Freeradius-Users
Threads by month
- ----- 2026 -----
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2025 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- 7 participants
- 27067 discussions
Alan,
This is the debug output using the latest release of 2.1.7 from http://git.freeradius.org/pre.
Thanks for your help in advance.
Chris
-----Original Message-----
From: Chris Howley [mailto:ecl6ch@netserv3.leeds.ac.uk]
Sent: 15 June 2009 12:07
To: Chris Howley
Subject: radius.debug4
ending Access-Accept of id 138 to 10.12.80.109 port 32769
User-Name = "isschug"
MS-MPPE-Recv-Key = 0x7c4e32b6485bed39ef623ae3c45738d54144c1492d00df705cb1902ed60d5578
MS-MPPE-Send-Key = 0x707c6949db85e4ebb023aaa8016fb3027bfaaf613fb82b92568ba62965235648
EAP-Message = 0x030b0004
Message-Authenticator = 0x00000000000000000000000000000000
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3021,"
Reply-Message = "Welcome isschug - student"
Finished request 9.
Going to the next request
Waking up in 0.2 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.2 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.8 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.1 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.8 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.7 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.9 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.7 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.0 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.0 seconds.
rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=146, length=156
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
+- entering group preacct {...}
++[preprocess] returns ok
[acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 10.12.80.109,NAS-IP-Address = 10.12.80.109,Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53",User-Name = "isschug"'
[acct_unique] Acct-Unique-Session-ID = "04fae10ff02490f4".
++[acct_unique] returns ok
[suffix] No '@' in User-Name = "isschug", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[files] returns noop
+- entering group accounting {...}
[detail] expand: /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 -> /usr/local/var/log/radius/radacct/2009-06-15/accounting-detail-12:00
[detail] /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 expands to /usr/local/var/log/radius/radacct/2009-06-15/accounting-detail-12:00
[detail] expand: %{Packet-Src-IP-Address} - %t -> 10.12.80.109 - Mon Jun 15 12:00:24 2009
++[detail] returns ok
++? if ("%{Client-IP-Address}" != "129.11.162.17")
expand: %{Client-IP-Address} -> 10.12.80.109
? Evaluating ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE
++? if ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE
++- entering if ("%{Client-IP-Address}" != "129.11.162.17") {...}
+++[control] returns ok
++- if ("%{Client-IP-Address}" != "129.11.162.17") returns ok
++[unix] returns ok
[radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp
[radutmp] expand: %{User-Name} -> isschug
++[radutmp] returns ok
[attr_filter.accounting_response] expand: %{User-Name} -> isschug
attr_filter: Matched entry DEFAULT at line 1
++[attr_filter.accounting_response] returns updated
server home.example.com {
}
Sending Accounting-Request of id 159 to 129.11.162.17 port 1813
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
Proxy-State = 0x313436
Proxying request 10 to home server 129.11.162.17 port 1813
Sending Accounting-Request of id 159 to 129.11.162.17 port 1813
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
Proxy-State = 0x313436
Going to the next request
Waking up in 0.3 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.3 seconds.
Cleaning up request 0 ID 129 with timestamp +6
Cleaning up request 1 ID 130 with timestamp +6
Cleaning up request 2 ID 131 with timestamp +6
Cleaning up request 3 ID 132 with timestamp +6
Cleaning up request 4 ID 133 with timestamp +6
Waking up in 0.1 seconds.
Cleaning up request 5 ID 134 with timestamp +6
Cleaning up request 6 ID 135 with timestamp +6
Waking up in 0.2 seconds.
Cleaning up request 7 ID 136 with timestamp +6
Cleaning up request 8 ID 137 with timestamp +7
Waking up in 0.1 seconds.
Cleaning up request 9 ID 138 with timestamp +7
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.7 seconds.
rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=146, length=156
Discarding duplicate request from client wism07-1 port 32769 - ID: 146 due to unfinished request 10
Waking up in 0.2 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.1 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.8 seconds.
rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=146, length=156
Discarding duplicate request from client wism07-1 port 32769 - ID: 146 due to unfinished request 10
Waking up in 0.2 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.0 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.6 seconds.
rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=146, length=156
Discarding duplicate request from client wism07-1 port 32769 - ID: 146 due to unfinished request 10
Rejecting request 10 due to lack of any response from home server 129.11.162.17 port 1813
Found Post-Proxy-Type
server home.example.com {
+- entering group Fail {...}
[detail.example.com] expand: /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H -> /usr/local/var/log/radius/radacct/detail.example.com/detail-20090615:12
[detail.example.com] /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/detail.example.com/detail-20090615:12
[detail.example.com] expand: %t -> Mon Jun 15 12:00:24 2009
[detail.example.com] Freeradius-Proxied-To = 129.11.162.17
++[detail.example.com] returns ok
}
Sending Accounting-Response of id 146 to 10.12.80.109 port 32769
Finished request 10.
Cleaning up request 10 ID 146 with timestamp +16
Going to the next request
PROXY: Marking home server 129.11.162.17 port 1813 as zombie (it looks like it is dead).
Sending Status-Server of id 121 to 129.11.162.17 port 1813
Message-Authenticator := 0x00000000000000000000000000000000
NAS-Identifier := "Status Check. Are you alive?"
Waking up in 0.1 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
detail_recv: Renaming /usr/local/var/log/radius/radacct/detail.example.com/detail-20090615:12 -> /usr/local/var/log/radius/radacct/detail.example.com/detail.work
detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
Acct-Unique-Session-Id = "04fae10ff02490f4"
Realm = "acct_realm.example.com"
FreeRADIUS-Proxied-To = 129.11.162.17
Packet-Original-Timestamp = "Jun 15 2009 12:00:24 BST"
Acct-Delay-Time = 6
server home.example.com {
+- entering group accounting {...}
++[control] returns noop
} # server home.example.com
server home.example.com {
}
Sending Accounting-Request of id 21 to 129.11.162.17 port 1813
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
FreeRADIUS-Proxied-To = 129.11.162.17
Acct-Delay-Time = 6
Proxy-State = 0x3333303539
Proxying request 12 to home server 129.11.162.17 port 1813
Sending Accounting-Request of id 21 to 129.11.162.17 port 1813
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
FreeRADIUS-Proxied-To = 129.11.162.17
Acct-Delay-Time = 6
Proxy-State = 0x3333303539
Going to the next request
Waking up in 0.8 seconds.
Waking up in 0.1 seconds.
Waking up in 0.5 seconds.
Waking up in 1.1 seconds.
Waking up in 0.9 seconds.
Waking up in 0.1 seconds.
Waking up in 1.0 seconds.
Waking up in 1.1 seconds.
Rejecting request 12 due to lack of any response from home server 129.11.162.17 port 1813
Found Post-Proxy-Type
server home.example.com {
+- entering group Fail {...}
[detail.example.com] Suppressing writes to detail file as the request was just read from a detail file.
++[detail.example.com] returns noop
}
server home.example.com {
} # server home.example.com
No response configured for request 12. Will retry in 30 seconds
Finished request 12.
Cleaning up request 12 ID 33059 with timestamp +22
Going to the next request
Waking up in 24.4 seconds.
Sending Status-Server of id 6 to 129.11.162.17 port 1813
Message-Authenticator := 0x00000000000000000000000000000000
NAS-Identifier := "Status Check. Are you alive?"
Waking up in 3.9 seconds.
Waking up in 1.5 seconds.
detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
Acct-Unique-Session-Id = "04fae10ff02490f4"
Realm = "acct_realm.example.com"
FreeRADIUS-Proxied-To = 129.11.162.17
Packet-Original-Timestamp = "Jun 15 2009 12:00:24 BST"
Acct-Delay-Time = 42
server home.example.com {
+- entering group accounting {...}
++[control] returns noop
} # server home.example.com
server home.example.com {
}
Sending Accounting-Request of id 57 to 129.11.162.17 port 1813
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
FreeRADIUS-Proxied-To = 129.11.162.17
Acct-Delay-Time = 42
Proxy-State = 0x3437323335
Proxying request 14 to home server 129.11.162.17 port 1813
Sending Accounting-Request of id 57 to 129.11.162.17 port 1813
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
FreeRADIUS-Proxied-To = 129.11.162.17
Acct-Delay-Time = 42
Proxy-State = 0x3437323335
Going to the next request
Waking up in 0.9 seconds.
Waking up in 0.1 seconds.
Waking up in 0.9 seconds.
Waking up in 1.1 seconds.
Waking up in 1.2 seconds.
Waking up in 0.8 seconds.
Waking up in 0.6 seconds.
Rejecting request 14 due to lack of any response from home server 129.11.162.17 port 1813
PROXY: Marking home server 129.11.162.17 port 1813 as dead.
Found Post-Proxy-Type
server home.example.com {
+- entering group Fail {...}
[detail.example.com] Suppressing writes to detail file as the request was just read from a detail file.
++[detail.example.com] returns noop
}
server home.example.com {
} # server home.example.com
No response configured for request 14. Will retry in 30 seconds
Finished request 14.
Cleaning up request 14 ID 47235 with timestamp +58
Going to the next request
Waking up in 0.2 seconds.
Waking up in 22.2 seconds.
Sending Status-Server of id 244 to 129.11.162.17 port 1813
Message-Authenticator := 0x00000000000000000000000000000000
NAS-Identifier := "Status Check. Are you alive?"
Waking up in 3.9 seconds.
Waking up in 3.7 seconds.
detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a3629c8/00:13:02:8d:f3:1f/53"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
Acct-Unique-Session-Id = "04fae10ff02490f4"
Realm = "acct_realm.example.com"
FreeRADIUS-Proxied-To = 129.11.162.17
Packet-Original-Timestamp = "Jun 15 2009 12:00:24 BST"
Acct-Delay-Time = 78
server home.example.com {
+- entering group accounting {...}
++[control] returns noop
} # server home.example.com
server home.example.com {
}
>>> Sending proxied request internally to virtual server.
server acct_detail.example.com {
+- entering group accounting {...}
[detail.example.com] Suppressing writes to detail file as the request was just read from a detail file.
++[detail.example.com] returns noop
} # server acct_detail.example.com
Going to the next request
<<< Received proxied response code 0 from internal virtual server.
Found Post-Proxy-Type
server home.example.com {
+- entering group Fail {...}
[detail.example.com] Suppressing writes to detail file as the request was just read from a detail file.
++[detail.example.com] returns noop
}
server home.example.com {
} # server home.example.com
Finished request 16.
Cleaning up request 16 ID 36027 with timestamp +94
Going to the next request
Waking up in 1.0 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.8 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
3
2
Hi All;
I'm using FreeRadius V1.
I want, when request from users to my routers(and of course routers to
FreeRadius server), feedback from FreeRadius to router: "This user not
connecting this router" or "OK". So, look an user access level...
This feature make possible? How, if possible?
Sorry my bad english, and thank you very much.
Best Redards...
2
1
Alan,
Here's the output from FR2.1.7.
Thanks for you help in advance,
Chris
++[exec] returns noop
Sending Access-Accept of id 128 to 10.12.80.109 port 32769
User-Name = "isschug"
MS-MPPE-Recv-Key = 0x3019b4c8f9f76bb2fc4d69edbc20e98377351a661c0b412c760cd773e3b4c5f5
MS-MPPE-Send-Key = 0x5c7923cd941d8d7bd673b823632371b01435f0590105a5c38211b89b04fdea1b
EAP-Message = 0x030b0004
Message-Authenticator = 0x00000000000000000000000000000000
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3021,"
Reply-Message = "Welcome isschug - student"
Finished request 20.
Going to the next request
Waking up in 1.0 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.9 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.9 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.9 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.8 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.7 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.2 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.9 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.9 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.0 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Cleaning up request 11 ID 119 with timestamp +601
Cleaning up request 12 ID 120 with timestamp +601
Cleaning up request 13 ID 121 with timestamp +601
Cleaning up request 14 ID 122 with timestamp +601
Cleaning up request 15 ID 123 with timestamp +601
Cleaning up request 16 ID 124 with timestamp +601
Cleaning up request 17 ID 125 with timestamp +601
Cleaning up request 18 ID 126 with timestamp +601
Cleaning up request 19 ID 127 with timestamp +601
Cleaning up request 20 ID 128 with timestamp +601
Waking up in 0.5 seconds.
rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=144, length=156
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
+- entering group preacct {...}
++[preprocess] returns ok
[acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 10.12.80.109,NAS-IP-Address = 10.12.80.109,Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52",User-Name = "isschug"'
[acct_unique] Acct-Unique-Session-ID = "5b58953f85bf5074".
++[acct_unique] returns ok
[suffix] No '@' in User-Name = "isschug", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[files] returns noop
+- entering group accounting {...}
[detail] expand: /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 -> /usr/local/var/log/radius/radacct/2009-06-12/accounting-detail-17:00
[detail] /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 expands to /usr/local/var/log/radius/radacct/2009-06-12/accounting-detail-17:00
[detail] expand: %{Packet-Src-IP-Address} - %t -> 10.12.80.109 - Fri Jun 12 17:10:06 2009
++[detail] returns ok
++? if ("%{Client-IP-Address}" != "129.11.162.17")
expand: %{Client-IP-Address} -> 10.12.80.109
? Evaluating ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE
++? if ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE
++- entering if ("%{Client-IP-Address}" != "129.11.162.17") {...}
+++[control] returns ok
++- if ("%{Client-IP-Address}" != "129.11.162.17") returns ok
++[unix] returns ok
[radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp
[radutmp] expand: %{User-Name} -> isschug
++[radutmp] returns ok
[attr_filter.accounting_response] expand: %{User-Name} -> isschug
attr_filter: Matched entry DEFAULT at line 1
++[attr_filter.accounting_response] returns updated
server home.example.com {
}
Sending Accounting-Request of id 253 to 129.11.162.17 port 1813
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
Proxy-State = 0x313434
Proxying request 21 to home server 129.11.162.17 port 1813
Sending Accounting-Request of id 253 to 129.11.162.17 port 1813
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
Proxy-State = 0x313434
Going to the next request
Waking up in 0.3 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.6 seconds.
Waking up in 0.1 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.1 seconds.
rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=144, length=156
Discarding duplicate request from client wism07-1 port 32769 - ID: 144 due to unfinished request 21
Waking up in 0.3 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.0 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.0 seconds.
rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=144, length=156
Discarding duplicate request from client wism07-1 port 32769 - ID: 144 due to unfinished request 21
Waking up in 0.4 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.0 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.4 seconds.
Rejecting request 21 due to lack of any response from home server 129.11.162.17 port 1813
Found Post-Proxy-Type
server home.example.com {
+- entering group Fail {...}
[detail.example.com] expand: /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H -> /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:17
[detail.example.com] /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:17
[detail.example.com] expand: %t -> Fri Jun 12 17:10:06 2009
[detail.example.com] Freeradius-Proxied-To = 129.11.162.17
++[detail.example.com] returns ok
}
Sending Accounting-Response of id 144 to 10.12.80.109 port 32769
Finished request 21.
Cleaning up request 21 ID 144 with timestamp +611
Going to the next request
PROXY: Marking home server 129.11.162.17 port 1813 as zombie (it looks like it is dead).
Sending Status-Server of id 225 to 129.11.162.17 port 1813
Message-Authenticator := 0x00000000000000000000000000000000
NAS-Identifier := "Status Check. Are you alive?"
Waking up in 0.5 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
detail_recv: Renaming /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:17 -> /usr/local/var/log/radius/radacct/detail.example.com/detail.work
detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
Acct-Unique-Session-Id = "5b58953f85bf5074"
Realm = "acct_realm.example.com"
FreeRADIUS-Proxied-To = 129.11.162.17
Packet-Original-Timestamp = "Jun 12 2009 17:10:06 BST"
Acct-Delay-Time = 7
server home.example.com {
+- entering group accounting {...}
++[control] returns noop
} # server home.example.com
server home.example.com {
}
Sending Accounting-Request of id 42 to 129.11.162.17 port 1813
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
FreeRADIUS-Proxied-To = 129.11.162.17
Acct-Delay-Time = 7
Proxy-State = 0x3133363235
Proxying request 23 to home server 129.11.162.17 port 1813
Sending Accounting-Request of id 42 to 129.11.162.17 port 1813
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
FreeRADIUS-Proxied-To = 129.11.162.17
Acct-Delay-Time = 7
Proxy-State = 0x3133363235
Going to the next request
Waking up in 0.9 seconds.
Waking up in 0.1 seconds.
Waking up in 0.9 seconds.
Waking up in 0.7 seconds.
Waking up in 0.5 seconds.
Waking up in 0.4 seconds.
Waking up in 1.0 seconds.
Waking up in 1.0 seconds.
Rejecting request 23 due to lack of any response from home server 129.11.162.17 port 1813
Found Post-Proxy-Type
server home.example.com {
+- entering group Fail {...}
[detail.example.com] Suppressing writes to detail file as the request was just read from a detail file.
++[detail.example.com] returns noop
}
server home.example.com {
} # server home.example.com
No response configured for request 23. Will retry in 30 seconds
Finished request 23.
Cleaning up request 23 ID 13625 with timestamp +618
Going to the next request
Waking up in 24.4 seconds.
Sending Status-Server of id 66 to 129.11.162.17 port 1813
Message-Authenticator := 0x00000000000000000000000000000000
NAS-Identifier := "Status Check. Are you alive?"
Waking up in 3.9 seconds.
Waking up in 1.5 seconds.
detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
Acct-Unique-Session-Id = "5b58953f85bf5074"
Realm = "acct_realm.example.com"
FreeRADIUS-Proxied-To = 129.11.162.17
Packet-Original-Timestamp = "Jun 12 2009 17:10:06 BST"
Acct-Delay-Time = 43
server home.example.com {
+- entering group accounting {...}
++[control] returns noop
} # server home.example.com
server home.example.com {
}
Sending Accounting-Request of id 13 to 129.11.162.17 port 1813
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
FreeRADIUS-Proxied-To = 129.11.162.17
Acct-Delay-Time = 43
Proxy-State = 0x3534373934
Proxying request 25 to home server 129.11.162.17 port 1813
Sending Accounting-Request of id 13 to 129.11.162.17 port 1813
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
FreeRADIUS-Proxied-To = 129.11.162.17
Acct-Delay-Time = 43
Proxy-State = 0x3534373934
Going to the next request
Waking up in 0.9 seconds.
Waking up in 0.1 seconds.
Waking up in 0.9 seconds.
Waking up in 1.1 seconds.
Waking up in 1.0 seconds.
Waking up in 1.1 seconds.
Waking up in 0.4 seconds.
Rejecting request 25 due to lack of any response from home server 129.11.162.17 port 1813
PROXY: Marking home server 129.11.162.17 port 1813 as dead.
Found Post-Proxy-Type
server home.example.com {
+- entering group Fail {...}
[detail.example.com] Suppressing writes to detail file as the request was just read from a detail file.
++[detail.example.com] returns noop
}
server home.example.com {
} # server home.example.com
No response configured for request 25. Will retry in 30 seconds
Finished request 25.
Cleaning up request 25 ID 54794 with timestamp +654
Going to the next request
Waking up in 0.7 seconds.
Waking up in 20.7 seconds.
Sending Status-Server of id 81 to 129.11.162.17 port 1813
Message-Authenticator := 0x00000000000000000000000000000000
NAS-Identifier := "Status Check. Are you alive?"
Waking up in 3.9 seconds.
Waking up in 5.2 seconds.
detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work
User-Name = "isschug"
NAS-Port = 29
NAS-IP-Address = 10.12.80.109
Framed-IP-Address = 129.11.1.138
NAS-Identifier = "WM07-1"
Airespace-Wlan-Id = 1
Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52"
Acct-Authentic = RADIUS
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "3022"
Acct-Status-Type = Start
Calling-Station-Id = "129.11.1.138"
Called-Station-Id = "10.12.80.109"
Acct-Unique-Session-Id = "5b58953f85bf5074"
Realm = "acct_realm.example.com"
FreeRADIUS-Proxied-To = 129.11.162.17
Packet-Original-Timestamp = "Jun 12 2009 17:10:06 BST"
Acct-Delay-Time = 79
server home.example.com {
+- entering group accounting {...}
++[control] returns noop
} # server home.example.com
server home.example.com {
}
>>> Sending proxied request internally to virtual server.
server acct_detail.example.com {
+- entering group accounting {...}
[detail.example.com] Suppressing writes to detail file as the request was just read from a detail file.
++[detail.example.com] returns noop
} # server acct_detail.example.com
Going to the next request
<<< Received proxied response code 0 from internal virtual server.
server home.example.com {
}
server home.example.com {
} # server home.example.com
Finished request 27.
Cleaning up request 27 ID 8957 with timestamp +690
Going to the next request
Waking up in 0.9 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.1 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.8 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.8 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.0 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.8 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.9 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.1 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.0 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.8 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.1 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.8 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.2 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.0 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.7 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.1 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.7 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.7 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.1 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.1 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.9 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 1.0 seconds.
Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*
Waking up in 0.8 seconds.
Sending Status-Server of id 3 to 129.11.162.17 port 1813
Message-Authenticator := 0x00000000000000000000000000000000
NAS-Identifier := "Status Check. Are you alive?"
Waking up in 0.3 seconds.
2
1
Hello,
I'm using FreeRadius for authenticating DSL users. Additional to the
Input- and Output octets I would like to log the transferred packet
count for the actual DSL session.
I need this information to generate statistics - and in past i got this
information from another (not local) Radius server, so I think, it
should be not impossible.
I didn't found any variables where this info is avaliable - is there any
possibility to get this information?
Thank you!
Max (Wuppertal, Germany)
3
2
I am a freeradius newbie.
I have configured Freeradius 1.1.7 on a Debian/Linux system. When I give the
command radisud -X i get the following errors:
radiusd.conf[636] Failed to link to module 'rlm_unix': rlm_unix.a: cannot
open shared object file: No such file or directory
radiusd.conf[1971] Unknown module "unix".
radiusd.conf[1931] Failed to parse authenticate section.
I have tried searching the previous posts and read the outputs of the
commands: ./configure, make and make install. I have not been able to debug
this so far. Can somebody please help me out with this?
DCC-Test-Server:/freeradius# radiusd -X
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /freeradius/raddb/proxy.conf
Config: including file: /freeradius/raddb/clients.conf
Config: including file: /freeradius/raddb/snmp.conf
Config: including file: /freeradius/raddb/eap.conf
Config: including file: /freeradius/raddb/sql.conf
main: prefix = "/usr/local"
main: localstatedir = "/usr/local/var"
main: logdir = "/usr/local/var/log/radius"
main: libdir = "/usr/local/lib"
main: radacctdir = "/usr/local/var/log/radius/radacct"
main: hostname_lookups = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 1645
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file = "/usr/local/var/log/radius/radius.log"
main: log_auth = no
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid"
main: bind_address = 192.168.15.103 IP address [192.168.15.103]
main: user = "(null)"
main: group = "(null)"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: checkrad = "/usr/local/sbin/checkrad"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
proxy: post_proxy_authorize = no
proxy: wake_all_if_all_dead = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
Using deprecated naslist file. Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded exec
exec: wait = yes
exec: program = "(null)"
exec: input_pairs = "request"
exec: output_pairs = "(null)"
exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
pap: encryption_scheme = "crypt"
pap: auto_header = yes
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = no
mschap: require_strong = no
mschap: with_ntdomain_hack = no
mschap: passwd = "(null)"
mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
radiusd.conf[636] Failed to link to module 'rlm_unix': rlm_unix.a: cannot
open shared object file: No such file or directory
radiusd.conf[1971] Unknown module "unix".
radiusd.conf[1931] Failed to parse authenticate section.
DCC-Test-Server:/freeradius#
Thanks,
Nakul
2
1
Hi,
This is my first post in this list.
I work for an ISP. We use freeradius with mysql in the radius server,
pptp/pppoe to in nas. I inherited a 5 years old freeradious installation
(version 1.0.0) and its running fine . Now i need to shift it to another
server (because server is too old). I have installed freeradius 2.1.6 in a
new PC with Centos5.3 with mysql 5.
I had dumped the mysql database from the old machine to new machine. There
is a field like "client-type" and there are two types of customer "basic"
and "shared". Bur when i added a nas is the radius, the user cannot be
authenticated, the following error occurs...
I am new with freeradius.
[chap] Setting 'Auth-Type := CHAP'
++[chap] returns ok
[sql] expand: %{User-Name} -> user1
[sql] sql_set_user escaped user --> 'user1'
rlm_sql (sql): Reserving sql socket id: 3
[sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE
Username = '%{SQL-User-Name}' ORDER BY id -> SELECT
id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'user1' ORDER
BY id
WARNING: Found User-Password == "...".
WARNING: Are you sure you don't mean Cleartext-Password?
WARNING: See "man rlm_pap" for more information.
[sql] User found in radcheck table
[sql] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE
Username = '%{SQL-User-Name}' ORDER BY id -> SELECT
id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'user1' ORDER
BY id
rlm_sql: Failed to create the pair: Invalid octet string "basic" for
attribute name "Client-Type"
rlm_sql (sql): Error getting data from database
[sql] SQL query error; rejecting user
rlm_sql (sql): Released sql socket id: 3
++[sql] returns fail
Invalid user: [user1/<CHAP-Password>] (from client nas-1 port 0)
Delaying reject of request 0 for 4 seconds
Going to the next request
Waking up in 0.9 seconds.
Waking up in 2.9 seconds.
Sending delayed reject for request 0
Sending Access-Reject of id 155 to *.*.*.* port 1033
Waking up in 4.9 seconds.
Cleaning up request 0 ID 155 with timestamp +46
Ready to process requests.
I googled the problem and find it could be a dictionary issue. So I added
dictionary. But this time freeradius is giving another problem (It is not
running.)
# /usr/local/sbin/radiusd -X
FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on May 22 2009
at 01:41:36
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
............
...........
/usr/local/etc/raddb/dictionary.compat[7]: Expecting section start brace '{'
after "ATTRIBUTE Password"
Errors reading /usr/local/etc/raddb/radiusd.conf
#
My system is CENTOS 5.3 (i386)
Mysql-server-5.0.45
Freeradius 2.1.6
I will be glad to have your comments on it. Sorry for such a long mail.
Thank you all for your patients, reading the mail.
Ashfaq.
3
2
Hello
As you will see I'm still a beginner in freeradius
I recently upgrade my version of freeradius to latest version V2.1.6,
my users or the same parameters are declared in the file "users"
These authenticate against an LDAP.
I have several two NAS, NAS1 a module with an analog modems and NAS2
digital modems to connect where Dialin using the service.
My question is:
1 - How can my users migrate users from the file into mysql?
2 - I have users connecting to both Access Server, but when they
connect the NAS1, my server raidus
assigned different parameters when connecting the NAS2 to pass other
parameters or conditions, Framed-IP-Address
etc...
Currently I have declared the same user with different parameters and
conditions.
NAS1= 192.168.25.20
NAS2= 192.168.25.30
frank Auth-Type := LDAP, NAS-IP-Address == "192.168.25.20",
Calling-Station-Id == "76415044", Simultaneous-Use := 1
Service-Type = Framed-User,
Framed-Protocol = PPP,
Framed-MTU = 1500,
Framed-Compression = Van-Jacobsen-TCP-IP,
Framed-Protocol = PPP,
Framed-IP-Address = 192.168.28.110,
Framed-IP-Netmask = 255.255.255.0,
Idle-Timeout = 0
frank Auth-Type := LDAP, NAS-IP-Address == "192.168.25.30",
Simultaneous-Use := 1
Service-Type = Framed-User,
Framed-Protocol = PPP,
Framed-MTU = 1500,
Framed-Compression = Van-Jacobsen-TCP-IP,
Framed-Protocol = PPP,
Framed-IP-Address = 192.168.29.110,
Framed-IP-Netmask = 255.255.255.0,
Idle-Timeout = 0
As would be declared to migrate to mysql?
I have to repeat them twice as I have done here?
Thank you
----------------------------------------------
Webmail, servicio de correo electronico
Casa de las Americas - La Habana, Cuba.
2
2
Hello All,
I am not able able to successfully get a port authorized via dot1x
(wired connection). I am using SecureW2 suite as a client. I get the
following message in the debug output of freeradius: "rlm_eap: SSL
error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did
not return a certificate"
I think this means that my windows XP client isn't returning a
certificate to the radius server, but I am not sure. I hope someone
can help me figure this out.
Below is a fuller output from freeradius.
Thanks!
John
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "john", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 5 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/ttls
[eap] processing type ttls
[ttls] Authenticate
[ttls] processing EAP-TLS
[ttls] Received TLS ACK
[ttls] ACK handshake fragment handler
[ttls] eaptls_verify returned 1
[ttls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 218 to 10.1.3.222 port 1024
EAP-Message = 0x010601541580000009363f8ea34a8928213fd268bf7e6095409ac959f34f444b40faf097692923ad83963e0395fa7c5dbee0011b5a9e43c819695e8dff5e4e393438c1f21a524eb69847838585d3d3c5dc5768677062f7f1fa98a14c0a1efe75201e211059691499941fa930077d23734c28a28c985d3131b7f01d21faa3dea7a544df8e6c2e87746d1b4e82eec6475a3b538d87a6cad17520189c2f86f1aa9a6e1c0deca5e45d9ee916030100a60d00009e0301024000980096308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a13045649
EAP-Message = 0x53443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c2044697374726963740e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x4aacbade4eaaaf8b77d4bfdb2d602cc2
Finished request 4.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 10.1.3.222 port 1024,
id=219, length=558
Framed-MTU = 1480
NAS-IP-Address = 10.1.3.222
NAS-Identifier = "HP ProCurve Switch 2524"
User-Name = "john"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 16
NAS-Port-Type = Ethernet
NAS-Port-Id = "16"
Called-Station-Id = "00-04-ea-a7-c2-70"
Calling-Station-Id = "00-1c-25-93-26-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
State = 0x4aacbade4eaaaf8b77d4bfdb2d602cc2
EAP-Message = 0x02060150150016030100070b00000300000016030101061000010201001ec801e7b54f1bacc0068882e8c18fce1cc9781c535dc2a9406139225a5f85a8bf309d83741a9c1980c009a09e60088af3eb8f6b0140772ca72a788e4653bf8b5df15e8a38eaa34da31bc6f2604438fb83156d7750ba083ee83838c06cdd09838e86289fb9dfe1e1664da15f157228a86ba5d248db4fae6c9e7d6c782ec9594d0e3c643becf5709608041eab084d0f2aa2237601f71b6ef98d0ee2a190101d67a908a98373884030becfb0df0b8c31349bcbfffc92e072bf3fc8591da21a70edfb234a916d3d1d19533ebec53f245e5facea057e1822a9ab93464dda7903198b
EAP-Message = 0xa87b9eb6eee9a3bca55c890b7161b1997f57f84244ef309bdbd91d5e63f9fab3140301000101160301002841175ab1eb200cb6ed8eb09ebdd827dcb0c94fb2f0cc4bbc1057c217d57c7082f6232bda1742633c
Message-Authenticator = 0x6d04184f1dac42b9c7c6da356158f8c5
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "john", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 6 length 253
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/ttls
[eap] processing type ttls
[ttls] Authenticate
[ttls] processing EAP-TLS
[ttls] eaptls_verify returned 7
[ttls] Done initial handshake
[ttls] <<< TLS 1.0 Handshake [length 0007], Certificate
[ttls] >>> TLS 1.0 Alert [length 0002], fatal handshake_failure
TLS Alert write:fatal:handshake failure
TLS_accept:error in SSLv3 read client certificate B
rlm_eap: SSL error error:140890C7:SSL
routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate
SSL: SSL_read failed in a system call (-1), TLS session fails.
TLS receive handshake failed during operation
[ttls] eaptls_process returned 4
[eap] Handler failed in EAP/ttls
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Using Post-Auth-Type Reject
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> john
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 5 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 5
Sending Access-Reject of id 219 to 10.1.3.222 port 1024
EAP-Message = 0x04060004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.5 seconds.
Cleaning up request 0 ID 214 with timestamp +10
Cleaning up request 1 ID 215 with timestamp +10
Cleaning up request 2 ID 216 with timestamp +10
Cleaning up request 3 ID 217 with timestamp +10
Cleaning up request 4 ID 218 with timestamp +10
Waking up in 1.2 seconds.
Cleaning up request 5 ID 219 with timestamp +10
Ready to process requests.
rad_recv: Access-Request packet from host 10.1.3.222 port 1024,
id=220, length=211
Framed-MTU = 1480
NAS-IP-Address = 10.1.3.222
NAS-Identifier = "HP ProCurve Switch 2524"
User-Name = "john"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 16
NAS-Port-Type = Ethernet
NAS-Port-Id = "16"
Called-Station-Id = "00-04-ea-a7-c2-70"
Calling-Station-Id = "00-1c-25-93-26-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
EAP-Message = 0x02070009016a6f686e
Message-Authenticator = 0x4bff9404e7321b17c71b169a7fe8c714
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "john", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 7 length 9
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[control] returns updated
++[unix] returns updated
[files] users: Matched entry DEFAULT at line 172
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Found existing Auth-Type, not changing it.
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Requiring client certificate
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 220 to 10.1.3.222 port 1024
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
EAP-Message = 0x010800061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xd9e67c5bd9ee655f64d832ead121cf75
Finished request 6.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.1.3.222 port 1024,
id=221, length=226
Framed-MTU = 1480
NAS-IP-Address = 10.1.3.222
NAS-Identifier = "HP ProCurve Switch 2524"
User-Name = "john"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 16
NAS-Port-Type = Ethernet
NAS-Port-Id = "16"
Called-Station-Id = "00-04-ea-a7-c2-70"
Calling-Station-Id = "00-1c-25-93-26-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
State = 0xd9e67c5bd9ee655f64d832ead121cf75
EAP-Message = 0x020800060315
Message-Authenticator = 0xf05ccffdc48c602e7055f1f09fd9f5bc
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "john", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 8 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[control] returns updated
++[unix] returns updated
[files] users: Matched entry DEFAULT at line 172
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Found existing Auth-Type, not changing it.
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP NAK
[eap] EAP-NAK asked for EAP-Type/ttls
[eap] processing type tls
[tls] Requiring client certificate
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 221 to 10.1.3.222 port 1024
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
EAP-Message = 0x010900061520
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xd9e67c5bd8ef695f64d832ead121cf75
Finished request 7.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.1.3.222 port 1024,
id=222, length=276
Framed-MTU = 1480
NAS-IP-Address = 10.1.3.222
NAS-Identifier = "HP ProCurve Switch 2524"
User-Name = "john"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 16
NAS-Port-Type = Ethernet
NAS-Port-Id = "16"
Called-Station-Id = "00-04-ea-a7-c2-70"
Calling-Station-Id = "00-1c-25-93-26-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
State = 0xd9e67c5bd8ef695f64d832ead121cf75
EAP-Message = 0x020900381500160301002d0100002903013faeaed39396e322ae3de01571d4a0cd64ad1a76a0e496d88b18489466fa7e58000002000a0100
Message-Authenticator = 0xb689989c467d49826a7819dc6283749e
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "john", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 9 length 56
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/ttls
[eap] processing type ttls
[ttls] Authenticate
[ttls] processing EAP-TLS
[ttls] eaptls_verify returned 7
[ttls] Done initial handshake
[ttls] (other): before/accept initialization
[ttls] TLS_accept: before/accept initialization
[ttls] <<< TLS 1.0 Handshake [length 002d], ClientHello
[ttls] TLS_accept: SSLv3 read client hello A
[ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello
[ttls] TLS_accept: SSLv3 write server hello A
[ttls] >>> TLS 1.0 Handshake [length 0857], Certificate
[ttls] TLS_accept: SSLv3 write certificate A
[ttls] >>> TLS 1.0 Handshake [length 00a6], CertificateRequest
[ttls] TLS_accept: SSLv3 write certificate request A
[ttls] TLS_accept: SSLv3 flush data
[ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
[ttls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 222 to 10.1.3.222 port 1024
EAP-Message = 0x010a040015c000000936160301002a0200002603014a32986de07b75d573655c77f11d4537645a9e1e9e971ae8d47560ff836ac66800000a0016030108570b00085300085000039f3082039b30820283a003020102020101300d06092a864886f70d0101040500308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a1304564953443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c204469737472696374
EAP-Message = 0x301e170d3039303630383139323933385a170d3130303630383139323933385a3075310b3009060355040613025553311330110603550408130a57617368696e67746f6e310d300b060355040a1304564953443119301706035504031310564953442052616469757320436572743127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100a9fb1e03259aafb1864477e036bb8f09194747b63bc2596d7c451882edd20837cb08675acf0e2d5fde4144bee680a0e2db76ed8fc5d717ae2cf3ab7f51acc522c7d3e50acd
EAP-Message = 0xa727b5aceb75346f22c7eef985b9703d2f7ac67192feb1e7762cd35e3c987bf5659fcd4167f60bdbf4a393ddf4b839fc6ef538c225f2277540cfd89602512127dd8c669c2010d7e7dbb2890e3b26ccc0912e3d67d0c115df2e9522999e5fc984e002890a87046517d6cc5b7a95b5e60ab5aa3b0bdc2471d3ae9a3c0a6774e29ef4df460cb409b010e998b0a80f17032e1c71cf4047f9ece5f2501fd32b6f7b4e25a4d62544f1cde4497f191c7224386d6762a6e1aba1e472af3ab50203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010093bff95e424f631cf806273bae99ae9e
EAP-Message = 0xced52efcd8e0905a6ea89f11adec836027c810257d2007ae4862ee5d6ca2dc969866d0f851ea82d7ef607da5a544b99d6392c1f86388ed55837c61f6fb634c4b537dd646332b25d729d2e6b6504f5d79f5c973d307573459f1a1afc0b86831d033c8a64bab7ba84875028362a2d44a605b1097e244073a1d9df1ca3d51622e536be8e570dacb061726210a814eb075a15b42715bec94fe1d4d6c36dbed8382bb141163ea74331741736ebafd5ac8497a639d024648badffe66853fb42c81bc83f0053b6fec9b4795035e094090d8183a340625e32903f380a38eb5578bd79940931644a6c1ef74bb15815f2cffcd7f290004ab308204a73082038fa003
EAP-Message = 0x020102020900833987f5f546
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xd9e67c5bdbec695f64d832ead121cf75
Finished request 8.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.1.3.222 port 1024,
id=223, length=226
Framed-MTU = 1480
NAS-IP-Address = 10.1.3.222
NAS-Identifier = "HP ProCurve Switch 2524"
User-Name = "john"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 16
NAS-Port-Type = Ethernet
NAS-Port-Id = "16"
Called-Station-Id = "00-04-ea-a7-c2-70"
Calling-Station-Id = "00-1c-25-93-26-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
State = 0xd9e67c5bdbec695f64d832ead121cf75
EAP-Message = 0x020a00061500
Message-Authenticator = 0x16540a47b56572901005cd0703be8083
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "john", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 10 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/ttls
[eap] processing type ttls
[ttls] Authenticate
[ttls] processing EAP-TLS
[ttls] Received TLS ACK
[ttls] ACK handshake fragment handler
[ttls] eaptls_verify returned 1
[ttls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 223 to 10.1.3.222 port 1024
EAP-Message = 0x010b040015c0000009363b43300d06092a864886f70d0101050500308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a1304564953443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c204469737472696374301e170d3039303630383139323833395a170d3130303630383139323833395a308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d060355
EAP-Message = 0x04071306566173686f6e310d300b060355040a1304564953443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c20446973747269637430820122300d06092a864886f70d01010105000382010f003082010a0282010100a55584aa47296e32cbab93cdad9908b909d0d7b633fde3e846df3b9a70d74940eb63cd058ed1557ae9f98342785555a7f69b29a170e1b0cc9865448cf75f18bdf837559e6c58f8f8ed427076258110aa99459a3ee88350fe1ea5a295fe7b8d9b4861e4dc8281bee62c64ae560fad3d741127
EAP-Message = 0x090cf68c60831fe46c8a894e4b15d923bea2b62ffc0b274dafe6f18012a821d91c25e5a16763ce21fa710f971d003503692a98ec8bc7e7aa68ab0e35c8f98d6dee0e3997055d3dab1d5f02890e50c2e57c8f41bd59aae1eb012900d4772c0f4f833db3c0e43ca8ad1653a13316e926364cd35f252e607b0cedd51d257a82a5bdb87320d7984f7e3b3bc864e923710203010001a381fb3081f8301d0603551d0e04160414543e18343eb614370c4130e3ff1afd8cf93fe9af3081c80603551d230481c03081bd8014543e18343eb614370c4130e3ff1afd8cf93fe9afa18199a48196308193310b3009060355040613025553311330110603550408130a
EAP-Message = 0x57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a1304564953443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c204469737472696374820900833987f5f5463b43300c0603551d13040530030101ff300d06092a864886f70d010105050003820101007b2ccc21443a1b43a5562175e927500efa22c16d4d8dd566cdead0b0830269d54cd7afa1098199403df344c78059d781af4ce410cfcd663c52cec5440540b0663a6096dd0084bd20b8ea8601860e244d922f85b7f1
EAP-Message = 0xfc18f3952fd1dda7d4ecca4e
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xd9e67c5bdaed695f64d832ead121cf75
Finished request 9.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 10.1.3.222 port 1024,
id=224, length=226
Framed-MTU = 1480
NAS-IP-Address = 10.1.3.222
NAS-Identifier = "HP ProCurve Switch 2524"
User-Name = "john"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 16
NAS-Port-Type = Ethernet
NAS-Port-Id = "16"
Called-Station-Id = "00-04-ea-a7-c2-70"
Calling-Station-Id = "00-1c-25-93-26-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
State = 0xd9e67c5bdaed695f64d832ead121cf75
EAP-Message = 0x020b00061500
Message-Authenticator = 0xb4dd50363a7aa33881d9d2ba2fad1f4b
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "john", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 11 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/ttls
[eap] processing type ttls
[ttls] Authenticate
[ttls] processing EAP-TLS
[ttls] Received TLS ACK
[ttls] ACK handshake fragment handler
[ttls] eaptls_verify returned 1
[ttls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 224 to 10.1.3.222 port 1024
EAP-Message = 0x010c01541580000009363f8ea34a8928213fd268bf7e6095409ac959f34f444b40faf097692923ad83963e0395fa7c5dbee0011b5a9e43c819695e8dff5e4e393438c1f21a524eb69847838585d3d3c5dc5768677062f7f1fa98a14c0a1efe75201e211059691499941fa930077d23734c28a28c985d3131b7f01d21faa3dea7a544df8e6c2e87746d1b4e82eec6475a3b538d87a6cad17520189c2f86f1aa9a6e1c0deca5e45d9ee916030100a60d00009e0301024000980096308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a13045649
EAP-Message = 0x53443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c2044697374726963740e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xd9e67c5bddea695f64d832ead121cf75
Finished request 10.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 10.1.3.222 port 1024,
id=225, length=558
Framed-MTU = 1480
NAS-IP-Address = 10.1.3.222
NAS-Identifier = "HP ProCurve Switch 2524"
User-Name = "john"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 16
NAS-Port-Type = Ethernet
NAS-Port-Id = "16"
Called-Station-Id = "00-04-ea-a7-c2-70"
Calling-Station-Id = "00-1c-25-93-26-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
State = 0xd9e67c5bddea695f64d832ead121cf75
EAP-Message = 0x020c0150150016030100070b000003000000160301010610000102010029f7cad2a5ed026b3f6ac94cbeff92814502139418aa0c84ac8530c3f8b94a1a7aa8e8d45cf5b45d5779353a166d916292d43cff1264d5d99484b5aca8c6a381dd11db935d9d5cdb36d718c0b5e1c6ef7cb8774a461feb431c3918b706066e0a112a991af85400d62bf7ef76b370a3aeea705256c55afedf775aeb1405edeb429ac74753aa03b82c52c1c56a7e8145056e0f01a5d1a689cca54cb9ed121ea86a1e6ace3ac093f9d757752049924ab81792d47beb638b4e6eecdc55e88da3218972a2aa0380bf2d38b517101373498c55bd60d6ae9e581a5d976662a6188ec416
EAP-Message = 0x258d45ed623983520f1b0a30aa81bda3ecc551ac0617eb0de1185927b79dca21140301000101160301002874cdc78d855874525e120a085bfeb198cb565313472a4bda41ca3a52acb2df5b2df7561652ffa1d9
Message-Authenticator = 0xc93875552209af406690e002d9d996ee
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "john", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 12 length 253
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/ttls
[eap] processing type ttls
[ttls] Authenticate
[ttls] processing EAP-TLS
[ttls] eaptls_verify returned 7
[ttls] Done initial handshake
[ttls] <<< TLS 1.0 Handshake [length 0007], Certificate
[ttls] >>> TLS 1.0 Alert [length 0002], fatal handshake_failure
TLS Alert write:fatal:handshake failure
TLS_accept:error in SSLv3 read client certificate B
rlm_eap: SSL error error:140890C7:SSL
routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate
SSL: SSL_read failed in a system call (-1), TLS session fails.
TLS receive handshake failed during operation
[ttls] eaptls_process returned 4
[eap] Handler failed in EAP/ttls
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Using Post-Auth-Type Reject
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> john
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 11 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 11
Sending Access-Reject of id 225 to 10.1.3.222 port 1024
EAP-Message = 0x040c0004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.5 seconds.
Cleaning up request 6 ID 220 with timestamp +71
Cleaning up request 7 ID 221 with timestamp +71
Cleaning up request 8 ID 222 with timestamp +71
Cleaning up request 9 ID 223 with timestamp +71
Cleaning up request 10 ID 224 with timestamp +71
Waking up in 1.3 seconds.
Cleaning up request 11 ID 225 with timestamp +71
Ready to process requests.
3
6
All,
I know this is an old(ish) issue, but one I have been playing with a
lot lately. I have a Vista Ultimate box that works perfectly, but an XP
SP3 box that stopped working after SP3 was applied. What I am seeing is
the inital challenge come in from the XP box, the freeRadius box
responding, an additional response from the XP system, and the final
challenge from the Radius box goes out and never gets an answer. This
repeats indefinitely until the WLAN is shut off on the XP box. It seems
to be failing only on this last challenge response section, the XP box
just never responds back. I am stumped as to what changed, and what else
I can hammer on, without mindlessly breaking a working Radius server.
My EAP.conf section is :
#
# Whatever you do, do NOT set 'Auth-Type := EAP'. The server
# is smart enough to figure this out on its own. The most
# common side effect of setting 'Auth-Type := EAP' is that the
# users then cannot use ANY other authentication method.
#
# $Id: eap.conf,v 1.4 2004/04/15 18:34:41 aland Exp $
#
eap {
# Invoke the default supported EAP type when
# EAP-Identity response is received.
#
# The incoming EAP messages DO NOT specify which EAP
# type they will be using, so it MUST be set here.
#
# For now, only one default EAP type may be used at a time.
#
# If the EAP-Type attribute is set by another module,
# then that EAP type takes precedence over the
# default type configured here.
#
default_eap_type = peap
# A list is maintained to correlate EAP-Response
# packets with EAP-Request packets. After a
# configurable length of time, entries in the list
# expire, and are deleted.
#
timer_expire = 60
# There are many EAP types, but the server has support
# for only a limited subset. If the server receives
# a request for an EAP type it does not support, then
# it normally rejects the request. By setting this
# configuration to "yes", you can tell the server to
# instead keep processing the request. Another module
# MUST then be configured to proxy the request to
# another RADIUS server which supports that EAP type.
#
# If another module is NOT configured to handle the
# request, then the request will still end up being
# rejected.
ignore_unknown_eap_types = no
# Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given
# a User-Name attribute in an Access-Accept, it copies one
# more byte than it should.
#
# We can work around it by configurably adding an extra
# zero byte.
cisco_accounting_username_bug = yes
# Supported EAP-types
#
# We do NOT recommend using EAP-MD5 authentication
# for wireless connections. It is insecure, and does
# not provide for dynamic WEP keys.
#
md5 {
}
# Cisco LEAP
#
# We do not recommend using LEAP in new deployments. See:
# http://www.securiteam.com/tools/5TP012ACKE.html
#
# Cisco LEAP uses the MS-CHAP algorithm (but not
# the MS-CHAP attributes) to perform it's authentication.
#
# As a result, LEAP *requires* access to the plain-text
# User-Password, or the NT-Password attributes.
# 'System' authentication is impossible with LEAP.
#
leap {
}
# Generic Token Card.
#
# Currently, this is only permitted inside of EAP-TTLS,
# or EAP-PEAP. The module "challenges" the user with
# text, and the response from the user is taken to be
# the User-Password.
#
# Proxying the tunneled EAP-GTC session is a bad idea,
# the users password will go over the wire in plain-text,
# for anyone to see.
#
gtc {
# The default challenge, which many clients
# ignore..
#challenge = "Password: "
# The plain-text response which comes back
# is put into a User-Password attribute,
# and passed to another module for
# authentication. This allows the EAP-GTC
# response to be checked against plain-text,
# or crypt'd passwords.
#
# If you say "Local" instead of "PAP", then
# the module will look for a User-Password
# configured for the request, and do the
# authentication itself.
#
auth_type = PAP
}
## EAP-TLS
#
# To generate ctest certificates, run the script
#
# ../scripts/certs.sh
#
# The documents on http://www.freeradius.org/doc
# are old, but may be helpful.
#
# See also:
#
# http://www.dslreports.com/forum/remark,9286052~mode=flat
#
tls {
#private_key_password = zaq1ZAQ!zaq1ZAQ
#private_key_file = ${raddbdir}/certs/haruhi.pem
private_key_file =
/etc/pki/tls/private/haruhi.tsukinokage.net.key
# If Private key & Certificate are located in
# the same file, then private_key_file &
# certificate_file must contain the same file
# name.
#certificate_file = ${raddbdir}/certs/haruhi.crt
certificate_file =
/etc/pki/tls/certs/haruhi.tsukinokage.net.crt
# Trusted Root CA list
#CA_file = ${raddbdir}/certs/CA/ca.cer
CA_file = /etc/pki/tls/certs/CA/ca.cer
dh_file = ${raddbdir}/certs/dh
random_file = ${raddbdir}/certs/random
random_file = /dev/random
#
# This can never exceed the size of a RADIUS
# packet (4096 bytes), and is preferably half
# that, to accomodate other attributes in
# RADIUS packet. On most APs the MAX packet
# length is configured between 1500 - 1600
# In these cases, fragment size should be
# 1024 or less.
#
fragment_size = 1024
# include_length is a flag which is
# by default set to yes If set to
# yes, Total Length of the message is
# included in EVERY packet we send.
# If set to no, Total Length of the
# message is included ONLY in the
# First packet of a fragment series.
#
include_length = yes
# Check the Certificate Revocation List
#
# 1) Copy CA certificates and CRLs to same
directory.
# 2) Execute 'c_rehash <CA certs&CRLs Directory>'.
# 'c_rehash' is OpenSSL's command.
# 3) Add 'CA_path=<CA certs&CRLs directory>'
# to radiusd.conf's tls section.
# 4) uncomment the line below.
# 5) Restart radiusd
# check_crl = yes
#
# If check_cert_cn is set, the value will
# be xlat'ed and checked against the CN
# in the client certificate. If the values
# do not match, the certificate verification
# will fail rejecting the user.
#
# check_cert_cn = %{User-Name}
}
# The TTLS module implements the EAP-TTLS protocol,
# which can be described as EAP inside of Diameter,
# inside of TLS, inside of EAP, inside of RADIUS...
#
# Surprisingly, it works quite well.
#
# The TTLS module needs the TLS module to be installed
# and configured, in order to use the TLS tunnel
# inside of the EAP packet. You will still need to
# configure the TLS module, even if you do not want
# to deploy EAP-TLS in your network. Users will not
# be able to request EAP-TLS, as it requires them to
# have a client certificate. EAP-TTLS does not
# require a client certificate.
#
ttls {
# The tunneled EAP session needs a default
# EAP type which is separate from the one for
# the non-tunneled EAP module. Inside of the
# TTLS tunnel, we recommend using EAP-MD5.
# If the request does not contain an EAP
# conversation, then this configuration entry
# is ignored.
default_eap_type = md5
# The tunneled authentication request does
# not usually contain useful attributes
# like 'Calling-Station-Id', etc. These
# attributes are outside of the tunnel,
# and normally unavailable to the tunneled
# authentication request.
#
# By setting this configuration entry to
# 'yes', any attribute which NOT in the
# tunneled authentication request, but
# which IS available outside of the tunnel,
# is copied to the tunneled request.
#
# allowed values: {no, yes}
# copy_request_to_tunnel = no
# The reply attributes sent to the NAS are
# usually based on the name of the user
# 'outside' of the tunnel (usually
# 'anonymous'). If you want to send the
# reply attributes based on the user name
# inside of the tunnel, then set this
# configuration entry to 'yes', and the reply
# to the NAS will be taken from the reply to
# the tunneled request.
#
# allowed values: {no, yes}
# use_tunneled_reply = no
}
#
# The tunneled EAP session needs a default EAP type
# which is separate from the one for the non-tunneled
# EAP module. Inside of the TLS/PEAP tunnel, we
# recommend using EAP-MS-CHAPv2.
#
# The PEAP module needs the TLS module to be installed
# and configured, in order to use the TLS tunnel
# inside of the EAP packet. You will still need to
# configure the TLS module, even if you do not want
# to deploy EAP-TLS in your network. Users will not
# be able to request EAP-TLS, as it requires them to
# have a client certificate. EAP-PEAP does not
# require a client certificate.
#
peap {
# The tunneled EAP session needs a default
# EAP type which is separate from the one for
# the non-tunneled EAP module. Inside of the
# PEAP tunnel, we recommend using MS-CHAPv2,
# as that is the default type supported by
# Windows clients.
default_eap_type = mschapv2
}
#
# This takes no configuration.
#
# Note that it is the EAP MS-CHAPv2 sub-module, not
# the main 'mschap' module.
#
# Note also that in order for this sub-module to work,
# the main 'mschap' module MUST ALSO be configured.
#
# This module is the *Microsoft* implementation of
MS-CHAPv2
# in EAP. There is another (incompatible) implementation
# of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not
# currently support.
#
mschapv2 {
}
}
If anyone knows what needs done to get this working please assist.
Thanks,
Seann
2
1
I have a check to verify that a user is allowed to use radius at all, simply
by checking if they are in the "radius" group.
DEFAULT Group != "radius", Auth-Type == Reject
Reply-Message == " Not in radius group"
I would like to expand this to check against TWO groups. If user is in either one then pass ,
if user is in neither then generate the Reply-Message == " Not in radius group(s)"
Its likely a simple tweak, but its escaping me. Is this where !* would serve?
Thank You!
________________________________
This e-mail, including any attachments, may be confidential, privileged or otherwise legally protected. It is intended only for the addressee. If you received this e-mail in error or from someone who was not authorized to send it to you, do not disseminate, copy or otherwise use this e-mail or its attachments. Please notify the sender immediately by reply e-mail and delete the e-mail from your system.
2
2