- Freeradius-Users - lists.freeradius.org

Error: rlm_eap: Failed to store handler
by Rokkhan 06 Aug '09

06 Aug '09

Hi, im new on the freeradius world but very curious. Sorry but my english is not very good. I have a working Freedius 1.0.5 server since year 2005 and i want to improve it, migrating a Freeradius 2.1.1-6 version, the latest version i have found for my Sles10 Sp2 server. This server its allowed to authenticate users by EAP-PEAP Mschapv2 and EAP-LEAP against Files and Ldap. In the new server moved all users in user's file to mysql server. All users in mysql are stored with Cleartext-Password. When i run server on debug mode for doing tests the server works without problems, and validate's users using both types of EAP and both Authorization types (Ldap and Mysql). But when i run as daemon and i introduce it in production validating about 2000 of users, freeradius 2.1.1-6 crashes in a few minutes and shows this error "Error: rlm_eap: Failed to store handler". I have only one server called default on sites-enabled configured like this. (The accounting is configured in another virtual server and works fine ) - Default Server - listen { ipaddr = * port = 1832 type = auth } authorize { preprocess eap { ok = return } sql ldap } # Authentication authenticate { Auth-Type MS-CHAP { mschap } # Allow EAP authentication. eap } session { sql } # Post-Authentication post-auth { Post-Auth-Type REJECT { attr_filter.access_reject sql } } pre-proxy { } post-proxy { eap } And Eap.conf is configured like this: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 300 # Cisco LEAP leap { } ## EAP-TLS tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = secret private_key_file = ${certdir}/cert-srv.pem certificate_file = ${certdir}/cert-srv.pem CA_file = ${cadir}/cacert.pem dh_file = ${certdir}/dh random_file = ${certdir}/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no lifetime = 24 # hours max_entries = 255 } } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no } mschapv2 { } } The debug log shows this. rad_recv: Access-Request packet from host 10.50.31.201 port 1645, id=48, length=120 User-Name = "25" Framed-MTU = 1400 Called-Station-Id = "000d.ed77.db21" Calling-Station-Id = "000b.6b1e.7177" Message-Authenticator = 0xf1247640d8918729e0c58f0f88dc5a8a EAP-Message = 0x02010007013235 NAS-Port-Type = Virtual NAS-Port = 358 NAS-IP-Address = 10.50.31.201 NAS-Identifier = "sar76010001" Mon Jul 27 17:16:25 2009 : Info: +- entering group authorize {...} Mon Jul 27 17:16:25 2009 : Info: ++[preprocess] returns ok Mon Jul 27 17:16:25 2009 : Info: [eap] EAP packet type response id 1 length 7 Mon Jul 27 17:16:25 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Jul 27 17:16:25 2009 : Info: ++[eap] returns updated Mon Jul 27 17:16:25 2009 : Info: [sql] expand: %{User-Name} -> 25 Mon Jul 27 17:16:25 2009 : Info: [sql] sql_set_user escaped user --> '25' Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 6 Mon Jul 27 17:16:25 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '25' ORDER BY id Mon Jul 27 17:16:25 2009 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '25' ORDER BY priority Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql): Released sql socket id: 6 Mon Jul 27 17:16:25 2009 : Info: [sql] User 25 not found Mon Jul 27 17:16:25 2009 : Info: ++[sql] returns notfound Mon Jul 27 17:16:25 2009 : Info: [ldap] performing user authorization for 25 Mon Jul 27 17:16:25 2009 : Info: [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Mon Jul 27 17:16:25 2009 : Info: [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=25) Mon Jul 27 17:16:25 2009 : Info: [ldap] expand: o=eroskiusers -> o=eroskiusers Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: performing search in o=eroskiusers, with filter (uid=25) Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: object not found or got ambiguous search result Mon Jul 27 17:16:25 2009 : Info: [ldap] search failed Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Jul 27 17:16:25 2009 : Info: ++[ldap] returns notfound Mon Jul 27 17:16:25 2009 : Info: Found Auth-Type = EAP Mon Jul 27 17:16:25 2009 : Info: +- entering group authenticate {...} Mon Jul 27 17:16:25 2009 : Info: [eap] EAP Identity Mon Jul 27 17:16:25 2009 : Info: [eap] processing type tls Mon Jul 27 17:16:25 2009 : Info: [tls] Initiate Mon Jul 27 17:16:25 2009 : Info: [tls] Start returned 1 Mon Jul 27 17:16:25 2009 : Error: rlm_eap: Failed to store handler Mon Jul 27 17:16:25 2009 : Info: ++[eap] returns fail Mon Jul 27 17:16:25 2009 : Info: Failed to authenticate the user. Mon Jul 27 17:16:25 2009 : Auth: Login incorrect (rlm_ldap: User not found): [25/<via Auth-Type = EAP>] (from client wifiap_arenal port 358 cli 000b.6b1e.7177) Mon Jul 27 17:16:25 2009 : Info: Using Post-Auth-Type Reject Mon Jul 27 17:16:25 2009 : Info: +- entering group REJECT {...} Mon Jul 27 17:16:25 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 25 Mon Jul 27 17:16:25 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Jul 27 17:16:25 2009 : Info: ++[attr_filter.access_reject] returns updated Mon Jul 27 17:16:25 2009 : Info: [sql] expand: %{User-Name} -> 25 Mon Jul 27 17:16:25 2009 : Info: [sql] sql_set_user escaped user --> '25' Mon Jul 27 17:16:25 2009 : Info: [sql] expand: %{User-Password} -> Mon Jul 27 17:16:25 2009 : Info: [sql] expand: %{Chap-Password} -> Mon Jul 27 17:16:25 2009 : Info: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '25', '', 'Access-Reject', '2009-07-27 17:16:25') Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '25', '', 'Access-Reject', '2009-07-27 17:16:25') Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 5 Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql): Released sql socket id: 5 Mon Jul 27 17:16:25 2009 : Info: ++[sql] returns ok Mon Jul 27 17:16:25 2009 : Info: Delaying reject of request 1045 for 1 seconds Mon Jul 27 17:16:25 2009 : Debug: Going to the next request Mon Jul 27 17:16:25 2009 : Info: Cleaning up request 994 ID 190 with timestamp +39 Mon Jul 27 17:16:25 2009 : Info: Sending delayed reject for request 1040 I looked to machine resources and CPU is 90% idle and has 1Gb of free ram when crashes so i dont think that could be a memory or cpu load problem. Anyone can help me, what im a doing wrong?. The configuration is very similar to the freeradius 1.0.5 server that works well. Thanks for all.

3 5

DEAFAULT keyword??
by Marlon Duksa 06 Aug '09

06 Aug '09

Hi - I've been reading through WiKi pages but still not clear. I need to evaluate two attributes and I'm doing this with the =~ operator. But the second attribute is not evaluated but instead returned as reg expr (exactly as stated below) DEFAULT *User-Name =~ "^([aA-zZ]+)-([aA-zZ]+)$", Auth-Type := Local, User-Password == "csetestp"* Alc-Subsc-ID-Str := "%{NAS-Port-Id}", Alc-Subsc-Prof-Str := "%{1}", Alc-SLA-Prof-Str := "%{2}", Alc-MSAP-Serv-Id := "100", Alc-MSAP-Policy := "msaps", *NAS-Port-Id =~ "^([^:]+):", * Alc-MSAP-Interface := "port-%{1}" Why is NAS-Port-ID returned, according to operators is should not be. I'm trying to evaluate NAS-Port attr and then based on the results assign a value to the last attribute: Alc-MSAP-Interface. If I put a DEFAULT keyword with credentials (Auth-Type, User-Pswd), infront of NAS-Port-Id, then, NAS-Port-Id and Alc-MSAP-Interfaces are not returned at all. What is the significance of this 'DEFAULT' keyword in the 'users' file? Thanks, Marlon

2 5

EAP errors in 2.1.1
by Wegener, Norbert 06 Aug '09

06 Aug '09

We are seeing an increasing number of eap error messages: Error: rlm_eap: No EAP session matching the State variable As mentioned in the Changelog in later version an eap error has been detected and fixed in 2.1.4 Fix EAP-TLS bug. Patch from Arnaud Ebalard Is this bug-fix related to the error messageabove so that upgrading alone would help? Norbert Wegener

4 5

Re: Simple username password text file
by Paul Blalock 06 Aug '09

06 Aug '09

On Wed, Aug 05, 2009 at 09:44:55AM -0500, Paul Blalock wrote: > Is it possible to have a simplistic username and password setup in freeradius? > For example. > user, pass > user1, pass1 > > Or is it possible to have the users file point to a file that does this? > > If not, is it possible to have this type of format by using mysql? I think you are looking for modules/passwd. modules/smbpasswd is an example of how you would use it. --Scott Lambert KC5MLE Unix SysAdmin lambert(a)lambertfam.org How do I tell radius to use smbpasswd instead of the users file? Also, is smbpasswd dynamic in that it updates real time when adding or deleting users? This is a big concern for me, since I can add and delete multiple people throughout the day.

1 0

Re: Freeradius-Users Digest, Vol 52, Issue 31
by Gilbert Lo 06 Aug '09

06 Aug '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Passing radius messages to script
by Dejan Markic 06 Aug '09

06 Aug '09

Hello! Is it possible, that FreeRadius would open >n< instances of one script, which would read from stdin (or such), to which it would send it's Radius messages and script would return the Radius reply? I do not want to run script everytime I receive a message on Radius, I'd like to keep it open (even more instances). So, when Radius starts, it also starts this script and keeps it running and that script is waiting for input and the script would return the message that should be returned. Is that possible or should we write a module for it? Maybe it is possible through rlm_perl? I'd be thankful for any tips provided! Thank you and kind regards, Dejan Markic

2 1

reinstalling freeradius .............while gmake giveing problme
by shivashankar 06 Aug '09

06 Aug '09

hi , i installed freeradius 2.1.6 on solaris 10 and i installed and configure mysql5.0.. now it workign fine . second time when i am tring to install freeradius2.1.6. i am facing below problem while gmake. see below error. help me did i do any mistake gmake[6]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_preprocess' Making all in rlm_python... gmake[6]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_python' for x in .libs/* rlm_python.la; do \ rm -rf /opt/packages/freeradius-server-2.1.6/src/modules/lib/$x; \ ln -s /opt/packages/freeradius-server-2.1.6/src/modules/rlm_python/$x /opt/packages/freeradius-server-2.1.6/src/modules/lib/$x; \ done gmake[6]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_python' Making all in rlm_radutmp... gmake[6]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_radutmp' for x in .libs/* rlm_radutmp.la; do \ rm -rf /opt/packages/freeradius-server-2.1.6/src/modules/lib/$x; \ ln -s /opt/packages/freeradius-server-2.1.6/src/modules/rlm_radutmp/$x /opt/packages/freeradius-server-2.1.6/src/modules/lib/$x; \ done gmake[6]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_radutmp' Making all in rlm_realm... gmake[6]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_realm' for x in .libs/* rlm_realm.la; do \ rm -rf /opt/packages/freeradius-server-2.1.6/src/modules/lib/$x; \ ln -s /opt/packages/freeradius-server-2.1.6/src/modules/rlm_realm/$x /opt/packages/freeradius-server-2.1.6/src/modules/lib/$x; \ done gmake[6]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_realm' Making all in rlm_sql... gmake[6]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql' gmake[7]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql' Making all in drivers... gmake[8]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers' /usr/sfw/bin/gmake -w WHAT_TO_MAKE=all common gmake[9]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers' Making all in rlm_sql_iodbc... gmake[10]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers/rlm_sql_iodbc' gmake[10]: Nothing to be done for `all'. gmake[10]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers/rlm_sql_iodbc' Making all in rlm_sql_mysql... gmake[10]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers/rlm_sql_mysql' /opt/packages/freeradius-server-2.1.6/libtool --mode=link gcc -release 2.1.6 \ -module -export-dynamic -o rlm_sql_mysql.la \ -rpath /usr/local/lib sql_mysql.lo -m64 -L/opt/mysql/mysql/lib -lmysqlclient_r -lz -lpthread -lthread -lposix4 -lresolv -lgen -lsocket -lnsl -lm -lpthread -lthread gcc -shared -Wl,-h -Wl,rlm_sql_mysql-2.1.6.so -o .libs/rlm_sql_mysql-2.1.6.so .libs/sql_mysql.o -L/opt/mysql/mysql/lib -lmysqlclient_r -lz -lposix4 -lresolv -lgen -lsocket -lnsl -lm -lpthread -lthread -lc -m64 ld: fatal: file .libs/sql_mysql.o: wrong ELF class: ELFCLASS32 ld: fatal: File processing errors. No output written to .libs/rlm_sql_mysql-2.1.6.so collect2: ld returned 1 exit status gmake[10]: *** [rlm_sql_mysql.la] Error 1 gmake[10]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers/rlm_sql_mysql' gmake[9]: *** [common] Error 2 gmake[9]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers' gmake[8]: *** [all] Error 2 gmake[8]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers' gmake[7]: *** [common] Error 2 gmake[7]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql' gmake[6]: *** [build-module] Error 2 gmake[6]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/opt/packages/freeradius-server-2.1.6' -- View this message in context: http://www.nabble.com/reinstalling-freeradius-.............while-gmake-give… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Freeradius and winbind problem
by Jean-Hubert Monlord 05 Aug '09

05 Aug '09

I have a problem with my freeradius installed on a Debian Lenny : I want to use PEAP with Active Directory. It works fine during a few minutes. After that, freeradius don't send the Access-Accept, it seems it waits for a response which never comes. I must restart winbind daemon and freeradius to succeed an authentification. The client is Aruba, but I have tested with Netgear with the same result. Here is the debug when it doesn't work and after when it works : rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=189, length=173 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020100130141434d535c6a686d6f6e6c6f7264 Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0x21e1615eabadbb261c919283b3f5c77c +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:20 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 19 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 189 to 10.254.0.32 port 32822 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1867aeb710f826cb3d04781dae Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=190, length=252 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0202005019800000004616030100410100003d03014a76aea459001bbf5e7c46d2faf33b74835c5f446843ed2fe97a84f4d5380fa300001600040005000a000900640062000300060013001200630100 State = 0x67acae1867aeb710f826cb3d04781dae Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0xebe44d56018b2078dc05fd10b49363ea +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:20 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06fa], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 190 to 10.254.0.32 port 32822 EAP-Message = 0x0103040019c000000757160301004a0200004603014a76aea439fe1adad0be15346fa9ddb8a2d4a2f98c906b8c279870926a73bd9e20684cafb03aa6b70221b0faa4f14e7a5ef2d5a7927a97cfdc560d0ac5b580b7b200040016030106fa0b0006f60006f30003243082032030820289a003020102020104300d06092a864886f70d010104050030819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a130441434d53310b3009060355040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f72 EAP-Message = 0x6974793126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e6672301e170d3039303531323037303233315a170d3139303531303037303233315a3070310b3009060355040613024652310f300d060355040813064672616e6365310d300b060355040a130441434d5331193017060355040313106c2d726164697573312e48512e444f4d3126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e667230820122300d06092a864886f70d01010105000382010f003082010a0282010100b591a1d3adb4e4ea8041108e8b7858638f181e1b0c9439ae22b6dd85f754c9 EAP-Message = 0x5a0cb03b3a5f5e44294598d31b1e69590452621253f761f2986999ef6e7814965bf0cbe10b16e0295fb88efc68979772f5053ba685d9af99b39994cbf17accde0831c26685960431dc4ac3696bf061ff0496a142ce2a576ad16c66c766cfe47038139a0584effb5bd1f63e502ae117e5286c79ad82192194bace81564e2c0ee5217b277a6969fd865a19152913cf50718ab09ccf01375bc1d5e7d501be14882cc1932693221a3274898e2d7387ced11b273c72d69a7719df1e43df7b6f54e7b70e9f3d91f216dcf1499e7ed37299fc3a982410737cde9ae04d76ab4053be800b0f0203010001a317301530130603551d25040c300a06082b0601050507 EAP-Message = 0x0301300d06092a864886f70d010104050003818100628fd16c16c9ca25d9fd4bf42b45dd9d1bba1b64146625d572b86a97e6c3780315511194fcf2510c4ce99393e61a63af985e6eb48438e8ef10d1f56f0380f626d9290e6b30f3459aa1ee66ae0556c5f5971a603343af9472105cabfb70eb144cb043f5cfadcc3a536f44bf3cd98c2bbb63af699594956609f75af9c9cadfe4e40003c9308203c53082032ea003020102020900ad028a9e72fb0f0a300d06092a864886f70d010104050030819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a13 EAP-Message = 0x0441434d53310b3009060355 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1866afb710f826cb3d04781dae Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=191, length=178 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020300061900 State = 0x67acae1866afb710f826cb3d04781dae Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0x69b0156bc0eb57e635cba7dbdc059fcf +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:20 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 191 to 10.254.0.32 port 32822 EAP-Message = 0x010403671900040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f726974793126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e6672301e170d3036303232383134323835375a170d3236303232333134323835375a30819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a130441434d53310b3009060355040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f726974793126302406092a EAP-Message = 0x864886f70d0109011617706f73746d61737465724061636d732e6173736f2e667230819f300d06092a864886f70d010101050003818d0030818902818100bc7d9f74ab64f276ac4c0059fbb63dd341d6e3f6938bbcc1d18614b5218a137322253da30d2c08e67d48425c192b3693766807b794f928a931adbe115181bc8f00941de778eb402079cce8298e0dd0fe6e80921db123209728442395c238c2902ac3dc5b9f23d239fadea85e62cabd30a3c6cdb162c46fd51e6d386ba868a3390203010001a382010730820103301d0603551d0e041604149cbb859d57389413b3def35ced857b46105dc5de3081d30603551d230481cb3081c880149cbb85 EAP-Message = 0x9d57389413b3def35ced857b46105dc5dea181a4a481a130819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a130441434d53310b3009060355040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f726974793126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e6672820900ad028a9e72fb0f0a300c0603551d13040530030101ff300d06092a864886f70d0101040500038181001b0a6fb0e890320aadf9c0baa7f3ca810ad2c8e6f246bdeadc EAP-Message = 0xcda483532b27e5fb39164b2e3db6fb717f8534442e9efd065309d0e6c9d1a6e90c2fba2b7beb1e72f794bcccd2fc95190c65d9e97d1d37089610db9f6238adff67a1a2c818bd2e7ad5707603d6eb25e47681a57aceda1d2e2ea0e9ced9ba61c463f671a1b1d2f716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1865a8b710f826cb3d04781dae Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=192, length=494 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0204014019800000013616030101061000010201006246ea1f8687d388d33a330d27ac41af039202ed25cc671b6c3b8feb6c70e61b80b965c252763ae7ad471ddf2019e8350ee0ee2562198dfdcf9280f8d44be13abbd17c2cf3c54daa125da6def0eab93a83a47ffcd4f183d3b44784edbbfab51f8db3c18cfaae60c6e2d25e398a1b57aaad2b97279c9501bef114811f2a617268718db187b5989b1f584752479c2a645877ff7ce68781e79dec1ca2c436d35d6497e0618fd1608c5b9b884569a3178c0baeeabb32a14b5c1c134adb18058ed373874a666e31a6a0a46220b63c275732db13abba3450b09ec624a2bf920f7a82439104b46d7ec901d1 EAP-Message = 0x40d0e6c361ac05a3d36a80be2c6097880ce35f69b19a5dbe1403010001011603010020c9efd83f8f0f46b740068191ae62591016a0d2039264d4e4dc79cc4377557e15 State = 0x67acae1865a8b710f826cb3d04781dae Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0xf3f7bf3ef7829cbf5076a085ad37306e +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:20 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 253 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 310 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 192 to 10.254.0.32 port 32822 EAP-Message = 0x01050031190014030100010116030100207740a100507477c1f718fb32124193de13aaead0837f5851882e8b7972a94c0c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1864a9b710f826cb3d04781dae Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=193, length=178 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020500061900 State = 0x67acae1864a9b710f826cb3d04781dae Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0x318ea52e0b08a88236c56460b2cd2297 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:21 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 193 to 10.254.0.32 port 32822 EAP-Message = 0x0106002019001703010015e31d9132a53caf4685e485312527c05fc62af5b815 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1863aab710f826cb3d04781dae Finished request 7. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=194, length=214 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0206002a1900170301001f9bdb3d417ff127d40066de4a25ba5d90e9743ec8ddd21e88b35661d661bd21 State = 0x67acae1863aab710f826cb3d04781dae Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0x2e4b14281e38b2f5c3a3d51bd8ae5247 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:21 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 42 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - ACMS\usertest PEAP: Got tunneled EAP-Message EAP-Message = 0x020600130141434d535c6a686d6f6e6c6f7264 PEAP: Got tunneled identity of ACMS\usertest PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to ACMS\usertest PEAP: Sending tunneled request EAP-Message = 0x020600130141434d535c6a686d6f6e6c6f7264 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ACMS\\usertest" server inner-tunnel { +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 6 length 19 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010700281a0107002310ba2fc1f10c107456492d749e4c51620041434d535c6a686d6f6e6c6f7264 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x410be7cb410cfdb5854c84f429fbe15f PEAP: Processing from tunneled session code 0x1448b50 11 EAP-Message = 0x010700281a0107002310ba2fc1f10c107456492d749e4c51620041434d535c6a686d6f6e6c6f7264 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x410be7cb410cfdb5854c84f429fbe15f PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 194 to 10.254.0.32 port 32822 EAP-Message = 0x0107003f19001703010034382dac222a8cbe39aa7423d7009bbb6cc7b99e27c8055439a29cc831faa8ceaeba250bd480aac0fd08a0f6be91a630027b16f8ec Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1862abb710f826cb3d04781dae Finished request 8. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=195, length=268 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020700601900170301005519e0c573c160d61825e0c1b4263659d02f871ee7d2b94b55e02b723733d2ac9b5f608539c59e517a7ba949007f888c19ee622fe8ae2a1886cf9977c98d49b80b2f6723b75097445c5f41cac1a738e381c73e56720b State = 0x67acae1862abb710f826cb3d04781dae Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0xc298a38a0773ca5e6f26806e0750b6f7 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:21 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 7 length 96 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x020700491a02070044318960abe2a4d2e1fe66969c8a71bbcfaa0000000000000000767c9816c36b03b2b3d7ae686db05eb5319239da6548f01e0041434d535c6a686d6f6e6c6f7264 PEAP: Setting User-Name to ACMS\usertest PEAP: Sending tunneled request EAP-Message = 0x020700491a02070044318960abe2a4d2e1fe66969c8a71bbcfaa0000000000000000767c9816c36b03b2b3d7ae686db05eb5319239da6548f01e0041434d535c6a686d6f6e6c6f7264 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ACMS\\usertest" State = 0x410be7cb410cfdb5854c84f429fbe15f server inner-tunnel { +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 7 length 73 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for usertest with NT-Password expand: --domain=%{mschap:NT-Domain} -> --domain=ACMS expand: --username=%{mschap:User-Name} -> --username=usertest mschap2: ba expand: --challenge=%{mschap:Challenge:-00} -> --challenge=b3dfd0f2062ff185 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=767c9816c36b03b2b3d7ae686db05eb5319239da6548f01e Exec-Program output: NT_KEY: 35E241131A9A3028B30C29496120AA85 Exec-Program-Wait: plaintext: NT_KEY: 35E241131A9A3028B30C29496120AA85 Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d34413435444431363133373234353141303230454339443134413644423132313746334130364546 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x410be7cb4003fdb5854c84f429fbe15f PEAP: Processing from tunneled session code 0x1448d00 11 EAP-Message = 0x010800331a0307002e533d34413435444431363133373234353141303230454339443134413644423132313746334130364546 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x410be7cb4003fdb5854c84f429fbe15f PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 195 to 10.254.0.32 port 32822 EAP-Message = 0x0108004a1900170301003f363cfc69b8eb543b309b5e3b0eeba4662d61f3f1ec8a55a0b4b401f987bcd6f1d8cf5f9e3cdc0c7d0afb0a22b49f6b0e67a301a591480f764cd0f5156c126f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1861a4b710f826cb3d04781dae Finished request 9. Going to the next request Waking up in 4.6 seconds. Cleaning up request 3 ID 189 with timestamp +539 Cleaning up request 4 ID 190 with timestamp +539 Cleaning up request 5 ID 191 with timestamp +539 Waking up in 0.1 seconds. Cleaning up request 6 ID 192 with timestamp +539 Waking up in 0.1 seconds. Cleaning up request 7 ID 193 with timestamp +540 Cleaning up request 8 ID 194 with timestamp +540 Cleaning up request 9 ID 195 with timestamp +540 Ready to process requests. Here, it works : rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=80, length=167 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0201001001444f4d5c6361726c696f7a Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x74ac90d2e39e6e057f970e06f8d308f6 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:35 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 80 to 10.254.0.32 port 32822 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b1d3d4b9577b19a501eee06e Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=81, length=281 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0202007019800000006616030100610100005d03014a76d2cb4fcdc3ecfcf18e4f349f62ca5dff023b687e8448aa20c99d8aaa1dc02052f6239bf116d56a2f94fc6106c098bb169d635312641c10d18e36178ea6e45c001600040005000a000900640062000300060013001200630100 State = 0xb1d1cd33b1d3d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x8a4f52d9a7d1030ca81375cb707dbbf9 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 112 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 102 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06fa], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 81 to 10.254.0.32 port 32822 EAP-Message = 0x0103040019c000000757160301004a0200004603014a76d2ccf7d4afc8a7cdbafc342ef1b377a655e92f5329cd0367ba8ef969447f20e37338d7a07f9ad5f0fb0999ed7e6af69a00fefe44d7c085de718cd53f61f04d00040016030106fa0b0006f60006f30003243082032030820289a003020102020104300d06092a864886f70d010104050030819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a130441434d53310b3009060355040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f72 EAP-Message = 0x6974793126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e6672301e170d3039303531323037303233315a170d3139303531303037303233315a3070310b3009060355040613024652310f300d060355040813064672616e6365310d300b060355040a130441434d5331193017060355040313106c2d726164697573312e48512e444f4d3126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e667230820122300d06092a864886f70d01010105000382010f003082010a0282010100b591a1d3adb4e4ea8041108e8b7858638f181e1b0c9439ae22b6dd85f754c9 EAP-Message = 0x5a0cb03b3a5f5e44294598d31b1e69590452621253f761f2986999ef6e7814965bf0cbe10b16e0295fb88efc68979772f5053ba685d9af99b39994cbf17accde0831c26685960431dc4ac3696bf061ff0496a142ce2a576ad16c66c766cfe47038139a0584effb5bd1f63e502ae117e5286c79ad82192194bace81564e2c0ee5217b277a6969fd865a19152913cf50718ab09ccf01375bc1d5e7d501be14882cc1932693221a3274898e2d7387ced11b273c72d69a7719df1e43df7b6f54e7b70e9f3d91f216dcf1499e7ed37299fc3a982410737cde9ae04d76ab4053be800b0f0203010001a317301530130603551d25040c300a06082b0601050507 EAP-Message = 0x0301300d06092a864886f70d010104050003818100628fd16c16c9ca25d9fd4bf42b45dd9d1bba1b64146625d572b86a97e6c3780315511194fcf2510c4ce99393e61a63af985e6eb48438e8ef10d1f56f0380f626d9290e6b30f3459aa1ee66ae0556c5f5971a603343af9472105cabfb70eb144cb043f5cfadcc3a536f44bf3cd98c2bbb63af699594956609f75af9c9cadfe4e40003c9308203c53082032ea003020102020900ad028a9e72fb0f0a300d06092a864886f70d010104050030819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a13 EAP-Message = 0x0441434d53310b3009060355 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b0d2d4b9577b19a501eee06e Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=82, length=175 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020300061900 State = 0xb1d1cd33b0d2d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x6db7cf5ed3d73d831bb04492bc36e0a8 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 82 to 10.254.0.32 port 32822 EAP-Message = 0x010403671900040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f726974793126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e6672301e170d3036303232383134323835375a170d3236303232333134323835375a30819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a130441434d53310b3009060355040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f726974793126302406092a EAP-Message = 0x864886f70d0109011617706f73746d61737465724061636d732e6173736f2e667230819f300d06092a864886f70d010101050003818d0030818902818100bc7d9f74ab64f276ac4c0059fbb63dd341d6e3f6938bbcc1d18614b5218a137322253da30d2c08e67d48425c192b3693766807b794f928a931adbe115181bc8f00941de778eb402079cce8298e0dd0fe6e80921db123209728442395c238c2902ac3dc5b9f23d239fadea85e62cabd30a3c6cdb162c46fd51e6d386ba868a3390203010001a382010730820103301d0603551d0e041604149cbb859d57389413b3def35ced857b46105dc5de3081d30603551d230481cb3081c880149cbb85 EAP-Message = 0x9d57389413b3def35ced857b46105dc5dea181a4a481a130819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a130441434d53310b3009060355040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f726974793126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e6672820900ad028a9e72fb0f0a300c0603551d13040530030101ff300d06092a864886f70d0101040500038181001b0a6fb0e890320aadf9c0baa7f3ca810ad2c8e6f246bdeadc EAP-Message = 0xcda483532b27e5fb39164b2e3db6fb717f8534442e9efd065309d0e6c9d1a6e90c2fba2b7beb1e72f794bcccd2fc95190c65d9e97d1d37089610db9f6238adff67a1a2c818bd2e7ad5707603d6eb25e47681a57aceda1d2e2ea0e9ced9ba61c463f671a1b1d2f716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b3d5d4b9577b19a501eee06e Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=83, length=491 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020401401980000001361603010106100001020100621a6d6489a3b775a64ad3ee2f28e053794c50f912e68f4e67f03d70f8a0d1dd9dda173b2f6669f1b4c3bfdf17ae425ea3a2475b1191083540da42b1418efe2641b3a218326f60cf1b6eecd32d21409ea10079a2be923248253fd9a1c36db54260dc3562fb6c49245980d521d894763779662b0f70a32e0f48ae6b5767ea2c9e6c11409830b84f4bd3e553ee460afa486508d0e3e823fc251c6cd850cfbb1a43eecf83d5d03aed2e78f80f2e965ce7ceebf9259655c4c32d5efd88ed7a60ced5fcdaa5531be9bf7379597e25e7c37eca79eeca6ade118f9c7f904256e9f8b7d2563308f0480c8559 EAP-Message = 0x8942ff0c70a8c3ce206f908d3d2b3ee44fadc13d9a9f1e68140301000101160301002060d7e7fc4d412ea50f03efecf0d0cd8d01267753af8a16ff3095758ca82c3b9e State = 0xb1d1cd33b3d5d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x2c34b230bef2071b982d584fca5ec843 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 253 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 310 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 83 to 10.254.0.32 port 32822 EAP-Message = 0x0105003119001403010001011603010020c9602cd84aa7982ac74fdd03d1b658d1fb963f2d3b8ead12ea31c58209248c2b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b2d4d4b9577b19a501eee06e Finished request 3. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=85, length=175 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020500061900 State = 0xb1d1cd33b2d4d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x51af73ed1ede861fc06ee69ee7362ddd +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 85 to 10.254.0.32 port 32822 EAP-Message = 0x010600201900170301001514a38092da042a09a0d53f71c5db3c20253be3932a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b5d7d4b9577b19a501eee06e Finished request 4. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=84, length=208 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020600271900170301001c377f4b5460aaaa3ed396b66c24a6e7da327d38ffc15fdbbfa5071b7e State = 0xb1d1cd33b5d7d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x9458c933041125b9f6ca8610574f998f +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 39 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - ACMS\usertest PEAP: Got tunneled EAP-Message EAP-Message = 0x0206001001444f4d5c6361726c696f7a PEAP: Got tunneled identity of ACMS\usertest PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to ACMS\usertest PEAP: Sending tunneled request EAP-Message = 0x0206001001444f4d5c6361726c696f7a FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ACMS\\usertest" server inner-tunnel { +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 6 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010700251a0107002010556e70ce846691aea2c042838cb465b6444f4d5c6361726c696f7a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbb7f125bbc65603c947384488c39d8 PEAP: Processing from tunneled session code 0x1d6fa00 11 EAP-Message = 0x010700251a0107002010556e70ce846691aea2c042838cb465b6444f4d5c6361726c696f7a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbb7f125bbc65603c947384488c39d8 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 84 to 10.254.0.32 port 32822 EAP-Message = 0x0107003c190017030100315d3c38589f24e052410d29c4316debb268b576d1491c91397a2c2c47ed82de8d07e25f85ddbca888ce5f2f52498b00a17a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b4d6d4b9577b19a501eee06e Finished request 5. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=86, length=262 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0207005d19001703010052c5802a50a76626e911c84500e1b139ec0e448554c2539bfd8f2c422a750c6b46c2f45c07d81b631135434e59b0127081fbbb408133efa7d87546245dc74d5ea394ba4725db00c777e1db5649858339a6ff89 State = 0xb1d1cd33b4d6d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0xaaba5a2f699aa217dc67dbd1ad2c1b8b +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 7 length 93 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x020700461a0207004131b8a86f74525f79287c685926df8506b30000000000000000937766f3b6118923d4a2833ba1d198e1b0c984525ac7d57000444f4d5c6361726c696f7a PEAP: Setting User-Name to ACMS\usertest PEAP: Sending tunneled request EAP-Message = 0x020700461a0207004131b8a86f74525f79287c685926df8506b30000000000000000937766f3b6118923d4a2833ba1d198e1b0c984525ac7d57000444f4d5c6361726c696f7a FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ACMS\\usertest" State = 0x5bbb7f125bbc65603c947384488c39d8 server inner-tunnel { +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 7 length 70 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for usertest with NT-Password expand: --ACMSain=%{mschap:NT-ACMSain} -> --ACMSain=ACMS expand: --username=%{mschap:User-Name} -> --username=usertest mschap2: 55 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=b4dbd917acb3d690 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=937766f3b6118923d4a2833ba1d198e1b0c984525ac7d570 Exec-Program output: NT_KEY: D139B35EDBE5A4E870E34920F2D63FEF Exec-Program-Wait: plaintext: NT_KEY: D139B35EDBE5A4E870E34920F2D63FEF Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d36303743343137423644323646333643423935313230443135454133304346393743383145354232 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbb7f125ab365603c947384488c39d8 PEAP: Processing from tunneled session code 0x1d48ad0 11 EAP-Message = 0x010800331a0307002e533d36303743343137423644323646333643423935313230443135454133304346393743383145354232 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbb7f125ab365603c947384488c39d8 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 86 to 10.254.0.32 port 32822 EAP-Message = 0x0108004a1900170301003f790d3c1318deb33bc9b0bffbdc62f89cb9ef00e48a4369d5176e082332ac0f3e1adeececf9133a24e2db88a48f131b24f96b470ad735d56aab1e398d8b1962 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b7d9d4b9577b19a501eee06e Finished request 6. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=87, length=198 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0208001d19001703010012c0833497cbb416bd4af4736ed09a77f33fcc State = 0xb1d1cd33b7d9d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x11904e5ce88bdc7e4015519888a50038 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 29 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x020800061a03 PEAP: Setting User-Name to ACMS\usertest PEAP: Sending tunneled request EAP-Message = 0x020800061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ACMS\\usertest" State = 0x5bbb7f125ab365603c947384488c39d8 server inner-tunnel { +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 8 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler ++[eap] returns ok Login OK: [ACMS\\usertest/<via Auth-Type = EAP>] (from client aruba1 port 0 via TLS tunnel) } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ACMS\\usertest" PEAP: Processing from tunneled session code 0x1d6d7f0 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ACMS\\usertest" PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS ++[eap] returns handled Sending Access-Challenge of id 87 to 10.254.0.32 port 32822 EAP-Message = 0x010900261900170301001b740c352358b879b666b2617fe8fa1cb29288f5b899546d41a5655a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b6d8d4b9577b19a501eee06e Finished request 7. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=88, length=207 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020900261900170301001bd911f82a6b41a035a62496200168b13d84f72b9c8b9d86ed23c3c0 State = 0xb1d1cd33b6d8d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0xc65b393765c82022a70ba974c1df2966 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 9 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success rlm_eap: Freeing handler ++[eap] returns ok Login OK: [ACMS\\usertest/<via Auth-Type = EAP>] (from client aruba1 port 2 cli 0018DECCECAA) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 88 to 10.254.0.32 port 32822 MS-MPPE-Recv-Key = 0x695e9dd8253cf8ad3be2d108b81c7071284dce6533e98dfc3c776afd46f80a2a MS-MPPE-Send-Key = 0x48dea6a783506a6d57acd8d4ae74e9911463c666e58cd632b44cb3146c832d30 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ACMS\\usertest" Finished request 8. Going to the next request Waking up in 4.6 seconds. Cleaning up request 0 ID 80 with timestamp +164 Cleaning up request 1 ID 81 with timestamp +165 Cleaning up request 2 ID 82 with timestamp +165 Waking up in 0.2 seconds. Cleaning up request 3 ID 83 with timestamp +165 Cleaning up request 4 ID 85 with timestamp +165 Cleaning up request 5 ID 84 with timestamp +165 Cleaning up request 6 ID 86 with timestamp +165 Cleaning up request 7 ID 87 with timestamp +165 Cleaning up request 8 ID 88 with timestamp +165 Thanks Jean-Hubert Monlord

2 1

Simple username password text file
by Paul Blalock 05 Aug '09

05 Aug '09

Is it possible to have a simplistic username and password setup in freeradius? For example. user, pass user1, pass1 Or is it possible to have the users file point to a file that does this? If not, is it possible to have this type of format by using mysql? -- Paul Blalock

3 2

Service-type
by Bert Beaudin 05 Aug '09

05 Aug '09

Hello all I have freeradius authenticating off of Active Directory. This is working but I now need to pass Service-Type = 6 for all connections that sussfuly authencate. What file and section to I put this in? Let me know if you need mroe information. Thanks, bert

1 0