- Freeradius-Users - lists.freeradius.org

Allow PEAP and TTLS, but reject TLS
by usawebbox＠fastmail.fm 21 Mar '09

21 Mar '09

I'm using Freeradius 2.1.1. My setup has been successfully authenticating TLS, TTLS, and PEAP for a while. Now I would like to deny TLS in the EAP negotiation, although the users will still have client certificates. I don't know how to reject TLS without breaking PEAP/TTLS. Those methods require the TLS block, which must then have the CA cert to validate the server certificate, and the server continues to use that to validate user certs. Problem: PEAP is my default EAP-type, but the client can nak it and choose EAP-TLS instead. I saw this comment in eap.conf: "If you do not use client certificates, and you do not want to permit EAP-TLS authentication, then delete this configuration item" (referring to CA_file) Unfortunately, this is not literally true. It sounded like a simple way to use the TLS block only to enable PEAP and TTLS, but if the CA cert is in "certificate_file" and the "CA_file" configuration item is deleted, EAP-TLS is still permitted as an authentication method. Note: I have read all the comments in this file, not just the one I quoted. If someone knows a way to do this, I would appreciate the knowledge. I suppose I would be willing to restrict the EAP-type only PEAP (or only TTLS) if that is the only way to reject EAP-TLS. Thank you. -- usawebbox(a)fastmail.fm -- http://www.fastmail.fm - Faster than the air-speed velocity of an unladen european swallow

2 1

Usernames with spaces
by Joeven Rex Dizon 21 Mar '09

21 Mar '09

I'm a relatively new freeradius user so I am not really an expert with it. I have two users in the racheck table: "admin" and "d6 40 1a 98". Both with passwords "admin198". Doing this: *radtest admin admin198 localhost 0 testing123* ..returns an Access-Accept packet. But doing this: *radtest "d6 40 1a 87" admin198 localhost 0 testing123* ..returns an Access-Reject packet. I wonder why the user with spaces in the username is being rejected. I've read somewhere that I need to specify "nospace_user". Can I edit that in the radiusd.conf? What should the value be: before, after or no? Our installed version is 2.1.0+dfsg-0ubuntu2, running on Ubuntu 8.10. The backend database we used is MySql. Thanks in advance. Joeven Rex L. Dizon

3 2

Login to Cisco devices through freeradius
by Bruno Noronha 21 Mar '09

21 Mar '09

Buddies, I don't know if I can issue this question here, but I need your help to implement RADIUS solution... I think that my objective is quite simple in comparison with RADIUS most variables purposes. I must login to my network devices through RADIUS server, centralizing this management process. After installing freeradius, I couldn't start it. Checking radius.log I saw the following errors: Wed Mar 18 15:31:28 2009 : Error: rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied Wed Mar 18 15:31:28 2009 : Error: rlm_eap_tls: Error reading Trusted root CA list /etc/raddb/certs/ca.pem Wed Mar 18 15:31:28 2009 : Error: rlm_eap: Failed to initialize type tls Wed Mar 18 15:31:28 2009 : Error: /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" Wed Mar 18 15:31:28 2009 : Error: /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". Wed Mar 18 15:31:28 2009 : Error: /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Wed Mar 18 15:31:28 2009 : Error: Errors initializing modules I'm completely lost about the solution and I wasn't able to find any "how to" on the web. I appreciate any help, thanks in advance. Bruno

7 18

Perl/Peap-MSChapV2 Issues
by Adam W. Sewell 20 Mar '09

20 Mar '09

I'm trying to get Perl authentication setup along with Peap/MSChapV2. I have a perl script that I wish to use to authenticate the user but for some reason, it does not look like the perl script is even being called at the point where it needs to. See below for the log. I could be wrong, but the issue seems to be here: ------------------------------------------------ WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancel ling invalid proxy request. auth: No authenticate method (Auth-Type) configuration found for the request: Re jecting the user auth: Failed to validate the user. Login incorrect: [testUser] (from client DORMTEST2_M80 port 0 via TLS tunnel) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled -------------------------------------------------- If I need to provide any config files, please just say so. I'm not sure which ones to include here. Version is 2.0.5 Thanks. -Adam Sewell Log: -------------------------------------------------- rad_recv: Access-Request packet from host 192.168.240.78 port 2372, id=131, lengt h=152 Message-Authenticator = 0xede4cc6e1f95787b1f2f1eb7172fdf44 User-Name = "testUser" NAS-IP-Address = 192.168.240.78 NAS-Port = 4 NAS-Port-Type = Ethernet Calling-Station-Id = "00-16-D3-30-E5-74" EAP-Message = 0x0207000d016c6a61636b736f6e Framed-MTU = 1000 Called-Station-Id = "0001F4-B6-1B-80\0004" NAS-Identifier = "HOKDORM_01953_M48" NAS-Port-Id = "fe.0.4" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop users: Matched entry DEFAULT at line 189 ++[files] returns ok rlm_eap: EAP packet type response id 7 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++? if (EAP-Message) ? Evaluating (EAP-Message) -> TRUE ++? if (EAP-Message) -> TRUE ++- entering if (EAP-Message) +++[noop] returns noop ++- if (EAP-Message) returns noop ++ ... skipping elsif for request 0: Preceding "if" was taken ++ ... skipping elsif for request 0: Preceding "if" was taken rad_check_password: Found Auth-Type Perl rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'testUser' auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 131 to 192.168.240.78 port 2372 EAP-Message = 0x010800061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd856426bd8d7d24113b1577a1fc0b35 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.240.78 port 2372, id=132, lengt h=249 Message-Authenticator = 0xff045bcad52434215028c1d31990ae00 User-Name = "testUser" State = 0xbd856426bd8d7d24113b1577a1fc0b35 NAS-IP-Address = 192.168.240.78 NAS-Port = 4 NAS-Port-Type = Ethernet Calling-Station-Id = "00-16-D3-30-E5-74" Called-Station-Id = "00-01-F4-B6-1B-80" Framed-MTU = 1000 EAP-Message = 0x0208005c190016030100510100004d030149c2516a7d86eed958cf9d bcc1b3a313d5271a03db4f39f3ce88760640dfaabc00002600390038003500160013000a 00330032 002f00050004001500120009001400110008000600030100 NAS-Identifier = "HOKDORM_01953_M48" NAS-Port-Id = "fe.0.4" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop users: Matched entry DEFAULT at line 189 ++[files] returns ok rlm_eap: EAP packet type response id 8 length 92 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type Perl rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'testUser' auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0051], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 132 to 192.168.240.78 port 2372 EAP-Message = 0x010903e419c000000acd160301004a02000046030149c23c6e6f3afe ce786b5cb656f4566f4b9ab71a9b123a9ee0c351d3cacad44a20e9c2f3afa8b7e0eeb081 288ac57e 9975f411c844194714ff16f15cde4ad2f3ae003900160301085e0b00085a0008570003a6 308203a2 3082028aa003020102020101300d06092a864886f70d0101040500308193310b30090603 55040613 024652310f300d060355040813065261646975733112301006035504071309536f6d6577 68657265 31153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d01 09011611 61646d696e406578616d706c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f 72697479301e170d3039303232363138313530335a170d3130303232363138313530335a 307c310b 3009060355040613024652310f300d060355040813065261646975733115301306035504 0a130c45 78616d706c6520496e632e312330210603550403131a4578616d706c6520536572766572 20436572 74696669636174653120301e06092a864886f70d010901161161646d696e406578616d70 6c652e63 6f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100af 91ce4cc9 6ce447a1b9ce6a3c8d5cee06559ffe5d6c58649c8af10cf4d8 EAP-Message = 0x2196a122f04a957a7ca72043e3f61c0e4149a18d32bea21f5807e44e 710762d5ede33f41f89e5238ba8ec146775ec45f90335564a0ccdf9d7332b714993b5277 76d70068 a939f58c7475e677850446ef1de2427a39b1469d4707f59723cc3c5c432426f51d899e3d f16df486 41151eb1a34b9aacf00fb3380f43db62d6efe38255abd22667ba5a4a4d0de897d955eb54 532c642b 009994eb1d4353ab340852d9a2db429111f08e31dc5a5c063a1b4625023d21496f55717d 44b2ef16 38b6cce64bf716e719d885f20b305fed4e6d94a8ecb1201d43389cbbd9e48328d7f88506 41d50203 010001a317301530130603551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d010104050003820101005e3f3bed58 8f5e438581d8abdf869d6e5b9751c0407043ba804bae8a935f2ccfda3e106c7b9bd3c41e 3baa1e6b ea239a7878a67fa523f76e9207640ce1900a71ee645e0a200007826520944b15177a2d85 5ba97f35 b5484cc4476b4c49bbcc55fa40b919506eb73e3f6f35c87ed3d38fca2b33a82d541a108e 60a54b95 8ebab48dbcbed264380c05df5c4e8839169ade9bed2cde41faa08755b53dfe9a4a8fe741 7795f114 9529d9e2ad6c0c6f610a12772c3a5b1dca9826bc8e55ba4d17bd2e60db88e70bb9f66b22 433be9a9 d28522870278805bab Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd856426bc8c7d24113b1577a1fc0b35 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.240.78 port 2372, id=133, lengt h=163 Message-Authenticator = 0x1a136248076ddec3dfa07234893eb3fb User-Name = "testUser" State = 0xbd856426bc8c7d24113b1577a1fc0b35 NAS-IP-Address = 192.168.240.78 NAS-Port = 4 NAS-Port-Type = Ethernet Calling-Station-Id = "00-16-D3-30-E5-74" Called-Station-Id = "00-01-F4-B6-1B-80" Framed-MTU = 1000 EAP-Message = 0x020900061900 NAS-Identifier = "HOKDORM_01953_M48" NAS-Port-Id = "fe.0.4" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop users: Matched entry DEFAULT at line 189 ++[files] returns ok rlm_eap: EAP packet type response id 9 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type Perl rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'testUser' auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 133 to 192.168.240.78 port 2372 EAP-Message = 0x010a03e01940192b141d954ba5dad16f574bfa9c6f1069e1fda082af c3ba1fc97a0d151f664e5dd53aed97cf332119fe0004ab308204a73082038fa003020102 020900ba d26bfd4ce6479b300d06092a864886f70d0101050500308193310b300906035504061302 4652310f 300d060355040813065261646975733112301006035504071309536f6d65776865726531 15301306 0355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161 646d696e 406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469 66696361 746520417574686f72697479301e170d303930323236313831 EAP-Message = 0x3530315a170d3039303332383138313530315a308193310b30090603 55040613024652310f300d06035504081306526164697573311230100603550407130953 6f6d6577 6865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a8648 86f70d01 0901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d 706c6520 436572746966696361746520417574686f7269747930820122300d06092a864886f70d01 01010500 0382010f003082010a0282010100c005918d15156e31de5cad4be43bcee9a30544cbd781 4d9e8b12 5c6aefc9a71a5c8d815d1cc12b0f37be7b2b30abd5cb4c696e EAP-Message = 0x9f5aa45dd330796a68c9440b1114f9181342ef7006f2ca01e8805e58 0f4505da0d6b20c3e5ec1c85ac9473c4ce52cbba3917612d45f3d2ddcd0a7da895a57d4e f7defd41 353010449e124599e5d3115874e99c358e6448a5b78d84626d9b4479134e2fe45407e708 8bf1930a 59b64aa4d17dc992cd317ea3ace04b31064a61647847ad710d6f458d128810e2152bc460 182cf327 c63cf30639c3072fbd5ac302e525319efdb02c7e3a33026e7228186d464695aa1e00e461 fc004d86 f4aabb8be9f06db98714d5ef63b51c433d0203010001a381fb3081f8301d0603551d0e04 160414d0 0f03b207edebc2780daafc959d2c27157dcad13081c8060355 EAP-Message = 0x1d230481c03081bd8014d00f03b207edebc2780daafc959d2c27157d cad1a18199a48196308193310b3009060355040613024652310f300d0603550408130652 61646975 733112301006035504071309536f6d65776865726531153013060355040a130c4578616d 706c6520 496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e63 6f6d3126 30240603550403131d4578616d706c6520436572746966696361746520417574686f7269 74798209 00bad26bfd4ce6479b300c0603551d13040530030101ff300d06092a864886f70d010105 05000382 010100183c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd856426bf8f7d24113b1577a1fc0b35 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.240.78 port 2372, id=134, lengt h=163 Message-Authenticator = 0xfe56a2125a6096f339b3c22ce587817b User-Name = "testUser" State = 0xbd856426bf8f7d24113b1577a1fc0b35 NAS-IP-Address = 192.168.240.78 NAS-Port = 4 NAS-Port-Type = Ethernet Calling-Station-Id = "00-16-D3-30-E5-74" Called-Station-Id = "00-01-F4-B6-1B-80" Framed-MTU = 1000 EAP-Message = 0x020a00061900 NAS-Identifier = "HOKDORM_01953_M48" NAS-Port-Id = "fe.0.4" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop users: Matched entry DEFAULT at line 189 ++[files] returns ok rlm_eap: EAP packet type response id 10 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type Perl rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'testUser' auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 134 to 192.168.240.78 port 2372 EAP-Message = 0x010b031f19005647775d06a03ebb8b89c3256914ceac4171e7ee41b3 bb5f8497c3f7eea643ac0637116e282046f3611e910dcf39d779ad13a14a68e75e9c416a f68cb847 4782e1d77d20cbb4785c40d8b36de0f2caca1c5a477b3a09c488d3065b0865e63b546965 fa1bc70c 89f578eb1c88bcd329c3afb49730d0af199bf022be1f0cb74f71fde6d6be2f23af396c88 3b5411c1 07b4d6fc51bc2bc07534c6d6d352c9afde1cb48565b9b669489403d0940d0da70125b207 3f724b7d 1e3cd7cf5f31432eb7a659105af9fb92e5f67d36ad6c15321a218a34f89235844c88cc09 f44d3915 1cbbc12c70d4f6dba5f9e80cbfb2af15bb644c7749a3b34a57 EAP-Message = 0x50b8f96e2da78c160301020d0c000209008095c28ea954c729df2931 ea0e63d9b9ab25cdacbad88a7ded24c19ae298dddfd9b9b2dfba285398d544e1aebe2e6f d4302399 a2a156a1be615d6b7579973fe3323c4f65428282088b141e06ee2d99144c7b458bb1da4e c85778a8 806b2e9183475abdc4707fd70974a7bfeb9068894e5b15a6a576a266a6ccf9e439a22428 44530001 0200807016d2ffeeac20415bd5e3d06f5d56797b894340ba4cfa86b7c249d7a19f4a30a1 50166a1c ad77dc80946762574bbe839165a11847955d822c7618609cb0823aa6fbfa3fde5ac1689d e3992cc7 7b62ed0f56f46e72899d535b2a7686b42a23879e2e43b31ebe EAP-Message = 0x1436022c138e7ea74e034cd234eed9bf9e88a34b36dcf47a567b0100 5ecc0ea78b9c0878dfc0795293d10b08dd9bd428ded50b9ee6e466268adcefea9d179f53 f109cdb2 1a8e7a3db6b0968211beffd26709bdfd941711deeadcfcdb3070a225778a47dd4d37e189 b12514b4 002bee6009872c50d6fba56fc0a687d4d6d4db9e034ce2679d03a28d2b3cc2cdee4c2107 7e7c41aa 15a5e1cb08fa98e01ad0c70248712e18b4e491dc63d54c1e0e4276997f834f02a76138e4 ecc3cf95 2f47659401e312bc4e3a1f7fad06988938bb26f6e16261603f793c33220772ae205cdab2 7d1b7271 846bf24a154840e38af13a8be8e8b37245599708ee3458d84d EAP-Message = 0xf119be8b5c51d006e288aa595c249249489b1c5e01ba8561fac3ff17 13e15416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd856426be8e7d24113b1577a1fc0b35 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.240.78 port 2372, id=135, lengt h=361 Message-Authenticator = 0xaadc7c7cbfc2e4703d87937b07653f56 User-Name = "testUser" State = 0xbd856426be8e7d24113b1577a1fc0b35 NAS-IP-Address = 192.168.240.78 NAS-Port = 4 NAS-Port-Type = Ethernet Calling-Station-Id = "00-16-D3-30-E5-74" Called-Station-Id = "00-01-F4-B6-1B-80" Framed-MTU = 1000 EAP-Message = 0x020b00cc1900160301008610000082008034b73538e4af77762136cf 968dff3f35c0d7d26816075e8acf59f85a9ea17d2d2bdaba8c52bf8b73ca5e4cf1b3f41d df18b7b3 445bd77cd43505da9d00164b0b4e910aaa253aa28e96c2b434a5bffc9676162be91af163 ed23925d 1d81ba43067a5a8745490c4084d009852adf47e9378c5449fc0ec305b358ee2bbfae681f 04140301 0001011603010030c008d2eb665cdccc20489b58aef27cf392e5c948d673fb629ba7c518 b1b5639c a046ccb28c891a79e2fedb7bc1b55850 NAS-Identifier = "HOKDORM_01953_M48" NAS-Port-Id = "fe.0.4" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop users: Matched entry DEFAULT at line 189 ++[files] returns ok rlm_eap: EAP packet type response id 11 length 204 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type Perl rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'testUser' auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 135 to 192.168.240.78 port 2372 EAP-Message = 0x010c0041190014030100010116030100309920be9ebe8f52fa4ed630 8ada16be1cd50eec4ec78738d17b4397acff90fd2bf52e77f77ceb28a8acacd32c82e092 ab Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd856426b9897d24113b1577a1fc0b35 Finished request 4. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.240.78 port 2372, id=136, lengt h=163 Message-Authenticator = 0xcfaba03208b5391f2170865024c7b4d2 User-Name = "testUser" State = 0xbd856426b9897d24113b1577a1fc0b35 NAS-IP-Address = 192.168.240.78 NAS-Port = 4 NAS-Port-Type = Ethernet Calling-Station-Id = "00-16-D3-30-E5-74" Called-Station-Id = "00-01-F4-B6-1B-80" Framed-MTU = 1000 EAP-Message = 0x020c00061900 NAS-Identifier = "HOKDORM_01953_M48" NAS-Port-Id = "fe.0.4" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop users: Matched entry DEFAULT at line 189 ++[files] returns ok rlm_eap: EAP packet type response id 12 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type Perl rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'testUser' auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 136 to 192.168.240.78 port 2372 EAP-Message = 0x010d002b19001703010020eaa91fa81f90eda46f466f7882f677ea9e bcc91b987231d339cf0aa989cf0c54 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd856426b8887d24113b1577a1fc0b35 Finished request 5. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.240.78 port 2372, id=137, lengt h=237 Message-Authenticator = 0xa9aedf5cd00f0ac40e58d97685afb53c User-Name = "testUser" State = 0xbd856426b8887d24113b1577a1fc0b35 NAS-IP-Address = 192.168.240.78 NAS-Port = 4 NAS-Port-Type = Ethernet Calling-Station-Id = "00-16-D3-30-E5-74" Called-Station-Id = "00-01-F4-B6-1B-80" Framed-MTU = 1000 EAP-Message = 0x020d00501900170301002057cb0d149913d21e3bf3fef3c63273735c 374f1f98a48743223f9256cf517be31703010020a85accc63c089e33310a616953971ec9 20520cb9 8fe0d3244b4bd8ce10aaa739 NAS-Identifier = "HOKDORM_01953_M48" NAS-Port-Id = "fe.0.4" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop users: Matched entry DEFAULT at line 189 ++[files] returns ok rlm_eap: EAP packet type response id 13 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type Perl rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'testUser' auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - testUser PEAP: Got tunneled identity of testUser PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to testUser +- entering group authorize ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testUser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: Request is supposed to be proxied to Realm LOCAL. Not doing EAP. ++[eap] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancel ling invalid proxy request. auth: No authenticate method (Auth-Type) configuration found for the request: Re jecting the user auth: Failed to validate the user. Login incorrect: [testUser] (from client DORMTEST2_M80 port 0 via TLS tunnel) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled Sending Access-Challenge of id 137 to 192.168.240.78 port 2372 EAP-Message = 0x010e002b190017030100200dbc1fdc99ce198e1395aaf13395f18c2a d4deecf9025e18d3a17e85698aba58 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd856426bb8b7d24113b1577a1fc0b35 Finished request 6. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.240.78 port 2372, id=138, lengt h=237 Message-Authenticator = 0xc55c7e9c1e86cc3723640d1d5ca4ed5e User-Name = "testUser" State = 0xbd856426bb8b7d24113b1577a1fc0b35 NAS-IP-Address = 192.168.240.78 NAS-Port = 4 NAS-Port-Type = Ethernet Calling-Station-Id = "00-16-D3-30-E5-74" Called-Station-Id = "00-01-F4-B6-1B-80" Framed-MTU = 1000 EAP-Message = 0x020e00501900170301002059f4b1892fa7f016f7576a058660d11c7d 8064c436922e0ce4963588c05be5be1703010020d23026f856c74389b87ecbb68d220a7f 215ee0f5 1ed4cd4746cfdb39c6180a48 NAS-Identifier = "HOKDORM_01953_M48" NAS-Port-Id = "fe.0.4" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop users: Matched entry DEFAULT at line 189 ++[files] returns ok rlm_eap: EAP packet type response id 14 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type Perl rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'testUser' auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this sessio n. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [testUser] (from client DORMTEST2_M80 port 4 cli 00-16-D3-30-E5 -74) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testUser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 138 to 192.168.240.78 port 2372 EAP-Message = 0x040e0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 7. Going to the next request Waking up in 4.7 seconds. Cleaning up request 0 ID 131 with timestamp +1335 Cleaning up request 1 ID 132 with timestamp +1335 Cleaning up request 2 ID 133 with timestamp +1335 Cleaning up request 3 ID 134 with timestamp +1335 Waking up in 0.1 seconds. Cleaning up request 4 ID 135 with timestamp +1336 Cleaning up request 5 ID 136 with timestamp +1336 Cleaning up request 6 ID 137 with timestamp +1336 Cleaning up request 7 ID 138 with timestamp +1336 Ready to process requests.

3 14

dear everyone..
by Nizar Zulmi 20 Mar '09

20 Mar '09

iam a new bie freeradius user, i have a duty from my lecture to build a hotspot captive portal using chillispot and freeradius. now i make it, chilispot and freeradius working well on ubuntu machine, but the problem is my lecture want me to do stress test on the radius server to make sure that the system is still working well in any condition.. i still confused how to perform the stress test...anyone help me please..thank you for your attentionsorry for bad english :D

3 2

Re: freeradius and mikrotik auth problem pppoe error 691
by Lazar Cherveniakov 20 Mar '09

20 Mar '09

Everything looks fine in IP addresses, but the problem is still the same. Here again the log of Mikrotik and freeradius: Mikrotik debug log 01:33:40 pppoe,info PPPoE connection established from 00:15:AF:1F:23:1A 01:33:40 pppoe,ppp,info <pppoe-0>: waiting for call... 01:33:40 radius,debug new request 53:02 code=Access-Request service=ppp called-id=pppoe-in 01:33:40 radius,debug sending 53:02 to 192.168.200.2:1812 01:33:40 radius,debug,packet sending Access-Request with id 8 to 192.168.200.2:1812 01:33:40 radius,debug,packet Signature = 0x83d0415d6b98f0421df6bb83a01bdb28 01:33:40 radius,debug,packet Service-Type = 2 01:33:40 radius,debug,packet Framed-Protocol = 1 01:33:40 radius,debug,packet NAS-Port = 10 01:33:40 radius,debug,packet NAS-Port-Type = 15 01:33:40 radius,debug,packet User-Name = "lacho" 01:33:40 radius,debug,packet Calling-Station-Id = "00:15:AF:1F:23:1A" 01:33:40 radius,debug,packet Called-Station-Id = "pppoe-in" 01:33:40 radius,debug,packet NAS-Port-Id = "ether1" 01:33:40 radius,debug,packet CHAP-Challenge = 0xe3c819400560adadbf019f209dc42f7e 01:33:40 radius,debug,packet CHAP-Password = 0x01dad26d1d56167a1899b3e9c8a8ba01 01:33:40 radius,debug,packet 18 01:33:40 radius,debug,packet NAS-Identifier = "TEST-RADIUS" 01:33:40 radius,debug,packet NAS-IP-Address = 192.168.200.4 01:33:41 radius,debug resending 53:02 01:33:41 radius,debug,packet sending Access-Request with id 8 to 192.168.200.2:1812 01:33:41 radius,debug,packet Signature = 0x83d0415d6b98f0421df6bb83a01bdb28 01:33:41 radius,debug,packet Service-Type = 2 01:33:41 radius,debug,packet Framed-Protocol = 1 01:33:41 radius,debug,packet NAS-Port = 10 01:33:41 radius,debug,packet NAS-Port-Type = 15 01:33:41 radius,debug,packet User-Name = "lacho" 01:33:41 radius,debug,packet Calling-Station-Id = "00:15:AF:1F:23:1A" 01:33:41 radius,debug,packet Called-Station-Id = "pppoe-in" 01:33:41 radius,debug,packet NAS-Port-Id = "ether1" 01:33:41 radius,debug,packet CHAP-Challenge = 0xe3c819400560adadbf019f209dc42f7e 01:33:41 radius,debug,packet CHAP-Password = 0x01dad26d1d56167a1899b3e9c8a8ba01 01:33:41 radius,debug,packet 18 01:33:41 radius,debug,packet NAS-Identifier = "TEST-RADIUS" 01:33:41 radius,debug,packet NAS-IP-Address = 192.168.200.4 01:33:41 radius,debug resending 53:02 01:33:41 radius,debug,packet sending Access-Request with id 8 to 192.168.200.2:1812 01:33:41 radius,debug,packet Signature = 0x83d0415d6b98f0421df6bb83a01bdb28 01:33:41 radius,debug,packet Service-Type = 2 01:33:41 radius,debug,packet Framed-Protocol = 1 01:33:41 radius,debug,packet NAS-Port = 10 01:33:41 radius,debug,packet NAS-Port-Type = 15 01:33:41 radius,debug,packet User-Name = "lacho" 01:33:41 radius,debug,packet Calling-Station-Id = "00:15:AF:1F:23:1A" 01:33:41 radius,debug,packet Called-Station-Id = "pppoe-in" 01:33:41 radius,debug,packet NAS-Port-Id = "ether1" 01:33:41 radius,debug,packet CHAP-Challenge = 0xe3c819400560adadbf019f209dc42f7e 01:33:41 radius,debug,packet CHAP-Password = 0x01dad26d1d56167a1899b3e9c8a8ba01 01:33:41 radius,debug,packet 18 01:33:41 radius,debug,packet NAS-Identifier = "TEST-RADIUS" 01:33:41 radius,debug,packet NAS-IP-Address = 192.168.200.4 01:33:41 radius,debug timeout for 53:02 01:33:41 pppoe,ppp,info <pppoe-lacho>: terminating... - user lacho authentication failed - radius timeout (6) 01:33:41 pppoe,ppp,info <pppoe-lacho>: disconnected Freeradius debug log: Sending Access-Accept of id 7 to 192.168.200.4 port 32768 Acct-Interim-Interval = 300 Session-Timeout = 31 Mikrotik-Xmit-Limit = 1073217536 Framed-IP-Address = 10.8.15.44 Mikrotik-Recv-Limit = 1073217536 Framed-IP-Netmask = 255.255.255.255 Thu Mar 19 12:37:16 2009 : Debug: Finished request 3 Thu Mar 19 12:37:16 2009 : Debug: Going to the next request Thu Mar 19 12:37:16 2009 : Debug: Thread 4 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.200.4:32768, id=8, length=144 Thu Mar 19 12:37:31 2009 : Debug: --- Walking the entire request list --- Thu Mar 19 12:37:31 2009 : Debug: Cleaning up request 3 ID 7 with timestamp 49c2205c Thu Mar 19 12:37:31 2009 : Debug: Waking up in 31 seconds... Thu Mar 19 12:37:31 2009 : Debug: Threads: total/active/spare threads = 5/0/5 Thu Mar 19 12:37:31 2009 : Debug: Thread 5 got semaphore Thu Mar 19 12:37:31 2009 : Debug: Thread 5 handling request 4, (1 handled so far) Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 10 NAS-Port-Type = Ethernet User-Name = "lacho" Calling-Station-Id = "00:15:AF:1F:23:1A" Called-Station-Id = "pppoe-in" NAS-Port-Id = "ether1" CHAP-Challenge = 0xe3c819400560adadbf019f209dc42f7e CHAP-Password = 0x01dad26d1d56167a1899b3e9c8a8ba0118 NAS-Identifier = "TEST-RADIUS" NAS-IP-Address = 192.168.200.4 Thu Mar 19 12:37:31 2009 : Debug: Processing the authorize section of radiusd.conf Thu Mar 19 12:37:31 2009 : Debug: modcall: entering group authorize for request 4 Thu Mar 19 12:37:31 2009 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 4 Thu Mar 19 12:37:31 2009 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 4 Thu Mar 19 12:37:31 2009 : Debug: modcall[authorize]: module "preprocess" returns ok for request 4 Thu Mar 19 12:37:31 2009 : Debug: modsingle[authorize]: calling pre_auth (rlm_exec) for request 4 Thu Mar 19 12:37:31 2009 : Debug: Exec-Program output: Auth-Type := Accept Thu Mar 19 12:37:31 2009 : Debug: Exec-Program-Wait: value-pairs: Auth-Type := Accept rad_recv: Access-Request packet from host 192.168.200.4:32768, id=8, length=144 Thu Mar 19 12:37:31 2009 : Error: Discarding duplicate request from client TEST-RADIUS:32768 - ID: 8 due to unfinished request 4 Thu Mar 19 12:37:31 2009 : Debug: rl_next: returning NULL Thu Mar 19 12:37:31 2009 : Debug: Waking up in 31 seconds... Thu Mar 19 12:37:31 2009 : Debug: Threads: total/active/spare threads = 5/1/4 Thu Mar 19 12:37:32 2009 : Debug: Exec-Program: returned: 0 Thu Mar 19 12:37:32 2009 : Debug: modsingle[authorize]: returned from pre_auth (rlm_exec) for request 4 Thu Mar 19 12:37:32 2009 : Debug: modcall[authorize]: module "pre_auth" returns ok for request 4 Thu Mar 19 12:37:32 2009 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 4 Thu Mar 19 12:37:32 2009 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 4 Thu Mar 19 12:37:32 2009 : Debug: modcall[authorize]: module "mschap" returns noop for request 4 Thu Mar 19 12:37:32 2009 : Debug: modsingle[authorize]: calling files (rlm_files) for request 4 Thu Mar 19 12:37:32 2009 : Debug: users: Matched entry DEFAULT at line 52 Thu Mar 19 12:37:32 2009 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 4 Thu Mar 19 12:37:32 2009 : Debug: modcall[authorize]: module "files" returns ok for request 4 Thu Mar 19 12:37:32 2009 : Debug: modcall: leaving group authorize (returns ok) for request 4 Thu Mar 19 12:37:32 2009 : Debug: rad_check_password: Found Auth-Type Accept Thu Mar 19 12:37:32 2009 : Debug: rad_check_password: Auth-Type = Accept, accepting the user Thu Mar 19 12:37:32 2009 : Debug: Exec-Program output: Acct-Interim-Interval = 300, Session-Timeout = 31, Mikrotik-Xmit-Limit = 1073217536, Framed-IP-Address = 10.8.15.38, Mikrotik-Recv-Limit = 1073217536, Framed-IP-Netmask = 255.255.255.255, Thu Mar 19 12:37:32 2009 : Debug: Exec-Program-Wait: value-pairs: Acct-Interim-Interval = 300, Session-Timeout = 31, Mikrotik-Xmit-Limit = 1073217536, Framed-IP-Address = 10.8.15.38, Mikrotik-Recv-Limit = 1073217536, Framed-IP-Netmask = 255.255.255.255, rad_recv: Access-Request packet from host 192.168.200.4:32768, id=8, length=144 Thu Mar 19 12:37:32 2009 : Error: Discarding duplicate request from client TEST-RADIUS:32768 - ID: 8 due to unfinished request 4 Thu Mar 19 12:37:32 2009 : Debug: --- Walking the entire request list --- Thu Mar 19 12:37:32 2009 : Debug: Waking up in 5 seconds... Thu Mar 19 12:37:32 2009 : Debug: Exec-Program: returned: 0 Sending Access-Accept of id 8 to 192.168.200.4 port 32768 Acct-Interim-Interval = 300 Session-Timeout = 31 Mikrotik-Xmit-Limit = 1073217536 Framed-IP-Address = 10.8.15.38 Mikrotik-Recv-Limit = 1073217536 Framed-IP-Netmask = 255.255.255.255 Thu Mar 19 12:37:32 2009 : Debug: Finished request 4 Thu Mar 19 12:37:32 2009 : Debug: Going to the next request Thu Mar 19 12:37:32 2009 : Debug: Thread 5 waiting to be assigned a request Thu Mar 19 12:37:37 2009 : Debug: --- Walking the entire request list --- Thu Mar 19 12:37:37 2009 : Debug: Cleaning up request 4 ID 8 with timestamp 49c2206b Thu Mar 19 12:37:37 2009 : Debug: Nothing to do. Sleeping until we see a request. Thu Mar 19 12:37:37 2009 : Debug: Threads: total/active/spare threads = 5/0/5 mikrotik ip [admin@TEST-RADIUS] > ip address print Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK BROADCAST INTERFACE 0 192.168.200.4/24 192.168.200.0 192.168.200.255 ether1 radius server ip`s # ifconfig eth0 Link encap:Ethernet HWaddr 00:19:66:4E:F4:E8 inet addr:192.168.200.3 Bcast:192.168.200.255 Mask:255.255.255.0 inet6 addr: fe80::219:66ff:fe4e:f4e8/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:67047606 errors:2 dropped:0 overruns:0 frame:0 TX packets:1327141 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:480659514 (458.3 MiB) TX bytes:570459851 (544.0 MiB) Interrupt:17 eth0:1 Link encap:Ethernet HWaddr 00:19:66:4E:F4:E8 inet addr:192.168.200.2 Bcast:192.168.200.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:17 eth0:3 Link encap:Ethernet HWaddr 00:19:66:4E:F4:E8 inet addr:212.70.XX.XX Bcast:212.XX.XX.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:17 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:37293 errors:0 dropped:0 overruns:0 frame:0 TX packets:37293 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1787220 (1.7 MiB) TX bytes:1787220 (1.7 MiB) And watch as I can not understand where is the problem? Radius everything looks okay More ideas? Thank you P.S. witout firewall # iptables -L -v Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Thanks -- Lazar Cherveniakov Micro computers system - Lazkom LIVE FREE OR DIE ------------------------------------- Powered by Mail.BG - http://mail.bg

4 3

Modify User-Name to upper Case (rewrite/unlang)
by Eric Martell 20 Mar '09

20 Mar '09

Hi, I am searching through the forum and did not got a right suggestion. I am doing LDAP authentication and getting macaddress as User-Name in the following format. User-Name = "001e.5283.34aa" I want to convert that to "001E528334AA" => convert to uppercase.and remove the dots. Is there any function I can use such as, ldap { User-Name := User-Name.toUpperCase().replace('.',''); } Please guide me to the documentation. Thanks and Regards. Eric.

1 0

Bandwidth limit
by Gunza 20 Mar '09

20 Mar '09

Dear All, I have installed Mikrotik Router OS server for PPPoE and I have installed Ubuntu Server 8.10 with Freeradius+My Sql server. I want to create user with bandwith limit in mysql database. Anybody please help me.

5 7

unlang question
by Bruce_M_Richardson＠biscuits.com 20 Mar '09

20 Mar '09

Hi, I have freeRADIUS 2.0.5 authenticating against LDAP via eap and this has been working perfectly since last year. Now a I have a new requirement to authenticate another set of users in the same LDAP tree onto a different service. These users will be visitors to our site and will have the user names Visitor1 ... Visitor(nn) I do not want visitors to be able to get onto the original service, and I do not want normal users to get onto the visitor service. My thoughts are to set up a new virtual server and add an 'if' statement to look for the visitor user names, and reject or allow as necessary. something like this in the new virtual server if ( Stripped-User-Name != /visitor[0-9]?[0-9]/i ) { reject } and the inverse for the old service. if ( Stripped-User-Name =~ /visitor[0-9]?[0-9]/i ) { reject } Is this syntax correct ? and where do I put it? Thanks for your time ...regards, Bruce Richardson Please consider the environment - do you really need to print this email? ________________________________________________________________________________________ This e-mail and any attachments are confidential and solely for the use of the intended recipient. They may contain material protected by legal professional or other privilege. If you receive it in error, please delete it from your system, make no copies of it, do not disclose its contents to any third party or use it for your own or any other person's benefit. Please advise the sender of its receipt as soon as possible. Although this email and its attachments are believed to be free of any virus or other defect, it is the responsibility of the recipient to ensure that they are virus free and no responsibility is accepted by the company for any loss or damage arising from receipt or use thereof. Any opinions expressed that do not relate to the official business of the company are those of the author, not the United Biscuits group of companies. United Biscuits (UK) Limited Registered in England number 2506007 Registered Office: Hayes Park, Hayes End Road, Hayes, Middlesex, UB4 8EE ________________________________________________________________________________________

4 7

radclient: problem with exit code 0 and 1
by oz 20 Mar '09

20 Mar '09

Hello, for monitoring our radius-servers, I use radclient for a long time in a script. After migration to another platform, radclient seems to work else, than before. If a monitored radiusd is down or the Auth of my monitoring-user fails, radclient gets an expected answer, but exits with status 0 in these cases. As far as I remember, in the past it was exit 1 (--> echo $?=1). I used to process exit 1 to indicate a problem with my radius-servers. Has this behaviour changed somewhere in the past? Or is it the wanted behaviour, that every valid answer to radclient exits with status 0 now? Take this for example: # /usr/bin/radclient -f /home/me/radpacket -x 192.168.x.x:1812 auth secret123 Sending Access-Request of id 248 to 192.168.x.x port 1812 User-Name = "test-user" Password = "XXXXXXX" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 radclient: no response from server for ID 248 # echo $? 0 ... I expected $? to be 1, because the server was down and did not respond, what indicates an error. I am running radclient from freeradius 1.1.3-3, Debian/etch amd64: # radclient -v radclient: $Id: radclient.c,v 1.72.2.1.2.5 2006/05/16 18:26:08 aland Exp $ built on Dec 17 2006 at 01:07:36 Any ideas? thnx

4 14