- Freeradius-Users - lists.freeradius.org

response_window and zombie_period problem
by Ana Gallardo 25 Jun '09

25 Jun '09

Hello, first of all, sorry for my english. I'm testing Freeradius 2.0.4+dfsg-6 in Debian. I want to configure proxy like this (proxy.conf): # radiusxx authentication home_server radiusxx_auth { type = auth ipaddr = 1.2.3.4 port = 1812 secret = secret response_window = 50 zombie_period = 20 status_check = request username = "user" password = "pass" check_interval = 30 num_answers_to_alive = 3 } # radiusxx accounting home_server radiusxx_acct { type = acct ipaddr = 1.2.3.4 port = 1813 secret = secret response_window = 50 zombie_period = 20 status_check = request username = "user" password = "pass" check_interval = 30 num_answers_to_alive = 3 } # radiusyy authentication home_server radiusyy_auth { type = auth ipaddr = 1.2.3.5 port = 1812 secret = secret response_window = 50 zombie_period = 20 status_check = request username = "user" password = "pass" check_interval = 30 num_answers_to_alive = 3 } # radiusyy accounting home_server radiusyy_acct { type = acct ipaddr = 1.2.3.5 port = 1813 secret = secret response_window = 50 zombie_period = 20 status_check = request username = "user" password = "pass" check_interval = 30 num_answers_to_alive = 3 } #authentication pool home_server_pool my_auth { type = fail-over home_server = radiusxx_auth home_server = radiusyy_auth } #accounting pool home_server_pool my_acct { type = fail-over home_server = radiusxx_acct home_server = radiusyy_acct } realm myrealm.my { auth_pool = my_auth acct_pool = my_acct # nostrip } My problem is when I'm going to test failover: I stop Freeradius in xx server and I send a authentication request. Sending Access-Request of id 143 to 1.2.3.4 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x3238 Proxying request 0 to home server 1.2.3.4 port 1812 Sending Access-Request of id 143 to 1.2.3.4 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x3238 Going to the next request Waking up in 0.9 seconds. Waking up in 28.9 seconds. rad_recv: Access-Request packet from host 1.2.2.2 port 39710, id=28, length=75 Sending duplicate proxied request to home server 1.2.3.4 port 1812 - ID: 143 Sending Access-Request of id 143 to 1.2.3.4 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x3238 Waking up in 26.9 seconds. rad_recv: Access-Request packet from host 1.2.2.2 port 39710, id=28, length=75 Sending duplicate proxied request to home server 1.2.3.4 port 1812 - ID: 143 Sending Access-Request of id 143 to 1.2.3.4 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x3238 Waking up in 23.9 seconds. . . . WARNING: Marking home server 1.2.3.4 port 1812 as zombie (it looks like it is dead). After 30 seconds I always get an accept_reject the first time. But if my zombie_period = 20, don't must mark radiusxx as zombie after 20 seconds and proxy my request to radiusyy. My response_window = 50 and Freeradius must wait 50 seconds before consider the request dead. Then, when I send another authentication request: Sending Access-Request of id 129 to 1.2.3.4 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x31 Proxying request 1 to home server 1.2.3.4 port 1812 Sending Access-Request of id 129 to 1.2.3.4 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x31 Going to the next request Waking up in 0.9 seconds. Waking up in 28.9 seconds. rad_recv: Access-Request packet from host 1.2.2.2 port 59850, id=1, length=75 FAILURE: Marking home server 1.2.3.4 port 1812 as dead. Sending Access-Request of id 118 to 1.2.3.5 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x31 Proxying request 1 to home server 1.2.3.5 port 1812 Sending Access-Request of id 118 to 1.2.3.5 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x31 Waking up in 26.9 seconds. rad_recv: Access-Accept packet from host 1.2.3.5 port 1812, id=118, length=23 Proxy-State = 0x31 I don't know why Freeradius doesn't send me an acces-accept, when I send the first request, after mark radiusxx (zombie_period = 20) as zombie and proxy the request to radiusyy. Thank you and sorry for my english.

3 4

Re: Old password 'grace period'
by Arran Cudbard-Bell 25 Jun '09

25 Jun '09

On 25/6/09 13:11, Ivan Kalik wrote: >>> I have tested something like this yesterday - it doesn't. You can't just >>> replace Cleartext-Password. NT-Password and LM-Passowrd were created for >>> the "new" password and mschap module will reuse them, completely >>> ignoring >>> "old" Cleartext-Password. They need to be removed or replaced before >>> mschap module is called again. >> Writes the NT-Password and LM-Password values back to the control list of >> the request. >> >> But seeing as the values are just being stored in the control list of the >> request, >> we can remove them using unlang. >> >> >> authenticate { >> mschap { > > Just for the readers of the list - the section is Auth-Type MS-CHAP not > mschap. Oops, yep Auth-Type MS-CHAP. > >> update control { >> Cleartext-Password := "%{sql_new:SELECT<cleartext password >> query...>}" >> } >> mschap { >> reject = 2 >> } > > Ah, so that's how you make if work. Yep. Otherwise reject has a priority/opcode of reject, and the request is rejected ;) > >> if(reject){ >> update control { >> NT-Password -= "%{control:NT-Password}" >> LM-Password -= "%{control:LM-Password}" > > Yes, I had that lined up, but couldn't get if to work. > >> Cleartext-Password := "%{sql_old:SELECT<cleartext >> password query...>}" >> } >> mschap >> } >> } >> } > > Ok, pap failover done this way now works. I can't test mschap from where I > am right now but I don't see a problem any more. My construction is > slightly different - I read only replacement password from sql assuming > that the usual one is pulled by regular sql queries (my scenario has > Cleartext-Password and custom attribute Old-Password both in same radcheck > table). That should work fine too. So you can just swap out the first update control { Cleartext-Password .... } bit for a call to the SQL module. Though you'd probably want to put it in the authorise section... So it'd be something like : instantiate { sql_old } authorize { # Retrieves credentials sql_new # Sets auth-type mschap mschap } authenticate { Auth-Type MS-CHAP { mschap { reject = 2 } if(reject){ # Remove stale password hashes created on first call to rlm_mschap update control { NT-Password -= "%{control:NT-Password}" LM-Password -= "%{control:LM-Password}" Cleartext-Password := "%{sql_old:SELECT<cleartext password query...>}" } mschap } } } Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer, Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2

1 0

Old password 'grace period'
by Arran Cudbard-Bell 25 Jun '09

25 Jun '09

-------- Original Message -------- Subject: Re: Old password 'grace period' Date: Thu, 25 Jun 2009 12:11:07 +0100 From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> Organization: University of Sussex To: tnt(a)kalik.net [snip] > I have tested something like this yesterday - it doesn't. You can't just > replace Cleartext-Password. NT-Password and LM-Passowrd were created for > the "new" password and mschap module will reuse them, completely ignoring > "old" Cleartext-Password. They need to be removed or replaced before > mschap module is called again. Ahhh ok... Yes, the code agrees with you :) } else if (!password) { RDEBUG2("No Cleartext-Password configured. Cannot create LM-Password."); } else { /* there is a configured Cleartext-Password */ lm_password = radius_pairmake(request, &request->config_items, "LM-Password", "", T_OP_EQ); Writes the NT-Password and LM-Password values back to the control list of the request. But seeing as the values are just being stored in the control list of the request, we can remove them using unlang. authenticate { mschap { update control { Cleartext-Password := "%{sql_new:SELECT <cleartext password query...>}" } mschap { reject = 2 } if(reject){ update control { NT-Password -= "%{control:NT-Password}" LM-Password -= "%{control:LM-Password}" Cleartext-Password := "%{sql_old:SELECT <cleartext password query...>}" } mschap } } } Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer, Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2 -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer, Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2

1 0

new member
by K bharathan 25 Jun '09

25 Jun '09

i'd have freeradius rpm for opensuse 11 appreciate ur guidance thanks

1 0

problem to forcing TLS and reject PEAP
by Mauro Screti 25 Jun '09

25 Jun '09

Hi all, i need to authenicate in wireless network only users that use eap-tls as method, and reject the same user that try in peap. I just use Huntgroup for filtering the users, but the same username can be used in wired network with PEAP and in wireless netwok by TLS. I insert in my users file this configuration item: DEFAULT Huntgroup-Name == wi-fi, Ldap-Group == "wifi", EAP-Type == PEAP, Auth-Type := Reject DEFAULT Huntgroup-Name == wi-fi, Ldap-Group == "wifi", EAP-Type == TLS Fall-Through = No DEFAULT Ldap-Group == "user", Huntgroup-Name == user Fall-Through = No The fist DEFAULT should reject the request if the EAP-type is PEAP, while the second DEFAULT should accept only the request if the EAP is TLS .... i think :-)) but during the test i note that if i force wifi in PEAP, the request is reject from the second default, and not in the fist, this is the log: Wed Jun 24 14:02:36 2009 : Debug: users: Matched entry DEFAULT at line 3 ( line 3 is the second DEFAULT ) the reject is because it dont is able to oepn tls If i try in TLS the system accept the request.... The questions is....Why the Peap request dont match the fist DEFAULT ? thanks for all help mauro

3 2

ubuntu server, FreeRadius 2.1.6, Active Directory Win2K3, Cisco Aironet AG1242
by Petar Marinkovic 25 Jun '09

25 Jun '09

I've read several threads, but none of them helped me. I saw that few users had similar problems as mine, but somehow I can't get it to work. We're using FreeRadius for testing purposes. Story goes like this, I installed freeradius and managed to get it work with test user in users file and PEAP. Problems begin when I started to try to use AD to authenticate users. I followed this tutorial http://deployingradius.com/documents/configuration/active_directory.html, and everything works great, until the last part . I managed to add the machine to domain, kinit command worked, wbinfo also, same as ntlm_auth, it says NT_USER_OK or similar. Thing is that when I try to connect an XP SP3 user via WiFI, authentication doesnt work. Here's the server debug, when it starts petar@freeradius:~$ sudo freeradius -X FreeRADIUS Version 2.1.6, for host i486-pc-linux-gnu, built on Jun 18 2009 at 14:35:49 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/control-socket group = freerad user = freerad including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 172.17.0.93 { require_message_authenticator = no secret = "testing123" shortname = "172.17.0.93" nastype = "cisco" } client 172.17.0.0/24 { require_message_authenticator = no secret = "testing123" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=EXCHANGE --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-EXCHANGE}--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/freeradius/freeradius.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/freeradius/freeradius.sock Listening on proxy address * port 1814 Ready to process requests. Here is the output when user with domen credentials try to connect via WiFi. For setting up that I checked last part of "old" tutorial http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=87, length=153 User-Name = "EXCHANGE\\pmarinkovic" Framed-MTU = 1400 Called-Station-Id = "0014.1cde.6ab0" Calling-Station-Id = "0016.ead8.3812" Service-Type = Login-User Message-Authenticator = 0xd325a4d6017bfc77cf5bd3c213ae1745 EAP-Message = 0x020200190145584348414e47455c706d6172696e6b6f766963 NAS-Port-Type = Wireless-802.11 NAS-Port = 18204 NAS-IP-Address = 172.17.0.93 NAS-Identifier = "ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "EXCHANGE\pmarinkovic", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 25 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 87 to 172.17.0.93 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68aa16cc68a90f2af50a0ba6abea9d5a Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=88, length=226 User-Name = "EXCHANGE\\pmarinkovic" Framed-MTU = 1400 Called-Station-Id = "0014.1cde.6ab0" Calling-Station-Id = "0016.ead8.3812" Service-Type = Login-User Message-Authenticator = 0xd65c918a92d5de6981b0fa3bc0aaea39 EAP-Message = 0x0203005019800000004616030100410100003d03014a4213d23c2079e6582ef6c7470d2013dd975aca0d5227311929f95487d0594a00001600040005000a000900640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 18204 State = 0x68aa16cc68a90f2af50a0ba6abea9d5a NAS-IP-Address = 172.17.0.93 NAS-Identifier = "ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "EXCHANGE\pmarinkovic", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 88 to 172.17.0.93 port 1645 EAP-Message = 0x0104040019c00000089b160301002a0200002603014a42140726eb8f99c597f39a57ae4a007cbeca5e9a6da4f6d53570dc77b8fee500000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303631383132343133375a170d3130303631383132343133375a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100b9cff9695c7b6e0a56aa0b242cb9a07bd57b0718d52c01564d0b68b3555965ce9d43d45b041c53daee6a8c4b2324801cd6ba4364c52b174ba9f39d4fd6b2 EAP-Message = 0xf78ba7fb9c98f95fa6be789fdeac4f17fe237a5abb8370700b78aeb53c7924e0ac26a8808c49e76f7671eb031d1f24718bc7d4058c5c674271362cecf28fa3169541031775ad716871d104c35c868d64644395fec87b58f2965d2b6629c8b2730bcc6cab8ab74c6b7a85ac5ba9fa1b2ff67763428c90078fc0d2150a41716fdd2bf8f9f915e72732c1ca643d671fea89ff55cc5d2aeb49a0266c14fb9573941fb7e2b986b750e7c830cb7a6ded5f5965726337fc24196ebfdd624c5ea40242e51d570203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003820101009565721e4e1cc2fb33 EAP-Message = 0x69d5d123852116d311bae5d9450fbbe6c195ea05acc84bd39d93d4d7acf00af9586947734b42d259696db4f6f96005c210907daefa0831362db018b64943e26e0bddcb663901f686b7f94183255294e6520e271e9cf932a74dba38890cb829fffe4a86a8dc33a34ef8ee3b7fbf64beeca7d75975ea3556cf9689e6042582a600ccfd40ef4a1e62bef677b09c3f2875298c3c7b8b62e552e7b19c083353f5b042cc68f42d9edbfc40452e7f5153f91d4aa80be64cb1e96e7585b031935467ded8d12599c5e89824ba64112b9e67c508d67c48cbee5dcbf20bc80a360a005ecb707833bb16850616e39dd34ec35542ff9613b80aaa53f2940004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68aa16cc69ae0f2af50a0ba6abea9d5a Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=89, length=152 User-Name = "EXCHANGE\\pmarinkovic" Framed-MTU = 1400 Called-Station-Id = "0014.1cde.6ab0" Calling-Station-Id = "0016.ead8.3812" Service-Type = Login-User Message-Authenticator = 0x54bc861048eda2e22203034f3eb31f02 EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 18204 State = 0x68aa16cc69ae0f2af50a0ba6abea9d5a NAS-IP-Address = 172.17.0.93 NAS-Identifier = "ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "EXCHANGE\pmarinkovic", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 89 to 172.17.0.93 port 1645 EAP-Message = 0x010503fc1940008be5093fd724bf3b300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303631383132343133375a170d3130303631383132343133375a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100b2387b926b71c0b483fae83d644f512ec4cf31cc22a456786ad78fe9260c5ad0ed084803a53005e711af4e38320cae4dabddc4f308e2397c67f27b65fb66b59a1b3ca469d271dbe63d1d68b5fe19bd9964d623a97719b25f469cab10ab905d2f259659d4f95d1068be55d3c88d7e47 EAP-Message = 0xb3c4c05b8d93ec53a8bfa9776ded03ff64317ef6ce04722c73e63f4672ba3131c3a818c994c100481195bd4d620850b5b6cea036976ead412ac077e8fb58142517ef53fae5ccd3380ae57a873659f144b9bf9204b092741dc4f6d3d6a5f478f6ec2a0ada457778edaffec26bd36be9e28ab59ad1817ac5902692dc6a574946d6dfadd0ff18b13e329980ad23d8d1e43e450203010001a381fb3081f8301d0603551d0e041604141eebd5a29c221e94740f672acf7ee98a2fd82b303081c80603551d230481c03081bd80141eebd5a29c221e94740f672acf7ee98a2fd82b30a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f726974798209008be5093fd724bf3b300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010005525a77c2eafa9426fb81adb9f5b755abdcfdcd797a140c2ed7752ea621ac4e7fe59b15e9b032ab9c01ca92e400010dae6b00ce089dc026510221a7408b77373469311bf4c79e16c9cbc51a4e8bdbfc1048 EAP-Message = 0xc3be21b792c4ed44 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68aa16cc6aaf0f2af50a0ba6abea9d5a Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=90, length=152 User-Name = "EXCHANGE\\pmarinkovic" Framed-MTU = 1400 Called-Station-Id = "0014.1cde.6ab0" Calling-Station-Id = "0016.ead8.3812" Service-Type = Login-User Message-Authenticator = 0x4aa0ce893551d6796e4ad98991f72c7a EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 18204 State = 0x68aa16cc6aaf0f2af50a0ba6abea9d5a NAS-IP-Address = 172.17.0.93 NAS-Identifier = "ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "EXCHANGE\pmarinkovic", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 90 to 172.17.0.93 port 1645 EAP-Message = 0x010600b51900a73433974eaca7174e319cb9708968c1efee2e5560ed1a98add3ff825b9c9b01472a7cd67c0c4f4b12b3a0d8751b039683fc88ce04b8da5ea71539a4a489ae0e19db05e4c410c1c9efef5233c0a5c28c1301b72a583bb952ec8ab7da466464a7e61a7227ece5fcf9ffcf230642c011a1140916315783367053fb2b974be359082c462e7d067ef710d750c9646b8b704fd5b36454f10af7b5e8cb999e9bcd7007448ac284613a16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68aa16cc6bac0f2af50a0ba6abea9d5a Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=91, length=468 User-Name = "EXCHANGE\\pmarinkovic" Framed-MTU = 1400 Called-Station-Id = "0014.1cde.6ab0" Calling-Station-Id = "0016.ead8.3812" Service-Type = Login-User Message-Authenticator = 0x8e5ddf0e25d2b052a6f94a88d0263087 EAP-Message = 0x0206014019800000013616030101061000010201007797e2f40c6e89796600ce543bfe70485622255a8239b73db3550a7f3ba9f341d8af63e1894d913c58f507ea0457daf79a5f1f12588fec8ea52d9a8c3172aaf276930ba07116d21b1ed3d5768626a0b26ac5e1b1f41887ee1667f0cf2c050ba8cedc7fbe027c0efa9b11e92dac089fa628e0badfca2b566eb512104092565bd115a2c46c4fb4f1d6a4b879bfdf25401f16652e3fb1db6d197db077e90c7a0b931634e028163d79755c7b1da3552261b05e5ebff1d5e960ac4272ea661a7609b46a07ffdc00f31a09e2a77facbec3df95ae49ef109da80cf3053abe22d1c91a9db97faa5efb071463 EAP-Message = 0xf5d409faec2a51aae45678227398f4dc93a53b33e6e509a41403010001011603010020a595650d85d9d8ebbd4b935212b306389ea4ff1e4a3678ac25505e59abdead87 NAS-Port-Type = Wireless-802.11 NAS-Port = 18204 State = 0x68aa16cc6bac0f2af50a0ba6abea9d5a NAS-IP-Address = 172.17.0.93 NAS-Identifier = "ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "EXCHANGE\pmarinkovic", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 91 to 172.17.0.93 port 1645 EAP-Message = 0x0107003119001403010001011603010020b47e0fc66abd9d43a1963f41f8c6d6c072b3cb66001a7793c1581bc6fcbc7963 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68aa16cc6cad0f2af50a0ba6abea9d5a Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=92, length=152 User-Name = "EXCHANGE\\pmarinkovic" Framed-MTU = 1400 Called-Station-Id = "0014.1cde.6ab0" Calling-Station-Id = "0016.ead8.3812" Service-Type = Login-User Message-Authenticator = 0xa98a256c4a390756a51eaad4cb7a3bdb EAP-Message = 0x020700061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 18204 State = 0x68aa16cc6cad0f2af50a0ba6abea9d5a NAS-IP-Address = 172.17.0.93 NAS-Identifier = "ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "EXCHANGE\pmarinkovic", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 92 to 172.17.0.93 port 1645 EAP-Message = 0x0108002019001703010015eb32b973d50fe1c93287e0a62f7994c2bceb4eeec3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68aa16cc6da20f2af50a0ba6abea9d5a Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=93, length=194 User-Name = "EXCHANGE\\pmarinkovic" Framed-MTU = 1400 Called-Station-Id = "0014.1cde.6ab0" Calling-Station-Id = "0016.ead8.3812" Service-Type = Login-User Message-Authenticator = 0x4b39bbfb00cd8a8dc76be1b73cde14f1 EAP-Message = 0x0208003019001703010025374f8bdd2c4915fbbdc65f26eea29db863d44902cf2accbf135038d640c8d84cca815269fd NAS-Port-Type = Wireless-802.11 NAS-Port = 18204 State = 0x68aa16cc6da20f2af50a0ba6abea9d5a NAS-IP-Address = 172.17.0.93 NAS-Identifier = "ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "EXCHANGE\pmarinkovic", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 48 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - EXCHANGE\pmarinkovic [peap] Got tunneled request EAP-Message = 0x020800190145584348414e47455c706d6172696e6b6f766963 server { PEAP: Got tunneled identity of EXCHANGE\pmarinkovic PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to EXCHANGE\pmarinkovic Sending tunneled request EAP-Message = 0x020800190145584348414e47455c706d6172696e6b6f766963 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "EXCHANGE\\pmarinkovic" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "EXCHANGE\pmarinkovic", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 25 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x0109002e1a01090029103033c05ef4057d06db43e3671ec5892545584348414e47455c706d6172696e6b6f766963 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe9cb5785e9c24dc02f0c5b9856abc538 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0109002e1a01090029103033c05ef4057d06db43e3671ec5892545584348414e47455c706d6172696e6b6f766963 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe9cb5785e9c24dc02f0c5b9856abc538 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 93 to 172.17.0.93 port 1645 EAP-Message = 0x010900451900170301003a35147e663ad6ef2afe346252613a6f70209cdaed1e90d5822ab86c68687b785cf52bfc7354a7174beec2771f73838369d9b46276ba297e4e8b4b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68aa16cc6ea30f2af50a0ba6abea9d5a Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=94, length=248 User-Name = "EXCHANGE\\pmarinkovic" Framed-MTU = 1400 Called-Station-Id = "0014.1cde.6ab0" Calling-Station-Id = "0016.ead8.3812" Service-Type = Login-User Message-Authenticator = 0xcbb6232d980618716e1e9bf37945d32c EAP-Message = 0x020900661900170301005b9b97402e1842ca116277c3402b4a3ade8705ca8fcd85040733779bcfde103f1ef8083fcf9dec676da34bfe97b6dd7b5337e2120b8d6cf6ed07486b89846b5ec8e0a2a1c66a40444210ed213bbeeb04ba75c171bf0073e33da7e5fd NAS-Port-Type = Wireless-802.11 NAS-Port = 18204 State = 0x68aa16cc6ea30f2af50a0ba6abea9d5a NAS-IP-Address = 172.17.0.93 NAS-Identifier = "ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "EXCHANGE\pmarinkovic", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 102 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0209004f1a0209004a31eede92de63d6b5c0e2fa83f3c0307c7f00000000000000007d955691d4b353ed671b109278a02de0ceabec8cdde2eb930045584348414e47455c706d6172696e6b6f766963 server { PEAP: Setting User-Name to EXCHANGE\pmarinkovic Sending tunneled request EAP-Message = 0x0209004f1a0209004a31eede92de63d6b5c0e2fa83f3c0307c7f00000000000000007d955691d4b353ed671b109278a02de0ceabec8cdde2eb930045584348414e47455c706d6172696e6b6f766963 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "EXCHANGE\\pmarinkovic" State = 0xe9cb5785e9c24dc02f0c5b9856abc538 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "EXCHANGE\pmarinkovic", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 79 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for pmarinkovic with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=pmarinkovic [mschap] mschap2: 30 [mschap] expand: --domain=%{mschap:NT-Domain:-EXCHANGE}--challenge=%{mschap:Challenge:-00} -> --domain=EXCHANGE--challenge=73e442d7ccbf38a0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=7d955691d4b353ed671b109278a02de0ceabec8cdde2eb93 password: It asks me for a password? When I enter password of that domain account, it gives following output Exec-Program output: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Exec-Program-Wait: plaintext: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\tE=691 R=1" EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\tE=691 R=1" EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 94 to 172.17.0.93 port 1645 EAP-Message = 0x010a00261900170301001bc119cd9925061d59f4967693d64f29c70171a0a82c0c0c8d92602c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68aa16cc6fa00f2af50a0ba6abea9d5a Finished request 7. Going to the next request Cleaning up request 0 ID 87 with timestamp +276 Cleaning up request 1 ID 88 with timestamp +276 Cleaning up request 2 ID 89 with timestamp +276 Cleaning up request 3 ID 90 with timestamp +276 Cleaning up request 4 ID 91 with timestamp +276 Cleaning up request 5 ID 92 with timestamp +276 Cleaning up request 6 ID 93 with timestamp +276 rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=94, length=248 Sending duplicate reply to client 172.17.0.93 port 1645 - ID: 94 Sending Access-Challenge of id 94 to 172.17.0.93 port 1645 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=94, length=248 Sending duplicate reply to client 172.17.0.93 port 1645 - ID: 94 Sending Access-Challenge of id 94 to 172.17.0.93 port 1645 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=94, length=248 Sending duplicate reply to client 172.17.0.93 port 1645 - ID: 94 Sending Access-Challenge of id 94 to 172.17.0.93 port 1645 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=94, length=248 Sending duplicate reply to client 172.17.0.93 port 1645 - ID: 94 Sending Access-Challenge of id 94 to 172.17.0.93 port 1645 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=95, length=153 User-Name = "EXCHANGE\\pmarinkovic" Framed-MTU = 1400 Called-Station-Id = "0014.1cde.6ab0" Calling-Station-Id = "0016.ead8.3812" Service-Type = Login-User Message-Authenticator = 0xc80201228ec35028d9ce888dc15f8ac3 EAP-Message = 0x020200190145584348414e47455c706d6172696e6b6f766963 NAS-Port-Type = Wireless-802.11 NAS-Port = 18206 NAS-IP-Address = 172.17.0.93 NAS-Identifier = "ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "EXCHANGE\pmarinkovic", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 25 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 95 to 172.17.0.93 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xebca9fefebc98666206fed83e0de5375 Finished request 8. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=95, length=153 Sending duplicate reply to client 172.17.0.93 port 1645 - ID: 95 Sending Access-Challenge of id 95 to 172.17.0.93 port 1645 Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=95, length=153 Sending duplicate reply to client 172.17.0.93 port 1645 - ID: 95 Sending Access-Challenge of id 95 to 172.17.0.93 port 1645 Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.17.0.93 port 1645, id=95, length=153 Sending duplicate reply to client 172.17.0.93 port 1645 - ID: 95 Sending Access-Challenge of id 95 to 172.17.0.93 port 1645 Waking up in 4.8 seconds. Cleaning up request 7 ID 94 with timestamp +276 Waking up in 0.1 seconds. Cleaning up request 8 ID 95 with timestamp +531 Ready to process requests. In radiusd.conf, I only added exec lines to modules section from the tutorial exec ntlm_auth { wait = yes program = "*/*usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=EXCHANGE --username=%{mschap:User-Name} --password=%{User-Password}" } And mschap file in modules dir. I left those 3 commented lines, I tried also with them, but no luck. mschap { with_ntdomain_hack = yes #use_mppe = yes #require_encryption = yes #require_strong = no ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-EXCHANGE}--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } What I am doing wrong here? In eap.conf I only changed default_auth_type to PEAP, and that's all. Many thanks for your help, and I would appreaciate it a lot if you can help me, cause this thing is driving me crazy for last 2-3 days. I read bunch of topics, but none helped..

3 2

sqlcounter / end session at the end of the month
by YvesDM 24 Jun '09

24 Jun '09

Hi, I'm having issues with octet accounting. Users are monthly limited in octets, not in time. The problem i have is when a user logs in on the last day of the month and stays online for 3 days then there's 2days within the new month but the accounting counts within the previous month, which we don't like :-) So I was thinking about adding a counter module which calculates a session-timeout at the last second of the month so users get logged out just before the new month starts. But, I don't know how to set the check-item. If I use max-all-session and a monthly reset I need a check item that equals the end of the month, which can be 28 days, 30 days or 31 days. Any known solutions to this? Kind regards, Y.

2 1

1.x to 2.x Upgrade Howto available?
by John Kane 24 Jun '09

24 Jun '09

Is there a 'howto' on upgrade from Freeradius 1.x to 2.x, one that lists what configs were moved where, etc. that would allow a person to do the upgrade as smoothly and quickly as possible (I can't seem to find one). Or better yet, are there any perl or python scripts available that automate the config conversions (or am I just dreaming :) )? Thanks, John This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

3 2

radius syntax checker
by sr2690＠columbia.edu 24 Jun '09

24 Jun '09

All, I am newbie with radius configuration. I wanted to know is there any way to check syntax in radius configuration files. I want to see if it is possible to check for illegal character in configuration file during restarting radius server with init script. Please advise on this. Thanks

2 1

radgroupreply issue with freeradius,mysql and daloradius
by mikoi 24 Jun '09

24 Jun '09

Hello. I am having problems getting the radgroupreply attributes to work. radreply works fine when adding reply attributes to users. Now i have a user defined that belongs to a group (for example. SSL). This group has groupreply attributes rfc 2865. (Class). But when trying with radtest it does not seem to check for groups.. SQL-conf: mysql> select * from usergroup; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | ssluser | SSL | 1 | +----------+-----------+----------+ 1 row in set (0.00 sec) mysql> mysql> select * from radgroupreply; +----+-----------+-----------+----+------------+ | id | groupname | attribute | op | value | +----+-----------+-----------+----+------------+ | 10 | SSL | Class | = | ou=bblblbk | +----+-----------+-----------+----+------------+ 1 row in set (0.00 sec) radtest: [root@centos]# radtest ssluser ssluser localhost 1812 testing123 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "ssluser" User-Password = "ssluser" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=178, length=20 [root@centos]# radiusd -X debug: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 47384, id=178, length=59 User-Name = "ssluser" User-Password = "ssluser" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ssluser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> ssluser [sql] sql_set_user escaped user --> 'ssluser' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'ssluser' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'ssluser' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'ssluser' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "ssluser" [pap] Using clear text password "ssluser" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 178 to 127.0.0.1 port 47384 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 178 with timestamp +2 Ready to process requests. I am probably missing something obvious here. Thankful for som help. Regards M -- View this message in context: http://www.nabble.com/radgroupreply-issue-with-freeradius%2Cmysql-and-dalor… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1