- Freeradius-Users - lists.freeradius.org

Error in test Freeradius
by Paulo César Naves Mota 12 Jan '09

12 Jan '09

Hello people, I`d like to know how to resolve this problem in configuration: [root@serverRH5 raddb]# radtest pc1 123456 localhost 0 mysecret Sending Access-Request of id 169 to 127.0.0.1 port 1812 User-Name = "pc1" User-Password = "123456" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=169, length=20 My clients.conf client localhost { ipaddr = 127.0.0.1 secret = mysecret require_message_authenticator = no shortname = localhost nastype = other } Thanks for all Best Regards Paulo Cesar

6 8

freeradius proxying to Juniper Steel-Belted - returning trailing \000 in attributes
by Jørn Kostøl 12 Jan '09

12 Jan '09

I'm running freeradius v2.1.1 that proxies to a Juniper Steel-Belted Radius. (NAS->freeradius->Juniper). The authentication works and the reply is sent to my NAS, but the Juniper sends back trailing \000 in the return attributes which my NAS obviously is not too fond of. The debug shows: rad_recv: Access-Accept packet from host <stripped> port 1812, id=94, length=289 Class = 0x53425232434c978dc5a3c1f6cbdbd4c011802c01800281988002801081aa91aab5a2d5a6c5a9908ab5a1b99ccc12800e81978dc5a3c1f6cbdbd4c289e48c84 Proxy-State = 0x3838 Cisco-AVPair = "+=lcp:interface-config= ip unnumbered lo10\000" Cisco-AVPair = "+=ip:addr-pool=testpool\000" Cisco-AVPair = "+=lcp:interface-config= ip vrf forwarding testvrf\000" Cisco-AVPair = "+=ip:dns-servers=x.x.x.x y.y.y.y\000" I'm having a problem figuring out where the trailing \000 is coming from. Has anyone experienced similar behavior or have experience proxying from freeradius to Juniper? Cheers, Jørn

2 1

3gpp2 parameter starts with '\0'
by lamersons 12 Jan '09

12 Jan '09

(debug listed below) Freeradius 2.x with Postgre database I need to store ESN value to my database, but it comes in format[3GPP2-ESN = "\000\000\000\000\000\000\00000BBF636"]. Freeradius counts '\0' as the end of the line and puts blank instead of actual parameter value. Not only ESN comes in that format but [Acct-Session-Id = "0000000\000"] does too. Does any1 have any ideas about this ? Thank You, Michael Zotov --------------------------------------------------------------------------------------------- main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 8192 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client PDSN { ipaddr = 192.168.145.1 netmask = 32 require_message_authenticator = no secret = "pdsn-key" shortname = "" nastype = "other" } client ltk1 { ipaddr = 80.232.227.87 require_message_authenticator = no secret = "cdma" shortname = "" nastype = "other" } client ltk2 { ipaddr = 80.232.227.88 require_message_authenticator = no secret = "cdma" shortname = "" nastype = "other" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "" shortname = "localhost" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server ltk1 { ipaddr = 80.232.227.87 port = 1813 type = "acct" secret = "cdma" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server ltk2 { ipaddr = 80.232.227.88 port = 1813 type = "acct" secret = "cdma" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server_pool ltk { type = fail-over home_server = ltk1 home_server = ltk2 } realm evdo.lattelecom { acct_pool = ltk nostrip } realm cdma.ltk.lv { acct_pool = ltk nostrip } realm lattelecom { acct_pool = ltk nostrip } radiusd: #### Instantiating modules #### instantiate { } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "Calling-Station-Id, Acct-Session-Id, 3GPP2-Correlation-Id" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_postgresql" server = "localhost" port = "" login = "" password = "" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 48 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_reply_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress, esn) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%{Event-Timestamp}', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}', ' es es es est')" accounting_start_query_alt = "" accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%{Event-Timestamp}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', OutputPacket = '%{Acct-Output-Packets}', InputPacket = '%{Acct-Input-Packets}', AcctOutputOctets = '%{Acct-Output-Octets}', ReleaseIndicator = '%{Acct-Terminate-Cause}', CDMABadPPPFrameCount = '%{3GPP2-Bad-PPP-Frame-Count}', CDMACorrelationId = '%{3GPP2-Correlation-Id}', CDMAActiveTime = '%{3GPP2-Active-Time}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /\" } rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql): Attempting to connect to radacc@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #27 rlm_sql (sql): Connected new DB handle, #27 rlm_sql (sql): starting 28 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #28 rlm_sql (sql): Connected new DB handle, #28 rlm_sql (sql): starting 29 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #29 rlm_sql (sql): Connected new DB handle, #29 rlm_sql (sql): starting 30 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #30 rlm_sql (sql): Connected new DB handle, #30 rlm_sql (sql): starting 31 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #31 rlm_sql (sql): Connected new DB handle, #31 rlm_sql (sql): starting 32 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #32 rlm_sql (sql): Connected new DB handle, #32 rlm_sql (sql): starting 33 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #33 rlm_sql (sql): Connected new DB handle, #33 rlm_sql (sql): starting 34 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #34 rlm_sql (sql): Connected new DB handle, #34 rlm_sql (sql): starting 35 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #35 rlm_sql (sql): Connected new DB handle, #35 rlm_sql (sql): starting 36 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #36 rlm_sql (sql): Connected new DB handle, #36 rlm_sql (sql): starting 37 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #37 rlm_sql (sql): Connected new DB handle, #37 rlm_sql (sql): starting 38 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #38 rlm_sql (sql): Connected new DB handle, #38 rlm_sql (sql): starting 39 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #39 rlm_sql (sql): Connected new DB handle, #39 rlm_sql (sql): starting 40 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #40 rlm_sql (sql): Connected new DB handle, #40 rlm_sql (sql): starting 41 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #41 rlm_sql (sql): Connected new DB handle, #41 rlm_sql (sql): starting 42 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #42 rlm_sql (sql): Connected new DB handle, #42 rlm_sql (sql): starting 43 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #43 rlm_sql (sql): Connected new DB handle, #43 rlm_sql (sql): starting 44 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #44 rlm_sql (sql): Connected new DB handle, #44 rlm_sql (sql): starting 45 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #45 rlm_sql (sql): Connected new DB handle, #45 rlm_sql (sql): starting 46 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #46 rlm_sql (sql): Connected new DB handle, #46 rlm_sql (sql): starting 47 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #47 rlm_sql (sql): Connected new DB handle, #47 } } radiusd: #### Opening IP addresses and Ports #### listen { type = "acct" ipaddr = 192.168.104.5 port = 1813 } Listening on accounting address 192.168.104.5 port 1813 Listening on proxy address * port 1489 Ready to process requests. Acct-Status-Type = Start User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823967" Framed-IP-Address = 192.168.173.4 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jan 9 2009 10:58:30 EET" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\00000BBF636" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "35067449" 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "35067449",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823967"' rlm_acct_unique: Acct-Unique-Session-ID = "44d6e7436e38e449". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress, esn) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%{Event-Timestamp}', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}','%{3GPP2-ESN}') -> INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress, esn) values('0000000', '44d6e7436e38e449', '247033715823967', 'Jan 9 2009 10:58:30 EET', NULL,'0', '0', '0', '192.168.173.4', trim('triatel(a)triatel.lv'), '0', '0', '35067449', '0', '192.168.145.1', '') rlm_sql (sql): Reserving sql socket id: 47 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 47 ++[sql] returns ok -------------------------------------------------------------------------------------------------- -- View this message in context: http://www.nabble.com/3gpp2-parameter-starts-with-%27%5C0%27-tp21409780p214… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 8

Re: Authentication Problem with PEAP and openldap
by Michael Poser 12 Jan '09

12 Jan '09

Hello Alan, thank you for your reply. The mapping of the NT-Password describe exactly our problem. We cannot find the right passage in the radius config to do this. Maybe you can give as a little hint, this would be very kindly. Best Regards, Michael > native wired xp 802.1X client with PEAP (mschapv2) tries to authenticate via > freeradius against openldap with an md4 encoded utf-16e password hash. The > authentication fails. If we use the hash instead of the clear-text password > with the xp client, the authentication works fine. There must be some > problems with the encryption of the password. How do we fix the problem? Any > help is appreciated. You may have the NT hash of the password in the LDAP database, but you're telling FreeRADIUS it's the clear-text password: ... > rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter > (uid=plisch01) > rlm_ldap: Added password 4183... in check items You want to map this to the NT-Password attribute. Alan DeKok. -- Michael Poser, HRZ - Abteilung Netze Tel.:069/798-28052

3 2

Disconnect packet
by Johan Meiring 12 Jan '09

12 Jan '09

Hi, This might be slightly off topic, but hoping I could get a pointer here. I am trying to use an openvpn talking to radius. I want the openvpn server to be able to receive a COA/DISCONNECT packet. The first idea I came up with was to try and get freeradius to receive the packet, then using rlm_perl do whatever I want after examining the packet. I realize that freeradius is not designed to do this, but I was hoping either the atuhentication of accounting module could give the packet to my own perl script to then "parse" and act upon. 1) Can anyone think of a way how freeradius might receive the packet for me and then pass it to perl for me to act on? or 2) Is anyone aware of other software that might listen on the coa port 1700/3799, receive a packet, parse it somehow and call my script to "disconnect" the client. i.e. a "disconnect server". as per http://wiki.freeradius.org/DM Thanks! -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

3 8

Creation of User Accounts and Certificates
by mihir patankar 12 Jan '09

12 Jan '09

Hi, We want to know how to create EAP-TTLS User Accounts and Accounts specific Certificates in Free-Radius. As of now we have only created PAP Accounts. Mihir V Patankar

4 9

Re: Freeradius-Users Digest, Vol 45, Issue 31
by Hanno Schupp 12 Jan '09

12 Jan '09

> > > Dear All, > > > > > > > > I have a few questions regarding the rlm_sqlcounter module and its > > configuration. I have a freeradius 2.1.0 communicating with a router > running > > chillispot 1.1 I set up counters for time, data volume, and with > different > > reset periods. All works fine and as expected. > > > > > > > > Here my questions: > > > > > > > > 1) After the time or data volume for a period (say a month) is > reached > > the user is automatically disconnected – as expected. Rather them not > > allowing to log in , I would like freeradius to return some other > attributes > > (WISPr-Bandwidth-Max-Up and WISPr-Bandwidth-Max-Down work fine with > > ChilliSpot) to be sent to the router for the user, so that a connection > is > > still possible, but at a much lower maximum speed. Can that be done, and > if > > so, can someone give me a pointer. I was thinking maybe using unlang, but > I > > may be barking up the wrong tree. > > > > You might be better off making changes to your provisioning system > assuming you are using a database backend although > you might be able to get away with unlang. I know 'I might be able to get away with unlang'. I was hoping for a useful pointer as to how. I have followed this up further and have a new roadblock. I have put this code into my 'authorize' section: ... monthlytotal if (reject) { update control { Auth-Type := "Accept" } update reply { WISPr-Bandwidth-Max-Down := 256000 WISPr-Bandwidth-Max-Up := 32000 } } monthlyupload monthlydownload logintime ... Module monthlytotal is behaving as expected (definition below), throwing a reject, when the so far in the month used Octets exceed the set limit for the user. However, what appears to happen when looking through the debug (below), freeradius appears to stop processing any further modules in the authorise section. Is that what is expected? If so, can this behaviour be changed through configuration, or does this require a whole new module? ... sqlcounter monthlytotal { counter-name = Max-Monthly-Total-Octets check-name = Max-Monthly-Total reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql02 key = User-Name reset = monthly query = "SELECT IFNULL(SUM(AcctInputOctets - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0))+ SUM(AcctOutputOctets -GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } ... ... Mon Jan 12 11:49:28 2009 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Mon Jan 12 11:49:28 2009 : Debug: rlm_sqlcounter: Rejected user yubvef24, check_item=500000, counter=535178 Mon Jan 12 11:49:28 2009 : Info: ++[monthlytotal] returns reject Mon Jan 12 11:49:28 2009 : Info: Using Post-Auth-Type Reject Mon Jan 12 11:49:28 2009 : Info: +- entering group REJECT {...} Mon Jan 12 11:49:28 2009 : Debug: expand: %{User-Name} -> yubvef24 Mon Jan 12 11:49:28 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Jan 12 11:49:28 2009 : Info: ++[attr_filter.access_reject] returns updated Mon Jan 12 11:49:28 2009 : Info: Delaying reject of request 0 for 1 seconds ... > > > > > > > > 2) The reset = monthly method seem to the first of the current > > month. That is one way of doing it, but I would like the reset to occur > at > > the same date in the month every month. So if someone signs up, say on > the > > 12th of a month, the reset will occur every month on the 12th. Can that > be > > done with freeradius? > > > > > > rlm_sqlcounter only support calendar month or day or week. I am surprised to hear that, as this seems to be the standard way any ISP I came accross in this part of the world seems to define a 'month', including large internationals. If the final answer remains 'no, this cannot be done', who do I need to contact to discuss sponsoring the development of such a new feature within the module? > > > > > > 3) Currently I receive something like Reply-Message = "Your > maximum > > never usage time has been reached" when the counter reaches its limit – > > even when what was counted as not time but data volume. Can Reply-Message > > for sqlcounter be configured as in the expiration module? > > > > > > rlm_sqlcounter does not have provision for cusom reply messages. There > was a patch floating around to send custom reply messages from > rlm_sqlcounter. Probably you should look in mailing list archives. > I have done that, thanks. Neither search for 'rlm_sqlcounter' nor 'Reply-Message' yielded anything useful. > > > > > 4) One surprise I have had: I don't quite understand how the system > > calculates the day for the beginning of the reset = weekly. I appreciate > > that calculating the day of the week is not easy as for example first of > the > > current month or beginning of the day, so I was not surprised to not have > a > > Monday, but I was surprised to see the SQL query run with 'Fri Jan 09 > 2009 > > 00:00:00 GMT+1300 (New Zealand Daylight Time)' as beginning of the week, > > when running the query on a Saturday. BTW, SQL time is configured > correctly, > > and the UNIX_TIMESTAMP is giving a correct timestamp for local time. What > am > > I missing? > > (Note: When setting reset = 7d, I get something more explainable like > 'Sat > > Jan 10 2009 00:00:00 GMT+1300 (New Zealand Daylight Time)', which is the > > beginning of the today's day. Should reset = weekly and reset =7d yield > the > > same result? If not, what is weekly vs 7d, and why does the week not > start > > on a Monday? > > > Interesting running it today, Monday, 12 January 2009 12:26:36 p.m. NZSTD, I get Tuesday, 6 January 2009 12:00:00 a.m. NZSTD as beginning of the time weekly period the system is checking. Can someone explain that logic? ---------- Forwarded message ---------- From: Eric <bbahar3(a)gmail.com> To: freeradius-users(a)lists.freeradius.org Date: Sun, 11 Jan 2009 08:26:41 +0330 Subject: Re:freeradius doesn't sent information to mysql I had sent an instance of accounting request from my vpn server to radius server. you send me that I haven't got anything configured in the accounting section. do you mean that vpn server frame is correct but accounting section in radius server doesn't work? >rad_recv: Accounting-Request packet from host 10.10.10.3:11858, id=133, >length=260 > Acct-Status-Type = Start > Acct-Delay-Time = 0 > NAS-IP-Address = 10.10.10.3 > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 4 > MS-RAS-Vendor = 311 > MS-RAS-Version = "MSRASV5.20" > NAS-Port-Type = Virtual > Tunnel-Type:0 = PPTP > Tunnel-Medium-Type:0 = IP > Calling-Station-Id = "192.168.201.59" > Tunnel-Client-Endpoint:0 = "192.168.201.59" > Microsoft-Attr-35 = 0x4d5352415356352e3130 > Microsoft-Attr-34 = 0x4d535241532d302d312d34304432 > 454332364243374334 > > Acct-Session-Id = "118382" > > User-Name = "school" > > Framed-IP-Address = 10.10.10.4 > > Framed-MTU = 1400 > > Session-Timeout = 389554 > > Idle-Timeout = 1200 > > Acct-Multi-Session-Id = "953" > > Acct-Link-Count = 1 > > Event-Timestamp = "Dec 31 2008 15:45:03 IRST" > > Acct-Authentic = RADIUS > > MS-MPPE-Encryption-Types = 0x00000000 > >Sending Accounting-Response of id 133 to 10.10.10.3 port 11858 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

2 2

SQLCounter configuration
by Hanno Schupp 11 Jan '09

11 Jan '09

Dear All, I have a few questions regarding the rlm_sqlcounter module and its configuration. I have a freeradius 2.1.0 communicating with a router running chillispot 1.1 I set up counters for time, data volume, and with different reset periods. All works fine and as expected. Here my questions: 1) After the time or data volume for a period (say a month) is reached the user is automatically disconnected - as expected. Rather them not allowing to log in , I would like freeradius to return some other attributes (WISPr-Bandwidth-Max-Up and WISPr-Bandwidth-Max-Down work fine with ChilliSpot) to be sent to the router for the user, so that a connection is still possible, but at a much lower maximum speed. Can that be done, and if so, can someone give me a pointer. I was thinking maybe using unlang, but I may be barking up the wrong tree. 2) The reset = monthly method seem to the first of the current month. That is one way of doing it, but I would like the reset to occur at the same date in the month every month. So if someone signs up, say on the 12th of a month, the reset will occur every month on the 12th. Can that be done with freeradius? 3) Currently I receive something like Reply-Message = "Your maximum never usage time has been reached" when the counter reaches its limit - even when what was counted as not time but data volume. Can Reply-Message for sqlcounter be configured as in the expiration module? 4) One surprise I have had: I don't quite understand how the system calculates the day for the beginning of the reset = weekly. I appreciate that calculating the day of the week is not easy as for example first of the current month or beginning of the day, so I was not surprised to not have a Monday, but I was surprised to see the SQL query run with 'Fri Jan 09 2009 00:00:00 GMT+1300 (New Zealand Daylight Time)' as beginning of the week, when running the query on a Saturday. BTW, SQL time is configured correctly, and the UNIX_TIMESTAMP is giving a correct timestamp for local time. What am I missing? (Note: When setting reset = 7d, I get something more explainable like 'Sat Jan 10 2009 00:00:00 GMT+1300 (New Zealand Daylight Time)', which is the beginning of the today's day. Should reset = weekly and reset =7d yield the same result? If not, what is weekly vs 7d, and why does the week not start on a Monday? Any hints welcome

3 2

Using checkval for Call Routing with Sippy B2BUA
by Tobias Wolf 11 Jan '09

11 Jan '09

Hello, i am using FreeRadius 1.1.3 and want to use it for Call Routing. The Sippy B2BUA will send AAA Requests to RADIUS and i want the routing based on the Called-Station-Id Attribute. For the beginning i would like to configure the routes in the users-File and later switch to an sql backend. This is my users-File: b2b Called-Station-Id == 555,Called-Station-Id == 557,Auth-Type := Accept h323-ivr-in = 'Routing:12345@192.168.1.1;expires=30;Codecs:alaw,g.726' b2b Called-Station-Id == 556,Called-Station-Id == 558,Auth-Type := Accept h323-ivr-in = 'Routing:12345@192.168.1.2;expires=30;Codecs:alaw,g.726' The Calls will always come from the same user and the called number will have to decide what SIP Server to use. If i have only one Called-Station-Id in the check pairs line, i get the Access-Accept with the reply data. But since one route can have a lot of numbers i need to be able to have several Called-Station-Id Entrys. From the description of the checkval attribute it appeared to me the correct solution. Apart from this the different number ranges are conncected to different end users, which i have to find. This will be an accounting issue. How can this be solved with Freeradius ? The real user is not known when the INVITE reaches Sippy. Sippy sends the request to Freeradius with a lot of information, from which Called-Station-Id will indicate what SIP Server to use and what End User is associated with the call. Just want to clarify the whole procedure: I have several incoming SIP Servers, which sends SIP calls to Sippy. Each SIP Server will control a certain number range and will send its servername as Username. The SIP Server have no infomation about which number belongs to which end user, they forward all calls to Sippy. The Radius Server will have the information what numbers are associated with a certain end user and to which sip server a call have to be sent. The Authorize Request from Sippy should confirm wether the destination number is valid (is configured for an end user) and replys with the correct sip server to use and with a special codec list for the call. If the number is not configured, a Access-Reject is send and the call is aborted. I hope i made myself clear ;) Kind regards, -- Tobias Wolf

4 7

Authentication Problem with PEAP and openldap
by Michael Poser 11 Jan '09

11 Jan '09

Hello, native wired xp 802.1X client with PEAP (mschapv2) tries to authenticate via freeradius against openldap with an md4 encoded utf-16e password hash. The authentication fails. If we use the hash instead of the clear-text password with the xp client, the authentication works fine. There must be some problems with the encryption of the password. How do we fix the problem? Any help is appreciated. Here are the radiusd.conf file and the debug output aof radiusd -X: Best Regards, Michael <radiusd.conf> prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes } ldap { server = "ldaps://XXXXXXXXXX.XX" identity = "uid=XXX,o=XXX,dc=XXX,dc=de" password = XXXXXXX basedn = "ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no tls_cacertfile = /etc/openldap/cacerts/ca-bundle.crt dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailfile = ${radacctdir}/sammeldir/detail detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap files ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } </radiusd.conf> <radiusd -X> rad_recv: Access-Request packet from host 141.2.252.203:62849, id=206, length=86 User-Name = "plisch01" EAP-Message = 0x0200000d01706c697363683031 Message-Authenticator = 0xf0812bbe8b0e990ff9c6206d353405de NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldaps://XXX.XE, authentication 0 rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/ca-bundle.crt rlm_ldap: bind as uid=XXX,o=XXX,dc=XXX,dc=de/XXXX to ldaps://XXX rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 206 to 141.2.252.203:62849 EAP-Message = 0x010100160410c412f76e7e655747b06f3e294c7fed9a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbda20678cb572e52f1a93c3ce8de3099 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=229, length=97 User-Name = "plisch01" State = 0xbda20678cb572e52f1a93c3ce8de3099 EAP-Message = 0x020100060319 Message-Authenticator = 0xa2b38e829929b3245f489b88fef80135 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "files" returns notfound for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183..... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 229 to 141.2.252.203:62849 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x48a99a491f1506a34ab971b65e1e9eed Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=131, length=171 User-Name = "plisch01" State = 0x48a99a491f1506a34ab971b65e1e9eed EAP-Message = 0x0202005019800000004616030100410100003d0301496755f6f21ae795ee2b9dbe7e24064c e03e31795d9a4a18607059f3614c6afe00001600040005000a00090064006200030006001300 1200630100 Message-Authenticator = 0x99aced399bcbe6e1af0c51ee3c8f01d1 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall[authorize]: module "files" returns notfound for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 131 to 141.2.252.203:62849 EAP-Message = 0x0103040a19c0000006f1160301004a020000460301496755f3badec494486cf4bae34461c0 6b0505d69a956ae2d5a803f146feb962202cb7719a8ffcc825336c500975192cfb8a5e653a69 77d938ccde5707711b5eaa00040016030106940b00069000068d0002cd308202c930820232a0 03020102020102300d06092a864886f70d010104050030819f310b3009060355040613024341 3111300f0603550408130850726f76696e63653112301006035504071309536f6d6520436974 7931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63 616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d 706c652e636f6d301e170d3034303132353133323631305a170d303530313234313332363130 5a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112 301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174 696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74 206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d 706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a78 2098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014 a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f8 1ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603 551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d 921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd70845370834 96fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f 295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003 020102020100300d06092a864886f70d010104050030819f310b300906035504061302434131 11300f0603550408130850726f76696e63653112301006035504071309536f6d652043697479 31153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f6361 6c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f 06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4d941206f16d48604e5278275172f5d9 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=12, length=97 User-Name = "plisch01" State = 0x4d941206f16d48604e5278275172f5d9 EAP-Message = 0x020300061900 Message-Authenticator = 0x36256183de48f93989f06e14bc11f188 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 modcall[authorize]: module "files" returns notfound for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 12 to 141.2.252.203:62849 EAP-Message = 0x010402f71900170d3036303132343133323630375a30819f310b3009060355040613024341 3111300f0603550408130850726f76696e63653112301006035504071309536f6d6520436974 7931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63 616c686f7374311b301906035504031312436c69656e74206365727469666963617465312130 1f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06 092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8f bff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249e dd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229 963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e 1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7 bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111 300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931 153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e7420636572 74696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c 652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d010104050003 81810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc27 43fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00 163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d437 3354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x39f344cd69a2f35503a380fcc8ea4a83 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=45, length=283 User-Name = "plisch01" State = 0x39f344cd69a2f35503a380fcc8ea4a83 EAP-Message = 0x020400c01980000000b616030100861000008200805cf4ad6f145c089dc932b32a4c8c29f6 6f8ba762b19ca5e49d7fdcc56064623b8de51dc9f8eb186709c4c529f4c35dffc2c4d0868331 97659aea363231b79ef93008c66bc525ee5f83937f4a581566f4af250c15e7b9b4a931b04630 a359e665ac4f9497f9a60527d49ce0428e6b8005e2e2c44ce6617f35bf73370396429b641403 0100010116030100204729c2b650ffc91ec681e46eefe199e7405708a6fa89699d1e5d729b37 323e02 Message-Authenticator = 0xe4a3fc40c382c15a35606865a372fc0c NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall[authorize]: module "files" returns notfound for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 45 to 141.2.252.203:62849 EAP-Message = 0x01050031190014030100010116030100204b6baa9082446a5e5d949733bcd61cd97e71147f 4b7b0ede2fdf227003f80d63 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x283e48785e8097412f97fd724e4a6e25 Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=57, length=97 User-Name = "plisch01" State = 0x283e48785e8097412f97fd724e4a6e25 EAP-Message = 0x020500061900 Message-Authenticator = 0x322cc75005e5f7d756741b6b9db14083 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall[authorize]: module "files" returns notfound for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 57 to 141.2.252.203:62849 EAP-Message = 0x010600201900170301001515b983ce613f1d101b1b0c3e9f632bc2bdd92bf0ef Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3ee625007e53c68d653aa899c99579c1 Finished request 5 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=147, length=127 User-Name = "plisch01" State = 0x3ee625007e53c68d653aa899c99579c1 EAP-Message = 0x020600241900170301001920ce664e444ad38f8d09783ae8c77e4e6891969c2973856cff Message-Authenticator = 0xe7234912513e897b42b52724e518927e NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 36 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall[authorize]: module "files" returns notfound for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - plisch01 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0206000d01706c697363683031 PEAP: Got tunneled identity of plisch01 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to plisch01 PEAP: Sending tunneled request EAP-Message = 0x0206000d01706c697363683031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "plisch01" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched DEFAULT at 244 radius_xlat: 'plisch01' modcall[authorize]: module "files" returns ok for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 PEAP: Got tunneled reply RADIUS code 11 User-Name = "plisch01" EAP-Message = 0x010700221a0107001d105fe75feb133da90be571a2ab66b56b41706c697363683031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5d10815c41541ad37a91292eea4550b6 PEAP: Processing from tunneled session code 0x90f6918 11 User-Name = "plisch01" EAP-Message = 0x010700221a0107001d105fe75feb133da90be571a2ab66b56b41706c697363683031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5d10815c41541ad37a91292eea4550b6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 147 to 141.2.252.203:62849 EAP-Message = 0x010700391900170301002ec95e5e434f311c9c7cbd1b8eeea7bd19d9078f4cffcfd930a088 ad9a6318e723477696e13974f1fc1101894571e4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf75459f95978ea5dee485ccbf6b9ad9a Finished request 6 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=70, length=181 User-Name = "plisch01" State = 0xf75459f95978ea5dee485ccbf6b9ad9a EAP-Message = 0x0207005a1900170301004f491c7ee6409ec5ae6769e0c33d4f7062f03a24ef9c951fc1b00b 7204a7e10e2cc5d9a1ff9c3b8f6dbb71d8f4b3d69bf7a710d6019376d6a370b59671d11de1cb 9cf688c434a68ad7d5281e6cfd8d46 Message-Authenticator = 0x0a9cf79ba8ea337330e56aa8b0785547 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 90 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall[authorize]: module "files" returns notfound for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=raduser,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020700431a0207003e3168e3bcd95cb641bff66d420b10b07cd80000000000000000307384 bc22ffe588803cf80f47635e7c4d43fe726c920d6700706c697363683031 PEAP: Setting User-Name to plisch01 PEAP: Adding old state with 5d 10 PEAP: Sending tunneled request EAP-Message = 0x020700431a0207003e3168e3bcd95cb641bff66d420b10b07cd80000000000000000307384 bc22ffe588803cf80f47635e7c4d43fe726c920d6700706c697363683031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "plisch01" State = 0x5d10815c41541ad37a91292eea4550b6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 67 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched DEFAULT at 244 radius_xlat: 'plisch01' modcall[authorize]: module "files" returns ok for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 7 rlm_mschap: Told to do MS-CHAPv2 for plisch01 with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: group Auth-Type returns reject for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. Login incorrect: [plisch01] (from client localhost port 0) PEAP: Got tunneled reply RADIUS code 3 User-Name = "plisch01" MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x90f60d0 3 User-Name = "plisch01" MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 70 to 141.2.252.203:62849 EAP-Message = 0x010800261900170301001b1aaec581089b9d3dbc54fb36761fbe248d25e2663ca7476b4971 b5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0826aec91672e96341cd1b93cca166c5 Finished request 7 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=1, length=129 User-Name = "plisch01" State = 0x0826aec91672e96341cd1b93cca166c5 EAP-Message = 0x020800261900170301001bc8df9767d6720bbf4aa9ba81c8c6749d20979bf65f4d20e3a862 59 Message-Authenticator = 0x78b71176e4eccdb35ecb960b32ec0a0a NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 modcall[authorize]: module "files" returns notfound for request 8 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: group authenticate returns invalid for request 8 auth: Failed to validate the user. Login incorrect: [plisch01] (from client Juniper-EX port 0) Delaying request 8 for 1 seconds Finished request 8 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=1, length=129 Sending Access-Reject of id 1 to 141.2.252.203:62849 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 12 with timestamp 496755f3 Cleaning up request 2 ID 131 with timestamp 496755f3 Cleaning up request 0 ID 206 with timestamp 496755f3 Cleaning up request 1 ID 229 with timestamp 496755f3 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 8 ID 1 with timestamp 496755f4 Cleaning up request 4 ID 45 with timestamp 496755f4 Cleaning up request 5 ID 57 with timestamp 496755f4 Cleaning up request 7 ID 70 with timestamp 496755f4 Cleaning up request 6 ID 147 with timestamp 496755f4 Nothing to do. Sleeping until we see a request. </radiusd -X>

3 2