- Freeradius-Users - lists.freeradius.org

CHAP authentication + FreeRadius + SQL
by Marcelo Freitas 18 Feb '09

18 Feb '09

Hello, I'm trying to authenticate users using CHAP and store the passwords in the SQL, but I'm having a hard time. I checked past messages, but I still couldn't get it to work ... Below is my Access-Request packet Wed Feb 18 12:31:04 2009 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "000E2EEB1D91" Called-Station-Id = "hotspot1" NAS-Port-Id = "wHotSpotB" User-Name = "admin2" NAS-Port = 2153775219 Acct-Session-Id = "80600073" Framed-IP-Address = 10.5.50.253 Mikrotik-Host-IP = 10.5.50.253 CHAP-Challenge = 0x4f0299d5a5107ded915739e236f71e3c CHAP-Password = 0x606707e3411f443140573554283c987ca5 Service-Type = Login-User WISPr-Logoff-URL = "http://10.5.50.1/logout" NAS-Identifier = "AP_HQ" NAS-IP-Address = 10.0.1.130 In MySQL I just have Cleartext-Password == admin2 for check items ... But I always get Access-Reject. Before checking the past messages, I had already check items like Auth-Type := CHAP, Cleartext-Password == admin2; and also just CHAP-Password, but none of it worked ... Thanks in advance,

2 1

None
by Simon Earthrowl 18 Feb '09

18 Feb '09

Hi, I am trying to configure free radius to work with our 28 NASs. These NASs are split into two groups, at different locations (equal split 14-14). ll NASs report NAS-IP-Address correctly (ie uniquely) Any device requesting authentication randomly connects to any one of the 28 NASs. All devices are unique, and Calling-Station-ID is used to uniquely identify every device. There is no possible chance of multiple instances connecting Some devices *may* require require PAP/CHAP -- the default being ignore User-Name etc. This is configured on a device by device basis. Devices may require an alternative configuration using Called-Station-ID Furthermore, I wish to use MySQL, so that I can add new provisioned devices auto-magically, without needing to tell the radius server. I've a freshly compiled version 2.1.3, running on CentOS 5.3 -- That was by far the easiest bit! Many thanks for that. *Now the problem....* Each set of NASs requires a different Framed-IP-Address pool eg 10.0.0.0/24 for site1, and 10.8.0.0/24 for site2 with Called-Station-Id = domain.com, and 192.168.110.0/26 for site1, and 192.168.110.128/26 for site2 with Called-Station-Id = domain.co.uk I'm using sqlippool to supply the IP. *What I've tried.....* Pool-name : I've set this in huntgroups, hints, clients.conf with no success whatsoever. Pool-Name: In netgroups -- performace was too slow, as I need 28 groups per device! Virtual-Servers: I just don't get these. The README suggests I don't need a listen clause, the debug output suggests I do. I'm concerned that if I go down this route, I'll end up with slow responses again *Where I've got to:* I'm using radcheck table with the Sql-Name set to Calling-Station-ID, with Auth-Type := Accept (for the default case), and adding User-Name & password checking for specific PAP/CHAP authentication. *What I need please* Easiest: A fix, so I can set Pool-Name in clients.conf, or hints, that works in sqlippool. Intermediate: Another strategy that will scale (not 28 groups per device) Or Advanced: A far better understanding of where, and how, I can use unlang, and be able to calculate Pool-Name within a context such that sqlippool will corectly allocate an IP address. Many thanks in anticipation for help/suggestions being offered kind regards Simon

2 4

linking gdbm_compat in rlm_dbm
by Damjan 18 Feb '09

18 Feb '09

I've noticed that the check that ./configure script does in order to find out if gdbm si used only tries to link with gdbm_compat. But the man page of gdbm says: If you wish to use the dbm or ndbm compatibility routines, you must link in the gdbm_compat library as well. For example: gcc -o prog proc.c -lgdbm -lgdbm_compat and indeed on any vanilla system this is the case. Debian, OTOH have patched their libgdbm_compat. -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk -- not my mail address, it's a Jabber ID --^ :)

2 1

FW: wimax.c
by dave anderson 17 Feb '09

17 Feb '09

-----Original Message----- From: dave anderson Sent: February 13, 2009 5:14 PM To: freeradius-users Subject: FW: wimax.c I have the Wimax FreeRadius (2.1.3) working but I am a bit unclear on a few key reply parameters: In the default server I have added update "reply"{ WiMAX-MSK = �%{reply:EAP-MSK}� Which successfully produces the right length MSK in the reply. However to populate these other variable into the reply such as Session reply, it is not clear how to do so: WiMAX-AAA-Session-ID = ? WiMAX-HA-RK-SPI = ? WiMAX-HA-RK-Lifetime = ? How to I get the reply to include these with correct values ? Further, putting WiMAX-MN-NAI = �%{User-Name}� in the default config prior to calling the wimax function still results in the WiMAX module warning that WiMAX-MN-NAI has not been set. Would anyone have advice on how to resolve these two issues? Thanks Dave Anderson

2 8

Freeradius with OpenLDAP and AD.
by LEOSI 17 Feb '09

17 Feb '09

Hi, I have several problems when I would like to link freeradius with AD using OpenLDAP. When I tried to test the binding of OpenLDAP to the AD with radtest, it responds Access-Accept (as you can see in the log after). But when I wanted to check with a real supplicant (under WinXP with MD5-Challenge Auth) I got an access-reject. Things I changed : - modules/ldap : ldap { server = "test.fr" identity = "cn=bindradius,cn=Users,dc=test,dc=fr" password = bindradius basedn = "cn=Users,dc=test,dc=fr" filter = "(samaccountname=%{User-Name})" .. } password_attribute = userPassword - site-enabled/default & inner-tunnel : authorize { .. # uncommented : ldap .. } authenticate { .. # uncommented : Auth-Type LDAP { ldap } Thanks for your help --------------------------------------------------------------------------------- Radtest : --------------------------------------------------------------------------------- root@freeradius:~# radtest philippe philippe localhost 0 testing123 Sending Access-Request of id 50 to 127.0.0.1 port 1812 User-Name = "philippe" User-Password = "philippe" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=50, length=20 --------------------------------------------------------------------------------- Freeradius log with radtest : --------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 127.0.0.1 port 47525, id=50, length=60 User-Name = "philippe" User-Password = "philippe" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 [..] Tue Feb 17 15:38:25 2009 : Info: [ldap] performing user authorization for philippe Tue Feb 17 15:38:25 2009 : Info: [ldap] expand: (samaccountname=%{User-Name}) -> (samaccountname=philippe) Tue Feb 17 15:38:25 2009 : Info: [ldap] expand: cn=Users,dc=test,dc=fr -> cn=Users,dc=test,dc=fr Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: attempting LDAP reconnection Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: (re)connect to test.fr:389, authentication 0 Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: bind as cn=bindradius,cn=Users,dc=test,dc=fr/bindradius to test.fr:389 Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: waiting for bind result ... Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: Bind was successful Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: performing search in cn=Users,dc=test,dc=fr, with filter (samaccountname=philippe) Tue Feb 17 15:38:25 2009 : Info: [ldap] looking for check items in directory... Tue Feb 17 15:38:25 2009 : Info: [ldap] looking for reply items in directory... Tue Feb 17 15:38:25 2009 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Feb 17 15:38:25 2009 : Info: [ldap] user philippe authorized to use remote access Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Feb 17 15:38:25 2009 : Info: ++[ldap] returns ok [..] Tue Feb 17 15:38:25 2009 : Info: Found Auth-Type = LDAP Tue Feb 17 15:38:25 2009 : Info: +- entering group LDAP {...} Tue Feb 17 15:38:25 2009 : Info: [ldap] login attempt by "philippe" with password "philippe" Tue Feb 17 15:38:25 2009 : Info: [ldap] user DN: CN=philippe,CN=Users,DC=test,DC=fr Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: (re)connect to test.fr:389, authentication 1 Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: bind as CN=philippe,CN=Users,DC=test,DC=fr/philippe to test.fr:389 Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: waiting for bind result ... Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: Bind was successful Tue Feb 17 15:38:25 2009 : Info: [ldap] user philippe authenticated succesfully [..] Sending Access-Accept of id 50 to 127.0.0.1 port 47525 --------------------------------------------------------------------------------- With a real supplicant : --------------------------------------------------------------------------------- Tue Feb 17 15:40:50 2009 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 1024, id=5, length=202 Framed-MTU = 1480 NAS-IP-Address = 192.168.1.1 NAS-Identifier = "SWiTCH" User-Name = "philippe" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 21 NAS-Port-Type = Ethernet NAS-Port-Id = "21" Called-Station-Id = "00-13-21-a8-24-40" Calling-Station-Id = "00-15-c5-06-84-d8" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4" EAP-Message = 0x0201000d017068696c69707065 Message-Authenticator = 0x2e787b9c5fea331ecfc02e8c3b85c55c Tue Feb 17 15:41:28 2009 : Info: +- entering group authorize {...} Tue Feb 17 15:41:28 2009 : Info: ++[preprocess] returns ok Tue Feb 17 15:41:28 2009 : Info: ++[chap] returns noop Tue Feb 17 15:41:28 2009 : Info: ++[mschap] returns noop Tue Feb 17 15:41:28 2009 : Info: [suffix] No '@' in User-Name = "philippe", looking up realm NULL Tue Feb 17 15:41:28 2009 : Info: [suffix] No such realm "NULL" Tue Feb 17 15:41:28 2009 : Info: ++[suffix] returns noop Tue Feb 17 15:41:28 2009 : Info: [eap] EAP packet type response id 1 length 13 Tue Feb 17 15:41:28 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Feb 17 15:41:28 2009 : Info: ++[eap] returns updated Tue Feb 17 15:41:28 2009 : Info: ++[unix] returns notfound Tue Feb 17 15:41:28 2009 : Info: [files] users: Matched entry DEFAULT at line 1 Tue Feb 17 15:41:28 2009 : Info: ++[files] returns ok Tue Feb 17 15:41:28 2009 : Info: [ldap] performing user authorization for philippe Tue Feb 17 15:41:28 2009 : Info: [ldap] expand: (samaccountname=%{User-Name}) -> (samaccountname=philippe) Tue Feb 17 15:41:28 2009 : Info: [ldap] expand: cn=Users,dc=test,dc=fr -> cn=Users,dc=test,dc=fr Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: attempting LDAP reconnection Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: (re)connect to test.fr:389, authentication 0 Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: bind as cn=bindradius,cn=Users,dc=test,dc=fr/bindradius to test.fr:389 Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: waiting for bind result ... Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: Bind was successful Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: performing search in cn=Users,dc=test,dc=fr, with filter (samaccountname=philippe) Tue Feb 17 15:41:28 2009 : Info: [ldap] looking for check items in directory... Tue Feb 17 15:41:28 2009 : Info: [ldap] looking for reply items in directory... Tue Feb 17 15:41:28 2009 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Feb 17 15:41:28 2009 : Info: [ldap] user philippe authorized to use remote access Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Feb 17 15:41:28 2009 : Info: ++[ldap] returns ok Tue Feb 17 15:41:28 2009 : Info: ++[expiration] returns noop Tue Feb 17 15:41:28 2009 : Info: ++[logintime] returns noop Tue Feb 17 15:41:28 2009 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Feb 17 15:41:28 2009 : Info: ++[pap] returns noop Tue Feb 17 15:41:28 2009 : Info: Found Auth-Type = EAP Tue Feb 17 15:41:28 2009 : Info: +- entering group authenticate {...} Tue Feb 17 15:41:28 2009 : Info: [eap] EAP Identity Tue Feb 17 15:41:28 2009 : Info: [eap] processing type md5 Tue Feb 17 15:41:28 2009 : Debug: rlm_eap_md5: Issuing Challenge Tue Feb 17 15:41:28 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 5 to 192.168.1.1 port 1024 EAP-Message = 0x01020016041005f180280d72810cb4b1b9fa2033ede2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89d76e5089d56a6c48de80e818248c16 Tue Feb 17 15:41:28 2009 : Info: Finished request 0. Tue Feb 17 15:41:28 2009 : Debug: Going to the next request Tue Feb 17 15:41:28 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 1024, id=6, length=237 Framed-MTU = 1480 NAS-IP-Address = 192.168.1.1 NAS-Identifier = "SWiTCH" User-Name = "philippe" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 21 NAS-Port-Type = Ethernet NAS-Port-Id = "21" Called-Station-Id = "00-13-21-a8-24-40" Calling-Station-Id = "00-15-c5-06-84-d8" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4" State = 0x89d76e5089d56a6c48de80e818248c16 EAP-Message = 0x0202001e041046b39f2ac453deec1f14d2b599506e377068696c69707065 Message-Authenticator = 0x57f0fce82988e78eeb9bc719d015033d Tue Feb 17 15:41:28 2009 : Info: +- entering group authorize {...} Tue Feb 17 15:41:28 2009 : Info: ++[preprocess] returns ok Tue Feb 17 15:41:28 2009 : Info: ++[chap] returns noop Tue Feb 17 15:41:28 2009 : Info: ++[mschap] returns noop Tue Feb 17 15:41:28 2009 : Info: [suffix] No '@' in User-Name = "philippe", looking up realm NULL Tue Feb 17 15:41:28 2009 : Info: [suffix] No such realm "NULL" Tue Feb 17 15:41:28 2009 : Info: ++[suffix] returns noop Tue Feb 17 15:41:28 2009 : Info: [eap] EAP packet type response id 2 length 30 Tue Feb 17 15:41:28 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Feb 17 15:41:28 2009 : Info: ++[eap] returns updated Tue Feb 17 15:41:28 2009 : Info: ++[unix] returns notfound Tue Feb 17 15:41:28 2009 : Info: [files] users: Matched entry DEFAULT at line 1 Tue Feb 17 15:41:28 2009 : Info: ++[files] returns ok Tue Feb 17 15:41:28 2009 : Info: [ldap] performing user authorization for philippe Tue Feb 17 15:41:28 2009 : Info: [ldap] expand: (samaccountname=%{User-Name}) -> (samaccountname=philippe) Tue Feb 17 15:41:28 2009 : Info: [ldap] expand: cn=Users,dc=test,dc=fr -> cn=Users,dc=test,dc=fr Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: performing search in cn=Users,dc=test,dc=fr, with filter (samaccountname=philippe) Tue Feb 17 15:41:28 2009 : Info: [ldap] looking for check items in directory... Tue Feb 17 15:41:28 2009 : Info: [ldap] looking for reply items in directory... Tue Feb 17 15:41:28 2009 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Feb 17 15:41:28 2009 : Info: [ldap] user philippe authorized to use remote access Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Feb 17 15:41:28 2009 : Info: ++[ldap] returns ok Tue Feb 17 15:41:28 2009 : Info: ++[expiration] returns noop Tue Feb 17 15:41:28 2009 : Info: ++[logintime] returns noop Tue Feb 17 15:41:28 2009 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Feb 17 15:41:28 2009 : Info: ++[pap] returns noop Tue Feb 17 15:41:28 2009 : Info: Found Auth-Type = EAP Tue Feb 17 15:41:28 2009 : Info: +- entering group authenticate {...} Tue Feb 17 15:41:28 2009 : Info: [eap] Request found, released from the list Tue Feb 17 15:41:28 2009 : Info: [eap] EAP/md5 Tue Feb 17 15:41:28 2009 : Info: [eap] processing type md5 Tue Feb 17 15:41:28 2009 : Debug: rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication Tue Feb 17 15:41:28 2009 : Info: [eap] Handler failed in EAP/md5 Tue Feb 17 15:41:28 2009 : Info: [eap] Failed in EAP select Tue Feb 17 15:41:28 2009 : Info: ++[eap] returns invalid Tue Feb 17 15:41:28 2009 : Info: Failed to authenticate the user. Tue Feb 17 15:41:28 2009 : Info: Using Post-Auth-Type Reject Tue Feb 17 15:41:28 2009 : Info: +- entering group REJECT {...} Tue Feb 17 15:41:28 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> philippe Tue Feb 17 15:41:28 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Feb 17 15:41:28 2009 : Info: ++[attr_filter.access_reject] returns updated Tue Feb 17 15:41:28 2009 : Info: Delaying reject of request 1 for 1 seconds Tue Feb 17 15:41:28 2009 : Debug: Going to the next request Tue Feb 17 15:41:28 2009 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 1024, id=6, length=237 Tue Feb 17 15:41:29 2009 : Info: Waiting to send Access-Reject to client 192.168.1.1 port 1024 - ID: 6 Tue Feb 17 15:41:29 2009 : Info: Sending delayed reject for request 1 Sending Access-Reject of id 6 to 192.168.1.1 port 1024 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 Tue Feb 17 15:41:29 2009 : Debug: Waking up in 3.9 seconds. Tue Feb 17 15:41:33 2009 : Info: Cleaning up request 0 ID 5 with timestamp +38 Tue Feb 17 15:41:33 2009 : Debug: Waking up in 0.9 seconds. Tue Feb 17 15:41:34 2009 : Info: Cleaning up request 1 ID 6 with timestamp +38 Tue Feb 17 15:41:34 2009 : Debug: Ready to process requests. -- View this message in context: http://www.nabble.com/Freeradius-with-OpenLDAP-and-AD.-tp22058186p22058186.… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 4

No authenticate method using Mysql
by Pedro Henrique Mazzoni 17 Feb '09

17 Feb '09

Hello, I am trying to use mysql and Freeradius for AAA. The communication between freeradius and mysql server seems OK, since Freeradius is getting the clients from radclients table. When I do a test from the command line: "radtest user1 pass localhost 1812 shared" I got the output: "rad_recv: Access-Request packet from host 127.0.0.1 port 56962, id=152, length=57 User-Name = "user1" User-Password = "pass" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Mon Feb 16 17:22:09 2009 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Mon Feb 16 17:22:09 2009 : Info: Failed to authenticate the user. Mon Feb 16 17:22:09 2009 : Info: Using Post-Auth-Type Reject Mon Feb 16 17:22:09 2009 : Debug: WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Mon Feb 16 17:22:09 2009 : Info: Delaying reject of request 1 for 1 seconds Mon Feb 16 17:22:09 2009 : Debug: Going to the next request Mon Feb 16 17:22:09 2009 : Debug: Waking up in 0.9 seconds. Mon Feb 16 17:22:11 2009 : Info: Sending delayed reject for request 1 Sending Access-Reject of id 152 to 127.0.0.1 port 56962 Mon Feb 16 17:22:11 2009 : Debug: Waking up in 4.9 seconds. " Following is my configuration file(please note that this is only the file in sites-avaiable dir, note radiusd.conf): "###################################################################### # # As of 2.0.0, FreeRADIUS supports virtual hosts using the # "server" section, and configuration directives. # # Virtual hosts should be put into the "sites-available" # directory. Soft links should be created in the "sites-enabled" # directory to these files. This is done in a normal installation. # # $Id$ # ###################################################################### # # Read "man radiusd" before editing this file. See the section # titled DEBUGGING. It outlines a method where you can quickly # obtain the configuration you want, without running into # trouble. See also "man unlang", which documents the format # of this file. # # This configuration is designed to work in the widest possible # set of circumstances, with the widest possible number of # authentication methods. This means that in general, you should # need to make very few changes to this file. # # The best way to configure the server for your local system # is to CAREFULLY edit this file. Most attempts to make large # edits to this file will BREAK THE SERVER. Any edits should # be small, and tested by running the server with "radiusd -X". # Once the edits have been verified to work, save a copy of these # configuration files somewhere. (e.g. as a "tar" file). Then, # make more edits, and test, as above. # # There are many "commented out" references to modules such # as ldap, sql, etc. These references serve as place-holders. # If you need the functionality of that module, then configure # it in radiusd.conf, and un-comment the references to it in # this file. In most cases, those small changes will result # in the server being able to connect to the DB, and to # authenticate users. # ###################################################################### server intelitiva.com { # # In 1.x, the "authorize", etc. sections were global in # radiusd.conf. As of 2.0, they SHOULD be in a server section. # # The server section with no virtual server name is the "default" # section. It is used when no server name is specified. # # We don't indent the rest of this file, because doing so # would make it harder to read. # # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. # # The order of the realm modules will determine the order that # we try to find a matching realm. # # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { # # The preprocess module takes care of sanitizing some bizarre # attributes in the request, and turning them into attributes # which are more standard. # # It takes care of processing the 'raddb/hints' and the # 'raddb/huntgroups' files. # # It also adds the %{Client-IP-Address} attribute to the request. preprocess # # If you want to have a log of authentication requests, # un-comment the following line, and the 'detail auth_log' # section, above. #auth_log # # The chap module will set 'Auth-Type := CHAP' if we are # handling a CHAP request and Auth-Type has not already been set chap # # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. mschap # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authenticate' section. # digest # # Look for IPASS style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # IPASS # # If you are using multiple kinds of realms, you probably # want to set "ignore_null = yes" for all of them. # Otherwise, when the first style of realm doesn't match, # the other styles won't be checked. # # suffix # ntdomain # # This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP # authentication. # # It also sets the EAP-Type attribute in the request # attribute list to the EAP type from the packet. # # As of 2.0, the EAP module returns "ok" in the authorize stage # for TTLS and PEAP. In 1.x, it never returned "ok" here, so # this change is compatible with older configurations. # # The example below uses module failover to avoid querying all # of the following modules if the EAP module returns "ok". # Therefore, your LDAP and/or SQL servers will not be queried # for the many packets that go back and forth to set up TTLS # or PEAP. The load on those servers will therefore be reduced. # # eap { # ok = return # } # # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf sql # # Pull crypt'd passwords from /etc/passwd or /etc/shadow, # using the system API's to get the password. If you want # to read /etc/passwd or /etc/shadow directly, see the # passwd module in radiusd.conf. # # unix # # Read the 'users' file # files # # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'etc_smbpasswd' module, above. # etc_smbpasswd # # The ldap module will set Auth-Type to LDAP if it has not # already been set # ldap # # Enforce daily limits on time spent logged in. # daily # # Use the checkval module # checkval # expiration # logintime # # If no other module has claimed responsibility for # authentication, then try to use PAP. This allows the # other modules listed above to add a "known good" password # to the request, and to do nothing else. The PAP module # will then see that password, and use it to do PAP # authentication. # # This module should be listed last, so that the other modules # get a chance to set Auth-Type for themselves. # # pap # # If "status_server = yes", then Status-Server messages are passed # through the following section, and ONLY the following section. # This permits you to do DB queries, for example. If the modules # listed here return "fail", then NO response is sent. # # Autz-Type Status-Server { # # } } # Authentication. # # # This section lists which modules are available for authentication. # Note that it does NOT mean 'try each module in order'. It means # that a module from the 'authorize' section adds a configuration # attribute 'Auth-Type := FOO'. That authentication type is then # used to pick the apropriate module from the list below. # # In general, you SHOULD NOT set the Auth-Type attribute. The server # will figure it out on its own, and will do the right thing. The # most common side effect of erroneously setting the Auth-Type # attribute is that one authentication method will work, but the # others will not. # # The common reasons to set the Auth-Type attribute by hand # is to either forcibly reject the user (Auth-Type := Reject), # or to or forcibly accept the user (Auth-Type := Accept). # # Note that Auth-Type := Accept will NOT work with EAP. # # Please do not put "unlang" configurations into the "authenticate" # section. Put them in the "post-auth" section instead. That's what # the post-auth section is for. # authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authorize' section. # digest # # Pluggable Authentication Modules. # pam # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # # unix # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. # Auth-Type LDAP { # ldap # } # # Allow EAP authentication. # eap } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess # # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique # # Look for IPASS-style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # # Accounting requests are generally proxied to the same # home server as authentication requests. # IPASS suffix # ntdomain # # Read the 'acct_users' file files } # # Accounting. Log the accounting data. # accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf sql # # Instead of sending the query to the SQL server, # write it into a log file. # # sql_log # Cisco VoIP specific bulk accounting # pgsql-voip # Filter attributes from the accounting response. attr_filter.accounting_response # # See "Autz-Type Status-Server" for how this works. # # Acct-Type Status-Server { # # } } # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { radutmp # # See "Simultaneous Use Checking Queries" in sql.conf sql } # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { # Get an address from the IP Pool. # main_pool # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. # reply_log # # After authenticating the user, do another SQL query. # # See "Authentication Logging Queries" in sql.conf sql # # Instead of sending the query to the SQL server, # write it into a log file. # # sql_log # # Un-comment the following if you have set # 'edir_account_policy_check = yes' in the ldap module sub-section of # the 'modules' section. # # ldap exec # # Access-Reject packets are sent through the REJECT sub-section of the # post-auth section. # # Add the ldap module name (or instance) if you have set # 'edir_account_policy_check = yes' in the ldap module configuration # Post-Auth-Type REJECT { attr_filter.access_reject } } # # When the server decides to proxy a request to a home server, # the proxied request is first passed through the pre-proxy # stage. This stage can re-write the request, or decide to # cancel the proxy. # # Only a few modules currently have this method. # pre-proxy { # attr_rewrite # Uncomment the following line if you want to change attributes # as defined in the preproxy_users file. # files # Uncomment the following line if you want to filter requests # sent to remote servers based on the rules defined in the # 'attrs.pre-proxy' file. # attr_filter.pre-proxy # If you want to have a log of packets proxied to a home # server, un-comment the following line, and the # 'detail pre_proxy_log' section, above. # pre_proxy_log } # # When the server receives a reply to a request it proxied # to a home server, the request may be massaged here, in the # post-proxy stage. # post-proxy { # If you want to have a log of replies from a home server, # un-comment the following line, and the 'detail post_proxy_log' # section, above. # post_proxy_log # attr_rewrite # Uncomment the following line if you want to filter replies from # remote proxies based on the rules defined in the 'attrs' file. # attr_filter.post-proxy # # If you are proxying LEAP, you MUST configure the EAP # module, and you MUST list it here, in the post-proxy # stage. # # You MUST also use the 'nostrip' option in the 'realm' # configuration. Otherwise, the User-Name attribute # in the proxied request will not match the user name # hidden inside of the EAP packet, and the end server will # reject the EAP request. # eap # # If the server tries to proxy a request and fails, then the # request is processed through the modules in this section. # # The main use of this section is to permit robust proxying # of accounting packets. The server can be configured to # proxy accounting packets as part of normal processing. # Then, if the home server goes down, accounting packets can # be logged to a local "detail" file, for processing with # radrelay. When the home server comes back up, radrelay # will read the detail file, and send the packets to the # home server. # # With this configuration, the server always responds to # Accounting-Requests from the NAS, but only writes # accounting packets to disk if the home server is down. # # Post-Proxy-Type Fail { # detail # } } }" Any ideas? Thanks in advance, Pedro Mazzoni

4 5

Using accounting data for quotas
by Jonathan Gazeley 17 Feb '09

17 Feb '09

I'm trying to find a way to extract useful data from accounting logs to use towards a quota. I'm a bit stuck and I'm wondering if anyone has tried anything similar with success. Let me explain... My accounting logs are sent to SQL with the inner ID. Periodically, the NAS updates the accounting record with total of upload and download during that session. I've tweaked the FR queries so they also update a new field called 'lastupdatetime'. I want to write an hourly script that will tell me (eg in a CSV file) how much traffic has been done for each username (not necessarily each session) during the last hour. Clearly this will take some sort of hourly summary that can be compared each hour. But it is still not straightforward: - Some sessions remain open for weeks. - Some users have multiple simultaneous or multiple sequential sessions. - The updates come in at different times. - The traffic counters will roll over from time to time. - It's not possible to query hourly on how traffic the user has used since forever, because records older than around 90 days are dropped. Any ideas? Or am I barking up completely the wrong tree... Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------

3 2

reference client stanzas in unlang?
by Stefan Winter 17 Feb '09

17 Feb '09

Hi, is there a way to reference the name of the client stanza (or its shortname) in unlang? I.e. if there is client foo { ipaddr = 1.2.3.4 shortname = foostuff } Then there's a request coming in from this client. In the client processing, can there be sth like if ( -- something that reveals "foo" or "foostuff" -- ) { ... } ? Using huntgroups and assigning Client-IP-Address into huntgroups is procedurally not an option. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 2

Dynamic Vlan Allocation based on LDAP Attribute Value
by Paul Dealy 17 Feb '09

17 Feb '09

I have a working radius server (ver 1.1.3). which I am using for 802.1x authentication of wired switch ports. I would like to dynamically assign users vlans. I have cisco gear and have achieved basic vlan allocation by configuring a Default entry in the users file. So the vlan allocation part works ok. What I want to be able to do is allocate the vlan by matching the value of an LDAP attribute. Not by group membership, but the actual value of a users attribute. Is this possible? Cheers, Dealy

3 19

Freeradius2.1.3 + Fedora9 + PEAP + AD = problem
by Andrey.Trubnikov＠unicreditgroup.ru 17 Feb '09

17 Feb '09

Hi I configure Freeradius 2.1.3 how it describes in http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO but it doesn't work. here is debug output: FreeRADIUS Version 2.1.3, for host i386-redhat-linux-gnu, built on Dec 8 2008 at 16:00:08 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client 10.6.0.0/16 { require_message_authenticator = no secret = "secret" shortname = "cisco" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=123, length=155 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x02020019015350422e494d422e52555c747275626e696b6f76 Message-Authenticator = 0xca609e950b9d1b6e044b7b1e35ece327 NAS-Port-Type = Ethernet NAS-Port = 50020 NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 25 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 123 to 10.6.0.86 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f59c899961300b089b526f445b Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=124, length=228 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x0203005019800000004616030100410100003d03014994289f6e90304c75136fa081c24849e67c260665de87b51c9522d501063e5000001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xc5b019218bd1efacc9eb8657720601d4 NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f59c899961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 124 to 10.6.0.86 port 1645 EAP-Message = 0x0104040019c00000089b160301002a020000260301499428a3397c48ef2bf058423bf7bdf3f533b0e82d1d2323c12b36198d9554ff00000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303231323132353633385a170d3130303231323132353633385a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100be607ef369a0c5d803e13ed311e4ce6722607bd2b51a05394de4dcaaf45d4b2e0bae9e001a76dfac328a9e85beea2a32a40504b3fe3d3b9f51a76eac7999 EAP-Message = 0x457c18dc35beb05d700d0f0149de5709341a4c9b873c1001a74516e6594bf82b1fa72e2e09b4e32e4e3dc4a420f648506461e877942742347e42ea0d48614badf4866a4226b63fa2fcd8bc0f980544c4d04405ee96e5e656041e720eb92483ee20c26b2b82b840c3c33e6b05b9ba947e940e7a5a0efd802a9046d67232300932bd7eeaa16e6887768c4836819d0dba80eed0612cdeeb282c680df57f65cc27ab9f56dd53420b9219d72d0f735e9a97d8aa755b7bf3402bfcc011ec6cc276fbf125db0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010086ca73bda33dac167f EAP-Message = 0x80bc8fd2e714597d56198a94b45dcecbe3bd868c88fe759344759cf4a200205eeaedc663550feb4d86c7856d1cf6de9c8d87e2e35abd54eb2056b8c6c52e16ec95d4b58ff41bdbdcd85157c0bcafb01db3bab55e704d8a4bb3a23db7bde2721b3145ad4a0375616b008cf3cfb3f44eb8a8b2e3988c7a003f925f5fb3265b94844486254b2a6fe9e116e06a45a7b8c7e43a141dbbad2b91c0d767de58cc82bfa86f648d47049f4ac425137e83cfb8af113e12dcd0e9ac4c7f41d8d61c9e3b9cc5249d173c308c56d09c0fb504590e2fc4fdfa45f57703738925c24ba72feb69d05e4f4dbe0491c3c2216bd8fe7540b4a490cf2ed4f13f360004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f59d8e9961300b089b526f445b Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=125, length=154 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x020400061900 Message-Authenticator = 0x0e848ffd6bb8351f5ef907ebde5b7874 NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f59d8e9961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 125 to 10.6.0.86 port 1645 EAP-Message = 0x010503fc194000adc70b5be0044ad3300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303231323132353633385a170d3130303231323132353633385a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d597421324695f36aae1a4ae9647c315c17da1da6caaa82a1028db432f0951f98af8947a591c0f77cfb99dd948e217f540840d7b9a1bfd31059173f700f582d017b9da6ff4f0b4c168def0b87dec3281d066ed8a6711431b92fe65234f5dfab96205f8f933b107fb283c79e4530e9f EAP-Message = 0x2db2999043968b3d4d1081804b5896d30be16a0bc958a3b9d91aeff3075d36aa8d93758bfd86770e6647af75f60600b95e675eaffdb0b55c8e08aa5b56f970d6120ee85db50ae37b5c020eee094f81e8c8b25c9ee5e817365a7c88173b46479bd45b42896894321e147b319e9cac56cebc7e0c883a44d8662842068281cedf9f2226d45fb9551ff7eac9231c9e0647e8a50203010001a381fb3081f8301d0603551d0e0416041455460e5d2216933d47b1213dcba48130590f3f803081c80603551d230481c03081bd801455460e5d2216933d47b1213dcba48130590f3f80a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900adc70b5be0044ad3300c0603551d13040530030101ff300d06092a864886f70d010105050003820101000ca4fa0b2aeffd6f41b81c005b44979fb69bb157f76d01da7df39102b54c920862d6e184047adde5178e98f2b8d635dd9be7eae5e2b39640a7d5164cbd3f2cb1f080ea6b8b852b39e603151bb38ab0d744eb EAP-Message = 0xa0d53927f55728a7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f59e8f9961300b089b526f445b Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=126, length=154 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x020500061900 Message-Authenticator = 0x16385baf4cb2818e88325444881d1247 NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f59e8f9961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 126 to 10.6.0.86 port 1645 EAP-Message = 0x010600b51900aa0831430c97a13773e7deac05ec51fcbd0f3d4126c04ed338ec3d6213a156682ba77e3840cbd0b30bbcb2e14c5e2103a1b6bfa11381916245226510c11d083385ac4f08c37e80267304e623ad73a104b26a124f324eff7d42ef6cf02f8bfd456664c793bd4cf1e2e8cda3f565a40decd9f9ba557d9f6933cf5d710a395e11e0d6654a5da345c48f4e91eeab7174a64912a5495e04a0b82daf07bbb9af7db00c0f5452738d1616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f59f8c9961300b089b526f445b Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=127, length=470 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x02060140198000000136160301010610000102010078a20bd953aea703502943c0e100284b5c866240b1d05afbf17f5c83411c651a86d18f15491f2b28be61f0fc2ca5ae927f11607777fed0c96e089fc07acf3f31ac8add249b45fafc690a0e4fb6cea1aad9041c188e602fa171ee2a5054ff7a0d38ba2d06dc5766d04f1b16f7bfd5c886a424b2298b745098be9446996003741f308da494612bc0f0cedc9d8c472390a2a3d90d3ba9495a9d2c2776de2badbf9cfcfa5a2e4262d3ed54094bec0b61a83912fa6134ed1b22ec63fa039f6c93b976df06dad786cf1a38164cdb645ce07d75a640d2f49da9c5987f1deafd07ac91c3722cecdea9459600 EAP-Message = 0x29d5d86f8e2440200273e63839ac3a263bdd90dc7aa1005d1403010001011603010020facefc49020de52c0a23b0d8fdbbe5912ab3268be088aa6c4dea17a9c8e91ab9 Message-Authenticator = 0xf6aecb8339699f0c4fe8e16a5e63ead0 NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f59f8c9961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 127 to 10.6.0.86 port 1645 EAP-Message = 0x0107003119001403010001011603010020e49a8d4b1fd41d9c02ec41a3b101afe07da0b4e9635fde3e11cb6b0c9c979c07 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f5988d9961300b089b526f445b Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=128, length=154 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x020700061900 Message-Authenticator = 0x0db67edd1af97688be40d5c86c800a5e NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f5988d9961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 128 to 10.6.0.86 port 1645 EAP-Message = 0x0108002019001703010015a20163ee50d59c13086db8efb27fdb8847cd1ba680 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f599829961300b089b526f445b Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=129, length=196 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x020800301900170301002522a3717e23f4deab80a11045682aca6e40f14811082939e96a5afde4c52730cb4fc2263852 Message-Authenticator = 0xc32ec3ed44e0fd447b981ddffff6cf5c NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f599829961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 48 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - SPB.IMB.RU\trubnikov [peap] Got tunneled request EAP-Message = 0x02080019015350422e494d422e52555c747275626e696b6f76 server { PEAP: Got tunneled identity of SPB.IMB.RU\trubnikov PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to SPB.IMB.RU\trubnikov Sending tunneled request EAP-Message = 0x02080019015350422e494d422e52555c747275626e696b6f76 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "SPB.IMB.RU\\trubnikov" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 25 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x0109002e1a0109002910ecbf829566172500625bf7620a4f36795350422e494d422e52555c747275626e696b6f76 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x49749f5a497d85df4b8501b130a3e04c [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0109002e1a0109002910ecbf829566172500625bf7620a4f36795350422e494d422e52555c747275626e696b6f76 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x49749f5a497d85df4b8501b130a3e04c [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 129 to 10.6.0.86 port 1645 EAP-Message = 0x010900451900170301003ae178bf20a442a8ff436523b002959ace4150be491e8556ec798a439ef98a4b92c28e69dd1717e1e27fbe0081f057d5adc31304e15be33f58af79 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f59a839961300b089b526f445b Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=130, length=250 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x020900661900170301005b17cfadd420103a62807796ebc81cccc17ba868a0b32728ff8bd1be18aecfc4f8ee7032778a54581ecd13584dba8f36928343485c3718fbe3d96aba19ba1b9ece6a082e8a44ae4d9633e5ee1a2b24a4804836cfcc5f49c7456b9fd4 Message-Authenticator = 0x42701fb6beac1b74efafc2943d30f102 NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f59a839961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 102 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0209004f1a0209004a3183289583fd8f07645a9e0b401989b0aa00000000000000005b2390610fbbb0a33313369bf434352cf94105042703b5e0005350422e494d422e52555c747275626e696b6f76 server { PEAP: Setting User-Name to SPB.IMB.RU\trubnikov Sending tunneled request EAP-Message = 0x0209004f1a0209004a3183289583fd8f07645a9e0b401989b0aa00000000000000005b2390610fbbb0a33313369bf434352cf94105042703b5e0005350422e494d422e52555c747275626e696b6f76 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "SPB.IMB.RU\\trubnikov" State = 0x49749f5a497d85df4b8501b130a3e04c server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 79 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for trubnikov with NT-Password [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain=SPB.IMB.RU [mschap] expand: --username=%{mschap:User-Name} -> --username=trubnikov [mschap] mschap2: ec [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=9bb858a0208cb30a [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=5b2390610fbbb0a33313369bf434352cf94105042703b5e0 Exec-Program output: NT_KEY: E5E69707F927B4D612960B8BE48C7887 Exec-Program-Wait: plaintext: NT_KEY: E5E69707F927B4D612960B8BE48C7887 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a00331a0309002e533d45423936393838454632313731423530383032373337324435444239463534333937393336394337 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x49749f5a487e85df4b8501b130a3e04c [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00331a0309002e533d45423936393838454632313731423530383032373337324435444239463534333937393336394337 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x49749f5a487e85df4b8501b130a3e04c [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 130 to 10.6.0.86 port 1645 EAP-Message = 0x010a004a1900170301003f7201bd50ad95ad02eed7b8c10e950ce1d0858a8d2e64401635f1f270813682833ee111b5a1eb2db22fd25daf6a8fea82236d0ff920182b9e3325150deefeeb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f59b809961300b089b526f445b Finished request 7. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 123 with timestamp +51 Cleaning up request 1 ID 124 with timestamp +51 Cleaning up request 2 ID 125 with timestamp +51 Cleaning up request 3 ID 126 with timestamp +51 Cleaning up request 4 ID 127 with timestamp +51 Cleaning up request 5 ID 128 with timestamp +51 Cleaning up request 6 ID 129 with timestamp +51 Cleaning up request 7 ID 130 with timestamp +51 Ready to process requests.

5 8