- Freeradius-Users - lists.freeradius.org

Re:freeradius doesn't sent information to mysql
by Eric 11 Jan '09

11 Jan '09

I had sent an instance of accounting request from my vpn server to radius server. you send me that I haven't got anything configured in the accounting section. do you mean that vpn server frame is correct but accounting section in radius server doesn't work? >rad_recv: Accounting-Request packet from host 10.10.10.3:11858, id=133, >length=260 > Acct-Status-Type = Start > Acct-Delay-Time = 0 > NAS-IP-Address = 10.10.10.3 > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 4 > MS-RAS-Vendor = 311 > MS-RAS-Version = "MSRASV5.20" > NAS-Port-Type = Virtual > Tunnel-Type:0 = PPTP > Tunnel-Medium-Type:0 = IP > Calling-Station-Id = "192.168.201.59" > Tunnel-Client-Endpoint:0 = "192.168.201.59" > Microsoft-Attr-35 = 0x4d5352415356352e3130 > Microsoft-Attr-34 = 0x4d535241532d302d312d34304432 454332364243374334 > Acct-Session-Id = "118382" > User-Name = "school" > Framed-IP-Address = 10.10.10.4 > Framed-MTU = 1400 > Session-Timeout = 389554 > Idle-Timeout = 1200 > Acct-Multi-Session-Id = "953" > Acct-Link-Count = 1 > Event-Timestamp = "Dec 31 2008 15:45:03 IRST" > Acct-Authentic = RADIUS > MS-MPPE-Encryption-Types = 0x00000000 >Sending Accounting-Response of id 133 to 10.10.10.3 port 11858

2 1

Regular expressions on module 'files' (possible bug?)
by Flamur Rogova 10 Jan '09

10 Jan '09

Hi, On 'users' file I have this entry; b2 User-Password := "b2", Calling-Station-ID =~ "(00:10:B5:7A:13:BD)", Expiration := "28 Feb 2009 23:00:00" this entry should match only if Calling-Station-Id equals to "00:10:B5:7A:13:BD". on my case, it matches always, no matter what I send as Calling-Station-ID. if I dont set Calling-Station-Id on access request, then 'files' module returns with noop, which is correct. this is a snippet of debug output, rad_recv: Access-Request packet from host 10.241.21.202 port 1538, id=67, length=68 User-Name = "b2" User-Password = "b2" NAS-Port = 212 NAS-IP-Address = 192.168.10.113 Calling-Station-Id = "asdfasdfadsf" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "b2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] expand: %{Calling-Station-Id} -> asdfasdfadsf [files] users: Matched entry b2 at line 1 ++[files] returns ok [expiration] Checking Expiration time: '28 Feb 2009 23:00:00' ++[expiration] returns ok ++[logintime] returns noop I am testing this on latest version taken from git repositories, but I tried it also on older versions down to 2.1.1, they behave the same. on version 2.0.5 I get correct behavior. Thanks,

2 1

Error in SQL statement expansion? And how to correct it?
by Hanno Schupp 09 Jan '09

09 Jan '09

Dear All, I found the following in my freeradius 2.1.0 debug on Ubuntu 8.10 for my simultaneous use check: ... Sat Jan 10 10:21:47 2009 : Debug: expand: SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL AND callingstationid <> '{%Calling-Station-Id}' -> SELECT COUNT(*) FROM radacct WHERE username = 'yubvef23' AND acctstoptime IS NULL AND callingstationid <> '{anyonealling-Station-Id}' ... It appears that after expansion of {%Calling-Station-Id} the looked for value is {anyonealling-Station-Id}. The {} suggest this si a value that should have been expanded/replaced further. The spelling - {anyonealling-Station-Id} as opposed to {anyonecalling-Station-Id} as one might expect - suggested the expansion/replacement fails due to a syntax error. I have looked in the sql.conf and includes where the SQL statements are defined. The SQL statement looks OK but I cannot find any definition of or reference to {anyonealling-Station-Id}. I would like to confirm firstly that this is indeed a syntax error and secondly, where the value of {anyonealling-Station-Id} may be defined, so I can fix this. Thanks

3 2

RE: Authentication Problem with PEAP and openldap
by Michael Poser 09 Jan '09

09 Jan '09

Hello Thiabault, >> native wired xp 802.1X client with PEAP (mschapv2) tries to authenticate >> via freeradius against openldap with an md4 encoded utf-16e password hash. > This is just not possible. > PEAP (mschapv2) requires you can read the user password either as a > cleartext password or as a NTLM-hashed password in your DB. it was a bit ambiguous. The term "md4 encoded utf-16e password hash" should express, that it is an NTLM Hash. Sorry for the confusion. Best Regards, Michael

2 1

server selection
by Norbert Wegener 09 Jan '09

09 Jan '09

freeradius 2.1.1, configured to use multiple virtual servers, seems to select the server to use depending on the host sending the request, not depending on the NAS-IP-Address in the request. When using radtest I get: norbert@suse:~$ radtest 000000000002 000000000002 psucoll 0 secret dummy 1.1.1.1 Sending Access-Request of id 227 to 123.25.153.210 port 1812 User-Name = "000000000002" User-Password = "000000000002" NAS-IP-Address = 1.1.1.1 NAS-Port = 0 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 123.25.153.210 port 1812, id=227, length=20 while radiusd -X shows ..... Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 149.246.185.169 port 54115, id=244, length=70 User-Name = "000000000001" User-Password = "000000000001" NAS-IP-Address = 1.1.1.1 NAS-Port = 0 Framed-Protocol = PPP server enterasys { .... 1.1.1.1 is a nas belonging to the server cisco, 149.246.185.169 belongs to the server enterasys. I would have expected, the server is choosen because of the NAS-IP-Address. Thanks Norbert Wegener

3 6

freeradius not start after upgrade from 1.1.7 to 2.1.0
by Fabio 09 Jan '09

09 Jan '09

Hi all, i'm new on this ML. I've problem after upgrading from v1 to v2 ---------- # /etc/init.d/freeradius start * Starting FreeRADIUS daemon freeradius radiusd: Error: No log destination specified. ---------- In radiusd.conf the parameter of log are right with all permess: ---------- prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log ---------- I've search on the ML archive and i've found another thread with this problem but seems different. In my case freeradius not start with -X option and exit with error ---------- # freeradius -X ... ... ... Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } /etc/freeradius/radiusd.conf[1860]: Entry is not a reference to a module /etc/freeradius/radiusd.conf[1789]: Errors parsing authorize section. ---------- The two line in radiusd.conf: ---------- ... 1787 # Make *sure* that 'preprocess' comes before any realm if you 1788 # need to setup hints for the remote radius server 1789 authorize { ... 1856 # Look in an SQL database. The schema of the database 1857 # is meant to mirror the "users" file. 1858 # 1859 # See "Authorization Queries" in sql.conf 1860 sql # Edited ... ---------- Any ideas? Thanks

2 1

EAP-TLS without client authentication
by Christopher Byrd 09 Jan '09

09 Jan '09

This may sound like a strange request, but I'd like to know if it is possible to use FreeRADIUS to perform EAP-TLS without asking for a client certificate. The purpose is to allow for a secure connection to an access point without client authentication. I think this might be useful to replace "open wireless" for public wireless access with something more secure. According to the EAP-TLS RFC (rfc2716), it sounds like it might be possible: "The certificate_request message is included when the server desires the client to authenticate itself via public key. While the EAP server SHOULD require client authentication, this is not a requirement, since it may be possible that the server will require that the peer authenticate via some other means." I tried this with FreeRADIUS and eapol_test (from wpa_supplicant) with the following result: [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. The only change I've made from the default eap.conf is to try disabling the CA_file setting (I've tried it both ways). Does it sound like this is something that should be possible, or am I off base? Thanks! Christopher

4 5

Freeradius and Cisco ASA => Accounting and IP Static
by Phibee Network Operation Center 08 Jan '09

08 Jan '09

Hi I use FreeRadius for authenticate my IPSEC VPN User on a Cisco ASA. I search to know if it's possible: - Get Accounting for know: Login connection Start Login stop and time connected and if possible the number of Ko used - Use FreeRadius for IP Pool: Actually, it's the Asa that attribute IP Adresse with a IP Pool Do you know if it's possible that it's Freeradius sent the IP Adresse for use IP Static based on the login ? I Use a Perl Script in auth Thanks jerome

2 1

Some help with etc_smbpasswd auth and eap ttls
by Josh Hiner 08 Jan '09

08 Jan '09

Trying to configure eap ttls with mschapv2 using Freeradius version Version 1.1.3 in Redhat enterprise Linux 5. I have configured everything and gotten free radius to authenticate off /etc/samba/smbpasswd via the etc_smbpasswd module. The problem I have run into is when I switch the securew2 windows xp eap-ttls client to use the current logged on user credentials. Then, SecureW2 sends the username in the format of DOMAIN/user (which in this case is HTN/josh). Authentication then fails because of this extra domain part in the user. Ok fine, I first enable the nt_domain_hack in the mschap module then I configured realm ntdomain and simply set a default realm in proxy.conf to strip off the domain part. Nope, that fails (output will be included below). I also tried nostrip but that also fails obviously. Also tried silently stripping the domain in pre-process in radiusd.conf. Auth is successful but finally rejected because the user doesnt match the original HTN/josh user sent. Finally I simply added the username and password I was testing to the users file. It works there. My default realm strips the domain, proxies it back to localhost, authenticates of the users file and is successful. Arrg what Im I doing wrong. I really need to use the etc_smbpasswd module as I cant get ntlm_auth to work. It says no logon servers found. I think its because I am running it on the actual samba server I want to auth off of. Anyways, anyone know of how to get etc_smbpasswd module to work. I dont want to use the users file (blech) even though it does work when I put the user in there, and again, if I just supply the username and password (and leave the domain part blank in SecureW2 ttls client) authentication does work of /etc/samba/smbpasswd. Here is the /usr/sbin/radiusd -X output. Sorry its long. Below that I will put the relevant lines of config. Thanks a ton for any help. -Josh [root@file raddb]# /usr/sbin/radiusd -s -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server_key.pem" tls: certificate_file = "/etc/raddb/certs/server_cert.pem" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "serverH08ght0n23kip" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = yes Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = yes Module: Instantiated realm (ntdomain) Module: Loaded passwd passwd: filename = "/etc/samba/smbpasswd" passwd: format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" passwd: authtype = "MS-CHAP" passwd: delimiter = ":" passwd: ignorenislike = no passwd: ignoreempty = yes passwd: allowmultiplekeys = no passwd: hashsize = 100 rlm_passwd: nfields: 7 keyfield 0(User-Name) listable: no Module: Instantiated passwd (etc_smbpasswd) passwd: filename = "/etc/group" passwd: format = "=Group-Name:::*,User-Name" passwd: authtype = "(null)" passwd: delimiter = ":" passwd: ignorenislike = yes passwd: ignoreempty = yes passwd: allowmultiplekeys = yes passwd: hashsize = 50 rlm_passwd: nfields: 4 keyfield 3(User-Name) listable: yes Module: Instantiated passwd (etc_group) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.100.13.12:19527, id=104, length=202 User-Name = "HTN\\josh" Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff" Calling-Station-Id = "00-0E-35-B6-74-AF" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.100.13.12 NAS-Identifier = "Houghton Wireless Services" NAS-Port-Id = "HTNStaff" Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201000d0148544e5c6a6f7368 Message-Authenticator = 0xdf195f238143503d49244d6203620b10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 0 modcall[authorize]: module "etc_group" returns notfound for request 0 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 104 to 10.100.13.12 port 19527 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x61bf2476da0a8dbee700d7b52748377c Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.100.13.12:19527, id=105, length=263 User-Name = "HTN\\josh" Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff" Calling-Station-Id = "00-0E-35-B6-74-AF" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.100.13.12 NAS-Identifier = "Houghton Wireless Services" NAS-Port-Id = "HTNStaff" Connect-Info = "CONNECT 54Mbps 802.11g" State = 0x61bf2476da0a8dbee700d7b52748377c EAP-Message = 0x020200381500160301002d010000290301e9a07acc81410bcdf08077330d07ad8f018e56a6641624ec64a66da3f79bd121000002000a0100 Message-Authenticator = 0x0334fb063e9a6d53bd8682ba37d0620e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 56 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 1 modcall[authorize]: module "etc_group" returns notfound for request 1 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 002d], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 03d2], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 105 to 10.100.13.12 port 19527 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103040a15c00000042f160301004a02000046030149642f7ba9e448ca30ab30a9b6ed817c8aff8c408e4023e6940c762c1f36a6de20e1a7c54190eaf152b7593b2b138e0c050f4d101a4e1791b3f21981bd0acbe EAP-Message = 0x092a864886f70d010901161972656d637374616666406c697374732e72656d63312e6e6574301e170d3038313231353230323332365a170d3138313231333230323332365a308198310b300906035504061302555 EAP-Message = 0x82010100a721638f80275c7d8c29f90e3669da66da29a4dcb0e6d18b17c9349bd6eb88e205da76218efdf67065ee07977b86ccfbc278e1c229e5f9f32340cc2a04dc418528588e667ccb783bc13133bc15a0a0936 EAP-Message = 0xd5652a17fa2f1b0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038201010064900d552e6d98d35cde88dc41403c05fb45c2a2bdb2f5d6f9f0fdc EAP-Message = 0x21eaab40c755b46a6e7892ae526d055d6da3c8c3190a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x60ab04b8fd2e304f5d42050b620e1513 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.100.13.12:19527, id=106, length=213 User-Name = "HTN\\josh" Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff" Calling-Station-Id = "00-0E-35-B6-74-AF" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.100.13.12 NAS-Identifier = "Houghton Wireless Services" NAS-Port-Id = "HTNStaff" Connect-Info = "CONNECT 54Mbps 802.11g" State = 0x60ab04b8fd2e304f5d42050b620e1513 EAP-Message = 0x020300061500 Message-Authenticator = 0x85c0f98d60c740ec669de9a9c7da4986 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 2 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 2 modcall[authorize]: module "etc_group" returns notfound for request 2 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 106 to 10.100.13.12 port 19527 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0104003915800000042f639f242a6f6541ec7b1afbb86af1958c2e4ed1ab48a226b2d15b08e4b7887f25691e005162bd16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xabc302506c895702968419cddb2c0be9 Finished request 2 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.100.13.12:19527, id=107, length=533 User-Name = "HTN\\josh" Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff" Calling-Station-Id = "00-0E-35-B6-74-AF" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.100.13.12 NAS-Identifier = "Houghton Wireless Services" NAS-Port-Id = "HTNStaff" Connect-Info = "CONNECT 54Mbps 802.11g" State = 0xabc302506c895702968419cddb2c0be9 EAP-Message = 0x020401441500160301010610000102010037c452398dbb3df5559e7ef631f93adac1c31949e8b2e189e656c42563825fedb650c87be7a05cfa2b6ab6d25b111dfb5ed36ceafc6a81c2d90982bc4b9514fc25cca8f EAP-Message = 0xb50e2ba24d87acf465b6923ae7229fe4e011258f1403010001011603010028faee95c6e785c7a0c1f7794e71c76e67ff5ba2f4006e2aa188af3b9da28d6e2419833ca0820678c1 Message-Authenticator = 0xc0ff62f05516e184511c415d87cbbc2c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 3 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 3 modcall[authorize]: module "etc_group" returns notfound for request 3 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 107 to 10.100.13.12 port 19527 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0105003d1580000000331403010001011603010028721fb19555db97969e579863ff1f6fce4169183c7a0abb3ea443be416f722adbc21b355b7ac01a45 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe4bddc9ecec467abc03da29934752e16 Finished request 3 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.100.13.12:19527, id=108, length=290 User-Name = "HTN\\josh" Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff" Calling-Station-Id = "00-0E-35-B6-74-AF" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.100.13.12 NAS-Identifier = "Houghton Wireless Services" NAS-Port-Id = "HTNStaff" Connect-Info = "CONNECT 54Mbps 802.11g" State = 0xe4bddc9ecec467abc03da29934752e16 EAP-Message = 0x02050053150017030100485562de8771e70ff92e34bb96bf0f6c24b6e6aca70841355cc05a96146c524e1c2b177149e577817012b73f9bb41d96639692cbab41f711878b16e20d5a7c04b16bc67577457b2d47 Message-Authenticator = 0x37c5fec48b0fa7f5c14dddc680e8c4f2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 4 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 83 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 4 modcall[authorize]: module "etc_group" returns notfound for request 4 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled request EAP-Message = 0x0200000d0148544e5c6a6f7368 Message-Authenticator = 0x00000000000000000000000000000000 FreeRADIUS-Proxied-To = 127.0.0.1 TTLS: Got tunneled identity of HTN\josh TTLS: Setting default EAP type for tunneled EAP session. TTLS: Sending tunneled request EAP-Message = 0x0200000d0148544e5c6a6f7368 Message-Authenticator = 0x00000000000000000000000000000000 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "HTN\\josh" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 4 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 4 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 4 modcall[authorize]: module "etc_group" returns notfound for request 4 modcall[authorize]: module "files" returns notfound for request 4 modcall[authorize]: module "mschap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 TTLS: Got tunneled reply RADIUS code 11 EAP-Message = 0x010100221a0101001d1023197ffb3fbee0431fa33dd4ffe6ee4848544e5c6a6f7368 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9023e8d5cfb89d9eedf0b95ea0ea8077 TTLS: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 108 to 10.100.13.12 port 19527 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0106007415800000006a170301001869103bd6a2fc06d853c018dec840fcee432f605b3bbd5c7b170301004882ddab817db15367d699b45444ae600ef8afaba3ca3c2eae0b4be817885fde9ab28ecedeca71e5371 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc1a3900bb47d4eeed37494a4af610f6a Finished request 4 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.100.13.12:19527, id=109, length=346 User-Name = "HTN\\josh" Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff" Calling-Station-Id = "00-0E-35-B6-74-AF" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.100.13.12 NAS-Identifier = "Houghton Wireless Services" NAS-Port-Id = "HTNStaff" Connect-Info = "CONNECT 54Mbps 802.11g" State = 0xc1a3900bb47d4eeed37494a4af610f6a EAP-Message = 0x0206008b15001703010080ec308e1a81a20c80b07a9399135ce92cb9856ea5b98bf1d18e5b53c8959c899f7e0a5ac3cb31cd966591961318eb728dc0cdc95c3a09318920c6f9fba21b88827380f0ca91a8b66b9da Message-Authenticator = 0x24e4740de40c15633d63d47b2e2dcc5e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 5 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 139 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 5 modcall[authorize]: module "etc_group" returns notfound for request 5 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled request EAP-Message = 0x020100431a0201003e310fc0026c362449dfb52a48226b9bf58e000000000000000055a52026985b92247cf83d076fd500b15479fccd5f204f5f0048544e5c6a6f7368 Message-Authenticator = 0x00000000000000000000000000000000 FreeRADIUS-Proxied-To = 127.0.0.1 TTLS: Adding old state with 90 23 TTLS: Sending tunneled request EAP-Message = 0x020100431a0201003e310fc0026c362449dfb52a48226b9bf58e000000000000000055a52026985b92247cf83d076fd500b15479fccd5f204f5f0048544e5c6a6f7368 Message-Authenticator = 0x00000000000000000000000000000000 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "HTN\\josh" State = 0x9023e8d5cfb89d9eedf0b95ea0ea8077 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 5 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 5 rlm_eap: EAP packet type response id 1 length 67 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 5 modcall[authorize]: module "etc_group" returns notfound for request 5 modcall[authorize]: module "files" returns notfound for request 5 modcall[authorize]: module "mschap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 5 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for josh with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 5 modcall: leaving group MS-CHAP (returns reject) for request 5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 5 modcall: leaving group authenticate (returns reject) for request 5 auth: Failed to validate the user. TTLS: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\001E=691 R=1" EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls TTLS: Freeing handler for user HTN\josh rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 104 with timestamp 49642f7a Sending Access-Reject of id 109 to 10.100.13.12 port 19527 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1 seconds... [root@file raddb]# Relevent lines of config (all else is default pretty much) proxy.conf realm DEFAULT { type = radius authhost = LOCAL accthost = LOCAL # authhost = radius.company.com:1600 # accthost = radius.company.com:1601 secret = testing123 # nostrip } In radiusd.conf here is my etc_smbpasswd section passwd etc_smbpasswd { filename = /etc/samba/smbpasswd format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" authtype = MS-CHAP hashsize = 100 ignorenislike = no allowmultiplekeys = no } My ntdomain realm definition realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = yes }

5 6

unscribe
by liadalex＠libero.it 08 Jan '09

08 Jan '09

please unscribe from list

1 0