- Freeradius-Users - lists.freeradius.org

RE: Duplicate IPs for Radius Clients with different secrets
by Eric Geier 16 Dec '08

16 Dec '08

The best solution I can think of that I want to mimic is SecureMyWiFi from WiTopia, a hosted radius service (www.witopia.net) Their service works just like I want. > > Are you saying it would work, FreeRADIUS would respond to the > individual > > sites? > > Yes. This is how *any* networking protocol works. Would the server see request from just coming from the Internet IPs or individual APs...meaning would I have to list each location's Internet IP in the client.conf file? I want to be able to list each AP IP individually, tagged with the domain it belongs to. > >> of course, you could really freak things out by using > >> VPN tunnels from the inside networks of each site direct to > >> the FreeRADIUS box - but if all your sites use the same range > >> of addresses then the server wouldnt have a clue at all of which > >> tunnel to send the reply down! > > > > Why would I want to VPN to the server? > > So that your RADIUS packets aren't sent over the Internet in the > clear. Gotcha, I need to read more about this. > >> with latest version 2.x of FreeRADIUS you can have dynamic clients > >> etc which can select the correct shared secrets depending on > >> special DB lookups etc - but thats not a choice for you currently. > > > > Yes I read about this, and I'll be upgrading soon and moving to > Linux. When > > writing the DB lookups, can I use the User-Name attribute pulled from > the > > requests? > > No. Only the source IP address. Then I'm not sure how I would pull the correct shared secrets...unless it all works per internet IP rather than per AP. > > This will I think let me search for shared secret based on both > > the RadiusClient IP and the domain....the other server I tried > couldn't do > > this. I would also consider using the MAC address of the AP instead > or in > > addition to the domain. > > I don't think that's necessary. The source IP address should be good > enough. Same as above. Thanks, Eric

1 0

RE: Duplicate IPs for Radius Clients with different secrets
by Eric Geier 16 Dec '08

16 Dec '08

Thanks for your reply. > > I'm not exactly sure. How does a RADIUS server work over the > Internet? I'm > > not connecting the radius clients onto the same LAN. If a radius > request > > comes in from the internet, would the server send responses to the > Internet > > IP that it received it from (which I think would work for my case) or > would > > it send to the radius client IP? > > > > Here's what I'm trying to do: > > Host a radius server on the Internet...for PEAP 802.1X (WPA- > enterprise). > > Each AP at the different offices would be set with the Internet IP > address > > of where the radius server is running, along with a shared secret. > There > > would likely be APs set to the same IP address, that's why I'm asking > about > > all this. > > i'm having a quick stab in the dark here - I'm guessing > that your APs will have local non routed addresses on their > LAN - eg 192.168.x.x or 172.16.x.x etc Yes, that's correct. > - in this case, they > will appear to the FreeRADIUS server as originating from the > IP address of your real outside world gateway/NAT box. therefore > each of your sites will be presented to the FreeRADIUS server > as different IP addresses. Are you saying it would work, FreeRADIUS would respond to the individual sites? > of course, you could really freak things out by using > VPN tunnels from the inside networks of each site direct to > the FreeRADIUS box - but if all your sites use the same range > of addresses then the server wouldnt have a clue at all of which > tunnel to send the reply down! Why would I want to VPN to the server? > with latest version 2.x of FreeRADIUS you can have dynamic clients > etc which can select the correct shared secrets depending on > special DB lookups etc - but thats not a choice for you currently. Yes I read about this, and I'll be upgrading soon and moving to Linux. When writing the DB lookups, can I use the User-Name attribute pulled from the requests? This will I think let me search for shared secret based on both the RadiusClient IP and the domain....the other server I tried couldn't do this. I would also consider using the MAC address of the AP instead or in addition to the domain. Thanks!

2 1

post check
by lreeves 16 Dec '08

16 Dec '08

test Larry Reeves lreeves(a)heartoftn.net

1 0

MAC Auth (new problem)
by Nataniel Klug 16 Dec '08

16 Dec '08

Hello all, A new problem on my Radius tryout... Now I cant authorize my MAC clients. This is how it gets into my server: Listening on authentication address 172.30.0.27 port 1812 as server ppp Listening on accounting address 172.30.0.27 port 1813 as server ppp Listening on authentication address 172.30.0.27 port 1814 as server proxim Ready to process requests. rad_recv: Access-Request packet from host 172.30.0.165 port 6001, id=3, length=69 User-Name = "00:19:79:0F:98:3D" User-Password = "cnett1298" NAS-IP-Address = 172.30.0.165 NAS-Port = 0 server proxim { +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "00:19:79:0F:98:3D", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql_ap2000] expand: %{User-Name} -> 00:19:79:0F:98:3D [sql_ap2000] sql_set_user escaped user --> '00:19:79:0F:98:3D' rlm_sql (sql_ap2000): Reserving sql socket id: 4 [sql_ap2000] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE value = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE value = '00:19:79:0F:98:3D' ORDER BY id [sql_ap2000] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = '00:19:79:0F:98:3D' ORDER BY priority rlm_sql (sql_ap2000): Released sql socket id: 4 [sql_ap2000] User 00:19:79:0F:98:3D not found ++[sql_ap2000] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [00:19:79:0F:98:3D/cnett1298] (from client ap2000 port 0) } # server proxim Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 3 to 172.30.0.165 port 6001 Waking up in 4.9 seconds. Cleaning up request 0 ID 3 with timestamp +29 Ready to process requests. This user (MAC) exists and its in radcheck like this: mysql> SELECT * FROM radcheck WHERE Username="marmatec"; +------+----------+--------------------+----+-------------------+--------+------+ | id | UserName | Attribute | op | Value | numero | obs | +------+----------+--------------------+----+-------------------+--------+------+ | 796 | marmatec | Cleartext-Password | := | 654321 | 00923 | | | 1886 | marmatec | Calling-Station-Id | == | 00:19:79:0F:98:3D | 00923 | NULL | +------+----------+--------------------+----+-------------------+--------+------+ On mysql/sql/ap2000.conf (copy of dialup.conf file) I just changed this on authorize section: WHERE value = '%{SQL-User-Name}' \ I really don't know how to make this work. Can someone help me? -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

5 24

Problem returning default reply "Filter-ID" for Enterasys gear
by Kent Nasveschuk 16 Dec '08

16 Dec '08

Hello, I'm trying to set up MAC and 802.1x authentication and have a couple of questions. For right now I'm just working on the MAC authentication. Here's some info on my system: CentOS 5.2 [root@radius01 freeradius-1.1.3]# radiusd -v radiusd: FreeRADIUS Version 1.1.3, for host x86_64-redhat-linux-gnu, built on May 10 2007 at 12:24:01 Connecting on backend to OpenLDAP 2.3.39. Although in the production environment I will be running a replica on the radius server for testing I'm using a test LDAP server that I can modify at will. MAC addresses live in: ou=Devices,ou=Network,dc=mbl,dc=edu typical entry: dn: cn=00-0C-F1-94-2A-9D,ou=Devices,ou=Network,dc=mbl,dc=edu cn: 00-0C-F1-94-2A-9D userPassword:: c25rUnN3bQ== radiusCheckItem: 35452 radiusExpiration: 2030123100:00:00 description: SSH gateway objectClass: device objectClass: ieee802Device objectClass: radiusprofile objectClass: simpleSecurityObject objectClass: top macAddress: 00:0C:F1:94:2A:9D radiusFilterId: Enterasys:version=1:policy=F-Servers What I want to do is if a lookup in LDAP fails return ACCEPT and the string "radiusFilterId: Enterasys:version=1:policy=D-Unregistered" where a policy will be applied on the port that is associated wit "D-Unregistered". ############################ radiusd.conf ####################### ... modules { ldap devices { server = "x.x.x.x" identity = "cn=radiusd,ou=users,dc=mbl,dc=edu" password = supersecretpassword basedn = "ou=devices,ou=network,dc=mbl,dc=edu" filter = "(cn=%{User-Name})" start_tls = no tls_mode = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_cache_timeout = 120 ldap_cache_size = 0 ldap_connections_number = 10 #password_header = "{clear}" password_attribute = userPassword timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no access_attr = "radiusFilterId" } ldap 802_1x { server = "x.x.x.x" identity = "cn=radiusd,ou=users,dc=mbl,dc=edu" password = supersecretpassword basedn = "ou=users,dc=mbl,dc=edu" filter = "(cn=%{User-Name})" start_tls = no tls_mode = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_cache_timeout = 120 ldap_cache_size = 0 ldap_connections_number = 10 #password_header = "{clear}" password_attribute = userPassword timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no access_attr = "networkProfile" } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } pap { encryption_scheme = md5 auto_header = no } chap { authtype = CHAP } preprocess { huntgroups = ${confdir}/huntgroups #hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users #acctusersfile = ${confdir}/acct_users compat = no #use old style users } # regular detail files detail detail1 { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 dirperm = 0755 } # temp detail file to replicate to accountrad detail detail2 { detailfile= ${radacctdir}/detail-combined detailperm = 0600 dirperm = 0755 locking = yes } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } # # The 'expression' module current has no configuration. expr { } } instantiate { expr } authorize { preprocess Autz-Type LDAP1 { devices } Autz-Type LDAP2 { 802_1x chap mschap eap } files } authenticate { authtype PAP { pap } authtype CHAP { chap } authtype MS-CHAP { mschap } authtype LDAP1 { devices } authtype LDAP2 { 802_1x } eap } preacct { preprocess files } accounting { acct_unique detail1 detail2 #radutmp #sradutmp } ############################ users ####################### DEFAULT Client-IP-Address == "172.x.x.1", Auth-Type := LDAP1, Autz-Type:= LDAP1, Auth-Type := ACCEPT, Filter-Id := "Enterasys:version=1:policy=D-Unregistered" DEFAULT Client-IP-Address == "172.x.x.2", Auth-Type := LDAP2, Autz-Type:= LDAP2 DEFAULT Autz-Type = LDAP1, Auth-Type := ACCEPT ############################ clients.conf ####################### client 127.0.0.1 { secret = testing123 shortname = localhost nastype = other # localhost isn't usually a NAS... } client 172.x.x.3 { secret = yetanotherpassword shortname = NagiosMonitoring } client 172.x.x.1 { secret = anotherpassword shortname = DFE-CORE } client 172.x.x.2 { secret = anotherpassword shortname = ROAMABOUT8400 } I'm testing from the 172.x.x.3, client. Currently I can get a MAC address to authenticate and reply with the the correct "radiusFilterID" in LDAP. I can also get an unknown MAC address to return an ACCEPT but I can't get it to return a default "Filter-ID". Putting the return string "Filter-Id := "Enterasys:version=1:policy=D-Unregistered" in the users file doesn't seem to work. I'll work on the 802.1x when I get the above working, but I want to use the sambaLMpassword or sambaNTpassword hashes that are already in the LDAP directory versus clear text userPassword for 802.1x. Thanks for your help. Kent L. Nasveschuk Systems Administrator Office 508 289-7263 Cell 508 524-7263 ---------------------------- Marine Biological Laboratory 7 MBL St. Woods Hole, MA 02543

1 0

Re: Duplicate IPs for Radius Clients with different secrets
by Eric Geier 16 Dec '08

16 Dec '08

> >Hi, I'm wondering if someone can point me in the right direction. I > want to > >list radius clients with the same IPs (and different shared secrets). > This > >would let me use freeradius among multiple offices, where each could > use the > >same IP addresses for the radius clients. > > And how is routing going to work there? How is radius server suposed to > send the response back to the correct client? This can work only if > carry radius server from office to office so it works a little bit > here, > little bit there. If you connect those clients onto a network they will > all stop working (or, at best, first one you put on the network will > work but others won't). > > Ivan Kalik > Kalik Informatika ISP I'm not exactly sure. How does a RADIUS server work over the Internet? I'm not connecting the radius clients onto the same LAN. If a radius request comes in from the internet, would the server send responses to the Internet IP that it received it from (which I think would work for my case) or would it send to the radius client IP? Here's what I'm trying to do: Host a radius server on the Internet...for PEAP 802.1X (WPA-enterprise). Each AP at the different offices would be set with the Internet IP address of where the radius server is running, along with a shared secret. There would likely be APs set to the same IP address, that's why I'm asking about all this. > > Hi, I'm wondering if someone can point me in the right direction. I > want to > > list radius clients with the same IPs (and different shared secrets). > This > > would let me use freeradius among multiple offices, where each could > use the > > same IP addresses for the radius clients. I need something very > dynamic; > > manually creating virtual servers in the config file won't work well. > > RADIUS doesn't work that way. > > Shared secrets are per client IP. Each client IP is used to look up > the shared secret. You can't have multiple shared secrets for one IP. > > > Right now I'm using v1.188.2.4.2.14 > > That's not the server version number. > > Use "radiusd -v" to get the version information. > > Alan DeKOk. I know it traditionally doesn't, just checking to see what people think and if I might find a way to do what I want to do. What got me thinking something like this could work is when using a different server, I thought I could modify the SQL select statement that's used to find the shared secret. For example, the default is "select SharedSecret from NASES where ClientIPAddress='$c'" I thought I could just add the following to the end "and where Domain=(function that takes the domain from the username...after the @) I found that server can't register the username attribute during the select statement...so it all didn't work. Opps. I'm using v1.1.7 because at the moment I'm using FreeRadius.net on Windows Thanks for your help guys - Eric

3 2

Duplicate IPs for Radius Clients with different secrets
by Eric Geier 15 Dec '08

15 Dec '08

Hi, I'm wondering if someone can point me in the right direction. I want to list radius clients with the same IPs (and different shared secrets). This would let me use freeradius among multiple offices, where each could use the same IP addresses for the radius clients. I need something very dynamic; manually creating virtual servers in the config file won't work well. Right now I'm using v1.188.2.4.2.14 Thanks! Eric

3 2

FreeRADIUS vs Aradial RADIUS
by Aldo Zavala 15 Dec '08

15 Dec '08

Hello guys, I am a little bit scared how hard can be to deploy the FreeRADIUS, I found this in the internet: (aradial.com) this guys claim to have a very convenient and professional AAA server with a convenient price, does anybody here have experience with that "aradial radius server"? What would be the Pros and Cons of purchase it instead of have the FreeRADIUS one? Thanks again.

3 2

calling-station-id filtering with checkval
by Justin A. Williams 15 Dec '08

15 Dec '08

I see that the mac address from the calling-station-id but then it will not login with the user. If i delete the row 26 with calling-station-id it will permit that user to login. Please help rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 7 mysql> select * from radcheck; +----+------------+--------------------+----+-------------------+ | id | UserName | Attribute | op | Value | +----+------------+--------------------+----+-------------------+ | 25 | testuser | User-Password | == |testpass| | 26 | testuser | Calling-Station-Id | == |00-21-5c-7b-ff-2d| +----+------------+--------------------+----+-------------------+ 2 rows in set (0.00 sec) rad_recv: Access-Request packet from host 10.254.0.1:6001, id=109, length=142 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000f016a77696c6c6935363436 Message-Authenticator = 0xf2e55d0632d8ecd338a16f7fd5523106 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 109 to 10.254.0.1 port 6001 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d7a74c61baccd06a6da72f6137c2a3b Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=110, length=225 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0x3d7a74c61baccd06a6da72f6137c2a3b Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202005019800000004616030100410100003d0301494720b6f92efa4a7ea79b54e7adb7c31f53e46513e795facd9056b17b27b6eb00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xa12aca0fd57315e8de5b0a729a73f7b4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 110 to 10.254.0.1 port 6001 EAP-Message = 0x0103040a19c0000006f1160301004a0200004603014945cf54c95df83cb35080a7d88f1beb1399cd475bbd9e1aa746791daa604d0020f2a95cf814197a684a9636498965f7d207497edf9cbf7fcb66d28db1c9ff6a3400040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x04ed47a0de71a08bae722f88d6987218 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=111, length=151 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0x04ed47a0de71a08bae722f88d6987218 Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0x7cce1dc07ea3c41fcb55ca62aa372bf2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 2 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 111 to 10.254.0.1 port 6001 EAP-Message = 0x010402f71900170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x431dbf66e9563ef6c0b3cdac58fd0e4d Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=112, length=337 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0x431dbf66e9563ef6c0b3cdac58fd0e4d Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400c01980000000b61603010086100000820080121e3c6a20b3f0fbfb2036283c70f54c14e73b14430c7c82a24866038a75c69bb91eac0b286b735b8666111e4e40621ac80ee1d0996b9a9ce768875ed5d7c0c45a75dbb004a6a5bcdb7ae44ef3921b11f7acd89fac2a413e4391a163c08fee4667758a748139e6d5b15f829bfe545b640a69948441aa050c7c1152881d0a0b801403010001011603010020e69c55647e4c5a4fd3cf2c7f702684ca9de05460f816f7347c0647821ebdf9c0 Message-Authenticator = 0x4f024f2f7e3377b0a9622f3f859c0f9f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 3 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 112 to 10.254.0.1 port 6001 EAP-Message = 0x010500311900140301000101160301002095d66e5ab6a8eab6fadd4298805da0ee9e420234c498b39ce5ae4c3ac8232cc2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0ee4a12a1ab84d7435dce6a6935a88a4 Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=113, length=151 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0x0ee4a12a1ab84d7435dce6a6935a88a4 Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0x42d0e07d5e59f8d38baf59d71f5672e2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 4 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 113 to 10.254.0.1 port 6001 EAP-Message = 0x0106002019001703010015cfd1b627c3bf869d33564a058a9a317b0d49e8e682 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xde6481a2cbcb86cbfff8dea6911117da Finished request 4 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=114, length=183 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0xde6481a2cbcb86cbfff8dea6911117da Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600261900170301001bcce8d4d055cbc691f1340e46621d5cabe5eddcc855f52cd3a13f88 Message-Authenticator = 0x2b78b4114c8bffcb891aead7cf917457 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 5 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - testuser rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0206000f016a77696c6c6935363436 PEAP: Got tunneled identity of testuser PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to testuser PEAP: Sending tunneled request EAP-Message = 0x0206000f016a77696c6c6935363436 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testuser" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): No matching entry in the database for request from user [testuser] modcall[authorize]: module "sql" returns notfound for request 5 rlm_checkval: Could not find item named Calling-Station-Id in request rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval" returns notfound for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010700241a0107001f10dcab6769a85cba16a42fb47706453cbe6a77696c6c6935363436 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68e17da0a9a400917769de0451579732 PEAP: Processing from tunneled session code 0x8188f38 11 EAP-Message = 0x010700241a0107001f10dcab6769a85cba16a42fb47706453cbe6a77696c6c6935363436 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68e17da0a9a400917769de0451579732 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 114 to 10.254.0.1 port 6001 EAP-Message = 0x0107003b19001703010030aee484ac01a5a458cf552cf3c7aaf51cb06314433a871487e3d68c9e6f7dd9b20e50b7d8c4282d7120cec1f48fe0dee6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3c061f046a049d3c6e5a8010ac776fde Finished request 5 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=115, length=237 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0x3c061f046a049d3c6e5a8010ac776fde Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0207005c1900170301005181f86830de9489b959ba137783ac12d6d085883fb3dd21699611d12260f55b54402164084b309fe60a087e848b816bf48b8d712eadc6b38c708b58f8230dc0ca1925d44c06ff3b55902e7f3573164e8a2f Message-Authenticator = 0xebb532d259687d2da7be90fa77257950 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 92 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 6 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020700451a02070040310fb1ca476eb5dd96914ce816dd8109bb00000000000000004485d3dd2f8f7d100c6f1696fa1149988ced9e732e04d840006a77696c6c6935363436 PEAP: Setting User-Name to testuser PEAP: Adding old state with 68 e1 PEAP: Sending tunneled request EAP-Message = 0x020700451a02070040310fb1ca476eb5dd96914ce816dd8109bb00000000000000004485d3dd2f8f7d100c6f1696fa1149988ced9e732e04d840006a77696c6c6935363436 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testuser" State = 0x68e17da0a9a400917769de0451579732 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 69 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 rlm_sql (sql): No matching entry in the database for request from user [testuser] modcall[authorize]: module "sql" returns notfound for request 6 rlm_checkval: Could not find item named Calling-Station-Id in request rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval" returns notfound for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. Login incorrect: [testuser/<no User-Password attribute>] (from client localhost port 0) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x81a7668 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 115 to 10.254.0.1 port 6001 EAP-Message = 0x010800261900170301001bf8aa1a94ad4a2b0806614e7bead931ede68f144ac5809bbfaf1375 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfd5c14aca3f5548e24c6e1e0a7b6b3cc Finished request 6 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=116, length=183 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0xfd5c14aca3f5548e24c6e1e0a7b6b3cc Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800261900170301001bf6abd7a3bb6544d85a447f7ad16a9b7357761515db20de1cece78e Message-Authenticator = 0xdc013599dfdec1515ec553dd0afcfe88 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 7 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Login incorrect: [testuser/<no User-Password attribute>] (from client testwireless port 2 cli 00-21-5c-7b-ff-2d) Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 5 seconds... -- Justin A Williams

3 4

Two servers using virtualization
by Nataniel Klug 15 Dec '08

15 Dec '08

Hello all, Am using freeradius as my network AAA. For now it is working fine but now I get into a need that I could not solve. I have an small WISP and I use radius do authenticate/account my PPPoE/Hotspot clientes. This works fine using MySQL. My problem is that I need to control my clients MAC address that will connect into my APs. My AP will send it package like this to radius: Mon Dec 15 14:38:25 2008 : Auth: Login incorrect: [00:15:AF:6B:E0:E2/password] (from client ap2000 port 0) MAC address I already have into my mysql tables and password is the same for every mac. I just need to run another FreeRadius server on the same machine listening on another port (for auth and acco) and this new server should use another SQL instance. Is this possible? -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

2 3