- Freeradius-Users - lists.freeradius.org

build error on Solaris (undefined symbol)
by Ihsan Dogan 15 Jun '09

15 Jun '09

Hello, I'm trying to build FreeRADIUS on Solaris (versions 9 and 10) and I'm getting this error: ----------------------------------------------------------------- rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT /opt/csw/gcc4/bin/gcc .libs/radiusdS.o -mcpu=v8 -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -L/opt/csw/gcc4/lib/. -L/opt/csw/lib /home/ihsan/gar/csw/mgar/pkg/freeradius/trunk/work/build-isa-sparcv8/freeradius-server-2.1.6/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypt -lltdl -lssl -lcrypto -R/opt/csw/lib Undefined first referenced symbol in file lt__PROGRAM__LTX_preloaded_symbols .libs/modules.o ld: fatal: Symbol referencing errors. No output written to .libs/radiusd gmake[6]: *** [radiusd] Error 1 gmake[6]: Leaving directory `/home/ihsan/gar/csw/mgar/pkg/freeradius/trunk/work/build-isa-sparcv8/freeradius-server-2.1.6/src/main' ----------------------------------------------------------------- Configure runs fine. I've tried to build FreeRADIUS with Sun Studio 12 and GCC 4.3.3 and both show the same error. Ihsan -- ihsan(a)dogan.ch http://blog.dogan.ch/

2 4

Missing Realm when entering second authorization group
by Xiwen Cheng 15 Jun '09

15 Jun '09

Version & OS: Freeradius-2.0.5 Gentoo It appears that during the second iteration in authorize section, the Realm has become NULL. We rely on checking the Realm to choose the appropriate Auth-Type to authenticate local users and proxy everybody else to an external network. ... +- entering group authorize ++[preprocess] returns ok rlm_realm: Looking up realm "math.leidenuniv.nl" for User-Name = "testuser(a)math.leidenuniv.nl" rlm_realm: Found realm "math.leidenuniv.nl" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Adding Realm = "math.leidenuniv.nl" rlm_realm: Proxying request from user testuser to realm math.leidenuniv.nl rlm_realm: Preparing to proxy authentication request to realm "math.leidenuniv.nl" ++[suffix] returns updated rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop users: Matched entry DEFAULT at line 292 ++[files] returns ok ... +- entering group pre-proxy ... +- entering group authorize ++[preprocess] returns ok ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject ... NOTE: ... means stripped normal behaviour/output. From the verbose output, the first part is correct. The request is proxied to the correct server. But when it arrives in the authentication server it fails to extract the Realm from the proxied request. In ``users'' we have: DEFAULT Realm == "math.leidenuniv.nl", Auth-Type := PAM Reply-Message = "math here", Fall-Through = no But as the log says, which is correct, there's no Auth-Type for that Realm. If the Realm == "math.leidenuniv.nl" condition is removed, which results in Auth-Type = PAM for everybody, authentication succeeds for local users; which is to be expected. Our config worked perfectly in freeradius-1.1.7. Now I wonder, why is the Realm equal to NULL? I see suffix updated the request, why isn't the second iteration seeing that update? Best regards, Xiwen -- -- Xiwen Cheng System Administrator ;" Enthusiasm is contagious, Mathematical Institute ; but hype is a disease. " Leiden University ;E-mail: xcheng(a)math.leidenuniv.nl Niels Bohrweg 1 K210 ;Office: (+31) 715277134 2333 CA Leiden ;Mobile: (+31) 611119991 The Netherlands ;GPG Key id: 194F572B ++

3 5

Robust proxy accounting
by Chris Howley 15 Jun '09

15 Jun '09

Alan, This is the debug output using the latest release of 2.1.7 from http://git.freeradius.org/pre. Thanks for your help in advance. Chris -----Original Message----- From: Chris Howley [mailto:ecl6ch@netserv3.leeds.ac.uk] Sent: 15 June 2009 12:07 To: Chris Howley Subject: radius.debug4 ending Access-Accept of id 138 to 10.12.80.109 port 32769 User-Name = "isschug" MS-MPPE-Recv-Key = 0x7c4e32b6485bed39ef623ae3c45738d54144c1492d00df705cb1902ed60d5578 MS-MPPE-Send-Key = 0x707c6949db85e4ebb023aaa8016fb3027bfaaf613fb82b92568ba62965235648 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3021," Reply-Message = "Welcome isschug - student" Finished request 9. Going to the next request Waking up in 0.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=146, length=156 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 10.12.80.109,NAS-IP-Address = 10.12.80.109,Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53",User-Name = "isschug"' [acct_unique] Acct-Unique-Session-ID = "04fae10ff02490f4". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "isschug", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 -> /usr/local/var/log/radius/radacct/2009-06-15/accounting-detail-12:00 [detail] /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 expands to /usr/local/var/log/radius/radacct/2009-06-15/accounting-detail-12:00 [detail] expand: %{Packet-Src-IP-Address} - %t -> 10.12.80.109 - Mon Jun 15 12:00:24 2009 ++[detail] returns ok ++? if ("%{Client-IP-Address}" != "129.11.162.17") expand: %{Client-IP-Address} -> 10.12.80.109 ? Evaluating ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++? if ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++- entering if ("%{Client-IP-Address}" != "129.11.162.17") {...} +++[control] returns ok ++- if ("%{Client-IP-Address}" != "129.11.162.17") returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> isschug ++[radutmp] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> isschug attr_filter: Matched entry DEFAULT at line 1 ++[attr_filter.accounting_response] returns updated server home.example.com { } Sending Accounting-Request of id 159 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313436 Proxying request 10 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 159 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313436 Going to the next request Waking up in 0.3 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.3 seconds. Cleaning up request 0 ID 129 with timestamp +6 Cleaning up request 1 ID 130 with timestamp +6 Cleaning up request 2 ID 131 with timestamp +6 Cleaning up request 3 ID 132 with timestamp +6 Cleaning up request 4 ID 133 with timestamp +6 Waking up in 0.1 seconds. Cleaning up request 5 ID 134 with timestamp +6 Cleaning up request 6 ID 135 with timestamp +6 Waking up in 0.2 seconds. Cleaning up request 7 ID 136 with timestamp +6 Cleaning up request 8 ID 137 with timestamp +7 Waking up in 0.1 seconds. Cleaning up request 9 ID 138 with timestamp +7 Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=146, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 146 due to unfinished request 10 Waking up in 0.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=146, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 146 due to unfinished request 10 Waking up in 0.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.6 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=146, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 146 due to unfinished request 10 Rejecting request 10 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] expand: /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H -> /usr/local/var/log/radius/radacct/detail.example.com/detail-20090615:12 [detail.example.com] /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/detail.example.com/detail-20090615:12 [detail.example.com] expand: %t -> Mon Jun 15 12:00:24 2009 [detail.example.com] Freeradius-Proxied-To = 129.11.162.17 ++[detail.example.com] returns ok } Sending Accounting-Response of id 146 to 10.12.80.109 port 32769 Finished request 10. Cleaning up request 10 ID 146 with timestamp +16 Going to the next request PROXY: Marking home server 129.11.162.17 port 1813 as zombie (it looks like it is dead). Sending Status-Server of id 121 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 0.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* detail_recv: Renaming /usr/local/var/log/radius/radacct/detail.example.com/detail-20090615:12 -> /usr/local/var/log/radius/radacct/detail.example.com/detail.work detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "04fae10ff02490f4" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 15 2009 12:00:24 BST" Acct-Delay-Time = 6 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 21 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 6 Proxy-State = 0x3333303539 Proxying request 12 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 21 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 6 Proxy-State = 0x3333303539 Going to the next request Waking up in 0.8 seconds. Waking up in 0.1 seconds. Waking up in 0.5 seconds. Waking up in 1.1 seconds. Waking up in 0.9 seconds. Waking up in 0.1 seconds. Waking up in 1.0 seconds. Waking up in 1.1 seconds. Rejecting request 12 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com No response configured for request 12. Will retry in 30 seconds Finished request 12. Cleaning up request 12 ID 33059 with timestamp +22 Going to the next request Waking up in 24.4 seconds. Sending Status-Server of id 6 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 1.5 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "04fae10ff02490f4" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 15 2009 12:00:24 BST" Acct-Delay-Time = 42 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 57 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 42 Proxy-State = 0x3437323335 Proxying request 14 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 57 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 42 Proxy-State = 0x3437323335 Going to the next request Waking up in 0.9 seconds. Waking up in 0.1 seconds. Waking up in 0.9 seconds. Waking up in 1.1 seconds. Waking up in 1.2 seconds. Waking up in 0.8 seconds. Waking up in 0.6 seconds. Rejecting request 14 due to lack of any response from home server 129.11.162.17 port 1813 PROXY: Marking home server 129.11.162.17 port 1813 as dead. Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com No response configured for request 14. Will retry in 30 seconds Finished request 14. Cleaning up request 14 ID 47235 with timestamp +58 Going to the next request Waking up in 0.2 seconds. Waking up in 22.2 seconds. Sending Status-Server of id 244 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 3.7 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "04fae10ff02490f4" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 15 2009 12:00:24 BST" Acct-Delay-Time = 78 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } >>> Sending proxied request internally to virtual server. server acct_detail.example.com { +- entering group accounting {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } # server acct_detail.example.com Going to the next request <<< Received proxied response code 0 from internal virtual server. Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com Finished request 16. Cleaning up request 16 ID 36027 with timestamp +94 Going to the next request Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*

3 2

FreeRadius User Access Level
by Hakan OZAY 15 Jun '09

15 Jun '09

Hi All; I'm using FreeRadius V1. I want, when request from users to my routers(and of course routers to FreeRadius server), feedback from FreeRadius to router: "This user not connecting this router" or "OK". So, look an user access level... This feature make possible? How, if possible? Sorry my bad english, and thank you very much. Best Redards...

2 1

Robust proxy accounting
by Chris Howley 15 Jun '09

15 Jun '09

Alan, Here's the output from FR2.1.7. Thanks for you help in advance, Chris ++[exec] returns noop Sending Access-Accept of id 128 to 10.12.80.109 port 32769 User-Name = "isschug" MS-MPPE-Recv-Key = 0x3019b4c8f9f76bb2fc4d69edbc20e98377351a661c0b412c760cd773e3b4c5f5 MS-MPPE-Send-Key = 0x5c7923cd941d8d7bd673b823632371b01435f0590105a5c38211b89b04fdea1b EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3021," Reply-Message = "Welcome isschug - student" Finished request 20. Going to the next request Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Cleaning up request 11 ID 119 with timestamp +601 Cleaning up request 12 ID 120 with timestamp +601 Cleaning up request 13 ID 121 with timestamp +601 Cleaning up request 14 ID 122 with timestamp +601 Cleaning up request 15 ID 123 with timestamp +601 Cleaning up request 16 ID 124 with timestamp +601 Cleaning up request 17 ID 125 with timestamp +601 Cleaning up request 18 ID 126 with timestamp +601 Cleaning up request 19 ID 127 with timestamp +601 Cleaning up request 20 ID 128 with timestamp +601 Waking up in 0.5 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=144, length=156 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 10.12.80.109,NAS-IP-Address = 10.12.80.109,Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52",User-Name = "isschug"' [acct_unique] Acct-Unique-Session-ID = "5b58953f85bf5074". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "isschug", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 -> /usr/local/var/log/radius/radacct/2009-06-12/accounting-detail-17:00 [detail] /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 expands to /usr/local/var/log/radius/radacct/2009-06-12/accounting-detail-17:00 [detail] expand: %{Packet-Src-IP-Address} - %t -> 10.12.80.109 - Fri Jun 12 17:10:06 2009 ++[detail] returns ok ++? if ("%{Client-IP-Address}" != "129.11.162.17") expand: %{Client-IP-Address} -> 10.12.80.109 ? Evaluating ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++? if ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++- entering if ("%{Client-IP-Address}" != "129.11.162.17") {...} +++[control] returns ok ++- if ("%{Client-IP-Address}" != "129.11.162.17") returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> isschug ++[radutmp] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> isschug attr_filter: Matched entry DEFAULT at line 1 ++[attr_filter.accounting_response] returns updated server home.example.com { } Sending Accounting-Request of id 253 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313434 Proxying request 21 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 253 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313434 Going to the next request Waking up in 0.3 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.6 seconds. Waking up in 0.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=144, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 144 due to unfinished request 21 Waking up in 0.3 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=144, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 144 due to unfinished request 21 Waking up in 0.4 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.4 seconds. Rejecting request 21 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] expand: /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H -> /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:17 [detail.example.com] /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:17 [detail.example.com] expand: %t -> Fri Jun 12 17:10:06 2009 [detail.example.com] Freeradius-Proxied-To = 129.11.162.17 ++[detail.example.com] returns ok } Sending Accounting-Response of id 144 to 10.12.80.109 port 32769 Finished request 21. Cleaning up request 21 ID 144 with timestamp +611 Going to the next request PROXY: Marking home server 129.11.162.17 port 1813 as zombie (it looks like it is dead). Sending Status-Server of id 225 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 0.5 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* detail_recv: Renaming /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:17 -> /usr/local/var/log/radius/radacct/detail.example.com/detail.work detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "5b58953f85bf5074" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 12 2009 17:10:06 BST" Acct-Delay-Time = 7 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 42 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 7 Proxy-State = 0x3133363235 Proxying request 23 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 42 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 7 Proxy-State = 0x3133363235 Going to the next request Waking up in 0.9 seconds. Waking up in 0.1 seconds. Waking up in 0.9 seconds. Waking up in 0.7 seconds. Waking up in 0.5 seconds. Waking up in 0.4 seconds. Waking up in 1.0 seconds. Waking up in 1.0 seconds. Rejecting request 23 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com No response configured for request 23. Will retry in 30 seconds Finished request 23. Cleaning up request 23 ID 13625 with timestamp +618 Going to the next request Waking up in 24.4 seconds. Sending Status-Server of id 66 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 1.5 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "5b58953f85bf5074" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 12 2009 17:10:06 BST" Acct-Delay-Time = 43 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 13 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 43 Proxy-State = 0x3534373934 Proxying request 25 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 13 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 43 Proxy-State = 0x3534373934 Going to the next request Waking up in 0.9 seconds. Waking up in 0.1 seconds. Waking up in 0.9 seconds. Waking up in 1.1 seconds. Waking up in 1.0 seconds. Waking up in 1.1 seconds. Waking up in 0.4 seconds. Rejecting request 25 due to lack of any response from home server 129.11.162.17 port 1813 PROXY: Marking home server 129.11.162.17 port 1813 as dead. Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com No response configured for request 25. Will retry in 30 seconds Finished request 25. Cleaning up request 25 ID 54794 with timestamp +654 Going to the next request Waking up in 0.7 seconds. Waking up in 20.7 seconds. Sending Status-Server of id 81 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 5.2 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "5b58953f85bf5074" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 12 2009 17:10:06 BST" Acct-Delay-Time = 79 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } >>> Sending proxied request internally to virtual server. server acct_detail.example.com { +- entering group accounting {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } # server acct_detail.example.com Going to the next request <<< Received proxied response code 0 from internal virtual server. server home.example.com { } server home.example.com { } # server home.example.com Finished request 27. Cleaning up request 27 ID 8957 with timestamp +690 Going to the next request Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Sending Status-Server of id 3 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 0.3 seconds.

2 1

Logging data packet count to accounting table?
by Maximilian Grobecker 15 Jun '09

15 Jun '09

Hello, I'm using FreeRadius for authenticating DSL users. Additional to the Input- and Output octets I would like to log the transferred packet count for the actual DSL session. I need this information to generate statistics - and in past i got this information from another (not local) Radius server, so I think, it should be not impossible. I didn't found any variables where this info is avaliable - is there any possibility to get this information? Thank you! Max (Wuppertal, Germany)

3 2

Failed to parse authenticate section
by Nakul Deshpande 15 Jun '09

15 Jun '09

I am a freeradius newbie. I have configured Freeradius 1.1.7 on a Debian/Linux system. When I give the command radisud -X i get the following errors: radiusd.conf[636] Failed to link to module 'rlm_unix': rlm_unix.a: cannot open shared object file: No such file or directory radiusd.conf[1971] Unknown module "unix". radiusd.conf[1931] Failed to parse authenticate section. I have tried searching the previous posts and read the outputs of the commands: ./configure, make and make install. I have not been able to debug this so far. Can somebody please help me out with this? DCC-Test-Server:/freeradius# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /freeradius/raddb/proxy.conf Config: including file: /freeradius/raddb/clients.conf Config: including file: /freeradius/raddb/snmp.conf Config: including file: /freeradius/raddb/eap.conf Config: including file: /freeradius/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 192.168.15.103 IP address [192.168.15.103] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) radiusd.conf[636] Failed to link to module 'rlm_unix': rlm_unix.a: cannot open shared object file: No such file or directory radiusd.conf[1971] Unknown module "unix". radiusd.conf[1931] Failed to parse authenticate section. DCC-Test-Server:/freeradius# Thanks, Nakul

2 1

Using Dictionary in With Freeradius
by Ashfaq-Ur-Rahman 15 Jun '09

15 Jun '09

Hi, This is my first post in this list. I work for an ISP. We use freeradius with mysql in the radius server, pptp/pppoe to in nas. I inherited a 5 years old freeradious installation (version 1.0.0) and its running fine . Now i need to shift it to another server (because server is too old). I have installed freeradius 2.1.6 in a new PC with Centos5.3 with mysql 5. I had dumped the mysql database from the old machine to new machine. There is a field like "client-type" and there are two types of customer "basic" and "shared". Bur when i added a nas is the radius, the user cannot be authenticated, the following error occurs... I am new with freeradius. [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok [sql] expand: %{User-Name} -> user1 [sql] sql_set_user escaped user --> 'user1' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'user1' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'user1' ORDER BY id rlm_sql: Failed to create the pair: Invalid octet string "basic" for attribute name "Client-Type" rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Invalid user: [user1/<CHAP-Password>] (from client nas-1 port 0) Delaying reject of request 0 for 4 seconds Going to the next request Waking up in 0.9 seconds. Waking up in 2.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 155 to *.*.*.* port 1033 Waking up in 4.9 seconds. Cleaning up request 0 ID 155 with timestamp +46 Ready to process requests. I googled the problem and find it could be a dictionary issue. So I added dictionary. But this time freeradius is giving another problem (It is not running.) # /usr/local/sbin/radiusd -X FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on May 22 2009 at 01:41:36 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. ............ ........... /usr/local/etc/raddb/dictionary.compat[7]: Expecting section start brace '{' after "ATTRIBUTE Password" Errors reading /usr/local/etc/raddb/radiusd.conf # My system is CENTOS 5.3 (i386) Mysql-server-5.0.45 Freeradius 2.1.6 I will be glad to have your comments on it. Sorry for such a long mail. Thank you all for your patients, reading the mail. Ashfaq.

3 2

Migrate users file to mysql?
by michel＠casa.co.cu 14 Jun '09

14 Jun '09

Hello As you will see I'm still a beginner in freeradius I recently upgrade my version of freeradius to latest version V2.1.6, my users or the same parameters are declared in the file "users" These authenticate against an LDAP. I have several two NAS, NAS1 a module with an analog modems and NAS2 digital modems to connect where Dialin using the service. My question is: 1 - How can my users migrate users from the file into mysql? 2 - I have users connecting to both Access Server, but when they connect the NAS1, my server raidus assigned different parameters when connecting the NAS2 to pass other parameters or conditions, Framed-IP-Address etc... Currently I have declared the same user with different parameters and conditions. NAS1= 192.168.25.20 NAS2= 192.168.25.30 frank Auth-Type := LDAP, NAS-IP-Address == "192.168.25.20", Calling-Station-Id == "76415044", Simultaneous-Use := 1 Service-Type = Framed-User, Framed-Protocol = PPP, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Framed-Protocol = PPP, Framed-IP-Address = 192.168.28.110, Framed-IP-Netmask = 255.255.255.0, Idle-Timeout = 0 frank Auth-Type := LDAP, NAS-IP-Address == "192.168.25.30", Simultaneous-Use := 1 Service-Type = Framed-User, Framed-Protocol = PPP, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Framed-Protocol = PPP, Framed-IP-Address = 192.168.29.110, Framed-IP-Netmask = 255.255.255.0, Idle-Timeout = 0 As would be declared to migrate to mysql? I have to repeat them twice as I have done here? Thank you ---------------------------------------------- Webmail, servicio de correo electronico Casa de las Americas - La Habana, Cuba.

2 2

SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate
by john 13 Jun '09

13 Jun '09

Hello All, I am not able able to successfully get a port authorized via dot1x (wired connection). I am using SecureW2 suite as a client. I get the following message in the debug output of freeradius: "rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate" I think this means that my windows XP client isn't returning a certificate to the radius server, but I am not sure. I hope someone can help me figure this out. Below is a fuller output from freeradius. Thanks! John +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 218 to 10.1.3.222 port 1024 EAP-Message = 0x010601541580000009363f8ea34a8928213fd268bf7e6095409ac959f34f444b40faf097692923ad83963e0395fa7c5dbee0011b5a9e43c819695e8dff5e4e393438c1f21a524eb69847838585d3d3c5dc5768677062f7f1fa98a14c0a1efe75201e211059691499941fa930077d23734c28a28c985d3131b7f01d21faa3dea7a544df8e6c2e87746d1b4e82eec6475a3b538d87a6cad17520189c2f86f1aa9a6e1c0deca5e45d9ee916030100a60d00009e0301024000980096308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a13045649 EAP-Message = 0x53443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c2044697374726963740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4aacbade4eaaaf8b77d4bfdb2d602cc2 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=219, length=558 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0x4aacbade4eaaaf8b77d4bfdb2d602cc2 EAP-Message = 0x02060150150016030100070b00000300000016030101061000010201001ec801e7b54f1bacc0068882e8c18fce1cc9781c535dc2a9406139225a5f85a8bf309d83741a9c1980c009a09e60088af3eb8f6b0140772ca72a788e4653bf8b5df15e8a38eaa34da31bc6f2604438fb83156d7750ba083ee83838c06cdd09838e86289fb9dfe1e1664da15f157228a86ba5d248db4fae6c9e7d6c782ec9594d0e3c643becf5709608041eab084d0f2aa2237601f71b6ef98d0ee2a190101d67a908a98373884030becfb0df0b8c31349bcbfffc92e072bf3fc8591da21a70edfb234a916d3d1d19533ebec53f245e5facea057e1822a9ab93464dda7903198b EAP-Message = 0xa87b9eb6eee9a3bca55c890b7161b1997f57f84244ef309bdbd91d5e63f9fab3140301000101160301002841175ab1eb200cb6ed8eb09ebdd827dcb0c94fb2f0cc4bbc1057c217d57c7082f6232bda1742633c Message-Authenticator = 0x6d04184f1dac42b9c7c6da356158f8c5 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0007], Certificate [ttls] >>> TLS 1.0 Alert [length 0002], fatal handshake_failure TLS Alert write:fatal:handshake failure TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [ttls] eaptls_process returned 4 [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> john attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 219 to 10.1.3.222 port 1024 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.5 seconds. Cleaning up request 0 ID 214 with timestamp +10 Cleaning up request 1 ID 215 with timestamp +10 Cleaning up request 2 ID 216 with timestamp +10 Cleaning up request 3 ID 217 with timestamp +10 Cleaning up request 4 ID 218 with timestamp +10 Waking up in 1.2 seconds. Cleaning up request 5 ID 219 with timestamp +10 Ready to process requests. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=220, length=211 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x02070009016a6f686e Message-Authenticator = 0x4bff9404e7321b17c71b169a7fe8c714 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[control] returns updated ++[unix] returns updated [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 220 to 10.1.3.222 port 1024 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010800061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd9e67c5bd9ee655f64d832ead121cf75 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=221, length=226 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xd9e67c5bd9ee655f64d832ead121cf75 EAP-Message = 0x020800060315 Message-Authenticator = 0xf05ccffdc48c602e7055f1f09fd9f5bc +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[control] returns updated ++[unix] returns updated [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 221 to 10.1.3.222 port 1024 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010900061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd9e67c5bd8ef695f64d832ead121cf75 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=222, length=276 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xd9e67c5bd8ef695f64d832ead121cf75 EAP-Message = 0x020900381500160301002d0100002903013faeaed39396e322ae3de01571d4a0cd64ad1a76a0e496d88b18489466fa7e58000002000a0100 Message-Authenticator = 0xb689989c467d49826a7819dc6283749e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 56 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 002d], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 0857], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 00a6], CertificateRequest [ttls] TLS_accept: SSLv3 write certificate request A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 222 to 10.1.3.222 port 1024 EAP-Message = 0x010a040015c000000936160301002a0200002603014a32986de07b75d573655c77f11d4537645a9e1e9e971ae8d47560ff836ac66800000a0016030108570b00085300085000039f3082039b30820283a003020102020101300d06092a864886f70d0101040500308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a1304564953443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c204469737472696374 EAP-Message = 0x301e170d3039303630383139323933385a170d3130303630383139323933385a3075310b3009060355040613025553311330110603550408130a57617368696e67746f6e310d300b060355040a1304564953443119301706035504031310564953442052616469757320436572743127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100a9fb1e03259aafb1864477e036bb8f09194747b63bc2596d7c451882edd20837cb08675acf0e2d5fde4144bee680a0e2db76ed8fc5d717ae2cf3ab7f51acc522c7d3e50acd EAP-Message = 0xa727b5aceb75346f22c7eef985b9703d2f7ac67192feb1e7762cd35e3c987bf5659fcd4167f60bdbf4a393ddf4b839fc6ef538c225f2277540cfd89602512127dd8c669c2010d7e7dbb2890e3b26ccc0912e3d67d0c115df2e9522999e5fc984e002890a87046517d6cc5b7a95b5e60ab5aa3b0bdc2471d3ae9a3c0a6774e29ef4df460cb409b010e998b0a80f17032e1c71cf4047f9ece5f2501fd32b6f7b4e25a4d62544f1cde4497f191c7224386d6762a6e1aba1e472af3ab50203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010093bff95e424f631cf806273bae99ae9e EAP-Message = 0xced52efcd8e0905a6ea89f11adec836027c810257d2007ae4862ee5d6ca2dc969866d0f851ea82d7ef607da5a544b99d6392c1f86388ed55837c61f6fb634c4b537dd646332b25d729d2e6b6504f5d79f5c973d307573459f1a1afc0b86831d033c8a64bab7ba84875028362a2d44a605b1097e244073a1d9df1ca3d51622e536be8e570dacb061726210a814eb075a15b42715bec94fe1d4d6c36dbed8382bb141163ea74331741736ebafd5ac8497a639d024648badffe66853fb42c81bc83f0053b6fec9b4795035e094090d8183a340625e32903f380a38eb5578bd79940931644a6c1ef74bb15815f2cffcd7f290004ab308204a73082038fa003 EAP-Message = 0x020102020900833987f5f546 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd9e67c5bdbec695f64d832ead121cf75 Finished request 8. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=223, length=226 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xd9e67c5bdbec695f64d832ead121cf75 EAP-Message = 0x020a00061500 Message-Authenticator = 0x16540a47b56572901005cd0703be8083 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 223 to 10.1.3.222 port 1024 EAP-Message = 0x010b040015c0000009363b43300d06092a864886f70d0101050500308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a1304564953443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c204469737472696374301e170d3039303630383139323833395a170d3130303630383139323833395a308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d060355 EAP-Message = 0x04071306566173686f6e310d300b060355040a1304564953443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c20446973747269637430820122300d06092a864886f70d01010105000382010f003082010a0282010100a55584aa47296e32cbab93cdad9908b909d0d7b633fde3e846df3b9a70d74940eb63cd058ed1557ae9f98342785555a7f69b29a170e1b0cc9865448cf75f18bdf837559e6c58f8f8ed427076258110aa99459a3ee88350fe1ea5a295fe7b8d9b4861e4dc8281bee62c64ae560fad3d741127 EAP-Message = 0x090cf68c60831fe46c8a894e4b15d923bea2b62ffc0b274dafe6f18012a821d91c25e5a16763ce21fa710f971d003503692a98ec8bc7e7aa68ab0e35c8f98d6dee0e3997055d3dab1d5f02890e50c2e57c8f41bd59aae1eb012900d4772c0f4f833db3c0e43ca8ad1653a13316e926364cd35f252e607b0cedd51d257a82a5bdb87320d7984f7e3b3bc864e923710203010001a381fb3081f8301d0603551d0e04160414543e18343eb614370c4130e3ff1afd8cf93fe9af3081c80603551d230481c03081bd8014543e18343eb614370c4130e3ff1afd8cf93fe9afa18199a48196308193310b3009060355040613025553311330110603550408130a EAP-Message = 0x57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a1304564953443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c204469737472696374820900833987f5f5463b43300c0603551d13040530030101ff300d06092a864886f70d010105050003820101007b2ccc21443a1b43a5562175e927500efa22c16d4d8dd566cdead0b0830269d54cd7afa1098199403df344c78059d781af4ce410cfcd663c52cec5440540b0663a6096dd0084bd20b8ea8601860e244d922f85b7f1 EAP-Message = 0xfc18f3952fd1dda7d4ecca4e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd9e67c5bdaed695f64d832ead121cf75 Finished request 9. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=224, length=226 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xd9e67c5bdaed695f64d832ead121cf75 EAP-Message = 0x020b00061500 Message-Authenticator = 0xb4dd50363a7aa33881d9d2ba2fad1f4b +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 224 to 10.1.3.222 port 1024 EAP-Message = 0x010c01541580000009363f8ea34a8928213fd268bf7e6095409ac959f34f444b40faf097692923ad83963e0395fa7c5dbee0011b5a9e43c819695e8dff5e4e393438c1f21a524eb69847838585d3d3c5dc5768677062f7f1fa98a14c0a1efe75201e211059691499941fa930077d23734c28a28c985d3131b7f01d21faa3dea7a544df8e6c2e87746d1b4e82eec6475a3b538d87a6cad17520189c2f86f1aa9a6e1c0deca5e45d9ee916030100a60d00009e0301024000980096308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a13045649 EAP-Message = 0x53443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c2044697374726963740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd9e67c5bddea695f64d832ead121cf75 Finished request 10. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=225, length=558 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xd9e67c5bddea695f64d832ead121cf75 EAP-Message = 0x020c0150150016030100070b000003000000160301010610000102010029f7cad2a5ed026b3f6ac94cbeff92814502139418aa0c84ac8530c3f8b94a1a7aa8e8d45cf5b45d5779353a166d916292d43cff1264d5d99484b5aca8c6a381dd11db935d9d5cdb36d718c0b5e1c6ef7cb8774a461feb431c3918b706066e0a112a991af85400d62bf7ef76b370a3aeea705256c55afedf775aeb1405edeb429ac74753aa03b82c52c1c56a7e8145056e0f01a5d1a689cca54cb9ed121ea86a1e6ace3ac093f9d757752049924ab81792d47beb638b4e6eecdc55e88da3218972a2aa0380bf2d38b517101373498c55bd60d6ae9e581a5d976662a6188ec416 EAP-Message = 0x258d45ed623983520f1b0a30aa81bda3ecc551ac0617eb0de1185927b79dca21140301000101160301002874cdc78d855874525e120a085bfeb198cb565313472a4bda41ca3a52acb2df5b2df7561652ffa1d9 Message-Authenticator = 0xc93875552209af406690e002d9d996ee +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 12 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0007], Certificate [ttls] >>> TLS 1.0 Alert [length 0002], fatal handshake_failure TLS Alert write:fatal:handshake failure TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [ttls] eaptls_process returned 4 [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> john attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 11 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 11 Sending Access-Reject of id 225 to 10.1.3.222 port 1024 EAP-Message = 0x040c0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.5 seconds. Cleaning up request 6 ID 220 with timestamp +71 Cleaning up request 7 ID 221 with timestamp +71 Cleaning up request 8 ID 222 with timestamp +71 Cleaning up request 9 ID 223 with timestamp +71 Cleaning up request 10 ID 224 with timestamp +71 Waking up in 1.3 seconds. Cleaning up request 11 ID 225 with timestamp +71 Ready to process requests.

3 6