- Freeradius-Users - lists.freeradius.org

Extra fields in accounting
by Jonathan Gazeley 22 Oct '08

22 Oct '08

I have a FreeRadius server, which is running two virtual servers that process requests from different wireless SSIDs. They are set to do accounting to a MySQL database. What I'd like to know is how to add an extra field to say which virtual server the request came from, so I can query on this field when I analyse my accounting records. Is there an easy way of doing this? Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------

2 2

EAP-AKA server RAND error
by Mohammad Belgaumkar 22 Oct '08

22 Oct '08

Hi I have configured freeradius for EAP AKA by applying the patch. I m using radeapclient to test it. Below is my configuration for server in raddb/users file DEFAULT Auth-Type := EAP, EAP-Type := AKA EAP-Sim-AUTN=0xa0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0 EAP-Aka-IK=0xb0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0 EAP-Aka-CK=0xc0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0 EAP-Sim-RES=0xd0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0 EAP-Sim-RAND=0xe0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0 Bu i get this "eap-aka can not find EAP-Sim-RAND" error in server Please help Regards Mohammad Arif Belgaumkar L&T Infotech Ltd, Whitefield, Bangalore - 66 Ph - 91-80-66242424 extn 2018 www.Lntinfotech.com ( ) L&T Infotech General Business (+) L&T Infotech Internal Use ( ) L&T Infotech Confidential ( ) L&T Infotech Proprietary Larsen & Toubro Infotech Ltd. www.Lntinfotech.com This Document is classified as: |------| | [X] | |------|L&T Infotech Proprietary |------| | [ ] | |------|L&T Infotech Confidential |------| | [ ] | |------| L&T Infotech Internal Use Only |------| | [ ] | |------|L&T Infotech General Business This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system. ______________________________________________________________________

1 0

Error in the negotiations certificates
by Martin Silvero 22 Oct '08

22 Oct '08

I mean, what I want to achieve is to use tls with certificates for the PC's that want to connect AP of entry, this creates certificates with the following reference: https://lists.freeradius.org/pipermail/freeradius-users/2008-October/msg005… license = certificates for tls , sorry my english (is very bad). then my problem is certificates? but i try many opcion and nothing. I created the certificates according to the README file, then tried and nothing, then did the same thing, but I created a bundle : "cat ca.pem server.pem > cabundle.pem" and convert in the cabundle. der, then import client.p12 and cabundle.der to the laptop, then try and get the last error that you showed.

2 1

EAP SIM error
by Nayan Gjain 22 Oct '08

22 Oct '08

Hi I had configured the freeradius-server-2.1.0 for eap-sim and trying to test it with radeapclient utility, while testing the following error occurs in server -: "EAP SIM error can not initiate sim, no RAND1 attribute" can anyone help me thanks Warm Regards, NAYAN JAIN (280609) SE (Software Engineer - 50PE) Larsen & Toubro Infotech Ltd. www.Lntinfotech.com This Document is classified as: L&T Infotech Proprietary L&T Infotech Confidential L&T Infotech Internal Use Only L&T Infotech General Business This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system. ______________________________________________________________________

2 1

Dynamic IP assignment problem
by Mr. K 22 Oct '08

22 Oct '08

Hi all, I´m starting on using freeRadius and I´m trying to use ippool to assign an IP dynamically for different users. Using the radiusd –X option, I finally could receive an Accept packet with an IP. The problem is that the IP that I’m receiving is not from the pool defined in the radius.conf file as I will try to show in the logs below. Module: Loaded IPPOOL ippool: session-db = "/usr/freeRadius/raddb/db.ippool" ippool: ip-index = "/usr/freeRadius/raddb/db.ipindex" #### This is the definition used in the radius.conf ippool: range-start = 10.0.10.1 IP address [10.0.10.1] ippool: range-stop = 10.0.10.200 IP address [10.0.10.200] ippool: netmask = 255.255.252.0 IP address [255.255.252.0] ippool: cache-size = 800 ippool: override = yes ippool: maximum-timeout = 0 Module: Instantiated ippool (main_pool) detail: detailfile = "/usr/freeRadius/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Then when I when receiving the IP: rad_recv: Access-Request packet from host 172.16.3.185:1130, id=0, length=64 User-Name = "7875305130@newcomm" User-Password = "7875305130" NAS-Port = 7777 Processing the authorize section of radiusd.conf The process of authorization ends OK, but the assigned IP is from the original main_ippool that I have modified. Login OK: [7875305130@newcomm] (from client iot port 7777) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Searching for an entry for nas/port: 172.16.3.185/7777 rlm_ippool: Found a stale entry for ip/port: 172.16.3.171/7777 rlm_ippool: num: 0 rlm_ippool: Searching for an entry for nas/port: 172.16.3.185/7777 rlm_ippool: Allocating ip to nas/port: 172.16.3.185/7777 rlm_ippool: num: 1 rlm_ippool: Allocated ip 172.16.3.172 to client on nas 172.16.3.185,port 7777 modcall[post-auth]: module "main_pool" returns ok for request 0 radius_xlat: '/usr/freeRadius/log/radius/radacct/172.16.3.185/reply-detail-20081022' rlm_detail: /usr/freeRadius/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/freeRadius/log/radius/radacct/172.16.3.185/reply-detail-20081022 modcall[post-auth]: module "reply_log" returns ok for request 0 rlm_sql (sql): Processing sql_postauth radius_xlat: '7875305130@newcomm' rlm_sql (sql): sql_set_user escaped user --> '7875305130@newcomm' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', '7875305130@newcomm', '7875305130', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', '7875305130@newcomm', '7875305130', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 0 to 172.16.3.185 port 1130 Framed-IP-Address = 172.16.3.172 Framed-IP-Netmask = 255.255.252.0 Finished request 0 I really don’t understand where are stored this IP from the original configuration. Maybe I still have to change any other configuration file, but I don`t realise where. Thanks in advance. Darío -- View this message in context: http://www.nabble.com/Dynamic-IP-assignment-problem-tp20103625p20103625.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

new to freeradius - proxy question
by Paul A 21 Oct '08

21 Oct '08

Hoping someone can help me or point me in the right direction. We currently are running a Livingston radius server that does realm and DNIS proxying. For obvious reasons we want to replace this server with freeradius. My current setup is like this. Livingston radius proxy - let's say it's 1.1.1.1, doing realm and DNIS proxy - which works. A freeradius destination server, 3.3.3.3, that handles usernames with/without realms. Which works with the Livingston proxy server. The new freeradius proxy server that currently only works with realms - let's say its 2.2.2.2 How im testing: In the old Livingston proxy I have this. ####3.3.3.3 somesecret 5500 old 2.2.2.2 somesecret 5500 1812 1813 Here's the problem: My ne freeradius proxy at 2.2.2.2 is doing realm and DNIS proxy but only realm proxy is working. Although it seems like that server is sending all radius packets to the destination server of 3.3.3.3 On this server I do have a DNIS entry on the acct_users file, like this: DEFAULT Called-Station-Id == "5500", Proxy-To-Realm := "realm.net" Fall-Through = No On Freeradius destination server I see start records for users login in with user@realm Oct 21 09:46:02 2008 User-Name = "test" NAS-IP-Address = xx.xx.80.15 Ascend-Owner-IP-Addr = 0.0.0.0 NAS-Port = 751 Ascend-NAS-Port-Format = 2_4_5_5 NAS-Port-Type = Async Service-Type = Framed-User Acct-Status-Type = Start But for users login in without a realm I notice a lot of stop records but the curious thing is that I see some with Ascend-Disconnect-Cause = PPP-PAP-Auth-Failed. So now im wondering if the proxy at 2.2.2.2 is doing something to the packets leaving for 3.3.3.3 that's causing it to fail without the realm at the destination server. Any help would be appreciated. Thanks p.a

2 3

using radtest as a different client..
by Oguzhan Kayhan 21 Oct '08

21 Oct '08

Hello , I just wonder if i can use radtest command as testing from a different client? Such as, Assume i have a client conf for 1.1.1.1 ip add. in my freeradius(2.2.2.2) server. And from 3.3.3.3 client(lets call client3) i am trying to test the connection.like radtest user pass 2.2.2.2 10 secret ?????? ????? There is two optional parameters as i see on man page. PPPhint and nasname. Is it possible to test from client1 as is it is from client2 like radtest user pass 2.2.2.2 10 secret 3.3.3.3 If not, what is the purpose of nasname parameter?? Why i need is , I wanna have server with 2 interfaces and there are 2 different chilli processes are working which authenticates from 2 different virtual freeradius servers. So maybe i can figure out the different client problem via nasnames?? Or not..

4 4

New RADIUS book - Nuevo libro de RADIUS
by nanotech＠terra.es 21 Oct '08

21 Oct '08

Saludos a todos (Hi everybody) He descubierto el lanzamiento de un nuevo libro de RADIUS en la Web: www.radiusdoc.com (Parece muy interesante) I've discovered a new RADIUS book in the website: www.radiusdoc.com (It appears to be very interesting and helpful). Francisco Montes Ahora también puedes acceder a tu correo Terra desde el móvil. Infórmate pinchando aquí.

1 0

Regarding Calling CArd
by Santosh Sen 21 Oct '08

21 Oct '08

Hi all, I am new to this service , I would like to request you that anyone has every tried the callcard system with freeradius. Is there any how to on this type. Thanx. Regards, Santosh __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Error in the negotiations certificates
by Martin Silvero 21 Oct '08

21 Oct '08

well! it worked! Now my problem is that since the notebook I get an error: "Server mistaken identity - failed authentication" The truth is that I followed the steps recommended me to create the certificates, the amount to the notebooks, but the error continues. that is, I know it is wrong license, but why?, what could be the problem?. This is the HOWTO that I follow. thank you very much for your time people, really. this is my log: rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=1, length=136 User-Name = "cert" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xa1d37d14d3ca314db3216fe7ad3213e9 EAP-Message = 0x020100090163657274 NAS-Port-Type = Wireless-802.11 NAS-Port = 257 NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "cert", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry cert at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 1 to 10.0.31.40 port 1645 EAP-Message = 0x010200160410c2f88223fdf1eaa4f3067c04238d3721 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x828568e182876c44ecbe1a83334ff52d Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=2, length=151 User-Name = "cert" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xc2fb1c2d823ddbcd52324d74a0b5fed2 EAP-Message = 0x02020006030d NAS-Port-Type = Wireless-802.11 NAS-Port = 257 State = 0x828568e182876c44ecbe1a83334ff52d NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "cert", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry cert at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/tls rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 2 to 10.0.31.40 port 1645 EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x828568e183866544ecbe1a83334ff52d Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=3, length=255 User-Name = "cert" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x739c2fb445978b8fe22541c3b32fe49f EAP-Message = 0x0203006e0d8000000064160301005f0100005b030148fddd7b02ee2de9cfa41a003ff5314b24e0eda43acd15432391683003cfd6e500003400390038003500160013000a00330032002f006600050004006500640063006200610060001500120009001400110008000600030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 257 State = 0x828568e183866544ecbe1a83334ff52d NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "cert", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 110 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry cert at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 100 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 005f], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0839], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a0], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 10.0.31.40 port 1645 EAP-Message = 0x010404000dc000000b44160301004a02000046030148fddd7dc37e19076e351405e62f436a1922fb73cf30455f894e5c4190795ae0204a154ccf97bbead151eeaf459f681421a262c4556effa79a2002e054df616e9900390016030108390b000835000832000396308203923082027aa003020102020101300d06092a864886f70d010104050030818c310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3120301e06092a864886f70d0109011611636572744069706c616e2e636f6d2e6172311e301c060355 EAP-Message = 0x04031315436572746966696361746520417574686f72697479301e170d3038313031363230313733315a170d3039313031363230313733315a3073310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c060355040a130549504c414e311b3019060355040313125365727665722043657274696669636174653120301e06092a864886f70d0109011611636572744069706c616e2e636f6d2e617230820122300d06092a864886f70d01010105000382010f003082010a0282010100e5ed708ad7629eb1a4406955fa12ca763e4d1a5264d13c13a59d82175ef6c50a8a7c145bfbba1b2ead6e65164759 EAP-Message = 0x742a02898ebd5795851b82f8488ea091ea5066dc89e6af059571af16716d3fb1a6e272e7f651b4b594d5bbc2a8d245790865da844926416a6356691dac17f9cca14b98c59fb70a690d85527b855796def90e81472a8eac1d25f59bb7daa3911f36aa8b98a8c33eadce40371ecae6f94bde99b0116973fe2376511d7e1377bfde2ba0056ee0824130884744e341851d8c10a2ed37ad726554c87b3bb138b6f77e0d7abe640d513bc062deb0c8a2e72c60afe7e2f00a0601b201f3b36c89c5eefb9d7fdd00a43109b8a3efd02a0c4b45f7d4b10203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104 EAP-Message = 0x050003820101000971fc8236218044d0674241bd4bf450c5c11a72d13d8e3aeb7b37d89f2eca83f6ac0c2a08a541ad6995b86f21d158777cb8b55eebd5f74b2809b97aa64404f67fb3d00a10008ff3d8a92c37311536bc5d6d0fd62f4ad6bcddfcc9b96fe0db9a6087be315c360edbb6333d45817ef783f2fa31071b46613c601c29a1f6187e5dbe0f8abb01ea6fdf5eece6af36e7f25d0ab0c9ae05ca422a0c367fe97df9d7eefeec739c36e88c3631af892ab0bb76e248c3aaf7bfe240e60b8eb86d95b78cc81e959debbe37be439d2c68b010dc81e06705c4142db6f88820a9284a0f12bb128802591036617a64e21b1521960de4ad6339381ae8be EAP-Message = 0xaf5d9a281ecc5339e0450004 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x828568e180816544ecbe1a83334ff52d Finished request 2. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=4, length=151 User-Name = "cert" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x252416bab9b6b1d85b8af4b674df9148 EAP-Message = 0x020400060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 257 State = 0x828568e180816544ecbe1a83334ff52d NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "cert", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry cert at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 4 to 10.0.31.40 port 1645 EAP-Message = 0x010504000dc000000b4496308204923082037aa003020102020900aa09a4eb699e73a6300d06092a864886f70d010105050030818c310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3120301e06092a864886f70d0109011611636572744069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f72697479301e170d3038313031363230313733315a170d3038313131353230313733315a30818c310b3009060355040613024152311530130603550408130c42 EAP-Message = 0x75656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3120301e06092a864886f70d0109011611636572744069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100af6a3a37df450bb00c1f30ecc060fc530881b40643e224fd853eb5e338789cb912bcecb071826a7ec4394c9c139948305fee4b3d0ac995414df5dcbda4d508af7305a7648462a0e9a11d2bdd9edb1ff348e9816035b6456edb77fa1eb0d32a778da12d839052a5fb18 EAP-Message = 0x133bf2bd62e9ad8f4923585ae3ae5f7d80b85ccb2473bd9230a9e55aa0d6938b5a41ed67fb734e20c48a4f2130b71ba5ae66c13faf5dabe29e005411fd43fef788bbc983d432a0264a995278edae38db7b32cfff8c14d9724cbc063e572bebafa57c2c7c2f972711a073f196dac82ccf3b4098d44dbcc72a7d1cffc0faa1be151dd771ded7e0815f66d10028859213044728146e9b9fb10203010001a381f43081f1301d0603551d0e041604142d644d4ab03c8babf1cec71991d94174579cdd423081c10603551d230481b93081b680142d644d4ab03c8babf1cec71991d94174579cdd42a18192a4818f30818c310b30090603550406130241523115 EAP-Message = 0x30130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3120301e06092a864886f70d0109011611636572744069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f72697479820900aa09a4eb699e73a6300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010007dac509033ec6d101253a619dd68b1e9007f99b1516e4c743e7f144bc21d4231d1086f082432bec4309cded4a8190e99a6cb2ee55b2d83f1b3ef4dbf1ceb4cd1703825dc6fa7a6b3924b443911a9c5b7a035e EAP-Message = 0x7c10ed5223d868feea672798 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x828568e181806544ecbe1a83334ff52d Finished request 3. Going to the next request Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=5, length=151 User-Name = "cert" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xff9eb6ba3fc361ee417c8d591840b2ad EAP-Message = 0x020500060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 257 State = 0x828568e181806544ecbe1a83334ff52d NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "cert", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry cert at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 5 to 10.0.31.40 port 1645 EAP-Message = 0x010603620d8000000b44154f0cb0744882ef4706ec8866c6430b2df368cefb2d469c6ba9206fd7841e146d9445d9d0da14ee2ea682cf574b6a118e729df9a84852718cb6802edd2169452bbc3509d6c7a68cc2b293aecf43a7a56a746da3b57865e8945c8531c39bd1f9ce0b576a0533c793e2787d98bf322b1d7b1f03e0b6cf82a6c80c4ca96b8bdd4a6a0ef2724a3034cc3c0f3e55bd2927a673f86ad6a8d55bd1d900ef1e73550440d3160301020d0c0002090080ad2df571269b93a787f80235487c28f730b4907620fed69ef713bb4f43d3579e11b02fbf45ab4e74cf79b5d447af0fe6805157482f2b5f8185c4cc59061e6882ab9e4dd6def073 EAP-Message = 0x6c0583158ab64a30e9a2de020c5e4f7a41b4c58149a9b110a6d3b521f30e96e82b2b43f2d0d1a699b6484f8c814f72d4fe8fc11d7943f2c6a300010200808d274ee97ca8a1539322ca1cc91663218998f3f246237c87d426f37ed5ca34e4219297a674b10bd0b2bad77050600c858d955abb3f5436b99f2182fb607330679a0fe893820631e51a809fe023f6e08c821c6eca3852849a5d73b5cf1dcd0b71ed6fbd57b0c492c83c313f2104812f2c5fa6ec3627ed7d2c87c0c8275fd2854f010007eb93c25d6e901a560299fc10a1b3ddb4f98c351a95f6442a02bb7ac314af82cc9d2e475c5e5fe0673fdddfe7962dca24183d4bc1e64738f0fb7ac4a5 EAP-Message = 0x1f2cf4ac73dfea488a0f4be5678893c1b0be7343f290ec5f5a9ccf4f93893aecb5ad34e5de809849e6d0e61a1ad2944c8d0905eafaf74c046f5e338ecd30b1f3bfd001dc8aff4772cb307e0d87f6a6753767c0d207525cba695cce41a7031596db606fe2c644a8607c31404d7e09336b02e640bc6fd3823871cc1294587936547522651f2d52fc1c4bbdbe5e637bda47b37ccd47e7c29f3f93533b3e7161343924ea63417efc93e16618ab84d87dc74a199dac734719e5db4faecf80ca10a56f0e581016030100a00d00009804030401020091008f30818c310b3009060355040613024152311530130603550408130c4275656e6f7320416972657331 EAP-Message = 0x1430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3120301e06092a864886f70d0109011611636572744069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f726974790e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x828568e186836544ecbe1a83334ff52d Finished request 4. Going to the next request Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=6, length=162 User-Name = "cert" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x7cdb2e5ab2d1ba0debf2dbe363ba0b9e EAP-Message = 0x020600110d80000000071503010002022a NAS-Port-Type = Wireless-802.11 NAS-Port = 257 State = 0x828568e186836544ecbe1a83334ff52d NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "cert", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry cert at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 7 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> cert attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 6 to 10.0.31.40 port 1645 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 5.

2 1