- Freeradius-Users - lists.freeradius.org

Error in the negotiations certificates
by Martin Silvero 17 Oct '08

17 Oct '08

Good day mate. Well, finally understood what I recomendastes and I did, I created a package with server.pem ca.pem and then convert it to. der, the amount to the notebook but this time gave an error with the validation of the server: rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=13, length=136 User-Name = "cert" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x4c4673bed5a0d93399f5b623d8046b1d EAP-Message = 0x020100090163657274 NAS-Port-Type = Wireless-802.11 NAS-Port = 1301 NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" Fri Oct 17 10:47:33 2008 : Debug: +- entering group authorize Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Fri Oct 17 10:47:33 2008 : Debug: ++[preprocess] returns ok Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Fri Oct 17 10:47:33 2008 : Debug: ++[chap] returns noop Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Fri Oct 17 10:47:33 2008 : Debug: ++[mschap] returns noop Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Fri Oct 17 10:47:33 2008 : Debug: rlm_realm: No '@' in User-Name = "cert", looking up realm NULL Fri Oct 17 10:47:33 2008 : Debug: rlm_realm: No such realm "NULL" Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Fri Oct 17 10:47:33 2008 : Debug: ++[suffix] returns noop Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Fri Oct 17 10:47:33 2008 : Debug: rlm_eap: EAP packet type response id 1 length 9 Fri Oct 17 10:47:33 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Fri Oct 17 10:47:33 2008 : Debug: ++[eap] returns updated Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: calling unix (rlm_unix) for request 0 Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: returned from unix (rlm_unix) for request 0 Fri Oct 17 10:47:33 2008 : Debug: ++[unix] returns notfound Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Fri Oct 17 10:47:33 2008 : Debug: users: Matched entry cert at line 76 Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Fri Oct 17 10:47:33 2008 : Debug: ++[files] returns ok Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: calling expiration (rlm_expiration) for request 0 Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: returned from expiration (rlm_expiration) for request 0 Fri Oct 17 10:47:33 2008 : Debug: ++[expiration] returns noop Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: calling logintime (rlm_logintime) for request 0 Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: returned from logintime (rlm_logintime) for request 0 Fri Oct 17 10:47:33 2008 : Debug: ++[logintime] returns noop Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 0 Fri Oct 17 10:47:33 2008 : Debug: rlm_pap: Found existing Auth-Type, not changing it. Fri Oct 17 10:47:33 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 0 Fri Oct 17 10:47:33 2008 : Debug: ++[pap] returns noop Fri Oct 17 10:47:33 2008 : Debug: rad_check_password: Found Auth-Type EAP Fri Oct 17 10:47:33 2008 : Debug: auth: type "EAP" Fri Oct 17 10:47:33 2008 : Debug: +- entering group authenticate Fri Oct 17 10:47:33 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 0 Fri Oct 17 10:47:33 2008 : Debug: rlm_eap: EAP Identity Fri Oct 17 10:47:33 2008 : Debug: rlm_eap: processing type md5 Fri Oct 17 10:47:33 2008 : Debug: rlm_eap_md5: Issuing Challenge Fri Oct 17 10:47:33 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 0 Fri Oct 17 10:47:33 2008 : Debug: ++[eap] returns handled Sending Access-Challenge of id 13 to 10.0.31.40 port 1645 EAP-Message = 0x0102001604105b73da6c29c23d1018905b343c4fb5c9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x267005d0267201665ceab013c67b6d34 Fri Oct 17 10:47:33 2008 : Debug: Finished request 0. Fri Oct 17 10:47:33 2008 : Debug: Going to the next request Fri Oct 17 10:47:33 2008 : Debug: Waking up in 4.9 seconds. a question: this certificate I'm going to install on multiple computers, can I generate problems that?

2 1

[awful patch] "Multiple levels of TLS nesting is invalid."
by Matt Bernstein 17 Oct '08

17 Oct '08

So saith FreeRADIUS 2.1.1, but I wasn't trying to do multiple levels of TLS nesting. I'm trying to use virtual servers so that a single radiusd can terminate TTLS/PEAP for multiple subrealms, _and_ use the inner-tunnel trick, keeping the configs completely independent for each subrealm. This allows me to hook up different departments with different AAA infrastructures into one radius set-up for our eduroam service. My "default" server has a pair of listen{} blocks, and little else: authorize { suffix } authenticate { } So, rlm_realm finds my virtual servers in proxy.conf, eg: realm dcs.qmul.ac.uk { nostrip virtual_server = dcs } ..and "dcs" has its own EAP config, which references a virtual_server "dcs-inner" for the PEAP/TTLS innards, which has _its_ own EAP config. My problem is that eap.c (line 219), as called by "dcs-inner", notices the request has a grandparent, and assumes it's multiple layers of TLS nesting. Interestingly, the comment omits the magic word "TLS". I think perhaps that the virtual servers appear to count as layers. Anyway, this braindead patch makes it work for me: --- freeradius-server-2.1.1/src/modules/rlm_eap/eap.c.orig 2008-09-25 09:41:26.000000000 +0100 +++ freeradius-server-2.1.1/src/modules/rlm_eap/eap.c 2008-10-14 15:19:53.800553926 +0100 @@ -216,10 +216,13 @@ /* * Multiple levels of nesting are invalid. */ - if (handler->request->parent && handler->request->parent->parent) { - RDEBUG2("Multiple levels of TLS nesting is invalid."); + if (handler->request->parent && handler->request->parent->parent && handler->request->parent->parent->parent ) { + RDEBUG2("Multiple levels of TLS nesting is really invalid."); return EAP_INVALID; } + if (handler->request->parent && handler->request->parent->parent) { + RDEBUG2("Multiple levels of nesting is thought invalid, continuing anyway."); + } /* * Figure out what to do. ..and my "radiusd -X" output now looks like this: Found Auth-Type = dcs-inner-eap +- entering group authenticate {...} [dcs-inner-eap] Request found, released from the list [dcs-inner-eap] Multiple levels of nesting is thought invalid, continuing anyway. [dcs-inner-eap] EAP/mschapv2 [dcs-inner-eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Found NT-Password [mschap] Told to do MS-CHAPv2 for username(a)dcs.qmul.ac.uk with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[dcs-inner-eap] returns handled So.. I hope this is useful. Do drop me a mail on- or off-list on <mb/freeradius(a)dcs.qmul.ac.uk>, if you want any further information or if I'm not being clear enough. Matt

3 7

Mschapv2 not working! Please help!
by saini_jas16 17 Oct '08

17 Oct '08

Hello All, I am trying to authenticate a Windows XP Client with the username and password configured in the Users file on the Radius Server. I have tried saveral changes, but I am not able to get rid of this error. I am running freeradius 2.1.1 on Suse 10 SP1. Kindly Help, I am in urgent need of making this radius server up and running. Below is the error I am receiving. rad_recv: Access-Request packet from host 130.1.254.174 port 20000, id=212, length=182 NAS-Port-Id = "2049/1" Calling-Station-Id = "00-1F-3B-70-5B-7F" Called-Station-Id = "00-18-6E-30-70-C0:NYCC_TEST" Service-Type = Framed-User User-Name = "jaswinder" State = 0x2aaca71b29aabed260fc846046180105 EAP-Message = 0x02060021198000000017150301001294659677442f8e7a361ee8ee93374c90ed53 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = 130.1.254.174 Message-Authenticator = 0xe42d1530c16b34c5b74bfb4c486083aa +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jaswinder", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 33 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 23 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied [peap] WARNING: No data inside of the tunnel. [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Tunneled data is invalid. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jaswinder attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Any help is greatly appreciated. Thanks, Jas -- View this message in context: http://www.nabble.com/Mschapv2-not-working%21-Please-help%21-tp20015619p200… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 14

Changes made
by Martin MacLeod-Brown 17 Oct '08

17 Oct '08

Ok, after a bit of googling and some feedback from the mailing list - here is my new sanity check In radius.conf ldap { server = "ldap-master.london.edu" identity = "cn=NetworkAuth,ou=People,o=london.edu,o=lbs" password = ********* basedn = "ou=People,o=london.edu,o=lbs" filter = "(uid=%u)" start_tls = no access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap base_filter = "(objectclass=people)" quote >DEFAULT Auth-Type = LDAP > Fall-Through :=1 > Don't do that. You can configure ldap module to set auth type itself. Ok fair enough, I have changed it back to DEFAULT Auth-Type = System Fall-Through = 1 Im confused - where can I set ldap module to set auth type itself.???? Find radiusd belonging to freeradius and run it. It would appear to be running... root@morpheus:/etc/freeradius# ps -ef |grep radiusd root 24106 11597 0 14:36 pts/1 00:00:00 grep radiusd Martin Macleod-Brown | Infrastructure Engineer - Networks & Security Infrastructure Team London Business School | Regent's Park | London NW1 4SA | United Kingdom Switchboard +44 (0)20 7000 7000 | Direct line +44 (0)20 7000 7772 | Mobile +44 (0)796 690 7772 | Email mmacleod(a)london.edu <mailto:mmacleod@london.edu> www.london.edu <http://www.london.edu> | London experience. World impact. Please consider the environment before printing this email ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System on behalf of the London Business School community. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

2 1

What Have I missed out?
by Martin MacLeod-Brown 17 Oct '08

17 Oct '08

Hi there, Im trying to get a basic radius set-up working and could do with a sanity check as it is not working? Steps taken so far 1) Default radius install on Unbuntu server (apt-get install freeradius freeradius-ldap) 2) In radiusd.conf - configure LDAP server properties in the modules section ldap { server = "ldap-master.london.edu" identity = "cn=NetworkAuth,ou=People,o=london.edu,o=lbs" password = ********* basedn = "ou=People,o=london.edu,o=lbs" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" Uncommented the following line: # ldap File: /etc/freeradius/radiusd.conf - Authentication Section. Uncommented the following three lines: # Auth-Type LDAP { # ldap # } File: /etc/freeradius/users Find: DEFAULT Auth-Type = System Fall-Through = 1 Replace with: DEFAULT Auth-Type = LDAP Fall-Through :=1 File: /etc/freeradius/clients.conf client 127.0.0.1 { secret = testing123 shortname = localhost nastype = other } Now when I try to test I get the following error radclient: no response from server for ID 80 Looking in the radius.log - I get no output at all from a tail -f command Putting the server into debug mode I get root@morpheus:/etc/freeradius# radiusd -X The program 'radiusd' can be found in the following packages: * radiusd-livingston * yardradius * xtradius Try: apt-get install <selected package> bash: radiusd: command not found This is now making me thing I have not installed it properly? Any pointers gratefully received :-) Thanks Martin Martin Macleod-Brown | Infrastructure Engineer - Networks & Security Infrastructure Team London Business School | Regent's Park | London NW1 4SA | United Kingdom Switchboard +44 (0)20 7000 7000 | Direct line +44 (0)20 7000 7772 | Mobile +44 (0)796 690 7772 | Email mmacleod(a)london.edu www.london.edu | London experience. World impact. Please consider the environment before printing this email ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System on behalf of the London Business School community. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

3 2

SQL Query question
by andreiv 17 Oct '08

17 Oct '08

Hi everybody, I'm using 2 Freeradius 2.0.5 servers for writting Accounting Requests into separate Oracle DBs (one for each server ). let's say one of the servers stops. On restart I need the radius server to execute a stored procedure that will syncronize the DBs. is it possible to execute this procedure without any accounting requests coming in ? -- View this message in context: http://www.nabble.com/SQL-Query-question-tp19992564p19992564.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 7

authenticate windows pc to samba/openldap
by alois blasbichler 17 Oct '08

17 Oct '08

Hello list I want to let authenticate the computer-account to radius - naturaly only computers who are in my samba-domain and also stored in my openldap-db like a laptop : uid=inf-lap-1$,ou=samba-computers,dc=sb-brixen,dc=it but from radius i get an error that this laptop was not found - is this a impostation of my client ? What can i do ? here my log by and thanks luis [suffix] No '@' in User-Name = "host/inf-lap-1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 10 length 73 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for host/inf-lap-1 WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=host/inf-lap-1) expand: dc=sb-brixen,dc=it -> dc=sb-brixen,dc=it rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=sb-brixen,dc=it, with filter (uid=host/inf-lap-1) request done: ld 0x8180140 msgid 5 rlm_ldap: object not found or got ambiguous search result [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop

1 0

pool name per nas AND per user
by Alexandre Chapellon 17 Oct '08

17 Oct '08

Hello, I have freeradius authenticating ADSL users (several types ADSL). request are comming from several BAS (my NASes). I would like freeradius to give customers IP addresses from differents IP pools based on the NAS from which the request come from (huntgroups does it perfectly today) but also based on the type for ADSL is authenticated (this information is stored in the sql database and so the NAS is completely unaware of it) ex: As a reminder, i want thoose pools pool_NAS1_ADSL512 pool_NAS1_ADSL1024 pool_NAS2_ADSL512 pool_NAS2_ADSL1024 if i am user1 who owns a 1024kb/s ADSL account, I want to have Pool-Name pool_NAS1_ADSL1024 if the request comes from NAS1 and pool_NAS2_ADSL1024 if the request comes from NAS2...and so on. Any idea?

4 9

Problems with EAP authentication
by Tomislav Goluza 17 Oct '08

17 Oct '08

I have a problem authenticating with Cisco Aironet 1200 access point. I have valid certificates on my laptop and on Freeradius. This is the output on AP: Interface Dot11Radio0, Deauthenticating Station 001e.4c8c.8406 Reason: Sending station has left the BSS Interface Dot11Radio0, Station NBD7FB3G3J 001e.4c8c.8406 Associated KEY_MGMT[NONE] 3 Interface Dot11Radio0, Deauthenticating Station 001e.4c8c.8406 Reason: Previous authentication no longer valid This is what I get on freeradius: [root@radius ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "root" main: group = "root" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "freeradius" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests.rad_recv: Access-Request packet from host 192.168.177.121:1645, id=23, length=149 rad_recv: Access-Request packet from host 192.168.177.121:1645, id=24, length=256 User-Name = "radius.rc.internal" Framed-MTU = 1400 Called-Station-Id = "000f.9093.b5c0" Calling-Station-Id = "001e.4c8c.8406" Service-Type = Login-User Message-Authenticator = 0x6fe0a230a00d77e3336c69daf8d5f435 EAP-Message = 0x020300700d800000006616030100610100005d030148f73a1b8c1dcc0750843f75c1f268c7dc1c034d6fb2487d406bcffe5d6cf4d600003600390038003500160013000a00330032002f0007006600050004006300620061001500120009006500640060001400110008000600030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 261 State = 0x4f843413ae6144aacc887d596ec6161b NAS-IP-Address = 192.168.177.121 NAS-Identifier = "AP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "radius.rc.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 112 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 159 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0654], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 010d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a5], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 24 to 192.168.177.121 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4091" EAP-Message = 0x0104040a0dc000000864160301004a02000046030148f73ae365e1f568fdc304f234482bb240a3a4c83815c22e71f46149d04fc67620cced767dfe705a0f1ff39a336f762a5982fbf84203e198293e429822cd1999b600390016030106540b00065000064d0002a7308202a33082020ca003020102020101300d06092a864886f70d0101050500308191310b300906035504061302706b311530130603550408130c70616b68746f6f6e6b687761311330110603550407130a6162626f747461626164310f300d060355040a0c06c29e63696974311b3019060355040313127261646975732e72632e696e7465726e616c3128302606092a864886f70d EAP-Message = 0x0109011619726e644070656163652e6e6f7440636969742e6e65742e706b301e170d3038303830343036333034365a170d3039303830343036333034365a308183310b300906035504061302706b311530130603550408130c70616b68746f6f6e6b687761311330110603550407130a6162626f747461626164310d300b060355040a130463696974311b3019060355040313127261646975732e72632e696e7465726e616c311c301a06092a864886f70d010901160d726e644070656163652e6e6f7430819f300d06092a864886f70d010101050003818d0030818902818100c5a299bdab568d9d2cd1d6e53c6af5e2baeec9ffb8c9b29a5031f256 EAP-Message = 0x37c92cc0751ee4787911dbdf4ec0e41c722f80c246da7276928b20cc8a803ee1ef33cf4debdf3bbf831d5f50d022362bfea7894c1099b5302255df7d8be28a1c3c540b6f97e6059a2ac5de07343358214d6b64c20f6bfd3d56324e1a2c9c372ecc4b0df70203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000381810013677557b079795d7bd6a10067bcb55a9ccb70ed11143aaed9e7678b0282ac72b05414c42b264b28d23b161758a4bdfab4456459fd5ff8c471be519168062a792e17e274140b9c0860d07e83aa7b2835365172967507debaffed053dd297138db5d8ec5d335655c9 EAP-Message = 0xdbff6196ad607f4b8af88bba741f77227c5b389b902bcd720003a03082039c30820305a003020102020900d0b963753ebde4ab300d06092a864886f70d0101050500308191310b300906035504061302706b311530130603550408130c70616b68746f6f6e6b687761311330110603550407130a6162626f747461626164310f300d060355040a0c06c29e63696974311b3019060355040313127261646975732e72632e696e7465726e616c3128302606092a864886f70d0109011619726e644070656163652e6e6f7440636969742e6e65742e706b301e170d3038303830313037303635325a170d3138303733303037303635325a308191310b3009 EAP-Message = 0x06035504061302706b311530130603550408130c7061 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5dbbf6bd35b4c1f6c4bd34a2cd101387 Finished request 1 Going to the next request Waking up in 6 seconds...

2 1

Send me an SMS
by Sunkara RaviPrakash 17 Oct '08

17 Oct '08

1 0