use the standart Calling-Station-Id, with the same radius. Thank You! Egi

2 1

radacct and db handles
by Ademir Klauck 27 Oct '09

27 Oct '09

HI, I'm installed freeradius with daloradius in a FC11 box, everything new. After some corrections everything is working, but in radius.log I receive constantly the error message below: Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 I checked my radius db and radacct table and there are many indexed and nothing I could found is the problem. It only append when I enable radius accounting in SQL. Any help would bee appreciated. Tks, Ademir

4 5

(no subject)
by jon jon 26 Oct '09

26 Oct '09

Hi, I want to have one computer just do mac authentication, instead of matching username and password. Can I just add this mac address to the mysql database. I am running chillispot also, I believe all I have to do is uncomment a line in the chilli.conf file to have it do mac authentication. Would this be the right way to do this? thanks

3 3

separate log file and access list config
by Yagnesh Dave 26 Oct '09

26 Oct '09

Hi All, How can we use separate flies for logging authentication and accouting information. Also wanted to know does free radius configure the access list on the interface, similar to the ip address. One more quick question, how can we set timeout for different users, so if the connection is ideal for say 4 hrs, it should get disconnected. Regards, Yagnesh

2 1