- Freeradius-Users - lists.freeradius.org

EAP errors in 2.1.1
by Wegener, Norbert 06 Aug '09

06 Aug '09

We are seeing an increasing number of eap error messages: Error: rlm_eap: No EAP session matching the State variable As mentioned in the Changelog in later version an eap error has been detected and fixed in 2.1.4 Fix EAP-TLS bug. Patch from Arnaud Ebalard Is this bug-fix related to the error messageabove so that upgrading alone would help? Norbert Wegener

4 5

Re: Simple username password text file
by Paul Blalock 06 Aug '09

06 Aug '09

On Wed, Aug 05, 2009 at 09:44:55AM -0500, Paul Blalock wrote: > Is it possible to have a simplistic username and password setup in freeradius? > For example. > user, pass > user1, pass1 > > Or is it possible to have the users file point to a file that does this? > > If not, is it possible to have this type of format by using mysql? I think you are looking for modules/passwd. modules/smbpasswd is an example of how you would use it. --Scott Lambert KC5MLE Unix SysAdmin lambert(a)lambertfam.org How do I tell radius to use smbpasswd instead of the users file? Also, is smbpasswd dynamic in that it updates real time when adding or deleting users? This is a big concern for me, since I can add and delete multiple people throughout the day.

1 0

Re: Freeradius-Users Digest, Vol 52, Issue 31
by Gilbert Lo 06 Aug '09

06 Aug '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Passing radius messages to script
by Dejan Markic 06 Aug '09

06 Aug '09

Hello! Is it possible, that FreeRadius would open >n< instances of one script, which would read from stdin (or such), to which it would send it's Radius messages and script would return the Radius reply? I do not want to run script everytime I receive a message on Radius, I'd like to keep it open (even more instances). So, when Radius starts, it also starts this script and keeps it running and that script is waiting for input and the script would return the message that should be returned. Is that possible or should we write a module for it? Maybe it is possible through rlm_perl? I'd be thankful for any tips provided! Thank you and kind regards, Dejan Markic

2 1

reinstalling freeradius .............while gmake giveing problme
by shivashankar 06 Aug '09

06 Aug '09

hi , i installed freeradius 2.1.6 on solaris 10 and i installed and configure mysql5.0.. now it workign fine . second time when i am tring to install freeradius2.1.6. i am facing below problem while gmake. see below error. help me did i do any mistake gmake[6]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_preprocess' Making all in rlm_python... gmake[6]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_python' for x in .libs/* rlm_python.la; do \ rm -rf /opt/packages/freeradius-server-2.1.6/src/modules/lib/$x; \ ln -s /opt/packages/freeradius-server-2.1.6/src/modules/rlm_python/$x /opt/packages/freeradius-server-2.1.6/src/modules/lib/$x; \ done gmake[6]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_python' Making all in rlm_radutmp... gmake[6]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_radutmp' for x in .libs/* rlm_radutmp.la; do \ rm -rf /opt/packages/freeradius-server-2.1.6/src/modules/lib/$x; \ ln -s /opt/packages/freeradius-server-2.1.6/src/modules/rlm_radutmp/$x /opt/packages/freeradius-server-2.1.6/src/modules/lib/$x; \ done gmake[6]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_radutmp' Making all in rlm_realm... gmake[6]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_realm' for x in .libs/* rlm_realm.la; do \ rm -rf /opt/packages/freeradius-server-2.1.6/src/modules/lib/$x; \ ln -s /opt/packages/freeradius-server-2.1.6/src/modules/rlm_realm/$x /opt/packages/freeradius-server-2.1.6/src/modules/lib/$x; \ done gmake[6]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_realm' Making all in rlm_sql... gmake[6]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql' gmake[7]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql' Making all in drivers... gmake[8]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers' /usr/sfw/bin/gmake -w WHAT_TO_MAKE=all common gmake[9]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers' Making all in rlm_sql_iodbc... gmake[10]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers/rlm_sql_iodbc' gmake[10]: Nothing to be done for `all'. gmake[10]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers/rlm_sql_iodbc' Making all in rlm_sql_mysql... gmake[10]: Entering directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers/rlm_sql_mysql' /opt/packages/freeradius-server-2.1.6/libtool --mode=link gcc -release 2.1.6 \ -module -export-dynamic -o rlm_sql_mysql.la \ -rpath /usr/local/lib sql_mysql.lo -m64 -L/opt/mysql/mysql/lib -lmysqlclient_r -lz -lpthread -lthread -lposix4 -lresolv -lgen -lsocket -lnsl -lm -lpthread -lthread gcc -shared -Wl,-h -Wl,rlm_sql_mysql-2.1.6.so -o .libs/rlm_sql_mysql-2.1.6.so .libs/sql_mysql.o -L/opt/mysql/mysql/lib -lmysqlclient_r -lz -lposix4 -lresolv -lgen -lsocket -lnsl -lm -lpthread -lthread -lc -m64 ld: fatal: file .libs/sql_mysql.o: wrong ELF class: ELFCLASS32 ld: fatal: File processing errors. No output written to .libs/rlm_sql_mysql-2.1.6.so collect2: ld returned 1 exit status gmake[10]: *** [rlm_sql_mysql.la] Error 1 gmake[10]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers/rlm_sql_mysql' gmake[9]: *** [common] Error 2 gmake[9]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers' gmake[8]: *** [all] Error 2 gmake[8]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers' gmake[7]: *** [common] Error 2 gmake[7]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql' gmake[6]: *** [build-module] Error 2 gmake[6]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/opt/packages/freeradius-server-2.1.6' -- View this message in context: http://www.nabble.com/reinstalling-freeradius-.............while-gmake-give… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Freeradius and winbind problem
by Jean-Hubert Monlord 05 Aug '09

05 Aug '09

I have a problem with my freeradius installed on a Debian Lenny : I want to use PEAP with Active Directory. It works fine during a few minutes. After that, freeradius don't send the Access-Accept, it seems it waits for a response which never comes. I must restart winbind daemon and freeradius to succeed an authentification. The client is Aruba, but I have tested with Netgear with the same result. Here is the debug when it doesn't work and after when it works : rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=189, length=173 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020100130141434d535c6a686d6f6e6c6f7264 Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0x21e1615eabadbb261c919283b3f5c77c +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:20 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 19 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 189 to 10.254.0.32 port 32822 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1867aeb710f826cb3d04781dae Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=190, length=252 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0202005019800000004616030100410100003d03014a76aea459001bbf5e7c46d2faf33b74835c5f446843ed2fe97a84f4d5380fa300001600040005000a000900640062000300060013001200630100 State = 0x67acae1867aeb710f826cb3d04781dae Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0xebe44d56018b2078dc05fd10b49363ea +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:20 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06fa], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 190 to 10.254.0.32 port 32822 EAP-Message = 0x0103040019c000000757160301004a0200004603014a76aea439fe1adad0be15346fa9ddb8a2d4a2f98c906b8c279870926a73bd9e20684cafb03aa6b70221b0faa4f14e7a5ef2d5a7927a97cfdc560d0ac5b580b7b200040016030106fa0b0006f60006f30003243082032030820289a003020102020104300d06092a864886f70d010104050030819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a130441434d53310b3009060355040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f72 EAP-Message = 0x6974793126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e6672301e170d3039303531323037303233315a170d3139303531303037303233315a3070310b3009060355040613024652310f300d060355040813064672616e6365310d300b060355040a130441434d5331193017060355040313106c2d726164697573312e48512e444f4d3126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e667230820122300d06092a864886f70d01010105000382010f003082010a0282010100b591a1d3adb4e4ea8041108e8b7858638f181e1b0c9439ae22b6dd85f754c9 EAP-Message = 0x5a0cb03b3a5f5e44294598d31b1e69590452621253f761f2986999ef6e7814965bf0cbe10b16e0295fb88efc68979772f5053ba685d9af99b39994cbf17accde0831c26685960431dc4ac3696bf061ff0496a142ce2a576ad16c66c766cfe47038139a0584effb5bd1f63e502ae117e5286c79ad82192194bace81564e2c0ee5217b277a6969fd865a19152913cf50718ab09ccf01375bc1d5e7d501be14882cc1932693221a3274898e2d7387ced11b273c72d69a7719df1e43df7b6f54e7b70e9f3d91f216dcf1499e7ed37299fc3a982410737cde9ae04d76ab4053be800b0f0203010001a317301530130603551d25040c300a06082b0601050507 EAP-Message = 0x0301300d06092a864886f70d010104050003818100628fd16c16c9ca25d9fd4bf42b45dd9d1bba1b64146625d572b86a97e6c3780315511194fcf2510c4ce99393e61a63af985e6eb48438e8ef10d1f56f0380f626d9290e6b30f3459aa1ee66ae0556c5f5971a603343af9472105cabfb70eb144cb043f5cfadcc3a536f44bf3cd98c2bbb63af699594956609f75af9c9cadfe4e40003c9308203c53082032ea003020102020900ad028a9e72fb0f0a300d06092a864886f70d010104050030819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a13 EAP-Message = 0x0441434d53310b3009060355 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1866afb710f826cb3d04781dae Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=191, length=178 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020300061900 State = 0x67acae1866afb710f826cb3d04781dae Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0x69b0156bc0eb57e635cba7dbdc059fcf +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:20 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 191 to 10.254.0.32 port 32822 EAP-Message = 0x010403671900040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f726974793126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e6672301e170d3036303232383134323835375a170d3236303232333134323835375a30819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a130441434d53310b3009060355040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f726974793126302406092a EAP-Message = 0x864886f70d0109011617706f73746d61737465724061636d732e6173736f2e667230819f300d06092a864886f70d010101050003818d0030818902818100bc7d9f74ab64f276ac4c0059fbb63dd341d6e3f6938bbcc1d18614b5218a137322253da30d2c08e67d48425c192b3693766807b794f928a931adbe115181bc8f00941de778eb402079cce8298e0dd0fe6e80921db123209728442395c238c2902ac3dc5b9f23d239fadea85e62cabd30a3c6cdb162c46fd51e6d386ba868a3390203010001a382010730820103301d0603551d0e041604149cbb859d57389413b3def35ced857b46105dc5de3081d30603551d230481cb3081c880149cbb85 EAP-Message = 0x9d57389413b3def35ced857b46105dc5dea181a4a481a130819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a130441434d53310b3009060355040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f726974793126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e6672820900ad028a9e72fb0f0a300c0603551d13040530030101ff300d06092a864886f70d0101040500038181001b0a6fb0e890320aadf9c0baa7f3ca810ad2c8e6f246bdeadc EAP-Message = 0xcda483532b27e5fb39164b2e3db6fb717f8534442e9efd065309d0e6c9d1a6e90c2fba2b7beb1e72f794bcccd2fc95190c65d9e97d1d37089610db9f6238adff67a1a2c818bd2e7ad5707603d6eb25e47681a57aceda1d2e2ea0e9ced9ba61c463f671a1b1d2f716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1865a8b710f826cb3d04781dae Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=192, length=494 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0204014019800000013616030101061000010201006246ea1f8687d388d33a330d27ac41af039202ed25cc671b6c3b8feb6c70e61b80b965c252763ae7ad471ddf2019e8350ee0ee2562198dfdcf9280f8d44be13abbd17c2cf3c54daa125da6def0eab93a83a47ffcd4f183d3b44784edbbfab51f8db3c18cfaae60c6e2d25e398a1b57aaad2b97279c9501bef114811f2a617268718db187b5989b1f584752479c2a645877ff7ce68781e79dec1ca2c436d35d6497e0618fd1608c5b9b884569a3178c0baeeabb32a14b5c1c134adb18058ed373874a666e31a6a0a46220b63c275732db13abba3450b09ec624a2bf920f7a82439104b46d7ec901d1 EAP-Message = 0x40d0e6c361ac05a3d36a80be2c6097880ce35f69b19a5dbe1403010001011603010020c9efd83f8f0f46b740068191ae62591016a0d2039264d4e4dc79cc4377557e15 State = 0x67acae1865a8b710f826cb3d04781dae Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0xf3f7bf3ef7829cbf5076a085ad37306e +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:20 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 253 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 310 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 192 to 10.254.0.32 port 32822 EAP-Message = 0x01050031190014030100010116030100207740a100507477c1f718fb32124193de13aaead0837f5851882e8b7972a94c0c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1864a9b710f826cb3d04781dae Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=193, length=178 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020500061900 State = 0x67acae1864a9b710f826cb3d04781dae Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0x318ea52e0b08a88236c56460b2cd2297 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:21 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 193 to 10.254.0.32 port 32822 EAP-Message = 0x0106002019001703010015e31d9132a53caf4685e485312527c05fc62af5b815 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1863aab710f826cb3d04781dae Finished request 7. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=194, length=214 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0206002a1900170301001f9bdb3d417ff127d40066de4a25ba5d90e9743ec8ddd21e88b35661d661bd21 State = 0x67acae1863aab710f826cb3d04781dae Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0x2e4b14281e38b2f5c3a3d51bd8ae5247 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:21 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 42 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - ACMS\usertest PEAP: Got tunneled EAP-Message EAP-Message = 0x020600130141434d535c6a686d6f6e6c6f7264 PEAP: Got tunneled identity of ACMS\usertest PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to ACMS\usertest PEAP: Sending tunneled request EAP-Message = 0x020600130141434d535c6a686d6f6e6c6f7264 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ACMS\\usertest" server inner-tunnel { +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 6 length 19 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010700281a0107002310ba2fc1f10c107456492d749e4c51620041434d535c6a686d6f6e6c6f7264 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x410be7cb410cfdb5854c84f429fbe15f PEAP: Processing from tunneled session code 0x1448b50 11 EAP-Message = 0x010700281a0107002310ba2fc1f10c107456492d749e4c51620041434d535c6a686d6f6e6c6f7264 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x410be7cb410cfdb5854c84f429fbe15f PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 194 to 10.254.0.32 port 32822 EAP-Message = 0x0107003f19001703010034382dac222a8cbe39aa7423d7009bbb6cc7b99e27c8055439a29cc831faa8ceaeba250bd480aac0fd08a0f6be91a630027b16f8ec Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1862abb710f826cb3d04781dae Finished request 8. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=195, length=268 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 1 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0013CE8BE8A6" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020700601900170301005519e0c573c160d61825e0c1b4263659d02f871ee7d2b94b55e02b723733d2ac9b5f608539c59e517a7ba949007f888c19ee622fe8ae2a1886cf9977c98d49b80b2f6723b75097445c5f41cac1a738e381c73e56720b State = 0x67acae1862abb710f826cb3d04781dae Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.3" Message-Authenticator = 0xc298a38a0773ca5e6f26806e0750b6f7 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 11:32:21 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 7 length 96 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x020700491a02070044318960abe2a4d2e1fe66969c8a71bbcfaa0000000000000000767c9816c36b03b2b3d7ae686db05eb5319239da6548f01e0041434d535c6a686d6f6e6c6f7264 PEAP: Setting User-Name to ACMS\usertest PEAP: Sending tunneled request EAP-Message = 0x020700491a02070044318960abe2a4d2e1fe66969c8a71bbcfaa0000000000000000767c9816c36b03b2b3d7ae686db05eb5319239da6548f01e0041434d535c6a686d6f6e6c6f7264 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ACMS\\usertest" State = 0x410be7cb410cfdb5854c84f429fbe15f server inner-tunnel { +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 7 length 73 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for usertest with NT-Password expand: --domain=%{mschap:NT-Domain} -> --domain=ACMS expand: --username=%{mschap:User-Name} -> --username=usertest mschap2: ba expand: --challenge=%{mschap:Challenge:-00} -> --challenge=b3dfd0f2062ff185 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=767c9816c36b03b2b3d7ae686db05eb5319239da6548f01e Exec-Program output: NT_KEY: 35E241131A9A3028B30C29496120AA85 Exec-Program-Wait: plaintext: NT_KEY: 35E241131A9A3028B30C29496120AA85 Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d34413435444431363133373234353141303230454339443134413644423132313746334130364546 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x410be7cb4003fdb5854c84f429fbe15f PEAP: Processing from tunneled session code 0x1448d00 11 EAP-Message = 0x010800331a0307002e533d34413435444431363133373234353141303230454339443134413644423132313746334130364546 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x410be7cb4003fdb5854c84f429fbe15f PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 195 to 10.254.0.32 port 32822 EAP-Message = 0x0108004a1900170301003f363cfc69b8eb543b309b5e3b0eeba4662d61f3f1ec8a55a0b4b401f987bcd6f1d8cf5f9e3cdc0c7d0afb0a22b49f6b0e67a301a591480f764cd0f5156c126f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67acae1861a4b710f826cb3d04781dae Finished request 9. Going to the next request Waking up in 4.6 seconds. Cleaning up request 3 ID 189 with timestamp +539 Cleaning up request 4 ID 190 with timestamp +539 Cleaning up request 5 ID 191 with timestamp +539 Waking up in 0.1 seconds. Cleaning up request 6 ID 192 with timestamp +539 Waking up in 0.1 seconds. Cleaning up request 7 ID 193 with timestamp +540 Cleaning up request 8 ID 194 with timestamp +540 Cleaning up request 9 ID 195 with timestamp +540 Ready to process requests. Here, it works : rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=80, length=167 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0201001001444f4d5c6361726c696f7a Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x74ac90d2e39e6e057f970e06f8d308f6 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:35 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 80 to 10.254.0.32 port 32822 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b1d3d4b9577b19a501eee06e Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=81, length=281 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0202007019800000006616030100610100005d03014a76d2cb4fcdc3ecfcf18e4f349f62ca5dff023b687e8448aa20c99d8aaa1dc02052f6239bf116d56a2f94fc6106c098bb169d635312641c10d18e36178ea6e45c001600040005000a000900640062000300060013001200630100 State = 0xb1d1cd33b1d3d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x8a4f52d9a7d1030ca81375cb707dbbf9 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 112 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 102 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06fa], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 81 to 10.254.0.32 port 32822 EAP-Message = 0x0103040019c000000757160301004a0200004603014a76d2ccf7d4afc8a7cdbafc342ef1b377a655e92f5329cd0367ba8ef969447f20e37338d7a07f9ad5f0fb0999ed7e6af69a00fefe44d7c085de718cd53f61f04d00040016030106fa0b0006f60006f30003243082032030820289a003020102020104300d06092a864886f70d010104050030819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a130441434d53310b3009060355040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f72 EAP-Message = 0x6974793126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e6672301e170d3039303531323037303233315a170d3139303531303037303233315a3070310b3009060355040613024652310f300d060355040813064672616e6365310d300b060355040a130441434d5331193017060355040313106c2d726164697573312e48512e444f4d3126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e667230820122300d06092a864886f70d01010105000382010f003082010a0282010100b591a1d3adb4e4ea8041108e8b7858638f181e1b0c9439ae22b6dd85f754c9 EAP-Message = 0x5a0cb03b3a5f5e44294598d31b1e69590452621253f761f2986999ef6e7814965bf0cbe10b16e0295fb88efc68979772f5053ba685d9af99b39994cbf17accde0831c26685960431dc4ac3696bf061ff0496a142ce2a576ad16c66c766cfe47038139a0584effb5bd1f63e502ae117e5286c79ad82192194bace81564e2c0ee5217b277a6969fd865a19152913cf50718ab09ccf01375bc1d5e7d501be14882cc1932693221a3274898e2d7387ced11b273c72d69a7719df1e43df7b6f54e7b70e9f3d91f216dcf1499e7ed37299fc3a982410737cde9ae04d76ab4053be800b0f0203010001a317301530130603551d25040c300a06082b0601050507 EAP-Message = 0x0301300d06092a864886f70d010104050003818100628fd16c16c9ca25d9fd4bf42b45dd9d1bba1b64146625d572b86a97e6c3780315511194fcf2510c4ce99393e61a63af985e6eb48438e8ef10d1f56f0380f626d9290e6b30f3459aa1ee66ae0556c5f5971a603343af9472105cabfb70eb144cb043f5cfadcc3a536f44bf3cd98c2bbb63af699594956609f75af9c9cadfe4e40003c9308203c53082032ea003020102020900ad028a9e72fb0f0a300d06092a864886f70d010104050030819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a13 EAP-Message = 0x0441434d53310b3009060355 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b0d2d4b9577b19a501eee06e Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=82, length=175 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020300061900 State = 0xb1d1cd33b0d2d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x6db7cf5ed3d73d831bb04492bc36e0a8 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 82 to 10.254.0.32 port 32822 EAP-Message = 0x010403671900040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f726974793126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e6672301e170d3036303232383134323835375a170d3236303232333134323835375a30819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a130441434d53310b3009060355040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f726974793126302406092a EAP-Message = 0x864886f70d0109011617706f73746d61737465724061636d732e6173736f2e667230819f300d06092a864886f70d010101050003818d0030818902818100bc7d9f74ab64f276ac4c0059fbb63dd341d6e3f6938bbcc1d18614b5218a137322253da30d2c08e67d48425c192b3693766807b794f928a931adbe115181bc8f00941de778eb402079cce8298e0dd0fe6e80921db123209728442395c238c2902ac3dc5b9f23d239fadea85e62cabd30a3c6cdb162c46fd51e6d386ba868a3390203010001a382010730820103301d0603551d0e041604149cbb859d57389413b3def35ced857b46105dc5de3081d30603551d230481cb3081c880149cbb85 EAP-Message = 0x9d57389413b3def35ced857b46105dc5dea181a4a481a130819e310b3009060355040613024652310f300d060355040813064672616e63653111300f0603550407130853757265736e6573310d300b060355040a130441434d53310b3009060355040b13024449312730250603550403131e41434d53202d2043657274696669636174696f6e20417574686f726974793126302406092a864886f70d0109011617706f73746d61737465724061636d732e6173736f2e6672820900ad028a9e72fb0f0a300c0603551d13040530030101ff300d06092a864886f70d0101040500038181001b0a6fb0e890320aadf9c0baa7f3ca810ad2c8e6f246bdeadc EAP-Message = 0xcda483532b27e5fb39164b2e3db6fb717f8534442e9efd065309d0e6c9d1a6e90c2fba2b7beb1e72f794bcccd2fc95190c65d9e97d1d37089610db9f6238adff67a1a2c818bd2e7ad5707603d6eb25e47681a57aceda1d2e2ea0e9ced9ba61c463f671a1b1d2f716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b3d5d4b9577b19a501eee06e Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=83, length=491 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020401401980000001361603010106100001020100621a6d6489a3b775a64ad3ee2f28e053794c50f912e68f4e67f03d70f8a0d1dd9dda173b2f6669f1b4c3bfdf17ae425ea3a2475b1191083540da42b1418efe2641b3a218326f60cf1b6eecd32d21409ea10079a2be923248253fd9a1c36db54260dc3562fb6c49245980d521d894763779662b0f70a32e0f48ae6b5767ea2c9e6c11409830b84f4bd3e553ee460afa486508d0e3e823fc251c6cd850cfbb1a43eecf83d5d03aed2e78f80f2e965ce7ceebf9259655c4c32d5efd88ed7a60ced5fcdaa5531be9bf7379597e25e7c37eca79eeca6ade118f9c7f904256e9f8b7d2563308f0480c8559 EAP-Message = 0x8942ff0c70a8c3ce206f908d3d2b3ee44fadc13d9a9f1e68140301000101160301002060d7e7fc4d412ea50f03efecf0d0cd8d01267753af8a16ff3095758ca82c3b9e State = 0xb1d1cd33b3d5d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x2c34b230bef2071b982d584fca5ec843 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 253 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 310 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 83 to 10.254.0.32 port 32822 EAP-Message = 0x0105003119001403010001011603010020c9602cd84aa7982ac74fdd03d1b658d1fb963f2d3b8ead12ea31c58209248c2b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b2d4d4b9577b19a501eee06e Finished request 3. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=85, length=175 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020500061900 State = 0xb1d1cd33b2d4d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x51af73ed1ede861fc06ee69ee7362ddd +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 85 to 10.254.0.32 port 32822 EAP-Message = 0x010600201900170301001514a38092da042a09a0d53f71c5db3c20253be3932a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b5d7d4b9577b19a501eee06e Finished request 4. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=84, length=208 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020600271900170301001c377f4b5460aaaa3ed396b66c24a6e7da327d38ffc15fdbbfa5071b7e State = 0xb1d1cd33b5d7d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x9458c933041125b9f6ca8610574f998f +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 39 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - ACMS\usertest PEAP: Got tunneled EAP-Message EAP-Message = 0x0206001001444f4d5c6361726c696f7a PEAP: Got tunneled identity of ACMS\usertest PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to ACMS\usertest PEAP: Sending tunneled request EAP-Message = 0x0206001001444f4d5c6361726c696f7a FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ACMS\\usertest" server inner-tunnel { +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 6 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010700251a0107002010556e70ce846691aea2c042838cb465b6444f4d5c6361726c696f7a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbb7f125bbc65603c947384488c39d8 PEAP: Processing from tunneled session code 0x1d6fa00 11 EAP-Message = 0x010700251a0107002010556e70ce846691aea2c042838cb465b6444f4d5c6361726c696f7a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbb7f125bbc65603c947384488c39d8 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 84 to 10.254.0.32 port 32822 EAP-Message = 0x0107003c190017030100315d3c38589f24e052410d29c4316debb268b576d1491c91397a2c2c47ed82de8d07e25f85ddbca888ce5f2f52498b00a17a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b4d6d4b9577b19a501eee06e Finished request 5. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=86, length=262 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0207005d19001703010052c5802a50a76626e911c84500e1b139ec0e448554c2539bfd8f2c422a750c6b46c2f45c07d81b631135434e59b0127081fbbb408133efa7d87546245dc74d5ea394ba4725db00c777e1db5649858339a6ff89 State = 0xb1d1cd33b4d6d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0xaaba5a2f699aa217dc67dbd1ad2c1b8b +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 7 length 93 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x020700461a0207004131b8a86f74525f79287c685926df8506b30000000000000000937766f3b6118923d4a2833ba1d198e1b0c984525ac7d57000444f4d5c6361726c696f7a PEAP: Setting User-Name to ACMS\usertest PEAP: Sending tunneled request EAP-Message = 0x020700461a0207004131b8a86f74525f79287c685926df8506b30000000000000000937766f3b6118923d4a2833ba1d198e1b0c984525ac7d57000444f4d5c6361726c696f7a FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ACMS\\usertest" State = 0x5bbb7f125bbc65603c947384488c39d8 server inner-tunnel { +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 7 length 70 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for usertest with NT-Password expand: --ACMSain=%{mschap:NT-ACMSain} -> --ACMSain=ACMS expand: --username=%{mschap:User-Name} -> --username=usertest mschap2: 55 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=b4dbd917acb3d690 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=937766f3b6118923d4a2833ba1d198e1b0c984525ac7d570 Exec-Program output: NT_KEY: D139B35EDBE5A4E870E34920F2D63FEF Exec-Program-Wait: plaintext: NT_KEY: D139B35EDBE5A4E870E34920F2D63FEF Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d36303743343137423644323646333643423935313230443135454133304346393743383145354232 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbb7f125ab365603c947384488c39d8 PEAP: Processing from tunneled session code 0x1d48ad0 11 EAP-Message = 0x010800331a0307002e533d36303743343137423644323646333643423935313230443135454133304346393743383145354232 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbb7f125ab365603c947384488c39d8 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 86 to 10.254.0.32 port 32822 EAP-Message = 0x0108004a1900170301003f790d3c1318deb33bc9b0bffbdc62f89cb9ef00e48a4369d5176e082332ac0f3e1adeececf9133a24e2db88a48f131b24f96b470ad735d56aab1e398d8b1962 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b7d9d4b9577b19a501eee06e Finished request 6. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=87, length=198 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0208001d19001703010012c0833497cbb416bd4af4736ed09a77f33fcc State = 0xb1d1cd33b7d9d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0x11904e5ce88bdc7e4015519888a50038 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 29 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x020800061a03 PEAP: Setting User-Name to ACMS\usertest PEAP: Sending tunneled request EAP-Message = 0x020800061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ACMS\\usertest" State = 0x5bbb7f125ab365603c947384488c39d8 server inner-tunnel { +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 8 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler ++[eap] returns ok Login OK: [ACMS\\usertest/<via Auth-Type = EAP>] (from client aruba1 port 0 via TLS tunnel) } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ACMS\\usertest" PEAP: Processing from tunneled session code 0x1d6d7f0 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ACMS\\usertest" PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS ++[eap] returns handled Sending Access-Challenge of id 87 to 10.254.0.32 port 32822 EAP-Message = 0x010900261900170301001b740c352358b879b666b2617fe8fa1cb29288f5b899546d41a5655a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1d1cd33b6d8d4b9577b19a501eee06e Finished request 7. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.254.0.32 port 32822, id=88, length=207 User-Name = "ACMS\\usertest" NAS-IP-Address = 10.254.0.30 NAS-Port = 2 NAS-Identifier = "10.254.0.32" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "0018DECCECAA" Called-Station-Id = "000B86613054" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020900261900170301001bd911f82a6b41a035a62496200168b13d84f72b9c8b9d86ed23c3c0 State = 0xb1d1cd33b6d8d4b9577b19a501eee06e Aruba-Essid-Name = "ACMS" Aruba-Location-Id = "254.1.2" Message-Authenticator = 0xc65b393765c82022a70ba974c1df2966 +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.254.0.32/auth-detail-20090803 expand: %t -> Mon Aug 3 14:06:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ACMS\usertest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 9 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success rlm_eap: Freeing handler ++[eap] returns ok Login OK: [ACMS\\usertest/<via Auth-Type = EAP>] (from client aruba1 port 2 cli 0018DECCECAA) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 88 to 10.254.0.32 port 32822 MS-MPPE-Recv-Key = 0x695e9dd8253cf8ad3be2d108b81c7071284dce6533e98dfc3c776afd46f80a2a MS-MPPE-Send-Key = 0x48dea6a783506a6d57acd8d4ae74e9911463c666e58cd632b44cb3146c832d30 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ACMS\\usertest" Finished request 8. Going to the next request Waking up in 4.6 seconds. Cleaning up request 0 ID 80 with timestamp +164 Cleaning up request 1 ID 81 with timestamp +165 Cleaning up request 2 ID 82 with timestamp +165 Waking up in 0.2 seconds. Cleaning up request 3 ID 83 with timestamp +165 Cleaning up request 4 ID 85 with timestamp +165 Cleaning up request 5 ID 84 with timestamp +165 Cleaning up request 6 ID 86 with timestamp +165 Cleaning up request 7 ID 87 with timestamp +165 Cleaning up request 8 ID 88 with timestamp +165 Thanks Jean-Hubert Monlord

2 1

Simple username password text file
by Paul Blalock 05 Aug '09

05 Aug '09

Is it possible to have a simplistic username and password setup in freeradius? For example. user, pass user1, pass1 Or is it possible to have the users file point to a file that does this? If not, is it possible to have this type of format by using mysql? -- Paul Blalock

3 2

Service-type
by Bert Beaudin 05 Aug '09

05 Aug '09

Hello all I have freeradius authenticating off of Active Directory. This is working but I now need to pass Service-Type = 6 for all connections that sussfuly authencate. What file and section to I put this in? Let me know if you need mroe information. Thanks, bert

1 0

Version 2.1.0 has been released.
by Alan DeKok 05 Aug '09

05 Aug '09

We are happy to announce the release of Version 2.1.0 of the FreeRADIUS server, with some major new features. Highlights include improved SNMP support, dynamically-defined clients, much more flexible (and readable) debugging mode, WiMAX support, fast reauthentication for PEAP and TTLS, and a command-line tool to administer a running server. The administration tool can stop the server, HUP it, or in limited cases, change the configuration of a running server, and cause just one module to reload it's configuration. Alan DeKok. Detailed change log: FreeRADIUS 2.1.0 Fri Sep 5 13:20:01 CEST 2008; , urgency=medium Feature improvements * Clients may now be defined dynamically, based on IP address. See raddb/sites-available/dynamic-clients. * SNMP support is now available through an experimental Perl script. See scripts/snmp-proxy/README * SNMP statistics are available through Status-Server packets. See raddb/sites-available/status * Added more Microsoft attributes from bug #568. * The "linelog" module has more functionality and flexibility. See raddb/modules/linelog. * The debugging output has been sanitized. It should be much more readable. * Debug logs can now be turned on/off while the server is running, for a user, group, realm, etc. See the "log" section of radiusd.conf. * Added support for WiMAX Forum attributes. The dynamic keys are not yet calculated. See share/dictionary.wimax * Added session resumption for PEAP and TTLS. See raddb/eap.conf, "cache" sub-section. * Added "radmin" command-line tool for administering a running server. See "man radmin" and raddb/sites-available/control-socket. Bug fixes * Double escaping of '\\' in the "users" (and some other) files has been fixed. If you have '\\' in the "users" file, your configuration WILL NEED TO BE CHECKED, AND FIXED! * Parse "security" section in radiusd.conf. This was accidentally deleted in 2.0.5. Closes bug #566. * Bind to interface before IP, which allows DHCP sockets to listen on "*" for multiple interfaces. * Fix handling of giaddr in DHCP responses. * Corrected parsing of status_check in home_server so that it works. * Fix hints so that "Puser" works again. * Removed length restrictions on attribute names in the dictionaries. * Update socket code to avoid C compiler optimizations.

6 14

Buffered SQL for authentication failures?
by John Morrissey 05 Aug '09

05 Aug '09

I'm in the process of replacing OSG's Radiator with FreeRADIUS. I have our relatively complex configuration mostly ported, but a few things have left me stumped. I'd like to write authentication failures to an SQL database using a detail listener so they're buffered, as with accounting: detail detail.auth { detailfile = ${radacctdir}/detail-auth detailperm = 0600 header = "%t" } post-auth { Post-Auth-Type REJECT { detail.auth } } server buffered-sql-auth { listen { type = detail filename = ${radacctdir}/detail-auth load_factor = 100 } post-auth { sql } } Detail entries are picked up by the listener, but it never seems to do anything with them: Going to the next request Waking up in 0.7 seconds. Polling for detail file /var/log/freeradius/radacct/detail-acct Polling for detail file /var/log/freeradius/radacct/detail-auth detail_recv: Renaming /var/log/freeradius/radacct/detail-auth -> /var/log/freeradius/radacct/detail-auth.work detail_recv: Read packet from /var/log/freeradius/radacct/detail-auth.work Packet-Type = Access-Reject Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Address = 255.255.255.254 Framed-Compression = Van-Jacobson-TCP-IP Framed-MTU = 1500 Acct-Delay-Time = 0 server buffered-sql-auth { } # server buffered-sql-auth Finished request 7. Cleaning up request 7 ID 41800 with timestamp +263 It looks like detail_recv() explicitly sets its RAD_REQUEST_FUNP to rad_accounting: *pfun = rad_accounting; I haven't looked much into the FreeRADIUS source yet; is it reasonably easy to determine/loop through the configured handlers for the detail listener to support a situation like this? Is there a better way of doing this? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

1 0