- Freeradius-Users - lists.freeradius.org

Fair usage package implementation
by Ming-Ching Tiew 08 May '09

08 May '09

I wonder if how such a "package" can be implemented, 1. Unlimited rate normally 2. But when downloaded packets exceed certain defined figure, download rate is trottled. Assumption ========== 1. Assuming the radius client is sending accounting information to the server, and so the downloaded octets can be obtained from the database through some sql query. 2. Assuming the radius client has some radius attributes which can set the download rate, WISPr-Bandwidth-Max-Down for example. One way I could think of is to run a batch job which work out per user octet usage and then set the attribute WISPr-Bandwidth-Max-Down accordingly. But this will have to be per day basis, it might be too late ( after the subscriber have over abused it ). Is there way such a thing can be implemented inside radiusd so that everything happens on the fly ? Regards.

2 1

Graphing - Online users
by AHMED KHIDR 07 May '09

07 May '09

Dear All , I have a question , is there any way to make a graph ( Like mrtg or cacti ) to graph no of online users ?? Regards

1 0

Is PEAP/EAP-MSCHAPv2 with certs a reasonable way to keep untrusted computers off the lan?
by john 07 May '09

07 May '09

Hello all, I want to deny any untrusted computer access to our lan. Lately we've had a lot of students and staff bring laptops into our school and plugging them in to any convenient network port. I want only users with domain credentials using trusted computers on the LAN. My test setup looks like Active Directory <=> winbind <=> Freeradius <=> NAS <=> Supplicant I think that using PEAP/EAP-MSCHAPv2 with client certs may be a reasonable way to proceed but I would like to get a sanity check from folks. 1) Would PEAP/EAP-MSCHAPv2 with client certs accomplish my goal? 2) Is there a better approach? 3) I am not clear on how to force checking of the client cert. I enabled "EAP-TLS-Require-Client-Cert = Yes" under the PEAP section of the eap.conf file but my WindowsXP client was still allowed to authenticate without specifying a root CA. Am I missing the point, if so please guide me. 4) Eventually I'll want to extend this approach to wireless devices so that trusted computers will get LAN services while untrusted computers with valid user credentials will be handed off to a different VLAN. Thanks for your help! John

2 2

freeradius - Openssl
by new conf 07 May '09

07 May '09

Dear all; I have to remove the link that does between freeradius and openssl.. to do some tests.. Can some one tells me what is the function that I must comment in "rlm_eap_tls.c" to use the module eap_tls without openssl? thank you so much for your help!

1 0

Storing user MAC address after first auth
by Tomas Mecir 07 May '09

07 May '09

Greetings ! I have the following situation here that I'd like to ask for some assistance with, if possible: My client has a RADIUS server installed (running freeRADIUS 2.0.5), and routers working as hotspots that users can connect to. Users can authorize against the RADIUS server using a name/password combination, which is stored in a MySQL database (using the rlm_sql module and the Cleartext-Password attribute in the radcheck table). This part works correctly. Now, my client wants an extra check to be added which would allow each user to login only from a specific MAC address, which can be different for each user, and which is obtained when the user logs in for the first time. Checking the MAC address is easy, as the hotspot is sending the MAC address in the Calling-Station-Id attribute that I could easily store in the radcheck table as well - but the problem is that this MAC address is not known when the name/password pair is being added to the radcheck table, and I am to make it so that when the user is successfully authorized for the first time, there is no MAC check, but the user's current MAC address is remembered on the server, and further logins are only permitted from that MAC address. So, I am thinking that the best solution would be to have the RADIUS server add a new "(username), 'Calling-Station-Id', '=', (user's MAC)" entry to the radcheck table, right after a successful SQL auth step, if such an entry isn't yet in the table. And my question is - is there a way to accomplish this with existing FreeRADIUS modules, or do I need to implement my own module to do this ? Thank you ! / Tomas

2 5

problem with eap-tls between FR and XP client
by bLn 07 May '09

07 May '09

hi forum, I'm trying to connect a Windows XP client (also I'm trying with Vista) with freeradius with EAP-TLS. I made my set of certificates (from this site http://www.linuxjournal.com/node/8095/print) and now, I have: CA, radius_cert.pem, radius_key.pem, radius_keycert.pem radius_req.pem, cliente_cert.p12, cliente_key.pem, cliente_cert.pem, cliente_req.pem, dh, random, xpextensions, xpclient_ext, xpserver_ext I've configured eap.conf of this way: tls { certdir = ${confdir}/certs2 cadir = ${confdir}/certs2 private_key_password = ******* private_key_file = ${certdir}/radius_keycert.pem certificate_file = ${certdir}/radius_keycert.pem CA_file = ${cadir}/cacert.pem dh_file = ${certdir}/dh random_file = ${certdir}/random cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" And I've installed my cacert.pem and cliente_cert.p12 into mmc into Trusted Root Certification Authorities and Personal - certificates, respectively. When I try to connect with freeradius my log is this: (it's too long because I see the same request again and again) rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=159, length=199 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001a016361726c6f7367617269407769746563682e636f6d Message-Authenticator = 0xc6247c05f7aae962aecbc459c9416907 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 0 length 26 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [sql] expand: %{User-Name} -> carlosgari(a)realmprueba.com [sql] sql_set_user escaped user --> 'carlosgari(a)realmprueba.com' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT groupname FROM usergroup WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Navega Mes' ORDER BY id [sql] User found in group Navega Mes [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Navega Mes' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 159 to 10.0.0.1 port 3072 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x84a02e6384a123686383961ecc8fb910 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=160, length=191 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0x84a02e6384a123686383961ecc8fb910 Message-Authenticator = 0xe9335e399fadf61413fddd7e717c778f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [sql] expand: %{User-Name} -> carlosgari(a)realmprueba.com [sql] sql_set_user escaped user --> 'carlosgari(a)realmprueba.com' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT groupname FROM usergroup WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Navega Mes' ORDER BY id [sql] User found in group Navega Mes [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Navega Mes' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 160 to 10.0.0.1 port 3072 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x84a02e6385a237686383961ecc8fb910 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=161, length=317 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202008419800000007a16030100750100007103014a01acb81f735187841a3bc2edfa94f1384de661364401c1530733f45d00560d000018002f00350005000ac009c00ac013c0140032003800130004010000300000001a00180100156361726c6f7367617269407769746563682e636f6d000a00080006001700180019000b00020100 State = 0x84a02e6385a237686383961ecc8fb910 Message-Authenticator = 0xc9c991513792d8f72f1e6dcbb3728186 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 132 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 122 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0075], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0501], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 161 to 10.0.0.1 port 3072 EAP-Message = 0x0103040019c00000053e160301002a02000026030149de14372a96c9dee0f575361420bb267d297c2000f439f4b516bbf08fbf6f8c00002f0016030105010b0004fd0004fa00025b30820257308201c0a003020102020101300d06092a864886f70d01010505003052310b3009060355040613024553310f300d060355040813064d6164726964310e300c060355040a1305476f77657831133011060355040b130a696e67656e6965726961310d300b0603550403130474657374301e170d3039303430363035303733375a170d3130303430363035303733375a3078310b3009060355040613024553310f300d060355040813064d6164726964310f EAP-Message = 0x300d060355040713064d6164726964310e300c060355040a1305476f77657831133011060355040b130a696e67656e69657269613122302006035504031319746573742e637573746f6d6572732e696265722d782e6e657430819f300d06092a864886f70d010101050003818d0030818902818100cd1fa7b002fe68845fcf82590e4d53f094b5cba6f8d0f81cc2e942f415bfd015f6a6163016951985d90b95966dcdffbb982515bfd4fcf623b3fa94118a84e9e14697d0d080292cf5d5052f163ead4d63472163664f42e48a7f9de0996823102d8abe56677b45c41c46ec42c8173feafb0cfb7aae29e440880260ccceb08442a90203010001a31730 EAP-Message = 0x1530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000381810022c03b52cdb6d30d58ac20fe96dd44bcb9b085bf90efa1db85ca23773e408dd176cc92f97efa0c18150494fe599cdf5f916c7e03e8d47159463f2d5c63b65221380fe5553a838f5e39021ca8c5fe0bcfa383ab4d79c98bb23d6e8e5725ddf592be29906b85c8fc09f6a050087c826b2c30368bc08a33a4a9d9ad9e5794d82eb300029930820295308201fea003020102020100300d06092a864886f70d01010505003052310b3009060355040613024553310f300d060355040813064d6164726964310e300c060355040a1305476f7765783113 EAP-Message = 0x3011060355040b130a696e67656e6965726961310d300b0603550403130474657374301e170d3039303430363030313530365a170d3132303430353030313530365a3052310b3009060355040613024553310f300d060355040813064d6164726964310e300c060355040a1305476f77657831133011060355040b130a696e67656e6965726961310d300b060355040313047465737430819f300d06092a864886f70d010101050003818d0030818902818100ddd96cf2e5e6c7e92e8a43f801e022e3247609b62b6bf40b56b303ae2ff49c5fc65340689ccc673b41ba7d32f0b0084d062083d24f2e4b4c9122707c3e3cf6b30779e5dc37c28c9d9e22 EAP-Message = 0x7e9e619ff325da768ddacc03 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x84a02e6386a337686383961ecc8fb910 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=162, length=191 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0x84a02e6386a337686383961ecc8fb910 Message-Authenticator = 0x05d653107342a96a9c356290a260d61f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 162 to 10.0.0.1 port 3072 EAP-Message = 0x0104014e1900c7cae9bdebcfaa3a06726618751da075a2c79e748c02a30758a3550184fca872a01f3ec7c2ef8cee1b4d0203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041421863a36c31be281cd1a3c31e52544b384bb25f1301f0603551d2304183016801421863a36c31be281cd1a3c31e52544b384bb25f1300d06092a864886f70d010105050003818100c851fd68627d9b98e537ff0e548d8a43683349ff2ced4e109cd6577d7cf0f6c7da04fe94c31f66a473385c2dfb626fd08bb8a69ab7276c1e EAP-Message = 0x99166bf09c44c83fc5ce3d362171b85d7de918d590a4acf95e0fc5da662c3f0d516c493675ce95470a92157a39b40f80b7431c291a211d4edaaa381acc2ca0512cae8015326e731516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x84a02e6387a437686383961ecc8fb910 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=163, length=191 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400061900 State = 0x84a02e6387a437686383961ecc8fb910 Message-Authenticator = 0xb9e22b4414f41497b616c4174385b8b4 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 163 to 10.0.0.1 port 3072 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x84a02e6380a537686383961ecc8fb910 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=164, length=199 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001a016361726c6f7367617269407769746563682e636f6d Message-Authenticator = 0xdd14d44138adb1f24901af4f2ac21fdc +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 0 length 26 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [sql] expand: %{User-Name} -> carlosgari(a)realmprueba.com [sql] sql_set_user escaped user --> 'carlosgari(a)realmprueba.com' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT groupname FROM usergroup WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Navega Mes' ORDER BY id [sql] User found in group Navega Mes [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Navega Mes' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 164 to 10.0.0.1 port 3072 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xec2decd6ec2ce137c20d83eb1d1d1e4f Finished request 5. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=165, length=317 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100840d800000007a16030100750100007103014a01acb83f8216b6454c57ebba9d19e3cc7db4ab863547bf1884f25b21b3eca6000018002f00350005000ac009c00ac013c0140032003800130004010000300000001a00180100156361726c6f7367617269407769746563682e636f6d000a00080006001700180019000b00020100 State = 0xec2decd6ec2ce137c20d83eb1d1d1e4f Message-Authenticator = 0xa9accde6d4fed435cc4b51e08c4a1fbd +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 132 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [sql] expand: %{User-Name} -> carlosgari(a)realmprueba.com [sql] sql_set_user escaped user --> 'carlosgari(a)realmprueba.com' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT groupname FROM usergroup WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Navega Mes' ORDER BY id [sql] User found in group Navega Mes [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Navega Mes' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 122 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0075], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 0501], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 0064], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 165 to 10.0.0.1 port 3072 EAP-Message = 0x010204000dc00000059e160301002a02000026030149de14379e475e80becd7ed1b05b777c2454aba0aab441958d3bc618844205e300002f0016030105010b0004fd0004fa00025b30820257308201c0a003020102020101300d06092a864886f70d01010505003052310b3009060355040613024553310f300d060355040813064d6164726964310e300c060355040a1305476f77657831133011060355040b130a696e67656e6965726961310d300b0603550403130474657374301e170d3039303430363035303733375a170d3130303430363035303733375a3078310b3009060355040613024553310f300d060355040813064d6164726964310f EAP-Message = 0x300d060355040713064d6164726964310e300c060355040a1305476f77657831133011060355040b130a696e67656e69657269613122302006035504031319746573742e637573746f6d6572732e696265722d782e6e657430819f300d06092a864886f70d010101050003818d0030818902818100cd1fa7b002fe68845fcf82590e4d53f094b5cba6f8d0f81cc2e942f415bfd015f6a6163016951985d90b95966dcdffbb982515bfd4fcf623b3fa94118a84e9e14697d0d080292cf5d5052f163ead4d63472163664f42e48a7f9de0996823102d8abe56677b45c41c46ec42c8173feafb0cfb7aae29e440880260ccceb08442a90203010001a31730 EAP-Message = 0x1530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000381810022c03b52cdb6d30d58ac20fe96dd44bcb9b085bf90efa1db85ca23773e408dd176cc92f97efa0c18150494fe599cdf5f916c7e03e8d47159463f2d5c63b65221380fe5553a838f5e39021ca8c5fe0bcfa383ab4d79c98bb23d6e8e5725ddf592be29906b85c8fc09f6a050087c826b2c30368bc08a33a4a9d9ad9e5794d82eb300029930820295308201fea003020102020100300d06092a864886f70d01010505003052310b3009060355040613024553310f300d060355040813064d6164726964310e300c060355040a1305476f7765783113 EAP-Message = 0x3011060355040b130a696e67656e6965726961310d300b0603550403130474657374301e170d3039303430363030313530365a170d3132303430353030313530365a3052310b3009060355040613024553310f300d060355040813064d6164726964310e300c060355040a1305476f77657831133011060355040b130a696e67656e6965726961310d300b060355040313047465737430819f300d06092a864886f70d010101050003818d0030818902818100ddd96cf2e5e6c7e92e8a43f801e022e3247609b62b6bf40b56b303ae2ff49c5fc65340689ccc673b41ba7d32f0b0084d062083d24f2e4b4c9122707c3e3cf6b30779e5dc37c28c9d9e22 EAP-Message = 0x7e9e619ff325da768ddacc03 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xec2decd6ed2fe137c20d83eb1d1d1e4f Finished request 6. Going to the next request Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=166, length=191 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200060d00 State = 0xec2decd6ed2fe137c20d83eb1d1d1e4f Message-Authenticator = 0xd94d9be93b04169026b7368402da36ae +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [sql] expand: %{User-Name} -> carlosgari(a)realmprueba.com [sql] sql_set_user escaped user --> 'carlosgari(a)realmprueba.com' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT groupname FROM usergroup WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Navega Mes' ORDER BY id [sql] User found in group Navega Mes [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Navega Mes' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 166 to 10.0.0.1 port 3072 EAP-Message = 0x010301b20d800000059ec7cae9bdebcfaa3a06726618751da075a2c79e748c02a30758a3550184fca872a01f3ec7c2ef8cee1b4d0203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041421863a36c31be281cd1a3c31e52544b384bb25f1301f0603551d2304183016801421863a36c31be281cd1a3c31e52544b384bb25f1300d06092a864886f70d010105050003818100c851fd68627d9b98e537ff0e548d8a43683349ff2ced4e109cd6577d7cf0f6c7da04fe94c31f66a473385c2dfb626fd08bb8a69a EAP-Message = 0xb7276c1e99166bf09c44c83fc5ce3d362171b85d7de918d590a4acf95e0fc5da662c3f0d516c493675ce95470a92157a39b40f80b7431c291a211d4edaaa381acc2ca0512cae8015326e731516030100640d00005c03010240005600543052310b3009060355040613024553310f300d060355040813064d6164726964310e300c060355040a1305476f77657831133011060355040b130a696e67656e6965726961310d300b06035504031304746573740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xec2decd6ee2ee137c20d83eb1d1d1e4f Finished request 7. Going to the next request Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=167, length=191 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300060d00 State = 0xec2decd6ee2ee137c20d83eb1d1d1e4f Message-Authenticator = 0xc8ad2690ce4bb94fa6ee92d26df76db2 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [sql] expand: %{User-Name} -> carlosgari(a)realmprueba.com [sql] sql_set_user escaped user --> 'carlosgari(a)realmprueba.com' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT groupname FROM usergroup WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Navega Mes' ORDER BY id [sql] User found in group Navega Mes [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Navega Mes' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 167 to 10.0.0.1 port 3072 EAP-Message = 0x0104000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xec2decd6ef29e137c20d83eb1d1d1e4f Finished request 8. Going to the next request Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=168, length=217 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0204001a016361726c6f7367617269407769746563682e636f6d State = 0xec2decd6ef29e137c20d83eb1d1d1e4f Message-Authenticator = 0x274fd340f61d1f66b2b03ba704d3ec2e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 26 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [sql] expand: %{User-Name} -> carlosgari(a)realmprueba.com [sql] sql_set_user escaped user --> 'carlosgari(a)realmprueba.com' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT groupname FROM usergroup WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Navega Mes' ORDER BY id [sql] User found in group Navega Mes [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Navega Mes' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 168 to 10.0.0.1 port 3072 EAP-Message = 0x010500060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2f6428b72f6125c07b0fb3246e0f1a2d Finished request 9. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=169, length=317 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500840d800000007a16030100750100007103014a01acbdbadc9a09fff908f49117fe4256ccc1abe3d5e0b168a22041e5eada09000018002f00350005000ac009c00ac013c0140032003800130004010000300000001a00180100156361726c6f7367617269407769746563682e636f6d000a00080006001700180019000b00020100 State = 0x2f6428b72f6125c07b0fb3246e0f1a2d Message-Authenticator = 0x945e136366ba63bb7daa1d7d67603aeb +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 132 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [sql] expand: %{User-Name} -> carlosgari(a)realmprueba.com [sql] sql_set_user escaped user --> 'carlosgari(a)realmprueba.com' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT groupname FROM usergroup WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Navega Mes' ORDER BY id [sql] User found in group Navega Mes [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Navega Mes' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 122 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0075], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 0501], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 0064], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 169 to 10.0.0.1 port 3072 EAP-Message = 0x010604000dc00000059e160301002a02000026030149de143bc7b95d7d8c7dd9e2a3d466bb438c26fd9c94393b645e7652fb10a3fc00002f0016030105010b0004fd0004fa00025b30820257308201c0a003020102020101300d06092a864886f70d01010505003052310b3009060355040613024553310f300d060355040813064d6164726964310e300c060355040a1305476f77657831133011060355040b130a696e67656e6965726961310d300b0603550403130474657374301e170d3039303430363035303733375a170d3130303430363035303733375a3078310b3009060355040613024553310f300d060355040813064d6164726964310f EAP-Message = 0x300d060355040713064d6164726964310e300c060355040a1305476f77657831133011060355040b130a696e67656e69657269613122302006035504031319746573742e637573746f6d6572732e696265722d782e6e657430819f300d06092a864886f70d010101050003818d0030818902818100cd1fa7b002fe68845fcf82590e4d53f094b5cba6f8d0f81cc2e942f415bfd015f6a6163016951985d90b95966dcdffbb982515bfd4fcf623b3fa94118a84e9e14697d0d080292cf5d5052f163ead4d63472163664f42e48a7f9de0996823102d8abe56677b45c41c46ec42c8173feafb0cfb7aae29e440880260ccceb08442a90203010001a31730 EAP-Message = 0x1530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000381810022c03b52cdb6d30d58ac20fe96dd44bcb9b085bf90efa1db85ca23773e408dd176cc92f97efa0c18150494fe599cdf5f916c7e03e8d47159463f2d5c63b65221380fe5553a838f5e39021ca8c5fe0bcfa383ab4d79c98bb23d6e8e5725ddf592be29906b85c8fc09f6a050087c826b2c30368bc08a33a4a9d9ad9e5794d82eb300029930820295308201fea003020102020100300d06092a864886f70d01010505003052310b3009060355040613024553310f300d060355040813064d6164726964310e300c060355040a1305476f7765783113 EAP-Message = 0x3011060355040b130a696e67656e6965726961310d300b0603550403130474657374301e170d3039303430363030313530365a170d3132303430353030313530365a3052310b3009060355040613024553310f300d060355040813064d6164726964310e300c060355040a1305476f77657831133011060355040b130a696e67656e6965726961310d300b060355040313047465737430819f300d06092a864886f70d010101050003818d0030818902818100ddd96cf2e5e6c7e92e8a43f801e022e3247609b62b6bf40b56b303ae2ff49c5fc65340689ccc673b41ba7d32f0b0084d062083d24f2e4b4c9122707c3e3cf6b30779e5dc37c28c9d9e22 EAP-Message = 0x7e9e619ff325da768ddacc03 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2f6428b72e6225c07b0fb3246e0f1a2d Finished request 10. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=170, length=191 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020600060d00 State = 0x2f6428b72e6225c07b0fb3246e0f1a2d Message-Authenticator = 0x618e4164cf39a7a344ca991da0c24224 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [sql] expand: %{User-Name} -> carlosgari(a)realmprueba.com [sql] sql_set_user escaped user --> 'carlosgari(a)realmprueba.com' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT groupname FROM usergroup WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Navega Mes' ORDER BY id [sql] User found in group Navega Mes [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Navega Mes' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 170 to 10.0.0.1 port 3072 EAP-Message = 0x010701b20d800000059ec7cae9bdebcfaa3a06726618751da075a2c79e748c02a30758a3550184fca872a01f3ec7c2ef8cee1b4d0203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041421863a36c31be281cd1a3c31e52544b384bb25f1301f0603551d2304183016801421863a36c31be281cd1a3c31e52544b384bb25f1300d06092a864886f70d010105050003818100c851fd68627d9b98e537ff0e548d8a43683349ff2ced4e109cd6577d7cf0f6c7da04fe94c31f66a473385c2dfb626fd08bb8a69a EAP-Message = 0xb7276c1e99166bf09c44c83fc5ce3d362171b85d7de918d590a4acf95e0fc5da662c3f0d516c493675ce95470a92157a39b40f80b7431c291a211d4edaaa381acc2ca0512cae8015326e731516030100640d00005c03010240005600543052310b3009060355040613024553310f300d060355040813064d6164726964310e300c060355040a1305476f77657831133011060355040b130a696e67656e6965726961310d300b06035504031304746573740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2f6428b72d6325c07b0fb3246e0f1a2d Finished request 11. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 3072, id=171, length=191 User-Name = "carlosgari(a)realmprueba.com" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "00116b3f0ce5" Calling-Station-Id = "00215d9ade9a" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020700060d00 State = 0x2f6428b72d6325c07b0fb3246e0f1a2d Message-Authenticator = 0x5b4d57449b4510dfe0ec25fbd8141a1e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "realmprueba.com" for User-Name = "carlosgari(a)realmprueba.com" [suffix] Found realm "realmprueba.com" [suffix] Adding Realm = "realmprueba.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [sql] expand: %{User-Name} -> carlosgari(a)realmprueba.com [sql] sql_set_user escaped user --> 'carlosgari(a)realmprueba.com' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT groupname FROM usergroup WHERE username = 'carlosgari(a)realmprueba.com' ORDER BY id [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Navega Mes' ORDER BY id [sql] User found in group Navega Mes [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Navega Mes' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 171 to 10.0.0.1 port 3072 EAP-Message = 0x0108000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2f6428b72c6c25c07b0fb3246e0f1a2d Finished request 12. Going to the next request Waking up in 0.8 seconds. Cleaning up request 0 ID 159 with timestamp +21 Cleaning up request 1 ID 160 with timestamp +21 Cleaning up request 2 ID 161 with timestamp +21 Cleaning up request 3 ID 162 with timestamp +21 Cleaning up request 4 ID 163 with timestamp +21 Waking up in 0.4 seconds. Cleaning up request 5 ID 164 with timestamp +21 Cleaning up request 6 ID 165 with timestamp +21 Cleaning up request 7 ID 166 with timestamp +21 Cleaning up request 8 ID 167 with timestamp +21 Waking up in 3.5 seconds. I've tried with AP Mikrotiks too and I got the same error, I think freeradius is waiting for the request from client and this doesn't back never, but I'm not sure. I've also tried with export password and not password in the client_cert.p12. I saw in another web this possible mistake. Anyone who can illuminate me???? please

2 1

Re: user login once???
by Nizar Zulmi 07 May '09

07 May '09

Thank u ivan, yaps..that's exactly what i mean..give me a clue please.. From: Ivan Kalik <tnt(a)kalik.net> Subject: Re: user login once??? To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Thursday, May 7, 2009, 3:06 AM > how to setup freeradius server to perform user log in to server once in a > day or few login in a month.. help please.. Radius server doesn't log in users onto the server. Ever! Perhaps you want something else: allow one login per day (or a few per month)? Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Regular expression in radcheck
by Eric Geier 07 May '09

07 May '09

Hi, I know there's hunt groups, but can't I use a reg exp to indicate multiple MAC addresses in a Calling-Station-ID entry on the radcheck table, so users can use multiple computers? Here is what I have: user@domain Calling-Station-ID =~ 00-1c-b3-b1-3e-00|00-1c-b3-b1-3e-01|00-1c-b3-b1-3e-02 However, any MAC address is accepted...its not working like I think it should. Thanks! Eric

1 0

Problem with FreeRADIUS Active Directory Integration
by Davies, Mike 06 May '09

06 May '09

In our test lab we are working on using FreeRADIUS to authenticate users against their AD credentials. We loaded FreeRADIUS on a Fedora 10. We loaded SAMBA and it works. We loaded freeradius-2.1.3-1.fc10.i386. We followed the http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO. We booted an XP workstation and logged in. It never got a DHCP address and failed authentication. I noticed a message, [suffix] No '@' in User-Name = "DOM002\DW68406A", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop In the smb.conf file we configured the workgroup to be the netbios name of the domain DOM002. Should that have been the IP name, fm.testdomain.com? Below is the output from the radius -X. FreeRADIUS Version 2.1.3, for host i386-redhat-linux-gnu, built on Dec 8 2008 at 15:31:31 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client 172.18.134.248 { require_message_authenticator = no secret = "testing123" shortname = "172.18.134.248" nastype = "other" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "peap" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.18.134.248 port 1812, id=83, length=333 Framed-MTU = 1480 NAS-IP-Address = 172.18.134.248 NAS-Identifier = "IDM test 5406" User-Name = "DOM002\\DW68406A" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 6 NAS-Port-Type = Ethernet NAS-Port-Id = "A6" Called-Station-Id = "00-21-f7-6e-02-00" Calling-Station-Id = "00-1e-4f-b0-27-10" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "999" EAP-Message = 0x0204001401444f4d3030325c4457363834303641 Message-Authenticator = 0xb42d28522d0b20c06178f6ca7e7a45aa MS-RAS-Vendor = 11 HP-Attr-255 = 0x011a0000000b28 HP-Attr-255 = 0x011a0000000b2e HP-Attr-255 = 0x011a0000000b3d HP-Attr-255 = 0x0138 HP-Attr-255 = 0x013a HP-Attr-255 = 0x0140 HP-Attr-255 = 0x0141 HP-Attr-255 = 0x0151 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DOM002\DW68406A", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 20 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 83 to 172.18.134.248 port 1812 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010500061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc651d6b8c654cf27ba01eec66aff3857 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.18.134.248 port 1812, id=84, length=411 Framed-MTU = 1480 NAS-IP-Address = 172.18.134.248 NAS-Identifier = "IDM test 5406" User-Name = "DOM002\\DW68406A" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 6 NAS-Port-Type = Ethernet NAS-Port-Id = "A6" Called-Station-Id = "00-21-f7-6e-02-00" Calling-Station-Id = "00-1e-4f-b0-27-10" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "999" State = 0xc651d6b8c654cf27ba01eec66aff3857 EAP-Message = 0x0205005019800000004616030100410100003d03014a00a4e6275cb2018565ad9e287d82f60ac726ef17efadae0c24cb245b56bef200001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x63a1081298f73e7c4143818242a8e5e8 MS-RAS-Vendor = 11 HP-Attr-255 = 0x011a0000000b28 HP-Attr-255 = 0x011a0000000b2e HP-Attr-255 = 0x011a0000000b3d HP-Attr-255 = 0x0138 HP-Attr-255 = 0x013a HP-Attr-255 = 0x0140 HP-Attr-255 = 0x0141 HP-Attr-255 = 0x0151 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DOM002\DW68406A", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 84 to 172.18.134.248 port 1812 EAP-Message = 0x0106040019c00000089b160301002a0200002603014a00a4ed4a3e2ac1489de523e4a75a46e342f93f08ce07266c3706baacc75b0c00000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303530343232323232355a170d3130303530343232323232355a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ba09d960ea3260af04d8e598747c45e986dd96a5610168a17aa1ba2199a9e310798230b2dcaf50afc0595f55e73e3e3a16d97a37aea0691b33be6441224e EAP-Message = 0xaa3e7ae28ec352d3742165a53e86eb01206a2c6d981e4e6661390980a8daca354de1f6f53d8da2f70dbf2db7a74ed5bf8f9cb40e9a1c305ea5ee832fbe947dd74253a174a477555a3963ec96c366153d35643f5915691e07178b78008614d49ebbeb77cd51d80cf522a6cbfe42c7df2e251a888d09d410e8204e25387be968b997511e3fc554e0ac6376f51c8ef421015b8adc9203ecd801c7177992620ad8594b91e3fc06345fb33768c95c5484e7b581edf539554d855032505f682befca5fcfa70203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100540f0cbea4618045f3 EAP-Message = 0xe10753d45f4fedd23906f32490b1fc7b1ac0ef87e6e7690fc0c1d5d5f1ca10a985ee95c3a5eba0639baf2ef068c25c0bceae385b261488a0b973c8094a7dc72b55923387eae276cbb2b44e662cb12e27026bf9f906fa55f73771d21d5bfbc18157295030934a02bd175784ab036acb5679cbe232060028ac93e910551a3006dcc84c89905f2e549fdbe29730816b8edf06020ab951fe62b03ce46428488e54243793ac5c375142b79f439a77f5b8bd521633683884d72e5374e66181b73d1b221f80cb9db794221945c56bf7d34d2d0bbb5296e4e995a15175baed922bc922ea17ded14cee86a358782aeab2354f107fba4f4d6bea609b0004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc651d6b8c757cf27ba01eec66aff3857 Finished request 1. Going to the next request Waking up in 4.9 seconds. Thanks, Mike Davies ________________________________ This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain information that is confidential and protected by law from unauthorized disclosure. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

SQL Counters and Realms
by liran tal 06 May '09

06 May '09

Hey, In my FR1.1.7 setup, I have different realms for the same machine using different databases for each. The login part is ok, as well as the accounting, which has entries in the radacct table for "account". I enabled one of the sql counters modules which, as it seems, isn't returning any results, because I am suspecting that it's running the query on another realm's database. I have several of the sql.conf config files for each realm, so what I'm basically doing is having in accounting {} section something like this: Acct-Type SQL_EXAMPLE { sql_example } What do you think is happening? Here is the relevant debug snippet from freeradius: Wed May 6 22:47:28 2009 : Debug: modsingle[authorize]: calling accessperiod (rlm_sqlcounter) for request 0 Wed May 6 22:47:28 2009 : Debug: rlm_sqlcounter: Entering module authorize code Wed May 6 22:47:28 2009 : Debug: sqlcounter_expand: 'SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = '%{Stripped-User-Name:-%{User-Name}}' ORDER BY AcctStartTime LIMIT 1' Wed May 6 22:47:28 2009 : Debug: radius_xlat: 'SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = 'access1' ORDER BY AcctStartTime LIMIT 1' Wed May 6 22:47:28 2009 : Debug: sqlcounter_expand: '%{sql:SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = 'access1' ORDER BY AcctStartTime LIMIT 1}' Wed May 6 22:47:28 2009 : Debug: radius_xlat: Running registered xlat function of module sql for string 'SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = 'access1' ORDER BY AcctStartTime LIMIT 1' Wed May 6 22:47:28 2009 : Debug: rlm_sql (sql): - sql_xlat Wed May 6 22:47:28 2009 : Debug: radius_xlat: 'access1' Wed May 6 22:47:28 2009 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'access1' Wed May 6 22:47:28 2009 : Debug: radius_xlat: 'SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = 'access1' ORDER BY AcctStartTime LIMIT 1' Wed May 6 22:47:28 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Wed May 6 22:47:28 2009 : Debug: rlm_sql (sql): SQL query did not return any results Wed May 6 22:47:28 2009 : Debug: rlm_sql (sql): Released sql socket id: 2 Wed May 6 22:47:28 2009 : Debug: radius_xlat: '' Wed May 6 22:47:28 2009 : Debug: rlm_sqlcounter: (Check item - counter) is greater than zero Wed May 6 22:47:28 2009 : Debug: rlm_sqlcounter: Authorized user access1, check_item=300, counter=0 Wed May 6 22:47:28 2009 : Debug: rlm_sqlcounter: Sent Reply-Item for user access1, Type=Session-Timeout, value=300 Wed May 6 22:47:28 2009 : Debug: modsingle[authorize]: returned from accessperiod (rlm_sqlcounter) for request 0 Wed May 6 22:47:28 2009 : Debug: modcall[authorize]: module "accessperiod" returns ok for request 0 Regards, Liran.

2 2