- Freeradius-Users - lists.freeradius.org

Re: Decoupled accounting
by Devinder Singh 04 Aug '09

04 Aug '09

Hi Ivan, ok could you let me know what do i need to alter in the Make File. Just wanted to make sure i dont do something wrong here What are the steps that i need to take to do this. I can see a Makefile in /etc/raddb/certs Thanks Devinder 2009/8/4 Ivan Kalik <tnt(a)kalik.net>: > OK, I think this is the issue where Windows refuses to accept server > certificate as the intermediate CA. You should alter Makefile in certs to > sign client certificates with CA and not server certificate. > > Ivan Kalik > Kalik Informatika ISP > >> Hi Ivan >> >> >> I still get the same error now >> >> >> Found Auth-Type = EAP >> +- entering group authenticate {...} >> [eap] Request found, released from the list >> [eap] EAP/tls >> [eap] processing type tls >> [tls] Authenticate >> [tls] processing EAP-TLS >> [tls] eaptls_verify returned 7 >> [tls] Done initial handshake >> [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate >> --> verify error:num=20:unable to get local issuer certificate >> [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca >> TLS Alert write:fatal:unknown CA >> TLS_accept:error in SSLv3 read client certificate B >> rlm_eap: SSL error error:140890B2:SSL >> routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned >> SSL: SSL_read failed in a system call (-1), TLS session fails. >> TLS receive handshake failed during operation >> [tls] eaptls_process returned 4 >> [eap] Handler failed in EAP/tls >> [eap] Failed in EAP select >> ++[eap] returns invalid >> Failed to authenticate the user. >> Using Post-Auth-Type Reject >> +- entering group REJECT {...} >> [attr_filter.access_reject] expand: %{User-Name} -> >> devinder(a)palettemm.com >> attr_filter: Matched entry DEFAULT at line 11 >> ++[attr_filter.access_reject] returns updated >> Delaying reject of request 7 for 1 seconds >> Going to the next request >> Waking up in 0.9 seconds. >> Sending delayed reject for request 7 >> Sending Access-Reject of id 141 to 203.121.4.59 port 6001 >> EAP-Message = 0x04070004 >> Message-Authenticator = 0x00000000000000000000000000000000 >> Waking up in 3.8 seconds. >> Cleaning up request 1 ID 135 with timestamp +120 >> Cleaning up request 2 ID 136 with timestamp +120 >> Cleaning up request 3 ID 137 with timestamp +120 >> Cleaning up request 4 ID 138 with timestamp +120 >> Cleaning up request 5 ID 139 with timestamp +120 >> Cleaning up request 6 ID 140 with timestamp +120 >> Waking up in 1.0 seconds. >> Cleaning up request 7 ID 141 with timestamp +120 >> Ready to process requests. >> >> >> >> 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: >>> Ok i took your advise and yes its a diffeenrent error now >>> >>> Listening on authentication address * port 1812 >>> Listening on accounting address * port 1813 >>> Listening on proxy address * port 1814 >>> Ready to process requests. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=134, length=181 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x0203001b01646576696e6465724070616c657474656d6d2e636f6d >>> Message-Authenticator = 0xb7f29ed2232abda7b5b24bb131883617 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 3 length 27 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> [pap] WARNING! No "known good" password found for the user. >>> Authentication may fail because of this. >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] EAP Identity >>> [eap] processing type md5 >>> rlm_eap_md5: Issuing Challenge >>> ++[eap] returns handled >>> Sending Access-Challenge of id 134 to 203.121.4.59 port 6001 >>> EAP-Message = 0x010400160410edd3007f1e599b71120693ed62eaee7c >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x17b5db9117b1dfd16583cca5ed9db022 >>> Finished request 0. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> Cleaning up request 0 ID 134 with timestamp +1 >>> Ready to process requests. >>> >>> >>> >>> >>> >>> 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: >>>> HI Ivan >>>> >>>> Thanks. Yes i have double click on the ca.der file and client.p12 both >>>> were installed successfuly. >>>> >>>> I also manaed to set up my SSID palstaff and when i click on the SSID >>>> i see a pop up windows on my wireles LAN asking for my username on >>>> certificate and i selected >>>> >>>> devinder(a)palettemm.com from the combo drop down list and click OK >>>> >>>> when i click OK radius reports the following error >>>> >>>> TLS Alert write:fatal:unknown CA >>>> TLS_accept:error in SSLv3 read client certificate B >>>> rlm_eap: SSL error error:140890B2:SSL >>>> routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned >>>> SSL: SSL_read failed in a system call (-1), TLS session fails. >>>> TLS receive handshake failed during operation >>>> [tls] eaptls_process returned 4 >>>> [eap] Handler failed in EAP/tls >>>> [eap] Failed in EAP select >>>> ++[eap] returns invalid >>>> Failed to authenticate the user. >>>> Using Post-Auth-Type Reject >>>> +- entering group REJECT {...} >>>> [attr_filter.access_reject] expand: %{User-Name} -> >>>> devinder(a)palettemm.com >>>> attr_filter: Matched entry DEFAULT at line 11 >>>> ++[attr_filter.access_reject] returns updated >>>> Delaying reject of request 6 for 1 seconds >>>> Going to the next request >>>> Waking up in 0.9 seconds. >>>> Sending delayed reject for request 6 >>>> Sending Access-Reject of id 133 to 203.121.4.59 port 6001 >>>> EAP-Message = 0x040a0004 >>>> Message-Authenticator = 0x00000000000000000000000000000000 >>>> Waking up in 3.6 seconds. >>>> Cleaning up request 0 ID 127 with timestamp +18 >>>> Cleaning up request 1 ID 128 with timestamp +18 >>>> Cleaning up request 2 ID 129 with timestamp +18 >>>> Cleaning up request 3 ID 130 with timestamp +18 >>>> Cleaning up request 4 ID 131 with timestamp +18 >>>> Waking up in 0.2 seconds. >>>> Cleaning up request 5 ID 132 with timestamp +18 >>>> Waking up in 1.0 seconds. >>>> Cleaning up request 6 ID 133 with timestamp +19 >>>> Ready to process requests. >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> 2009/8/4 Ivan Kalik <tnt(a)kalik.net>: >>>>>> I mnaged to follow the steps in /etc/raddb/certs/README >>>>>> >>>>>> and copied ca.der and client.p12 to XP machine >>>>> >>>>> It looks like you have copied them but not installed them in the >>>>> certificate store. Double-click the certificates and install them >>>>> first. >>>>> >>>>> Ivan Kalik >>>>> Kalik Informatika ISP >>>>> >>>>> >>>> >>>> >>>> >>>> -- >>>> Devinder >>>> >>> >>> >>> >>> -- >>> Devinder >>> >> >> >> >> -- >> Devinder >> > > > -- Devinder

1 0

LDAP PEAPv0/MSCHAPv2 Authentication
by Nicholas Cappelletti 04 Aug '09

04 Aug '09

Hello Everyone, I know I'll probably be berated with this and be told to read the documentation and the debug messages, but I'm at my whits end with this and would like a little direction, even if it a man page or something in the debug messages I missed. Okay, 802.1x for wireless works great when I'm using the default config files. I use the automatically generated cert and create a few users in the users config file. Here is the debug of that user authenticating: rad_recv: Access-Request packet from host 192.168.30.4 port 3072, id=0, length=221 Cleaning up request 31 ID 0 with timestamp +213 User-Name = "nick" NAS-IP-Address = 192.168.30.4 Called-Station-Id = "001217aa3fb7" Calling-Station-Id = "001b6301f74e" NAS-Identifier = "001217aa3fb7" NAS-Port = 56 Framed-MTU = 1400 State = 0xac75dd7bab7cc420d50c8e10f23f3553 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0209005b19001703010050e718360d0f11185fd80d47ada34e743f15ee4fe717bd546fdb0905964163642ec8de6d49e13fdaee97c1777c7729e8041f34f305d47aaabc0fc4814e76a3e2e69252faad5440929c8acf736479c90437 Message-Authenticator = 0x9c1f8ace22588eebd7a7e207c67d2910 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "nick", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 91 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0209003f1a0209003a3172435718fc889114f133ce5f13aa7e3a00000000000000008cacb226a61d81100b7f0313485b86d7fba9bedb93207397006e69636b server { PEAP: Setting User-Name to nick Sending tunneled request EAP-Message = 0x0209003f1a0209003a3172435718fc889114f133ce5f13aa7e3a00000000000000008cacb226a61d81100b7f0313485b86d7fba9bedb93207397006e69636b FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "nick" State = 0xa4d2ade0a4dbb70aa318d5923f95834c server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "nick", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 63 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry nick at line 60 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for nick with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a00331a0309002e533d35363630433534303036413841374444344632424236373344374337413542324634464431333331 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa4d2ade0a5d8b70aa318d5923f95834c [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00331a0309002e533d35363630433534303036413841374444344632424236373344374337413542324634464431333331 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa4d2ade0a5d8b70aa318d5923f95834c [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.30.4 port 3072 EAP-Message = 0x010a005b190017030100506b9a851f88d541fab50c47c1df1b0f06e628cea25b716609ff7d21ffebf29b985165fdd96ab6f1b3dc4c2d5840af2cf164d2239c46fe412099ed9a43c2b6a4671d194f2a97c8a71b46a2194d27b2b16b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac75dd7ba47fc420d50c8e10f23f3553 Finished request 32. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.30.4 port 3072, id=0, length=173 Cleaning up request 32 ID 0 with timestamp +213 User-Name = "nick" NAS-IP-Address = 192.168.30.4 Called-Station-Id = "001217aa3fb7" Calling-Station-Id = "001b6301f74e" NAS-Identifier = "001217aa3fb7" NAS-Port = 56 Framed-MTU = 1400 State = 0xac75dd7ba47fc420d50c8e10f23f3553 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020a002b19001703010020851f2695f1f66ef9a35dcb76dfa176acd5c47a131a8580c47eba67a5df577f00 Message-Authenticator = 0xdf5e02143bd04f312f52bdd368e70e7a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "nick", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00061a03 server { PEAP: Setting User-Name to nick Sending tunneled request EAP-Message = 0x020a00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "nick" State = 0xa4d2ade0a5d8b70aa318d5923f95834c server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "nick", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 10 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry nick at line 60 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "nick" [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "nick" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.30.4 port 3072 EAP-Message = 0x010b002b190017030100204c7bbda36687bbec748250a331403e85fcb9bc35f2a071afec4b072eb3cd8cc4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac75dd7ba57ec420d50c8e10f23f3553 Finished request 33. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.30.4 port 3072, id=0, length=173 Cleaning up request 33 ID 0 with timestamp +214 User-Name = "nick" NAS-IP-Address = 192.168.30.4 Called-Station-Id = "001217aa3fb7" Calling-Station-Id = "001b6301f74e" NAS-Identifier = "001217aa3fb7" NAS-Port = 56 Framed-MTU = 1400 State = 0xac75dd7ba57ec420d50c8e10f23f3553 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020b002b1900170301002018ce02e38e6c00b421658c4aedcbaa9b965e8c1c089954ec6a1fcc992a1468f8 Message-Authenticator = 0x48b93f3e89b5fc5a91a3d77f26ae3f35 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "nick", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.30.4 port 3072 MS-MPPE-Recv-Key = 0xa65e123a8723dbf8daff315d9eeefead767d1bf58f191a8cd2f14a3202535776 MS-MPPE-Send-Key = 0xfc919ac8721cfbf8ce4e09f20a9da90f63e65645ece3c293a878c58d7ae41af2 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "nick" Finished request 34. Going to the next request Waking up in 4.9 seconds. Cleaning up request 34 ID 0 with timestamp +214 Ready to process requests. ------------------------------------ And here is is when I configure the modules/ldap. This is with LDAP enabled for authentication in the sites-enabled/inner-tunnel with nothing else changed: rad_recv: Access-Request packet from host 192.168.30.4 port 3072, id=0, length=121 User-Name = "zack" NAS-IP-Address = 192.168.30.4 Called-Station-Id = "001217aa3fb7" Calling-Station-Id = "001b6301f74e" NAS-Identifier = "001217aa3fb7" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000009017a61636b Message-Authenticator = 0xba6a39bbf4d30c64ad62ca8af7de1e40 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "zack", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.30.4 port 3072 EAP-Message = 0x0101001604103d559c382e7e5d5dedb960b8107f467e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7a53d4d47a52d007e61d2d43d148851e Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.30.4 port 3072, id=0, length=121 Cleaning up request 0 ID 0 with timestamp +34 User-Name = "zack" NAS-IP-Address = 192.168.30.4 Called-Station-Id = "001217aa3fb7" Calling-Station-Id = "001b6301f74e" NAS-Identifier = "001217aa3fb7" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000009017a61636b Message-Authenticator = 0x3fa8484f6dc6f4a9dab5fccb4646fcf5 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "zack", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.30.4 port 3072 EAP-Message = 0x01010016041082fa9d0faaabc4dbae49e8c8fd2b8081 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0b7341550b724572c83e07f2140503b9 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 0 with timestamp +35 Ready to process requests. ----------------------------------- Again, I'm prepared to be told to look here or look there. I just need some guidence. :) --Nick

3 5

Simutaneus Check Query in FR2?
by Deepak 04 Aug '09

04 Aug '09

Hi, Currently my "Simultaneous-Use" attribute is not working and I have few questions regarding this. Following are my setup: ================ OS: CentOS 5.3 freeradius2-2.1.6 MySQL 5.0.45 PERL 5.8.8 =============== I am consulting the FAQ checklist. Some are not applicable to me since I am doing everything from SQL. 1) FAQ says "uncheck the Simutaneus check query in sql.conf" but I couldn't find that in in my sql.conf. Where is this in FR2? 2) in "/etc/raddb/sites-enable/default" I noticed that "radutmp" is uncommented by default in "session" and "accounting" section. I tried disabling this but no effect on simultaneous use. Do I need to turn on "radutmp" for something else (like for "radwho"? (What I mean is does any other part the freeradius use this feature for session and accounting purpose? Is it necessary to turn on this feature if I am using SQL for my session and accounting?) 3) I am trying to use "radwho" and it is giving me the error ========== "radwho: Error reading /var/log/radius/sradutmp: No such file or directory". ========== It is looking for "sradutmp" instead of "radutmp" which is not there. I guess probably it has its historical reasons. May be I can solve this my renaming the "radutmp" to "sradutmp" but I am not sure if I want to do that. 4) What are the other things I need to look for to solve this problem? Some suggestions greatly appreciated Thanks -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

2 4

Re: Freeradius-Users Digest, Vol 52, Issue 21
by Gilbert Lo 04 Aug '09

04 Aug '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Re: Decoupled accounting
by Devinder Singh 04 Aug '09

04 Aug '09

HI Ivan Thanks. Yes i have double click on the ca.der file and client.p12 both were installed successfuly. I also manaed to set up my SSID palstaff and when i click on the SSID i see a pop up windows on my wireles LAN asking for my username on certificate and i selected devinder(a)palettemm.com from the combo drop down list and click OK when i click OK radius reports the following error TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> devinder(a)palettemm.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 133 to 203.121.4.59 port 6001 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.6 seconds. Cleaning up request 0 ID 127 with timestamp +18 Cleaning up request 1 ID 128 with timestamp +18 Cleaning up request 2 ID 129 with timestamp +18 Cleaning up request 3 ID 130 with timestamp +18 Cleaning up request 4 ID 131 with timestamp +18 Waking up in 0.2 seconds. Cleaning up request 5 ID 132 with timestamp +18 Waking up in 1.0 seconds. Cleaning up request 6 ID 133 with timestamp +19 Ready to process requests. 2009/8/4 Ivan Kalik <tnt(a)kalik.net>: >> I mnaged to follow the steps in /etc/raddb/certs/README >> >> and copied ca.der and client.p12 to XP machine > > It looks like you have copied them but not installed them in the > certificate store. Double-click the certificates and install them first. > > Ivan Kalik > Kalik Informatika ISP > > -- Devinder

1 2

WPA Authentication
by Devinder Singh 04 Aug '09

04 Aug '09

Hi I have followed the instructions in /etc/raddb/certs to generate root server and client certificates . i copied root.der and client.p12 to XP machine and managed to install without any problems on XP i had configured Proxim AP 700 with WPA authentication When i click on SSID palstaff i get a pop up to select the client devinder(a)palettemm.com When i ran radisud -X i get some strange error in SSL Need you assistance on this. files] users: Matched entry devinder(a)palettemm.com at line 94 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate --> verify error:num=20:unable to get local issuer certificate [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> devinder(a)palettemm.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 126 to 203.121.4.59 port 6001 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 120 with timestamp +781 Cleaning up request 1 ID 121 with timestamp +781 Cleaning up request 2 ID 122 with timestamp +781 Cleaning up request 3 ID 123 with timestamp +781 Cleaning up request 4 ID 124 with timestamp +781 Cleaning up request 5 ID 125 with timestamp +781 Waking up in 1.0 seconds. Cleaning up request 6 ID 126 with timestamp +781 Ready to process requests. Devinder

1 0

Re: Decoupled accounting
by Devinder Singh 04 Aug '09

04 Aug '09

Hi I mnaged to follow the steps in /etc/raddb/certs/README and copied ca.der and client.p12 to XP machine When i run Radiusd -X i get Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate --> verify error:num=20:unable to get local issuer certificate [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> devinder(a)palettemm.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 98 to 203.121.4.59 port 6001 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 92 with timestamp +7 Cleaning up request 1 ID 93 with timestamp +7 Cleaning up request 2 ID 94 with timestamp +7 Cleaning up request 3 ID 95 with timestamp +7 Cleaning up request 4 ID 96 with timestamp +7 Cleaning up request 5 ID 97 with timestamp +7 Waking up in 1.0 seconds. Cleaning up request 6 ID 98 with timestamp +7 Ready to process requests. 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: > Ivan > > this is my director permissiion on /etc/raddb/certs > > 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: >> how do i chown radiusd /etc/raddb/certs >> >> >> >> 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> [tls] Received TLS ACK >>> [tls] ACK handshake fragment handler >>> [tls] eaptls_verify returned 1 >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 48 to 203.121.4.59 port 6001 >>> EAP-Message = >>> 0x010704000dc0000009478204a43082038ca003020102020900d590cbda3a11a132300d06092a864886f70d0101050500308192310b3009060355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f72697479301e170d3039303830333033343830355a170d3039303930323033343830355a308192310b3009060355040613024d593111300f06035504 >>> EAP-Message = >>> 0x08130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d42cbdfb9a6f9ceb5fbe99e32d62d9a6a8760e64b5a0026a45d42acac8d8de68009e3717cd35944d4030c9c85c2d95c9e75761a32c45adf3bec3c60b5a5f6dfdc622b70d486c407a54665d5ff58f74a5743f2e063aaa6d8d298169e792d370 >>> EAP-Message = >>> 0x6a7f3752c603ceb2be2ebfee7c3059ee4ceaca3695c3ef116a35e26f169b81d6e9c50bffe9c436bbbdf524db474435282a25febfb3b5ed973d81689c1328b84707c3c878f591e48b7aedb5161cafe8a6dd2e4493b8ed67e20d9142699bfda1681ae7139e7a105dbc45bc0b149dec5a280ef2a4cc0e2ad86867436bf1fbedfb5ef9f3d39ceccf7ec7efd164813e9ce202f06ef58c6d29470c23bfd1697d31cecd430203010001a381fa3081f7301d0603551d0e0416041449f8947678c307ad148fd0a0c5a391533ee6a0153081c70603551d230481bf3081bc801449f8947678c307ad148fd0a0c5a391533ee6a015a18198a48195308192310b300906 >>> EAP-Message = >>> 0x0355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f72697479820900d590cbda3a11a132300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100af0f1f02bf323c429efb8f3edbedf6ee6062e61eeb456ba280dc01b51555c2c93ca3d1f3c0ea49ffda0c4ed70949260b0fe6642b689eab183588746e7c2458ce020f27 >>> EAP-Message = 0x72d0f2c8ef880796a48a4639 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x62deb6d561d9bb124f3aa51530d369f1 >>> Finished request 4. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=49, length=178 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x62deb6d561d9bb124f3aa51530d369f1 >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = 0x020700060d00 >>> Message-Authenticator = 0x6d2e9d8a5cd95a1a8fc18325b8f88a39 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 7 length 6 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> [tls] Received TLS ACK >>> [tls] ACK handshake fragment handler >>> [tls] eaptls_verify returned 1 >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 49 to 203.121.4.59 port 6001 >>> EAP-Message = >>> 0x010801650d8000000947a1d78ae40853377f262dab6604e3534f9b991d387dda1acf7b2a165828cecf7198fa3519e9c398f9f54806d22a29777365a6651602590255d42009fadd80ccd452b671571840de2730d7d50b8478b6478b17cdb89e2a5b826aa1670805138427ff760119c30906bad29096307aaf871ca36d0a4b61e459ee52ea0f4b5c0f4eb2bd4c8f8049fcf44fcfda87cb9b3e1846aa7ab12ebe0a35148e378ef35181aabea20524ac7cfe702d701b8b57b661fd608716030100a50d00009d0301024000970095308192310b3009060355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a31 >>> EAP-Message = >>> 0x1c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f726974790e000000 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x62deb6d566d6bb124f3aa51530d369f1 >>> Finished request 5. >>> Going to the next request >>> Waking up in 4.8 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=50, length=1672 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x62deb6d566d6bb124f3aa51530d369f1 >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x020805d20dc0000005ee16030105be0b0003ae0003ab0003a8308203a43082028ca003020102020103300d06092a864886f70d010104050030818a310b3009060355040613024d593111300f0603550408130853656c616e676f72311c301a060355040a131350616c65747465204d756c74696d656469612e312330210603550403131a50616c65747465205365727665722043657274696669636174653125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d301e170d3039303830333034313133345a170d3130303830333034313133345a308186310b3009060355040613024d593111300f06035504 >>> EAP-Message = >>> 0x08130853656c616e676f72311c301a060355040a131350616c65747465204d756c74696d656469612e311f301d06035504031416646576696e6465724070616c657474656d6d2e636f6d3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a028f0c9637d0ba909226bfad97d1061d01ddf265185f2997d5243322335cd91343ed428c29ab9f7866fb26be520437de01cc109741dcbe0d7a83bf0cb92932c4674607eea85fdc0e2fb7682f214f708d0bd50520cd30d0cbf1a68477d1ef9ea04c6b8951ce9d57fbc3431 >>> EAP-Message = >>> 0x994b9cd5ea61c5608e963eb2d5301f78f3c4b6c93801374ccef2e8245d8fec043ad06b896cda97ecf0420669cdb4cf62826e31bb2ef967d09773254ced03ff60d0592b7da497a1c60e65862dc495fc9f99f78a4a5717d4b0563f35ceac77a053549eaf40c2eac3267cd7825fd3df9a5e6d9de45fff8cef6080aaa01b3c53ac846aa066552352d6b49b31ae445db5a8f9ac16ce7d2b0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010104050003820101006085f5f8417b7ef1e1dcb74a200999dab452d98a9a900ce5cafc1c6e30f1d3574b82145ebc3b4815075d48b762cd0dba7d6216294f10 >>> EAP-Message = >>> 0x8627af0c641e1ef0b1d4f7cb60c1afdb304831b3c0101e1f93a3f50567aaa3e5e8fee424986b41af8671d18732958b502ae1b4cb476655c3dce2cc6f44d5572f056b4992053c5d27e10a30476236e535032e7449e77e6e85fb53a6f952631099b3ac9ba016a192bf3fa78eaacfd45fe67040eee31eb04639049e8b95662b455376234d09c3a5ba9fac4ead0a128395d70a76134278cd12e6fe12a4e71eb5fd13e109dab1a5a3c949ad8b59ad68913f4535b7afbda44f715669e965fbd5d77697e57606ed96af0b5e60271000010201007a1f5b250a891d30ab5d616e8e4ab4585bc384f73c877d8758cbea3cdd8d76ff288f6919b77abb6434ce9d8fe5 >>> EAP-Message = >>> 0x362368ac21c3841dfab96bba705bd3b60c1967386f9efb0fb50234b4f5ed3933d7c154b1f363557674d7aa8dfff723637c55145dca8ffef427c7115e6fcfa965be5e315c97ba624d9a2be383b4d0be1dc4d1514532dc4c4b5a7cd1ea1e9d7084e4c01cfd2835271ca0d5611318316bf53cf910f7e9d5bed30dbc957ce3ee97e143f24a1a79f45be99bfb812611c90376575f9754f6b8d7aad5fb7865e40b643334de76c68d2196c4105a3f221f7a8603ec2330db055efff70dc47fed5ddb5ae3bec19f31be655b7771e6e8582016d3626a41a00f00010201004bbfd3312cfc92fe9e217f90f05575e9592fc63d0cd11fe4d3f312e775862130095e7f6a >>> EAP-Message = >>> 0x6c7fe5fc510236d68a166fc71dcbc8abe4b7c21c7f41776ae3e89b3afa4134d105d33b10e8caf58fbc23ac07e3fc3b41eeb5abf29cd011dc43b3e05e99f3de81a819e5455ca14b218c86f973485844739388d20dba8af5e894f648b935896fd16fc833ffd3381e2e1a778b83dd9fefe103f647cad570fd94c865135277299307ef0c3ee70a31bbabbaea3021063807100a2e4f6563b1455e663df9ca8b3f73576ce45170280045a18d30b7aed639e99d479536d857ef6b7d44cde521590d6688045ed32a0a524fcfd2926777c53013747fc40d3fd98cf7402550e6d71403010001 >>> Message-Authenticator = 0x2d49686ce9585a8543c601ffb006fac4 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 8 length 253 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> TLS Length 1518 >>> [tls] Received EAP-TLS First Fragment of the message >>> [tls] eaptls_verify returned 9 >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 50 to 203.121.4.59 port 6001 >>> EAP-Message = 0x010900060d00 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x62deb6d567d7bb124f3aa51530d369f1 >>> Finished request 6. >>> Going to the next request >>> Waking up in 4.8 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=51, length=216 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x62deb6d567d7bb124f3aa51530d369f1 >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x0209002c0d000116030100204fe855fc95e171b64cf548234edbbba8766c057c55fc938b4e64e30ebdd0e2ab >>> Message-Authenticator = 0x5717c92937ae05e6413b61d5a3ff3004 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 9 length 44 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> [tls] eaptls_verify returned 7 >>> [tls] Done initial handshake >>> [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate >>> --> verify error:num=20:unable to get local issuer certificate >>> [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca >>> TLS Alert write:fatal:unknown CA >>> TLS_accept:error in SSLv3 read client certificate B >>> rlm_eap: SSL error error:140890B2:SSL >>> routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned >>> SSL: SSL_read failed in a system call (-1), TLS session fails. >>> TLS receive handshake failed during operation >>> [tls] eaptls_process returned 4 >>> [eap] Handler failed in EAP/tls >>> [eap] Failed in EAP select >>> ++[eap] returns invalid >>> Failed to authenticate the user. >>> Using Post-Auth-Type Reject >>> +- entering group REJECT {...} >>> [attr_filter.access_reject] expand: %{User-Name} -> >>> devinder(a)palettemm.com >>> attr_filter: Matched entry DEFAULT at line 11 >>> ++[attr_filter.access_reject] returns updated >>> Delaying reject of request 7 for 1 seconds >>> Going to the next request >>> Waking up in 0.9 seconds. >>> Sending delayed reject for request 7 >>> Sending Access-Reject of id 51 to 203.121.4.59 port 6001 >>> EAP-Message = 0x04090004 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> Waking up in 3.8 seconds. >>> Cleaning up request 1 ID 45 with timestamp +27 >>> Cleaning up request 2 ID 46 with timestamp +27 >>> Cleaning up request 3 ID 47 with timestamp +27 >>> Cleaning up request 4 ID 48 with timestamp +27 >>> Cleaning up request 5 ID 49 with timestamp +27 >>> Cleaning up request 6 ID 50 with timestamp +27 >>> Waking up in 1.0 seconds. >>> Cleaning up request 7 ID 51 with timestamp +27 >>> Ready to process requests. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=52, length=181 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x0201001b01646576696e6465724070616c657474656d6d2e636f6d >>> Message-Authenticator = 0xe5b179ce51b5db29be069ebd7000f412 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 1 length 27 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> [pap] WARNING! No "known good" password found for the user. >>> Authentication may fail because of this. >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] EAP Identity >>> [eap] processing type md5 >>> rlm_eap_md5: Issuing Challenge >>> ++[eap] returns handled >>> Sending Access-Challenge of id 52 to 203.121.4.59 port 6001 >>> EAP-Message = 0x0102001604108195b49b704b8992bd4258cf70513300 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x92094dc4920b49c63e9e9d887da9f2ad >>> Finished request 8. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=53, length=178 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x92094dc4920b49c63e9e9d887da9f2ad >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = 0x02020006030d >>> Message-Authenticator = 0x22eb6a82d37f5eafd5ba8a5abc81f834 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 2 length 6 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> [pap] WARNING! No "known good" password found for the user. >>> Authentication may fail because of this. >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP NAK >>> [eap] EAP-NAK asked for EAP-Type/tls >>> [eap] processing type tls >>> [tls] Requiring client certificate >>> [tls] Initiate >>> [tls] Start returned 1 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 53 to 203.121.4.59 port 6001 >>> EAP-Message = 0x010300060d20 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x92094dc4930a40c63e9e9d887da9f2ad >>> Finished request 9. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=54, length=252 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x92094dc4930a40c63e9e9d887da9f2ad >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x020300500d800000004616030100410100003d03014a7794cc001bbe59615bb39e4e9a325ca1fd23210fdba327dda3ff227b9e03b400001600040005000a000900640062000300060013001200630100 >>> Message-Authenticator = 0xb50e7a762392b806ee2162fc3a3e13b7 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 3 length 80 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> TLS Length 70 >>> [tls] Length Included >>> [tls] eaptls_verify returned 11 >>> [tls] (other): before/accept initialization >>> [tls] TLS_accept: before/accept initialization >>> [tls] <<< TLS 1.0 Handshake [length 0041], ClientHello >>> [tls] TLS_accept: SSLv3 read client hello A >>> [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello >>> [tls] TLS_accept: SSLv3 write server hello A >>> [tls] >>> TLS 1.0 Handshake [length 0869], Certificate >>> [tls] TLS_accept: SSLv3 write certificate A >>> [tls] >>> TLS 1.0 Handshake [length 00a5], CertificateRequest >>> [tls] TLS_accept: SSLv3 write certificate request A >>> [tls] TLS_accept: SSLv3 flush data >>> [tls] TLS_accept: Need to read more data: SSLv3 read client >>> certificate A >>> In SSL Handshake Phase >>> In SSL Accept mode >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 54 to 203.121.4.59 port 6001 >>> EAP-Message = >>> 0x010404000dc000000947160301002a0200002603014a77953adaad636bbf032c0b182768cb323f0ae98c04e48c76ca655c6956c20b0000040016030108690b0008650008620003b4308203b030820298a003020102020102300d06092a864886f70d0101040500308192310b3009060355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f7269747930 >>> EAP-Message = >>> 0x1e170d3039303830333033353933355a170d3130303830333033353933355a30818a310b3009060355040613024d593111300f0603550408130853656c616e676f72311c301a060355040a131350616c65747465204d756c74696d656469612e312330210603550403131a50616c65747465205365727665722043657274696669636174653125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a02820101009c8f8d9eedcaf99b0366303d49b8576398606a36211c5c37f1253a8fc4aeb838f5ccb860559404d5757863308d1d983f >>> EAP-Message = >>> 0x30692d13aadb60700efb9d16bab77902a044fc6e4a10a1fba7d64eb02a791b4f94fc4602fa1e472c670769e9e2fb831bfffa719fae87e1c441e3333b2c675eaee504355a3cd971f1c622eaa1d8dab363a5d52dc4526fd8fe29d71c3b834972083cd2947e8833946e542a37a00f09afc83140308ee140e4450d9231c8a3b281d2ad9c95137f3bc54e2ea14f079cc54c469683b7dc064d90893fbda765454bd1d6ce8a6fd4e7b546ad1d0d744f0faa775cab24668a42363132f52cfcd73506b4b8c2e97cb6c24fb8a02a0b28dcea76ace30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500 >>> EAP-Message = >>> 0x03820101008f7692e8149dd275e0c14c3fc8453ab3c621911960ef3e63c5f1d1cc2af6a2b779b66427a9cdcd89e40dd173ec31e92e7dfc92bedf7fb91700f8409f625a5b369bed3d71922d7bee389d510146f300b0eeebdb94f0fa3444a93db04c61a02462970ca6042d3e837505c6ba0458e9ff2e629d4b044fd1c56a63674fca359d45cd115e91749d3899dfd60f55a2b8deb6ca90c2edd0ee4b2d00030495a73ff450e9bd059f3012873142b9f27b24c98a4f15bfcea7a9b47b75710a2f998e17654dd8e8a3e1c88f245469d332ea97935fcf7d43f00ba59a89a61885fa120840ce40c8f71358ef1335280be33cb331fb00158018d96db2b82efb7d >>> EAP-Message = 0x5cfc17ff37dd97490004a830 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x92094dc4900d40c63e9e9d887da9f2ad >>> Finished request 10. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=55, length=178 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x92094dc4900d40c63e9e9d887da9f2ad >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = 0x020400060d00 >>> Message-Authenticator = 0x3f1612c468a749f2d7be889ece43af04 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 4 length 6 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> [tls] Received TLS ACK >>> [tls] ACK handshake fragment handler >>> [tls] eaptls_verify returned 1 >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 55 to 203.121.4.59 port 6001 >>> EAP-Message = >>> 0x010504000dc0000009478204a43082038ca003020102020900d590cbda3a11a132300d06092a864886f70d0101050500308192310b3009060355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f72697479301e170d3039303830333033343830355a170d3039303930323033343830355a308192310b3009060355040613024d593111300f06035504 >>> EAP-Message = >>> 0x08130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d42cbdfb9a6f9ceb5fbe99e32d62d9a6a8760e64b5a0026a45d42acac8d8de68009e3717cd35944d4030c9c85c2d95c9e75761a32c45adf3bec3c60b5a5f6dfdc622b70d486c407a54665d5ff58f74a5743f2e063aaa6d8d298169e792d370 >>> EAP-Message = >>> 0x6a7f3752c603ceb2be2ebfee7c3059ee4ceaca3695c3ef116a35e26f169b81d6e9c50bffe9c436bbbdf524db474435282a25febfb3b5ed973d81689c1328b84707c3c878f591e48b7aedb5161cafe8a6dd2e4493b8ed67e20d9142699bfda1681ae7139e7a105dbc45bc0b149dec5a280ef2a4cc0e2ad86867436bf1fbedfb5ef9f3d39ceccf7ec7efd164813e9ce202f06ef58c6d29470c23bfd1697d31cecd430203010001a381fa3081f7301d0603551d0e0416041449f8947678c307ad148fd0a0c5a391533ee6a0153081c70603551d230481bf3081bc801449f8947678c307ad148fd0a0c5a391533ee6a015a18198a48195308192310b300906 >>> EAP-Message = >>> 0x0355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f72697479820900d590cbda3a11a132300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100af0f1f02bf323c429efb8f3edbedf6ee6062e61eeb456ba280dc01b51555c2c93ca3d1f3c0ea49ffda0c4ed70949260b0fe6642b689eab183588746e7c2458ce020f27 >>> EAP-Message = 0x72d0f2c8ef880796a48a4639 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x92094dc4910c40c63e9e9d887da9f2ad >>> Finished request 11. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=56, length=178 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x92094dc4910c40c63e9e9d887da9f2ad >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = 0x020500060d00 >>> Message-Authenticator = 0x9c8cc7715cfe14bc2ed6f2b8655c0220 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 5 length 6 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> [tls] Received TLS ACK >>> [tls] ACK handshake fragment handler >>> [tls] eaptls_verify returned 1 >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 56 to 203.121.4.59 port 6001 >>> EAP-Message = >>> 0x010601650d8000000947a1d78ae40853377f262dab6604e3534f9b991d387dda1acf7b2a165828cecf7198fa3519e9c398f9f54806d22a29777365a6651602590255d42009fadd80ccd452b671571840de2730d7d50b8478b6478b17cdb89e2a5b826aa1670805138427ff760119c30906bad29096307aaf871ca36d0a4b61e459ee52ea0f4b5c0f4eb2bd4c8f8049fcf44fcfda87cb9b3e1846aa7ab12ebe0a35148e378ef35181aabea20524ac7cfe702d701b8b57b661fd608716030100a50d00009d0301024000970095308192310b3009060355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a31 >>> EAP-Message = >>> 0x1c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f726974790e000000 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x92094dc4960f40c63e9e9d887da9f2ad >>> Finished request 12. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=57, length=1672 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x92094dc4960f40c63e9e9d887da9f2ad >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x020605d20dc0000005ee16030105be0b0003ae0003ab0003a8308203a43082028ca003020102020103300d06092a864886f70d010104050030818a310b3009060355040613024d593111300f0603550408130853656c616e676f72311c301a060355040a131350616c65747465204d756c74696d656469612e312330210603550403131a50616c65747465205365727665722043657274696669636174653125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d301e170d3039303830333034313133345a170d3130303830333034313133345a308186310b3009060355040613024d593111300f06035504 >>> EAP-Message = >>> 0x08130853656c616e676f72311c301a060355040a131350616c65747465204d756c74696d656469612e311f301d06035504031416646576696e6465724070616c657474656d6d2e636f6d3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a028f0c9637d0ba909226bfad97d1061d01ddf265185f2997d5243322335cd91343ed428c29ab9f7866fb26be520437de01cc109741dcbe0d7a83bf0cb92932c4674607eea85fdc0e2fb7682f214f708d0bd50520cd30d0cbf1a68477d1ef9ea04c6b8951ce9d57fbc3431 >>> EAP-Message = >>> 0x994b9cd5ea61c5608e963eb2d5301f78f3c4b6c93801374ccef2e8245d8fec043ad06b896cda97ecf0420669cdb4cf62826e31bb2ef967d09773254ced03ff60d0592b7da497a1c60e65862dc495fc9f99f78a4a5717d4b0563f35ceac77a053549eaf40c2eac3267cd7825fd3df9a5e6d9de45fff8cef6080aaa01b3c53ac846aa066552352d6b49b31ae445db5a8f9ac16ce7d2b0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010104050003820101006085f5f8417b7ef1e1dcb74a200999dab452d98a9a900ce5cafc1c6e30f1d3574b82145ebc3b4815075d48b762cd0dba7d6216294f10 >>> EAP-Message = >>> 0x8627af0c641e1ef0b1d4f7cb60c1afdb304831b3c0101e1f93a3f50567aaa3e5e8fee424986b41af8671d18732958b502ae1b4cb476655c3dce2cc6f44d5572f056b4992053c5d27e10a30476236e535032e7449e77e6e85fb53a6f952631099b3ac9ba016a192bf3fa78eaacfd45fe67040eee31eb04639049e8b95662b455376234d09c3a5ba9fac4ead0a128395d70a76134278cd12e6fe12a4e71eb5fd13e109dab1a5a3c949ad8b59ad68913f4535b7afbda44f715669e965fbd5d77697e57606ed96af0b5e60271000010201007eeb09107338770671a4942b45c4ff05f3c5e1d51411c581cb4491aaef3bc2ea8240a30444083bbcc543e408db >>> EAP-Message = >>> 0x01f980dfc84174065984fea22109efff29f90fc2ffe3f777386d35cfd478a2ef082700be3a4e85218cb20c5756c94854f23521dadbacbc33cdc80174153213f7c506ba8b89cafbb447ba919ab5b6b9ead24e4f352f0e02cb1daf32beed767bd160e99c8ca76bdd6308311a320cc2431eff0342dc2e11597829aadce97dec048e0fb7b8aee32490143ce64e3a491ab9300f03a0acf9f4f1430884dfdf0e5dc93e5e009a27922153d227be5f7985c7c23beb2d8860a96982e88173765c604ed146381386428a38f5ad31ca34eedebfa00c5f78200f00010201006e383e587281e7cf69508af21ceb1f9335d9b666ecad0bdcf4f2b3d72827aa23479f4e47 >>> EAP-Message = >>> 0xaf27fdcfbeafc8da935c1df948d31300498f3eb96fed62f79734f7d016d83b69ce34e915cc6fac754c46169c33ff6a102712fbb61bb44201a5a60b1317b06bcd72c5fe9650d302d6c66e4b670f41c26aa4f38f1519a0071f1c6352f05fe85bdaa2eb7f90833d667877a5e4e9c6b36bdfe219659aa3c3c439ff304f10947da32aeecd1ab25cc553653d1a4260771906ac181160cb64f464391f33a50c8b93225ebae4b9d40cb737890946c9f3de7a696396a71393e3a9919279a216f5dc7f665be50965f0dda21a4482ce44dcb92c0de1310fc1af9b3ab0e2e71547661403010001 >>> Message-Authenticator = 0x3c5c56dd8206e86f40fc58199cff01bd >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 6 length 253 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> TLS Length 1518 >>> [tls] Received EAP-TLS First Fragment of the message >>> [tls] eaptls_verify returned 9 >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 57 to 203.121.4.59 port 6001 >>> EAP-Message = 0x010700060d00 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x92094dc4970e40c63e9e9d887da9f2ad >>> Finished request 13. >>> Going to the next request >>> Waking up in 4.8 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=58, length=216 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x92094dc4970e40c63e9e9d887da9f2ad >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x0207002c0d000116030100206a37ffeef11849b1d0a6d9ef7e63012b68850674c5863fe770d7f04338d6e235 >>> Message-Authenticator = 0xcfa5e7a49f8af947020ce3ea3cef21eb >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 7 length 44 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> [tls] eaptls_verify returned 7 >>> [tls] Done initial handshake >>> [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate >>> --> verify error:num=20:unable to get local issuer certificate >>> [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca >>> TLS Alert write:fatal:unknown CA >>> TLS_accept:error in SSLv3 read client certificate B >>> rlm_eap: SSL error error:140890B2:SSL >>> routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned >>> SSL: SSL_read failed in a system call (-1), TLS session fails. >>> TLS receive handshake failed during operation >>> [tls] eaptls_process returned 4 >>> [eap] Handler failed in EAP/tls >>> [eap] Failed in EAP select >>> ++[eap] returns invalid >>> Failed to authenticate the user. >>> Using Post-Auth-Type Reject >>> +- entering group REJECT {...} >>> [attr_filter.access_reject] expand: %{User-Name} -> >>> devinder(a)palettemm.com >>> attr_filter: Matched entry DEFAULT at line 11 >>> ++[attr_filter.access_reject] returns updated >>> Delaying reject of request 14 for 1 seconds >>> Going to the next request >>> Waking up in 0.9 seconds. >>> Sending delayed reject for request 14 >>> Sending Access-Reject of id 58 to 203.121.4.59 port 6001 >>> EAP-Message = 0x04070004 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> Waking up in 3.8 seconds. >>> Cleaning up request 8 ID 52 with timestamp +164 >>> Cleaning up request 9 ID 53 with timestamp +164 >>> Cleaning up request 10 ID 54 with timestamp +164 >>> Cleaning up request 11 ID 55 with timestamp +164 >>> Cleaning up request 12 ID 56 with timestamp +164 >>> Cleaning up request 13 ID 57 with timestamp +165 >>> Waking up in 1.0 seconds. >>> Cleaning up request 14 ID 58 with timestamp +165 >>> Ready to process requests. >>> ^C >>> linux-h9qt:/etc/raddb # clear >>> linux-h9qt:/etc/raddb # radiusd -X >>> FreeRADIUS Version 2.1.1, for host x86_64-suse-linux-gnu, built on Dec >>> 3 2008 at 13:57:16 >>> Copyright (C) 1999-2008 The FreeRADIUS server project and >>> contributors. >>> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A >>> PARTICULAR PURPOSE. >>> You may redistribute copies of FreeRADIUS under the terms of the >>> GNU General Public License v2. >>> Starting - reading configuration files ... >>> including configuration file /etc/raddb/radiusd.conf >>> including configuration file /etc/raddb/proxy.conf >>> including configuration file /etc/raddb/clients.conf >>> including files in directory /etc/raddb/modules/ >>> including configuration file /etc/raddb/modules/wimax >>> including configuration file /etc/raddb/modules/ippool >>> including configuration file /etc/raddb/modules/expiration >>> including configuration file /etc/raddb/modules/inner-eap >>> including configuration file /etc/raddb/modules/exec >>> including configuration file /etc/raddb/modules/mac2ip >>> including configuration file /etc/raddb/modules/krb5 >>> including configuration file /etc/raddb/modules/logintime >>> including configuration file /etc/raddb/modules/detail >>> including configuration file /etc/raddb/modules/digest >>> including configuration file /etc/raddb/modules/etc_group >>> including configuration file /etc/raddb/modules/sql_log >>> including configuration file /etc/raddb/modules/attr_filter >>> including configuration file /etc/raddb/modules/always >>> including configuration file /etc/raddb/modules/ldap >>> including configuration file /etc/raddb/modules/files >>> including configuration file /etc/raddb/modules/detail.log >>> including configuration file /etc/raddb/modules/radutmp >>> including configuration file /etc/raddb/modules/preprocess >>> including configuration file /etc/raddb/modules/realm >>> including configuration file /etc/raddb/modules/sradutmp >>> including configuration file /etc/raddb/modules/policy >>> including configuration file /etc/raddb/modules/linelog >>> including configuration file /etc/raddb/modules/counter >>> including configuration file /etc/raddb/modules/smbpasswd >>> including configuration file /etc/raddb/modules/expr >>> including configuration file /etc/raddb/modules/mac2vlan >>> including configuration file /etc/raddb/modules/checkval >>> including configuration file /etc/raddb/modules/unix >>> including configuration file /etc/raddb/modules/pam >>> including configuration file /etc/raddb/modules/echo >>> including configuration file /etc/raddb/modules/passwd >>> including configuration file /etc/raddb/modules/mschap >>> including configuration file /etc/raddb/modules/detail.example.com >>> including configuration file /etc/raddb/modules/acct_unique >>> including configuration file /etc/raddb/modules/attr_rewrite >>> including configuration file /etc/raddb/modules/chap >>> including configuration file /etc/raddb/modules/pap >>> including configuration file /etc/raddb/eap.conf >>> including configuration file /etc/raddb/sql.conf >>> including configuration file /etc/raddb/sql/mysql/dialup.conf >>> including configuration file /etc/raddb/sql/mysql/counter.conf >>> including configuration file /etc/raddb/policy.conf >>> including files in directory /etc/raddb/sites-enabled/ >>> including configuration file /etc/raddb/sites-enabled/default >>> including configuration file /etc/raddb/sites-enabled/inner-tunnel >>> group = radiusd >>> user = radiusd >>> including dictionary file /etc/raddb/dictionary >>> main { >>> prefix = "/usr" >>> localstatedir = "/var" >>> logdir = "/var/log/radius" >>> libdir = "/usr/lib64/freeradius" >>> radacctdir = "/var/log/radius/radacct" >>> hostname_lookups = no >>> max_request_time = 30 >>> cleanup_delay = 5 >>> max_requests = 1024 >>> allow_core_dumps = no >>> pidfile = "/var/run/radiusd/radiusd.pid" >>> checkrad = "/usr/sbin/checkrad" >>> debug_level = 0 >>> proxy_requests = yes >>> log { >>> stripped_names = no >>> auth = no >>> auth_badpass = no >>> auth_goodpass = no >>> } >>> security { >>> max_attributes = 200 >>> reject_delay = 1 >>> status_server = yes >>> } >>> } >>> client localhost { >>> ipaddr = 127.0.0.1 >>> require_message_authenticator = no >>> secret = "testing123" >>> nastype = "other" >>> } >>> client 192.168.1.0/24 { >>> require_message_authenticator = no >>> secret = "testing123-1" >>> shortname = "private-network-1" >>> } >>> client 203.121.4.11 { >>> require_message_authenticator = no >>> secret = "testing123-1" >>> shortname = "private-network3" >>> } >>> client 203.121.4.59 { >>> require_message_authenticator = no >>> secret = "testing123-1" >>> shortname = "Proxim-700" >>> nastype = "other" >>> } >>> radiusd: #### Loading Realms and Home Servers #### >>> proxy server { >>> retry_delay = 5 >>> retry_count = 3 >>> default_fallback = no >>> dead_time = 120 >>> wake_all_if_all_dead = no >>> } >>> home_server localhost { >>> ipaddr = 127.0.0.1 >>> port = 1812 >>> type = "auth" >>> secret = "testing123" >>> response_window = 20 >>> max_outstanding = 65536 >>> zombie_period = 40 >>> status_check = "status-server" >>> ping_interval = 30 >>> check_interval = 30 >>> num_answers_to_alive = 3 >>> num_pings_to_alive = 3 >>> revive_interval = 120 >>> status_check_timeout = 4 >>> } >>> home_server_pool my_auth_failover { >>> type = fail-over >>> home_server = localhost >>> } >>> realm example.com { >>> auth_pool = my_auth_failover >>> } >>> realm LOCAL { >>> } >>> radiusd: #### Instantiating modules #### >>> instantiate { >>> Module: Linked to module rlm_exec >>> Module: Instantiating exec >>> exec { >>> wait = no >>> input_pairs = "request" >>> shell_escape = yes >>> } >>> Module: Linked to module rlm_expr >>> Module: Instantiating expr >>> Module: Linked to module rlm_expiration >>> Module: Instantiating expiration >>> expiration { >>> reply-message = "Password Has Expired " >>> } >>> Module: Linked to module rlm_logintime >>> Module: Instantiating logintime >>> logintime { >>> reply-message = "You are calling outside your allowed timespan >>> " >>> minimum-timeout = 60 >>> } >>> } >>> radiusd: #### Loading Virtual Servers #### >>> server inner-tunnel { >>> modules { >>> Module: Checking authenticate {...} for more modules to load >>> Module: Linked to module rlm_pap >>> Module: Instantiating pap >>> pap { >>> encryption_scheme = "auto" >>> auto_header = no >>> } >>> Module: Linked to module rlm_chap >>> Module: Instantiating chap >>> Module: Linked to module rlm_mschap >>> Module: Instantiating mschap >>> mschap { >>> use_mppe = yes >>> require_encryption = no >>> require_strong = no >>> with_ntdomain_hack = no >>> } >>> Module: Linked to module rlm_unix >>> Module: Instantiating unix >>> unix { >>> radwtmp = "/var/log/radius/radwtmp" >>> } >>> Module: Linked to module rlm_eap >>> Module: Instantiating eap >>> eap { >>> default_eap_type = "md5" >>> timer_expire = 60 >>> ignore_unknown_eap_types = no >>> cisco_accounting_username_bug = no >>> max_sessions = 2048 >>> } >>> Module: Linked to sub-module rlm_eap_md5 >>> Module: Instantiating eap-md5 >>> Module: Linked to sub-module rlm_eap_leap >>> Module: Instantiating eap-leap >>> Module: Linked to sub-module rlm_eap_gtc >>> Module: Instantiating eap-gtc >>> gtc { >>> challenge = "Password: " >>> auth_type = "PAP" >>> } >>> Module: Linked to sub-module rlm_eap_tls >>> Module: Instantiating eap-tls >>> tls { >>> rsa_key_exchange = no >>> dh_key_exchange = yes >>> rsa_key_length = 512 >>> dh_key_length = 512 >>> verify_depth = 0 >>> pem_file_type = yes >>> private_key_file = "/etc/raddb/certs/server.pem" >>> certificate_file = "/etc/raddb/certs/server.pem" >>> CA_file = "/etc/raddb/certs/ca.pem" >>> private_key_password = "devin123" >>> dh_file = "/etc/raddb/certs/dh" >>> random_file = "/etc/raddb/certs/random" >>> fragment_size = 1024 >>> include_length = yes >>> check_crl = no >>> cipher_list = "DEFAULT" >>> make_cert_command = "/etc/raddb/certs/bootstrap" >>> cache { >>> enable = no >>> lifetime = 24 >>> max_entries = 255 >>> } >>> } >>> Module: Linked to sub-module rlm_eap_ttls >>> Module: Instantiating eap-ttls >>> ttls { >>> default_eap_type = "md5" >>> copy_request_to_tunnel = no >>> use_tunneled_reply = no >>> virtual_server = "inner-tunnel" >>> } >>> Module: Linked to sub-module rlm_eap_peap >>> Module: Instantiating eap-peap >>> peap { >>> default_eap_type = "mschapv2" >>> copy_request_to_tunnel = no >>> use_tunneled_reply = no >>> proxy_tunneled_request_as_eap = yes >>> virtual_server = "inner-tunnel" >>> } >>> Module: Linked to sub-module rlm_eap_mschapv2 >>> Module: Instantiating eap-mschapv2 >>> mschapv2 { >>> with_ntdomain_hack = no >>> } >>> Module: Checking authorize {...} for more modules to load >>> Module: Linked to module rlm_realm >>> Module: Instantiating suffix >>> realm suffix { >>> format = "suffix" >>> delimiter = "@" >>> ignore_default = no >>> ignore_null = no >>> } >>> Module: Linked to module rlm_files >>> Module: Instantiating files >>> files { >>> usersfile = "/etc/raddb/users" >>> acctusersfile = "/etc/raddb/acct_users" >>> preproxy_usersfile = "/etc/raddb/preproxy_users" >>> compat = "no" >>> } >>> Module: Checking session {...} for more modules to load >>> Module: Linked to module rlm_radutmp >>> Module: Instantiating radutmp >>> radutmp { >>> filename = "/var/log/radius/radutmp" >>> username = "%{User-Name}" >>> case_sensitive = yes >>> check_with_nas = yes >>> perm = 384 >>> callerid = yes >>> } >>> Module: Checking post-proxy {...} for more modules to load >>> Module: Checking post-auth {...} for more modules to load >>> Module: Linked to module rlm_attr_filter >>> Module: Instantiating attr_filter.access_reject >>> attr_filter attr_filter.access_reject { >>> attrsfile = "/etc/raddb/attrs.access_reject" >>> key = "%{User-Name}" >>> } >>> } >>> } >>> modules { >>> Module: Checking authenticate {...} for more modules to load >>> Module: Checking authorize {...} for more modules to load >>> Module: Linked to module rlm_preprocess >>> Module: Instantiating preprocess >>> preprocess { >>> huntgroups = "/etc/raddb/huntgroups" >>> hints = "/etc/raddb/hints" >>> with_ascend_hack = no >>> ascend_channels_per_line = 23 >>> with_ntdomain_hack = no >>> with_specialix_jetstream_hack = no >>> with_cisco_vsa_hack = no >>> with_alvarion_vsa_hack = no >>> } >>> Module: Checking preacct {...} for more modules to load >>> Module: Linked to module rlm_acct_unique >>> Module: Instantiating acct_unique >>> acct_unique { >>> key = "User-Name, Acct-Session-Id, NAS-IP-Address, >>> Client-IP-Address, NAS-Port" >>> } >>> Module: Checking accounting {...} for more modules to load >>> Module: Linked to module rlm_detail >>> Module: Instantiating detail >>> detail { >>> detailfile = >>> "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" >>> header = "%t" >>> detailperm = 384 >>> dirperm = 493 >>> locking = no >>> log_packet_header = no >>> } >>> Module: Instantiating attr_filter.accounting_response >>> attr_filter attr_filter.accounting_response { >>> attrsfile = "/etc/raddb/attrs.accounting_response" >>> key = "%{User-Name}" >>> } >>> Module: Checking session {...} for more modules to load >>> Module: Checking post-proxy {...} for more modules to load >>> Module: Checking post-auth {...} for more modules to load >>> } >>> radiusd: #### Opening IP addresses and Ports #### >>> listen { >>> type = "auth" >>> ipaddr = * >>> port = 0 >>> } >>> listen { >>> type = "acct" >>> ipaddr = * >>> port = 0 >>> } >>> Listening on authentication address * port 1812 >>> Listening on accounting address * port 1813 >>> Listening on proxy address * port 1814 >>> Ready to process requests. >>> >>> >>> >>> 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: >>>> Hi Ivan, >>>> >>>> When i clik on my SSID palstaff it prompts for the certificate name >>>> >>>> username on certificate so i selected >>>> >>>> devinder(a)palettemm.com >>>> >>>> Click OK then authentication failed on the SSID >>>> >>>> 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: >>>>> Hi Ivan >>>>> >>>>> Ok i managed to install ca.der and client.p12 on my XP >>>>> >>>>> When i run radiusd -X i get >>>>> >>>>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>>>> id=30, length=216 >>>>> User-Name = "devinder(a)palettemm.com" >>>>> NAS-IP-Address = 203.121.4.59 >>>>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>>>> Calling-Station-Id = "00-04-23-7b-56-b9" >>>>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>>>> State = 0xf30ae66df60debd09c91249e7b82f0a9 >>>>> Framed-MTU = 1400 >>>>> NAS-Port-Type = Wireless-802.11 >>>>> EAP-Message = >>>>> 0x0207002c0d000116030100205a6f866d20eb642ddc9f404f90d8650422eb751e7bb0199a016bb14e384df6fa >>>>> Message-Authenticator = 0x06206416bbe520db012eb924f72ba75e >>>>> +- entering group authorize {...} >>>>> ++[preprocess] returns ok >>>>> ++[chap] returns noop >>>>> ++[mschap] returns noop >>>>> [suffix] Looking up realm "palettemm.com" for User-Name = >>>>> "devinder(a)palettemm.com" >>>>> [suffix] No such realm "palettemm.com" >>>>> ++[suffix] returns noop >>>>> [eap] EAP packet type response id 7 length 44 >>>>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>>>> ++[eap] returns updated >>>>> ++[unix] returns notfound >>>>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>>>> ++[files] returns ok >>>>> ++[expiration] returns noop >>>>> ++[logintime] returns noop >>>>> ++[pap] returns noop >>>>> Found Auth-Type = EAP >>>>> +- entering group authenticate {...} >>>>> [eap] Request found, released from the list >>>>> [eap] EAP/tls >>>>> [eap] processing type tls >>>>> [tls] Authenticate >>>>> [tls] processing EAP-TLS >>>>> [tls] eaptls_verify returned 7 >>>>> [tls] Done initial handshake >>>>> [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate >>>>> --> verify error:num=20:unable to get local issuer certificate >>>>> [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca >>>>> TLS Alert write:fatal:unknown CA >>>>> TLS_accept:error in SSLv3 read client certificate B >>>>> rlm_eap: SSL error error:140890B2:SSL >>>>> routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned >>>>> SSL: SSL_read failed in a system call (-1), TLS session fails. >>>>> TLS receive handshake failed during operation >>>>> [tls] eaptls_process returned 4 >>>>> [eap] Handler failed in EAP/tls >>>>> [eap] Failed in EAP select >>>>> ++[eap] returns invalid >>>>> Failed to authenticate the user. >>>>> Using Post-Auth-Type Reject >>>>> +- entering group REJECT {...} >>>>> [attr_filter.access_reject] expand: %{User-Name} -> devinder(a)palettemm.com >>>>> attr_filter: Matched entry DEFAULT at line 11 >>>>> ++[attr_filter.access_reject] returns updated >>>>> Delaying reject of request 6 for 1 seconds >>>>> Going to the next request >>>>> Waking up in 0.9 seconds. >>>>> Sending delayed reject for request 6 >>>>> Sending Access-Reject of id 30 to 203.121.4.59 port 6001 >>>>> EAP-Message = 0x04070004 >>>>> Message-Authenticator = 0x00000000000000000000000000000000 >>>>> Waking up in 3.8 seconds. >>>>> Cleaning up request 0 ID 24 with timestamp +83 >>>>> Cleaning up request 1 ID 25 with timestamp +83 >>>>> Cleaning up request 2 ID 26 with timestamp +83 >>>>> Cleaning up request 3 ID 27 with timestamp +83 >>>>> Cleaning up request 4 ID 28 with timestamp +83 >>>>> Cleaning up request 5 ID 29 with timestamp +83 >>>>> Waking up in 1.0 seconds. >>>>> Cleaning up request 6 ID 30 with timestamp +83 >>>>> Ready to process requests. >>>>> >>>>> >>>>> >>>>> Users File >>>>> >>>>> >>>>> "devinder(a)palettemm.com" Auth-Type := EAP >>>>> >>>>> DEFAULT Auth-Type := Reject >>>>> Reply-Message = "Authentication Failed" >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> 2009/8/3 Ivan Kalik <tnt(a)kalik.net>: >>>>>>> Do i copy this file to the XP and install ca.der >>>>>>> >>>>>>> ca.der and client.p12 >>>>>> >>>>>> Yes. >>>>>> >>>>>> Ivan Kalik >>>>>> Kalik Informatika ISP >>>>>> >>>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> Devinder >>>>> >>>> >>>> >>>> >>>> -- >>>> Devinder >>>> >>> >>> >>> >>> -- >>> Devinder >>> >> >> >> >> -- >> Devinder >> > > > > -- > Devinder > -- Devinder

1 1

Filter or restrict on NAS
by Rakotomandimby Mihamina 04 Aug '09

04 Aug '09

Hi all, Configuration (Debian packaged): - freeradius 2.0.4 - pgsql 8.3 When AUTHing and ACCounTing, the FreeRADIUS makes some SQL queries containing the NAS information. Currently, on our system, the query SELECTs a function and depending on that NAS information brought in the query we answer by a Access-Reject if from the bad NAS. - Is there, in the default FreeRadius proposed SQL schema a way to restrict on NAS? - Is there a query (or table) just for that usage? -- Architecte Informatique: Administration Systeme, Recherche & Developpement + 261 32 11 401 65 Pensez a l'environnement avant d'imprimer ce message

2 2

phpRadmin,dialupAdmin?
by RANDRIAMAMPIONONA José Johnny 04 Aug '09

04 Aug '09

Hello, Does anyone know if these projects still active! In fact , I d like to install it on my server but it looks like non-existent! Thanks! Sincerly! -- JJohnny R.

2 1

rlm_ldap: ldap_search() failed: Operations error
by Alba 03 Aug '09

03 Aug '09

Hello all, I'm receiving this message: rlm_ldap: ldap_search() failed: Operations error and I found in the list archives ( http://www.nabble.com/FreeRadius-cannot-Authenticate-to-Windows-AD-td196909…) this information: > rlm_ldap: ldap_search() failed: Operations error > http://bugs.freeradius.org/show_bug.cgi?id=183 > You're running into two issues: > > - the OpenLDAP client libraries don't use the >authentication credentials they're given when following references. > > - Active Directory is following references because your domain >controller has two domains, and the user isn't found in one, so it's >being referred to the other domain. > >The patch might help, but your LDAP queries should be made more specific. > Alan DeKok. But I can't see the bug information ("Page not found"). Does anyone know were I can find this information or other information about what this message means? Thanks in advance for your help. Regards, Alba

3 6