- Freeradius-Users - lists.freeradius.org

Re: Building a test tool
by Vinit Karandikar 06 Jun '09

06 Jun '09

Thanks for the prompt responses, Alan. I have a one follow up question before I head off and start poking through code, doxygen and writing some code. > > Vinit Karandikar wrote: > > >> So if I could run 10 copies of radclient in one process (each in a >> different thread for example), I can write code to co-ordinate what each >> thread should do for each test case. >> > > The server comes with a RADIUS API. You can use the API to create an > application that sends and receives RADIUS packets. > Aha ! Where can I find information on this API for what you correctly described as "very custom" development that I'm looking to do ? > >> Hope this illustrates the functionality I mentioned as desired in my >> original email. >> In BOTH cases, the AAA server is expected to forward RADIUS requests to >> a different network element and it behooves a test application to see >> both ends. >> > > What you're describing is a RADIUS simulator for a specific test > environment. That doesn't exist. It is a *very* custom piece of software. > > FreeRADIUS can do a lot of this, but you will still need to write all > of the custom rules for processing, timing, etc. > > > >> The point once again is just to ask if >> a) there is already a tool that can simulate multiple network elements >> and co-ordinate between them to know when to expect a packet and when to >> initiate traffic >> > > ... for your specific environment, and your specific test cases. > > The answer to that is "no". > > > > Alan DeKok. > > > ------------------------------ > >

2 1

RE: FreeRadius 2.1 + LDAP Authentication - mschap
by Mackey, Theral 05 Jun '09

05 Jun '09

[mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for sminhas with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Needs NT/LM passwords (or plain-text) for mschap to work. See perl's Crypt::SmbHash on CPAN for an easy way to generate the hash from plaintext. Look at the samba schema for openLdap, and probably want to compile the smbk5pwd module for openLDAP as well (in the contrib section of the source) to keep your pwds sync'd (also check pam/nssldap conf for passwd changes using LDAP-exop if you let shell accounts change pwds too). -T ----------------------------- Message: 7 Date: Fri, 05 Jun 2009 14:47:36 -0400 From: Nik Alleyne <nalleyne(a)brontecollege.ca> Subject: FreeRadius 2.1 + LDAP Authentication To: freeradius-users(a)lists.freeradius.org Message-ID: <20090605144736.cpa0ghg1wk4ok4gk(a)mail.brontecollege.ca> Content-Type: text/plain; charset=ISO-8859-1 Hi Guys, I'm hoping someone can help me, because I have been fighting with this issue for days now. Environment: FC10 + FreeRadius 2.1 + OpenLdap 2.4. I've successfully setup Certificate Based authentication on my FreeRadius server and that works well. My problem is I have some users I want to authenticate via username and password (EAP-PEAP). I configured FreeRadius for such and my radtest (Access-Accept) works as well as my NTRadPing Utility (Access-Accept) when checked against the users in LDAP. However, I cannot seem to get my Windows XP Wireless Clients to authenticate. Please see my debug info below for a sample user "sminhas" who has a cleartext LDAP password as "it". Thanks for the help. ---------------- radiusd -X ---------------------..snip

1 0

FreeRadius 2.1 + LDAP Authentication
by Nik Alleyne 05 Jun '09

05 Jun '09

Hi Guys, I'm hoping someone can help me, because I have been fighting with this issue for days now. Environment: FC10 + FreeRadius 2.1 + OpenLdap 2.4. I've successfully setup Certificate Based authentication on my FreeRadius server and that works well. My problem is I have some users I want to authenticate via username and password (EAP-PEAP). I configured FreeRadius for such and my radtest (Access-Accept) works as well as my NTRadPing Utility (Access-Accept) when checked against the users in LDAP. However, I cannot seem to get my Windows XP Wireless Clients to authenticate. Please see my debug info below for a sample user "sminhas" who has a cleartext LDAP password as "it". Thanks for the help. ---------------- radiusd -X ------------------------------- FreeRADIUS Version 2.1.3, for host i386-redhat-linux-gnu, built on Dec 8 2008 at 15:31:31 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/mschap.nik including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/ldap.conf including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 172.16.3.0/24 { require_message_authenticator = no secret = "BronteCollege" shortname = "bcc_WiFi" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "localhost" port = 389 password = "pp2%dfs;e" identity = "cn=Manager,dc=bcc,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=bcc,dc=com" filter = "(uid=%u)" base_filter = "(objectclass=uid)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90433c8 Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating auth_log detail auth_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Ready to process requests. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=2, length=157 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000c01736d696e686173 Message-Authenticator = 0xff3ec4918f7da24d224ee1e7f4e7687e +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [ldap] performing user authorization for sminhas [ldap] expand: (uid=%u) -> (uid=sminhas) [ldap] expand: dc=bcc,dc=com -> dc=bcc,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=bcc,dc=com/pp2%dfs;e to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=bcc,dc=com, with filter (uid=sminhas) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user sminhas authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 2 to 172.16.3.243 port 1026 EAP-Message = 0x0101001604107dc67d8561a4104bcd5d2564a184ae21 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e6448bc34871cad843bf022113 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=3, length=169 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020100060319 State = 0x448ac7e6448bc34871cad843bf022113 Message-Authenticator = 0xf484e28ce3364ad7c758370ff8a0fde7 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [ldap] performing user authorization for sminhas [ldap] expand: (uid=%u) -> (uid=sminhas) [ldap] expand: dc=bcc,dc=com -> dc=bcc,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=bcc,dc=com, with filter (uid=sminhas) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user sminhas authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 3 to 172.16.3.243 port 1026 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e64588de4871cad843bf022113 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=4, length=243 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0202005019800000004616030100410100003d03014a29675935525b99ff34aa90ab2f4f55de41f178895635aaf694bbc0d2abd39200001600040005000a000900640062000300060013001200630100 State = 0x448ac7e64588de4871cad843bf022113 Message-Authenticator = 0x17c9e0df16b03cba61ad387e61425b3c +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 4 to 172.16.3.243 port 1026 EAP-Message = 0x0103040019c00000089b160301002a0200002603014a2967093886b79ce89d2dc53e161778e1e238caef726810b5810527a4520f2b00000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303630343135343334305a170d3130303630343135343334305a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c4f2b7365ca8b81ec1506ef0c4add00d31fed2645528fa5ed28e647ab1b422acc16cdb30486ee70a55b3b6fdaa4d2f98f7d6251ee8e2bec05b252429c256 EAP-Message = 0x14d07246a7fa8e4d9fc6a7cd62fc67d41e548186b4c0819fdf6702b1ed2514d21c79453e01d308c1e5016cb089477d655012f03117154d7f61748bd15246b49f7e56a854e9ff7613ab7c57431d6044c147eab4a9606e5af9342117902e0dc7559a3b3495f121ed3b25f346bc155eda23d90a47e43ac713c1a665b6b72319e8962984b9315a694672a50b39ff08e62c988f56ff02453f5769b15d921905a85b30a0300d4ec09198e407e9f19417fedef01268e74a80b7dbb940dc1005b2753f5f0fe70203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010085dae846479873637b EAP-Message = 0x6430d3583e210c28d6c27cd677a2cb7f35800a81c563b55eb01ad51a0db37a5f0aec5a67884e8ca6dc1d5bfe8775615a627dc411b85966e54045bd38e16e5702398b887d4d8bc57e81ff01d17d35ef882f806268cfe6c7e4f8a85780c0e9b82dffdfa447b36887d19024bf49b36a91dc7c613110ff55d1a40abda5422d1cc5dafc83c80bdd982f9221b82d1d9fdc96a2775d69616ce2e15f352bc403e7770670ed625ed91a351c44b961bc89b7bb57c9321d01983b01760854fe350fa79b99c8b6db4d22cb1dc0201fa9cf29d69cf5e60086aa4669450188a288b40355bdf71d5c900e1a914ab9638375937ff93136ea3bb5e0bab6f22d0004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e64689de4871cad843bf022113 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=5, length=169 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300061900 State = 0x448ac7e64689de4871cad843bf022113 Message-Authenticator = 0xf3aa0fbb6061e253f2b396247dbe34f3 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 5 to 172.16.3.243 port 1026 EAP-Message = 0x010403fc194000bfbe10f4dc17bc57300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303630343135343334305a170d3130303630343135343334305a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a2df5bcfc7dfaf404123cd9eee92293fc10e130290d95b45f1d5ee1477cd79cc642a29f98e6969b06c1ebcee8f7891d7d8f9f98ccfbc8d847f39c463addd68571300b9580ed93fb65aa4134ea9ea50739aeb66af4eebf7b3f22b371d09e8b358460ed87c64c97b2ce77dd66422b397 EAP-Message = 0x885f56aa694174cdfda8df7b4ac3c4a727b3abadfa483529e5f8dabc90e1282472eefe3bdebe6b16f4a5281ab7e6fa930b29bd997b2d24642e2688c6bdefe837f46110a56b6fb021fc238e6d16cc992fe5174fdf2a30ff39513a9b0dd4f0a3bcf43eadd3050afaaebd8490b522a8465d32b9d9176ba04eb13bb28df11c9fd7f9cb8da5f5cd8abfd73c622348a9038ae6c30203010001a381fb3081f8301d0603551d0e041604140fd0a4d97630cf12b249f8118e1e5e2b6616e4033081c80603551d230481c03081bd80140fd0a4d97630cf12b249f8118e1e5e2b6616e403a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900bfbe10f4dc17bc57300c0603551d13040530030101ff300d06092a864886f70d010105050003820101000d1b7c610b8269f7f60db4f7eb582e2cd3c2e6ec7a557f3d40ab21ce614c28aa7547535ec6d82fc11e95b51dae4502dbd8c75bae4530ebf9a0d5385d0e154656592ebb02df514c8de95378f084d449a83d1a EAP-Message = 0x0734802e45757914 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e6478ede4871cad843bf022113 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=6, length=169 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400061900 State = 0x448ac7e6478ede4871cad843bf022113 Message-Authenticator = 0x326c80c3d6ff6c66412892224cf04b87 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 6 to 172.16.3.243 port 1026 EAP-Message = 0x010500b519003340e5531cf0d388c39fd268db69a6b64329725766db06e51180f8cfb46d1dbed8f37dea0603d57576dad3fbbbfb27e55399fe1f7627abea0db94c5a33ff94d14d7592541bf619e787d19b83f4f4b1ecb1f2c0d2a58727e99855ad1ad66b0f9548a5bbb5c341bcf87367f7e7e7efdf521f3831b651a1b000bc0f9091a55cf56dc542d451dca7a0fb49bf0644099d3fb486a217187331461833a35b3027e12970551a49d276ec16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e6408fde4871cad843bf022113 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=7, length=485 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0205014019800000013616030101061000010201001840b9b0f1e3847e833de04563d437492c9370f225da60f3459d8269ad02b68d20bf5239675f64e3edbdf95b6d382b88b55299f0477a413949cb59d8d8fc9eb26a3df28360901144b030c15efcc37eee5fd2134d3edaf9dcbb836cef2085ec74ec81bcaa203a7985f2e0c47f740a718b22f42f4a14f99aed538488cc6379e5c4c0d42379f3a883e012fcc9c317ce650a210f2a9879fb10718b9920f3e81db14deb55762928448f8d5b80f621311593b65942b6f5f5590a6c4140693c25296938079f9be0d3621a52cc8a9cccdc0a81fb7a75890707c4c13939977008cf3268ac21f4770920ac610b EAP-Message = 0x77fb54d881fc654231d061b03f32d4e145cc5fb8ca0432861403010001011603010020e378e0b99dbd0025936afc79910bd597d21aa1ab287ffa689325d8e2f8845670 State = 0x448ac7e6408fde4871cad843bf022113 Message-Authenticator = 0xa56256998c90432cc95ac5e2862624b0 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 7 to 172.16.3.243 port 1026 EAP-Message = 0x010600311900140301000101160301002069824744e087b896e73cdf48efd1922ee26a4e3e58d0581dacb5d8f9c5bb9dcf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e6418cde4871cad843bf022113 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=8, length=169 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020600061900 State = 0x448ac7e6418cde4871cad843bf022113 Message-Authenticator = 0x0f5f4b99a72b15cd40e377dee0ce705c +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 8 to 172.16.3.243 port 1026 EAP-Message = 0x0107002019001703010015398fdaf093922be8a86b61cd34aa8f7c5b71e2874f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e6428dde4871cad843bf022113 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=9, length=198 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02070023190017030100189045a426a592c65afb91c5447a54fb5440f72e95e4f760ed State = 0x448ac7e6428dde4871cad843bf022113 Message-Authenticator = 0xb1ad0301d20dcfa679c747016d1d161f +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 35 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - sminhas [peap] Got tunneled request EAP-Message = 0x0207000c01736d696e686173 server { PEAP: Got tunneled identity of sminhas PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to sminhas Sending tunneled request EAP-Message = 0x0207000c01736d696e686173 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] performing user authorization for sminhas [ldap] expand: (uid=%u) -> (uid=sminhas) [ldap] expand: dc=bcc,dc=com -> dc=bcc,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=bcc,dc=com, with filter (uid=sminhas) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user sminhas authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010800211a0108001c10a2cce07996096b9995cd579953c8a0d2736d696e686173 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd835184ed83d026fcd510a2453380f9a [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800211a0108001c10a2cce07996096b9995cd579953c8a0d2736d696e686173 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd835184ed83d026fcd510a2453380f9a [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 9 to 172.16.3.243 port 1026 EAP-Message = 0x010800381900170301002df6dd96a1a3fefcb4dd9d07c8d6d525f94e852f0d3b70ea23e25445b745e48fcfd13751108f6480bd9887df0305 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e64382de4871cad843bf022113 Finished request 7. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=10, length=252 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800591900170301004ef4f5895ae1386b18210c59be786e3390e65624aa56459564747a196beca068c47e0f4073c6607c1625606abc4dd02ebbedfd0e6bd349be90fb2fa92e52717805bca7d7decd285bc123c57d6a32ce State = 0x448ac7e64382de4871cad843bf022113 Message-Authenticator = 0x996225c55ce5b8971faab11de63db92c +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 89 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800421a0208003d312ecef7d7d8908f1a6b5c42a5d6cc5cda000000000000000011ecf3f719610d92861576e00d82c67ae8142c4416d96da200736d696e686173 server { PEAP: Setting User-Name to sminhas Sending tunneled request EAP-Message = 0x020800421a0208003d312ecef7d7d8908f1a6b5c42a5d6cc5cda000000000000000011ecf3f719610d92861576e00d82c67ae8142c4416d96da200736d696e686173 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sminhas" State = 0xd835184ed83d026fcd510a2453380f9a NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 66 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] performing user authorization for sminhas [ldap] expand: (uid=%u) -> (uid=sminhas) [ldap] expand: dc=bcc,dc=com -> dc=bcc,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=bcc,dc=com, with filter (uid=sminhas) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user sminhas authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for sminhas with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 10 to 172.16.3.243 port 1026 EAP-Message = 0x010900261900170301001b5c6c4555857f37d167f81d4e781468a5a5798f70aaade757f2758a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e64c83de4871cad843bf022113 Finished request 8. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=11, length=201 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020900261900170301001ba2885943dd8bbf7b657eb24589528193b4bac719e9b697782b8fa9 State = 0x448ac7e64c83de4871cad843bf022113 Message-Authenticator = 0x1d0008416ffcf27d3ad5f09e8f875f19 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sminhas attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 11 to 172.16.3.243 port 1026 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 2 with timestamp +16 Cleaning up request 1 ID 3 with timestamp +16 Cleaning up request 2 ID 4 with timestamp +16 Cleaning up request 3 ID 5 with timestamp +16 Cleaning up request 4 ID 6 with timestamp +16 Cleaning up request 5 ID 7 with timestamp +16 Cleaning up request 6 ID 8 with timestamp +16 Cleaning up request 7 ID 9 with timestamp +16 Cleaning up request 8 ID 10 with timestamp +16 Waking up in 1.0 seconds. Cleaning up request 9 ID 11 with timestamp +16 Ready to process requests. ------------------------- -------------------------- Once again Thanks Nik

1 0

Upgrading from 1.17 to 2.14 MySQL schema
by Steve Bertrand 05 Jun '09

05 Jun '09

Hi all, I'm in the process of migrating our RADIUS servers from 1.17 to 2.14. I've scoured all over for any information relating to the migration of the MySQL database. Am I just missing something here, or are the two versions completely non-compatible? If this is the case, I'll have to write a translator to migrate the data from the old DB into the new one. Steve

3 3

LDAP Auth
by Dave Rummel 05 Jun '09

05 Jun '09

First off I am totally new to radius...but really love the concept. I have radius working with ldap to authorize the user if they are in the corporate directory, o=lookout. My next step is to filter it by category to the NAS device. I have been looking at quite a few examples, but nothing seems to stick. In order for me to just grasp the concept, I have tried this in the users file, o=lookout is our complete list of all of our users DEFAULT Huntgroup-Name == CiscoAdmin, Ldap-Group == "o=lookout" Fall-Through = no DEFAULT Auth-Type := Reject If I comment out the Reject, the user is able to authenticate to the Cisco Router, as soon as uncomment it out, I get rejected...here is the log file from it. Thu Jun 4 16:15:52 2009 : Info: [ldap] user daverummel authorized to use remote access Thu Jun 4 16:15:52 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Thu Jun 4 16:15:52 2009 : Info: ++[ldap] returns ok Thu Jun 4 16:15:52 2009 : Info: ++[expiration] returns noop Thu Jun 4 16:15:52 2009 : Info: ++[logintime] returns noop Thu Jun 4 16:15:52 2009 : Info: Found Auth-Type = Reject Thu Jun 4 16:15:52 2009 : Info: Auth-Type = Reject, rejecting user Thu Jun 4 16:15:52 2009 : Info: Failed to authenticate the user. Thu Jun 4 16:15:52 2009 : Auth: Login incorrect: [daverummel] (from client R1 port 98 cli 216.103.190.220) Thu Jun 4 16:15:52 2009 : Info: Using Post-Auth-Type Reject Thu Jun 4 16:15:52 2009 : Info: +- entering group REJECT {...} Thu Jun 4 16:15:52 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> daverummel Thu Jun 4 16:15:52 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Jun 4 16:15:52 2009 : Info: ++[attr_filter.access_reject] returns updated Thu Jun 4 16:15:52 2009 : Info: Delaying reject of request 0 for 1 seconds Thu Jun 4 16:15:52 2009 : Debug: Going to the next request Thu Jun 4 16:15:52 2009 : Debug: Waking up in 0.9 seconds. Thu Jun 4 16:15:53 2009 : Info: Sending delayed reject for request 0 The line I am really trying to understand is this one, where is this line 11 ? *Thu Jun 4 16:15:52 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 *Thanks for your help Dave

2 1

dealing with 'corrupt' detail file
by A.L.M.Buxey＠lboro.ac.uk 05 Jun '09

05 Jun '09

hi, okay. so i've been preaching that people use eg the buffered-sql virtual machine rather than do accounting DB entries 'live' - therefore giving the admin better FR performance with slower DBs etc... however, I've been approached today by someone who has a rather large detail file (few gigs) that has 'corrupt' records in it... eg entries with no Acct-Status-Type set (broken NAS, duff RADIUS server or possibly attrbute filtering along the path)...anyway, my first though was edit the accouting stanza of buffered-sql so that it looks like if(Acct-Status-Type){ sql } instead of just calling sql and borking over the lack of Accounting status in the packet. but, of course, whilst this stop the bork, it also stops the ingestion of the detail file as it sticks at that point, doesnt flush that entry and move on... so...can anyone info me the magic or steps to bypass this entry in the detail file so it can continue working on it? the code itself seems to need to go through something before flushing the packet.. ..i expect to then be told there are other broken records too - but i hope a simple solution can deal with all sorts.... then I can get them to ensure that the call to detail is protected in the first place so NULL records etc dont even go in. which reminds me...any best practice from the FR community regarding the detail file and the aforementioned protection from duff NAS etc (I've already got, on my list, use Calling-Station-Id instead of NAS-Port for the unique function as many NAS use the same port for every accounting packet :-|) thanks alan

3 7

How use tagged atrributes?
by R.Filatov＠ttk.ru 05 Jun '09

05 Jun '09

Hello! This construction don't work # radiusd -X FreeRADIUS Version 2.1.6, for host x86_64-unknown-linux-gnu, built on Jun 2 2009 at 23:23:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf ..... attr_rewrite add.service-volume { attribute = "ERX-Service-Volume:1" searchfor = "" searchin = "packet" replacewith = "1000" append = no ignore_case = yes new_attribute = no max_matches = 1 } rlm_attr_rewrite: No such attribute ERX-Service-Volume:1 /usr/local/etc/raddb/modules/attr_rewrite[48]: Instantiation failed for module "add.service-volume" /usr/local/etc/raddb/sites-enabled/default[482]: Failed to find module "add.service-volume". /usr/local/etc/raddb/sites-enabled/default[480]: Errors parsing pre-proxy section. Errors initializing modules May be trouble in my /dev/hands? Best Regards Filatov Ruslan

2 2

Re: Building a test tool
by Vinit Karandikar 05 Jun '09

05 Jun '09

> > ------------------------------ > > Message: 4 > Date: Tue, 02 Jun 2009 00:48:56 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Building a test tool > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A245AD8.4050104(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Vinit Karandikar wrote: > >> Not sure how radclient will help, Tim. >> Based on my limited exposure, I get the impression that I can use >> radclient to simulate 1 network element (like the PDSN). >> I'm trying to simulate 10 different ones simultaneously. >> > > So... run 10 copies of radclient. > That requires a separate manual setup for each of 50 test cases which is bound to be error prone. So if I could run 10 copies of radclient in one process (each in a different thread for example), I can write code to co-ordinate what each thread should do for each test case. > >> As mentioned in my initial email, I need the tool to simulate the PDSN, >> the Pre-Paid Server and hosts of other network elements (possibly 10 >> such like the Foreign AAA, the Carrier Exchange and so on...) >> > > What do those do? Send RADIUS packets? If so, radclient can likely > emulate them. > Some of them receive RADIUS packets and send responses (acting as servers). Others initiate the traffic (acting as clients). Can radclient act as a server ? > >> Am I underestimating what the radclient can do ? >> > > It's not clear what you want out of a RADIUS client. > > radclient simulates a RADIUS client by sending packets, and looking > for responses. If you need different functionality, you need to first > define what that functionality is. > Fair enough. Here are 2 cases that describe the functionality that need a radclient-like network element simulation. Hope this illustrates the functionality I mentioned as desired in my original email. In BOTH cases, the AAA server is expected to forward RADIUS requests to a different network element and it behooves a test application to see both ends. In Case 1, the AAA server proxies the Disconnect Request to a different network element based on the location of the subscriber. In Case 2, the AAA server proxies the Access Requests from different network elements to another network element Case 1: ======= Mother Ship AAA PDSN (new) PDSN (old) | | | | | | (1) Access-Request | | | |<----------------------------| | |(2) Access-Request | | | |<----------------------------| | | |(3) Access-Accept | | | |---------------------------->| | | | |(4) Access-Accept | | | |---------------------------->| | | | | | | | Accounting pieces skipped | | | | | | |(5) Disconnect Request | | | |---------------------------->| | | | |(6) Disconnect Request | | | |---------------------------------------------------------->| | |(7) Disconnect ACK | | | |<----------------------------------------------------------| |(8) Disconnect ACK | | | |<----------------------------| | | | | | | | | Accounting pieces skipped | | | | again | | | | | | OR == Case 2: ======= Mother Ship AAA PDSN HA | | | | | | (1) Access-Request | | | |<----------------------------| | |(2) Access-Request | | | |<----------------------------| | | |(3) Access-Accept | | | |---------------------------->| | | | |(4) Access-Accept | | | |---------------------------->| | | | | | | | PDSN communication with HA skipped | | | | | | (5) Access-Request | | | | related to above accept | | | | in order to get more info | | | |<----------------------------------------------------------| |(6) Access-Request | | | |<----------------------------| | | |(7) Access-Accept | | | |---------------------------->| | | | |(8) Access-Accept | | | |---------------------------------------------------------->| | | | | | | Accounting pieces skipped | | | | yet again | | | | | | The point once again is just to ask if a) there is already a tool that can simulate multiple network elements and co-ordinate between them to know when to expect a packet and when to initiate traffic b) there is re-usable software that I can beat into shape to do such a thing. Thanks again, -Vinit > Alan DeKok. > > > ------------------------------ > > > >

2 1

NTLM Auth Help
by Rupert Finnigan 04 Jun '09

04 Jun '09

Hi All, Wander if someone can help me resolve a problem I'm experiencing.... I'm using FreeRADIUS to provide AAA for 802.1X for wireless in a number of sites. It doesn't need to be 100% up all the time, and so I've got one server back in our central site that handles all the requests over our site-to-site VPNs. The users are stored in either AD, or SQL. SQL is fine, and I've modified the queries to suit my environment. My real problem is with the AD.... I can get it to authenticate users no problems, but not machines. I've got three AD domains I have users in that I need to authenticate: WB-UK, WB-US & WB-AU. These are sub-domains of WB-ROOT, which has no users and is there simple to provide trusts etc. All my users can authenticate fine, as the ms-chap module fills in the nt-domain variable and all is good. However, host authentication fails... I need host authentication to facilitate password expiration messages and changes to keep everyone authenticating OK, and not getting locked out. I'm sure that someones dealt with this before, and so I'd be very grateful for feedback and help. What do I need to supply to ntlm_auth for a machine user name, the "host/machine.domain.local" style, or the "$machine$" style? And, is this a problem best solved by setting the ntlm_auth program variable based on unlang checks against an extracted realm? Or, is there another way to make this all behave? I've tryied using Alan's suggested line on the "how-to" on deployingradius.org, but the "if no nt-domain, use a manually entered default" bit seems to confuse host auth. Many thanks in advance for any help offered, Rupes

3 9

RE: Freeradius-Users Digest, Vol 50, Issue 18
by Marco De Magistris 04 Jun '09

04 Jun '09

Hi Nicolas, >Be careful that using MD5 is not possible with all authenfication >methods: >http://deployingradius.com/documents/protocols/compatibility.html >(as you cannot uncrypt a hash) I'm working on Radius Proxy. The method used for Authentication is EAP-TLS. The server is configured with a certificate for EAP-TLS. As Radius Proxy, I need to send the packet, received from Radius Client, towards Radius Server, with a Message-Authenticator (HMAC-MD5). Home_server function: home_server SERVER1 { ... require_message_authenticator = yes secret = <Shared Secret assigned to RAdiusServer> ... } As Radius Proxy, should I define an authentication protocols? Thanks Regards Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: giovedì 4 giugno 2009 13.55 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 50, Issue 18 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: dealing with 'corrupt' detail file (Arran Cudbard-Bell) 2. How use tagged atrributes? (R.Filatov(a)ttk.ru) 3. help HMAC-MD5 (Marco De Magistris) 4. Re: help HMAC-MD5 (Nicolas Goutte) ---------------------------------------------------------------------- Message: 1 Date: Thu, 04 Jun 2009 11:34:59 +0100 From: Arran Cudbard-Bell <a.cudbard-bell(a)sussex.ac.uk> Subject: Re: dealing with 'corrupt' detail file To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A27A353.3050306(a)sussex.ac.uk> Content-Type: text/plain; charset=UTF-8 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, >>> (I've already got, on my list, use Calling-Station-Id >>> instead of NAS-Port for the unique function as many >>> NAS use the same port for every accounting packet :-|) >> Create a patch, and send it to the list via git format-patch. "Best >> practices" really need to go into the server configuration. Anything >> else is too frustrating for the end users. > > I was hoping to get a small discussion initiated that would > hopefully bring up a few things that people find they have to do > to their configs ...at the end of which we get a nice comprehensive > list of updates needed for the core server configuration (and hopefully > a large number of 'you need to change this or add that' blog/wiki/random > document entries removed across the world) We write out a different detail file per hour. If for whatever reason the account buffer gets to be big, and you have to restart the server, at least you only have to deal with an hours worth of duplicate accounting logs. And just as Alan DeKok suggested: accounting { # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf sql { invalid = 2 } if (invalid) { ok } } You can log it to a rejects detail file as well, if you want to dissect the packets later. The other (far more difficult) to handle one, is where you're using this to Proxy eduroam Accounting records back to an ORPS. If the administrator of the ORPS has been particularly... obnoxious. Then the ORPS will not send Accounting-Responses, and the packet will be stuck in the detail file indefinitely. Our workaround is: accounting { # # Icky workaround for lack of universal eduroam accounting support # Really need NRPS to manufacture accounting response. # if((Acct-Delay-Time < 600) || (Realm != 'remote.jrs')){ proxy_to_realm } # # Since we're proxying, we don't log anything # locally. Ensure that the accounting section # "succeeds" by forcing an "ok" return. ok } This sucks, because perfectly valid Accounting Requests might be lost if they were received at around the same time as invalid ones. I'd be interested to hear if anyone has a better solution than the above. Thanks, Arran -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkono1MACgkQcaklux5oVKKh8ACdHgDLbeRIF6wpJY9boGATfybU AiUAoIsSVWWYt6LUETZ6Ky15Out8Fm+w =cShM -----END PGP SIGNATURE----- ------------------------------ Message: 2 Date: Thu, 4 Jun 2009 15:39:12 +0400 From: R.Filatov(a)ttk.ru Subject: How use tagged atrributes? To: <freeradius-users(a)lists.freeradius.org> Message-ID: <OF1C050F6B.AF15FFDD-ONC32575CB.003FFB82-C32575CB.004003A7(a)ttk.ru> Content-Type: text/plain; charset="us-ascii" Hello! This construction don't work # radiusd -X FreeRADIUS Version 2.1.6, for host x86_64-unknown-linux-gnu, built on Jun 2 2009 at 23:23:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf ..... attr_rewrite add.service-volume { attribute = "ERX-Service-Volume:1" searchfor = "" searchin = "packet" replacewith = "1000" append = no ignore_case = yes new_attribute = no max_matches = 1 } rlm_attr_rewrite: No such attribute ERX-Service-Volume:1 /usr/local/etc/raddb/modules/attr_rewrite[48]: Instantiation failed for module "add.service-volume" /usr/local/etc/raddb/sites-enabled/default[482]: Failed to find module "add.service-volume". /usr/local/etc/raddb/sites-enabled/default[480]: Errors parsing pre-proxy section. Errors initializing modules May be trouble in my /dev/hands? Best Regards Filatov Ruslan

1 0