- Freeradius-Users - lists.freeradius.org

Freeradius, PEAP, Active Directory and --require-membership-of
by Vieri 03 Oct '08

03 Oct '08

Hi, I'm running freeradius-2.0.5 on Linux. My setup is as follows: Windows Vista native client - Linksys AP - FreeRadius Linux server (PEAP/mschapv2) - Active Directory Windows server Everything works smoothly with the following ntlm_auth parameters in the mschap module: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" However, user authentication is rejected when I add the --domain parameter: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-D omain} --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" (from the Windows Vista client I obviously set the DOMAIN filed; besides, if I run the freeradius daemon with debug enabled I see that it "correclty" reeives 'DOMAIN\username') For starters, I don't understand why authentication fails if I add --domain. How can I find out why? Then, adding --require-membership-of with or without --domain also fails. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-D omain} --username=%{Stripped-User-Name:-%{User-Name:-None}} --require-membership-of='DOMAIN\\WIFI' --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Finally, running ntlm_auth from the command line yields: # ntlm_auth --request-nt-key --domain=DOMAIN --username=myuser --require-membership-of='DOMAIN\\WIFI' password: NT_STATUS_OK: Success (0x0) Could it be a "bug" in the freeradius version I'm running? Can anyone please suggest how I can debug this (not a radius expert ;-) )? Regards, Vieri

6 10

The client does not connect _*_*_*_
by Martin Silvero 03 Oct '08

03 Oct '08

Well, monitoring and testing in the log have this: Going to the next request Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=68, length=144 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xb7ec9c58aef5995fa1beeaf9fb22d535 EAP-Message = 0x0201000d016d73696c7665726f NAS-Port-Type = Wireless-802.11 NAS-Port = 278 NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 68 to 10.0.31.40 port 1645 EAP-Message = 0x0102001604100150e2e5a3af2f9bf6b494482cd5b15c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c4703a0f252b64ab3b8aac1c Finished request 63. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=69, length=155 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x32c823b2ce943c46fe0003306353f899 EAP-Message = 0x02020006030d NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c4703a0f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/tls rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 69 to 10.0.31.40 port 1645 EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c571330f252b64ab3b8aac1c Finished request 64. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=70, length=259 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x81272adb33bde6be5f5504b71ab4a408 EAP-Message = 0x0203006e0d8000000064160301005f0100005b030148e6393e196c12f7838dcd0d7a1694260cf59192b892175d80ab559c8c0d2a2c00003400390038003500160013000a00330032002f006600050004006500640063006200610060001500120009001400110008000600030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c571330f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 110 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 100 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 005f], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 084d], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a4], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 70 to 10.0.31.40 port 1645 EAP-Message = 0x010404000dc000000b5c160301004a02000046030148e6393f8cf1a3361f16721360b5d45888974900d9d8b23589586a54fe51948e20d797947a00be4bc79252c1053e25d5fce0cedf6011d6ec9db492fd852b63101f003900160301084d0b00084900084600039e3082039a30820282a003020102020101300d06092a864886f70d0101040500308190310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e30 EAP-Message = 0x1c06035504031315436572746966696361746520417574686f72697479301e170d3038303931313139333132345a170d3039303931313139333132345a3077310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c060355040a130549504c414e311b3019060355040313125365727665722043657274696669636174653124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e617230820122300d06092a864886f70d01010105000382010f003082010a0282010100cb176f82821ac53bae0ad6d892dc2fbc02bd709cfd64b2f81bf01398427a953dc2b95534af53 EAP-Message = 0xad5703b2d29b3907f7024d696fe1052b8a17e4e75a68ddaa7c71cae9e65a97275165e2c70edcaa483683b0dcd11b16eb3390c227d7dd513bcd994aae66c7edd36e527c7252c9100d6393d6f61b8a3f3a33bc2f010bd55f4d235582390de19faeb2c875d8d16abe3fc6c7ad9584c90f14e921e374873ab54996ae6e1e913105cccd7b3b17d9b7549e763a5e1a2bd5275bdb2a22326801738ef91eebe62254ed7169c4e228001e2632103b1f38440018088f1eaf6a67c4aa787e0b7742fd4b079bb054222f70b468d2beeed58097b09b1431aa547805ca87260e090203010001a317301530130603551d25040c300a06082b06010505070301300d06092a EAP-Message = 0x864886f70d0101040500038201010006bd989e695b4fc7051fed5d91b62cf1a0d75072e293faf15aa1b638ef07fecded678c1b5533c133c1a0ee2ee602a00def36556a8949260a6772f910c440a42fac024f1827575721130d2f6b5cedd85e0340439a0f651d2c9467054fb89817af3aef0d8a2a41168ff857d047d8ff5e9803dadd7f7946106856fc04fb9f38ff21bd3ff5999113806e7d01669f0e27c1e6be50228a4151e3d39acdc5a6c29ec9b9730055cca50e4d33f8a1c071d84d5df62823125a61a4e3c4d958e83c9218b2a6c3635da4e41c12e403ded5b2c2450e8f04ca53684d2e64cbbc6ccb2351e38207a19f7a9352bec178c892deace531 EAP-Message = 0x99099dcd2c06b6668361b45a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c676330f252b64ab3b8aac1c Finished request 65. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=71, length=155 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xb611e618564f594f59b8a57688c4fc6a EAP-Message = 0x020400060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c676330f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 71 to 10.0.31.40 port 1645 EAP-Message = 0x010504000dc000000b5ce3115e02e0670004a23082049e30820386a003020102020900d9dcff3987698a72300d06092a864886f70d0101050500308190310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f72697479301e170d3038303931313139323934345a170d3038313031313139323934345a308190310b3009060355040613024152 EAP-Message = 0x311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100b326eafca1440742350e357c49fc3ee99823cf82af887f2dab58faf782484e2b9a485b317ded6bd95fa746ef0432c96862dccbaad3d3a619da14c1cf684e530ca3003e18d9ab94284e31330b287dfe3e008c9ac54abc5acde9 EAP-Message = 0x1c85dd20c770467b546d8318c8d17e35709e704dec48b86afca059031c13a2130af97820bd7cfe73ab906acf847bc711184d0e9fba4377647754f6ab75717a7eda6ecc046bda89a0b147271fcdb84b094da53e168e2f83710e72f79fb4a4153ead2b7548dcf5f9d9789b3e0a46f21540659a9b30e834d5ab33184feec0ded43ba366d7b45bf5dec22d5670a7e8c34eb55aa593fc9021c7ec114a6bc0e116711efa8d39ec5617e90203010001a381f83081f5301d0603551d0e04160414783ebd2ad86bb68a828aa2e0b63806cfd5bf7ab03081c50603551d230481bd3081ba8014783ebd2ad86bb68a828aa2e0b63806cfd5bf7ab0a18196a481933081 EAP-Message = 0x90310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f72697479820900d9dcff3987698a72300c0603551d13040530030101ff300d06092a864886f70d010105050003820101001ec43670817b76126b2433fb85bf51d67870b4c4d7e6774e3c5f450c8d1e5d0d7a878812c09decd07d3aa00386d7e9a3f0ff78015767d94a7063fbc62418fc EAP-Message = 0x66d1badfb2f5a6654185c9e8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c777330f252b64ab3b8aac1c Finished request 66. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=72, length=155 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x2851fcc991a9202cc513a5ad8b42d88d EAP-Message = 0x020500060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c777330f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 72 to 10.0.31.40 port 1645 EAP-Message = 0x0106037a0d8000000b5c84d54ba8eb7d1802bb33ae272c6ae33a1f371394cacbfdc36c0dd90cd2a45b27e851fa308b5afba9c3084e6fe8eb04a2c296f328c401c5fd131e275d36db6fe471266bac60ac03bc52671946d3813931fa806d21dd0ad1bf1d243efb8c87cfac21b3bc3f6388cee5f661fcbc6f4f101d4e70989b243cb7a2612249a8918caef66497b10c9d61628506926941bd2d114d976fb8cbe71258686aaea6a0bb5e5c1527ec23b08c068a530e03a74878d6865971666abb10160301020d0c0002090080ad2df571269b93a787f80235487c28f730b4907620fed69ef713bb4f43d3579e11b02fbf45ab4e74cf79b5d447af0fe6805157 EAP-Message = 0x482f2b5f8185c4cc59061e6882ab9e4dd6def0736c0583158ab64a30e9a2de020c5e4f7a41b4c58149a9b110a6d3b521f30e96e82b2b43f2d0d1a699b6484f8c814f72d4fe8fc11d7943f2c6a300010200807eb17e2cd3bfe68954119040daeedff8b2dc0f3023ecc737b3a453b849a6725a6a17f801675e8821a4fc4cddb378120790c895fe52327e02e8f9c6e8f9ec839f7defbb6ff24ce37109716f9036c08068ff8831d267f1bad81afb6e34b1bf3311e69fece8ba8a23f36cd8d30950fb02bf350c76523ca7648447a0cf838438d6230100a9bd246a3c125ff2d25837a5df1922c8e4e41cc543755bee745d052ab78c4166ba6f335041d76861c5 EAP-Message = 0xc740bad59cc9d2b8901fba33e059f7f57eee59d50dff516179b5711c69c66b23f84f4c23976bfcb43b165784d36e4cdf6fae15d73158919ac4399fa34e7d072443949445c14474daa34cf2879b6af859b0ae20854b3b884baa36d9a3efa6ba97011e1d1f7b4807341d9386dc3d6047ed366d83a9c5b511071cc08bc7fa680064cad079a244fed8702ff7176d54f3de6a49fa7de1724dfa657681c3a762f16e264bfe145511225959cbe539409a8cfe85d4bb384d1a05e928d5de903c99dd5da60549dcbd39bba7953a3ead5575372e0f37f8ebf688e82516030100a40d00009c040304010200950093308190310b300906035504061302415231153013 EAP-Message = 0x0603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f726974790e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c074330f252b64ab3b8aac1c Finished request 67. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=73, length=1539 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xab3523198d100765a920a24032159941 EAP-Message = 0x020605640d800000055a16030103840b00038000037d00037a308203763082025ea003020102020102300d06092a864886f70d01010405003077310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c060355040a130549504c414e311b3019060355040313125365727665722043657274696669636174653124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172301e170d3038303931313139333731355a170d3039303931313139333731355a306d310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c0603 EAP-Message = 0x55040a130549504c414e3111300f060355040313086d73696c7665726f3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e617230820122300d06092a864886f70d01010105000382010f003082010a0282010100df4cf6b433a99e968c3032dc86887f26d20b302e996519460cd0c816fe3b4513794e0dd0c40ad573e59684615ab282db1af575f30ab44493abfeaf28154490523082d8531d282d79b4074aae96899c864baf660ebffe60ce1321de0a92cd6fc39b068e068195e4c9e6796de0c812420773f104d59b68f4e2ebc62ac86c02fdc22be08f0da9f12fece103fcaf1d3b45f0c63a0fa55da1aeeb26 EAP-Message = 0x9abff0c6a02984eaea3005d9b8e5c7e1c8bf191f326dd809ea05de48f245223e1ba582587119ded08144006ab2601daf6a405720ed912c9fa976bf8c3450f9a343ffd630530f144dca9e338915de3c1bee28a4d62142bc12541caeb7e6f5315da70fa7879fd79d0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d01010405000382010100c7b5c38930036400b1bba7dc9dcceef40b155059e124b445dd9600c8a00bab47396d76f2f9c42f40ae4a799dd9ef67169d7d748f6967f0474f46366ae80b325dad23879616f8889a5e182d89bdab15e1bbbf6b708054059e55e21eceab9115bc7d494753 EAP-Message = 0xfdcd0cb2c1323d872065465f112d9faabf1ebaef18cb615b818523e10b1c097b9dd4e170c9520bbf3e38e07c4001f6636739e2a756ccd7fc92d180edd66d493dc87a351b4f9203d8c9c034a1efc4b735727b7d04d3e9192ac68a4b33179eb1d2c671486551668a27d712e315aa7cd3f1d2ab328d89a41ccb3404435a493d644b67e64696d642c01c06f54f872d6a8744c6478cfd22f42d42b4021be3160301008610000082008009d50971946c422ae7a50a343bf17f7e5fc6097c5f8cddde0c246670bdd56771841c746db55bd3b8c450850b9ad84e4a99aea116ef578aed3102a603be729aef0fdc879a7578b5a98d94549f9810d1be6a06113673a2 EAP-Message = 0x30e516579b67463d93e885e58c9adced68eecb9f106a7b1554c83307f5b993acf3beb4b9016ef5a19fa116030101060f0001020100a6276e0d6682c25fe886c3d80cb517f574b630e6d1ffc2cf8a90b699b8a0c98e7317b6b4a391330a221c1c23717d9fce471df755ddcb5a49e3ad3417d096dda1d8f55fdb80fe095e7f50e950d66b1be490f52fc97e3c47364cac2391e25d24f196ea4d57e7059dae449cd52c47d3b660b49f5d3b180956a56d9897c46e61f5a9ea862b89807f1ce792ce5b9f99d8be3126eabbbb4fb6fbb93e13223c203ccd159c43afd3bce3538b22d4187c31f4a7cb583efa74a34bf2ce2d22bb7f455ad67b2a9928e0b5deb8d2 EAP-Message = 0x2c8c0542ba87680a7062650816c023c0f3c1fdfa5f1aa4d89030a65b59673d6b9990835818a5ad2d986f3ee9732c6c73bbd24646007fc2ef140301000101160301003029d9e8b20a09e539534830d4eaa73fc19de54c7b9ed0d2586ac9c1adda6438ef3ba746c7c1fa18ad064d0a222d1489ce NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c074330f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 1370 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0384], Certificate --> verify error:num=20:unable to get local issuer certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> msilvero attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 73 to 10.0.31.40 port 1645 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000

2 1

The client does not connect _*_*_*_
by Martin Silvero 03 Oct '08

03 Oct '08

ok tnt, I try that with the application, testing and do you notice. Thank you very much!

1 0

The client does not connect _*_*_*_
by Martin Silvero 03 Oct '08

03 Oct '08

the problem is... when I want to connect from the notebook to the network radius, asking me to configure the profile to the type of authentication, and so on. what set everything is ready and when I try to connect but does not connect to the server and are not recorded requests. on the server are not recorded movements, and the notebook does not show any error. I have no firewall either. Got it? the ping's respond well in both directions.

2 1

The client does not connect _*_*_*_
by Martin Silvero 03 Oct '08

03 Oct '08

sorry!!!!!!!! what they say is ... The access point has an IP 10.0.31.x and is included within raddb/client.conf, forget the IP 10.0.42.250 because I connect to that network to another topic. The server is in the 10.30.1.x , we do not need to be on the same network because they are VLAN ruteables. Pinging responds well. What could be the problem? -- -- Silvero Martin

3 2

strange rlm_expiration behavior
by Flamur Rogova 03 Oct '08

03 Oct '08

Hi, I am having strange behavior of rlm_expiration where it always returns "userlock", no matter what I put as expiration value. my radius install is latest from git repository, with default configuration (unchanged in any way), rlm_expiration rejects this user, date "10 Jan 2009", although it should be accepted... could somebody confirm working rlm_expiration on latest sources ? home raddb # cat users a Cleartext-Password := a, Expiration := "10 Jan 2009" Reply-Message = "ok" home raddb # ../../sbin/radiusd -XX Wed Oct 1 11:22:37 2008 : Info: FreeRADIUS Version 2.1.1, for host i686-pc-linux-gnu, built on Oct 1 2008 at 21:32:48 Wed Oct 1 11:22:37 2008 : Info: Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. Wed Oct 1 11:22:37 2008 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Wed Oct 1 11:22:37 2008 : Info: PARTICULAR PURPOSE. Wed Oct 1 11:22:37 2008 : Info: You may redistribute copies of FreeRADIUS under the terms of the Wed Oct 1 11:22:37 2008 : Info: GNU General Public License v2. Wed Oct 1 11:22:37 2008 : Info: Starting - reading configuration files ... Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/radiusd.conf Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/proxy.conf Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/clients.conf Wed Oct 1 11:22:37 2008 : Debug: including files in directory /home/radius2.11/etc/raddb/modules/ Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/radutmp Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/pap Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/logintime Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/detail Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/realm Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/acct_unique Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/expr Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/mac2vlan Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/files Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/echo Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/mschap Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/preprocess Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/krb5 Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/pam Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/attr_rewrite Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/smbpasswd Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/policy Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/ldap Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/wimax Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/attr_filter Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/detail.log Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/mac2ip Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/always Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/sradutmp Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/checkval Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/inner-eap Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/detail.example.com Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/exec Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/passwd Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/digest Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/chap Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/linelog Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/etc_group Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/ippool Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/sql_log Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/counter Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/unix Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/modules/expiration Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/eap.conf Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/sql.conf Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/sql/mysql/dialup.conf Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/sql/mysql/counter.conf Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/policy.conf Wed Oct 1 11:22:37 2008 : Debug: including files in directory /home/radius2.11/etc/raddb/sites-enabled/ Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/sites-enabled/default Wed Oct 1 11:22:37 2008 : Debug: including configuration file /home/radius2.11/etc/raddb/sites-enabled/inner-tunnel Wed Oct 1 11:22:37 2008 : Debug: including dictionary file /home/radius2.11/etc/raddb/dictionary Wed Oct 1 11:22:37 2008 : Debug: main { Wed Oct 1 11:22:37 2008 : Debug: prefix = "/home/radius2.11" Wed Oct 1 11:22:37 2008 : Debug: localstatedir = "/home/radius2.11/var" Wed Oct 1 11:22:37 2008 : Debug: logdir = "/home/radius2.11/var/log/radius" Wed Oct 1 11:22:37 2008 : Debug: libdir = "/home/radius2.11/lib" Wed Oct 1 11:22:37 2008 : Debug: radacctdir = "/home/radius2.11/var/log/radius/radacct" Wed Oct 1 11:22:37 2008 : Debug: hostname_lookups = no Wed Oct 1 11:22:37 2008 : Debug: max_request_time = 30 Wed Oct 1 11:22:37 2008 : Debug: cleanup_delay = 5 Wed Oct 1 11:22:37 2008 : Debug: max_requests = 1024 Wed Oct 1 11:22:37 2008 : Debug: allow_core_dumps = no Wed Oct 1 11:22:37 2008 : Debug: pidfile = "/home/radius2.11/var/run/radiusd/radiusd.pid" Wed Oct 1 11:22:37 2008 : Debug: checkrad = "/home/radius2.11/sbin/checkrad" Wed Oct 1 11:22:37 2008 : Debug: debug_level = 0 Wed Oct 1 11:22:37 2008 : Debug: proxy_requests = yes Wed Oct 1 11:22:37 2008 : Debug: log { Wed Oct 1 11:22:37 2008 : Debug: stripped_names = no Wed Oct 1 11:22:37 2008 : Debug: auth = no Wed Oct 1 11:22:37 2008 : Debug: auth_badpass = no Wed Oct 1 11:22:37 2008 : Debug: auth_goodpass = no Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: security { Wed Oct 1 11:22:37 2008 : Debug: max_attributes = 200 Wed Oct 1 11:22:37 2008 : Debug: reject_delay = 1 Wed Oct 1 11:22:37 2008 : Debug: status_server = yes Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: client localhost { Wed Oct 1 11:22:37 2008 : Debug: ipaddr = 127.0.0.1 Wed Oct 1 11:22:37 2008 : Debug: require_message_authenticator = no Wed Oct 1 11:22:37 2008 : Debug: secret = "testing123" Wed Oct 1 11:22:37 2008 : Debug: nastype = "other" Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: client 10.241.21.202 { Wed Oct 1 11:22:37 2008 : Debug: require_message_authenticator = no Wed Oct 1 11:22:37 2008 : Debug: secret = "testing123" Wed Oct 1 11:22:37 2008 : Debug: shortname = "winxp" Wed Oct 1 11:22:37 2008 : Debug: nastype = "other" Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: radiusd: #### Loading Realms and Home Servers #### Wed Oct 1 11:22:37 2008 : Debug: proxy server { Wed Oct 1 11:22:37 2008 : Debug: retry_delay = 5 Wed Oct 1 11:22:37 2008 : Debug: retry_count = 3 Wed Oct 1 11:22:37 2008 : Debug: default_fallback = no Wed Oct 1 11:22:37 2008 : Debug: dead_time = 120 Wed Oct 1 11:22:37 2008 : Debug: wake_all_if_all_dead = no Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: home_server localhost { Wed Oct 1 11:22:37 2008 : Debug: ipaddr = 127.0.0.1 Wed Oct 1 11:22:37 2008 : Debug: port = 1812 Wed Oct 1 11:22:37 2008 : Debug: type = "auth" Wed Oct 1 11:22:37 2008 : Debug: secret = "testing123" Wed Oct 1 11:22:37 2008 : Debug: response_window = 20 Wed Oct 1 11:22:37 2008 : Debug: max_outstanding = 65536 Wed Oct 1 11:22:37 2008 : Debug: zombie_period = 40 Wed Oct 1 11:22:37 2008 : Debug: status_check = "status-server" Wed Oct 1 11:22:37 2008 : Debug: ping_interval = 30 Wed Oct 1 11:22:37 2008 : Debug: check_interval = 30 Wed Oct 1 11:22:37 2008 : Debug: num_answers_to_alive = 3 Wed Oct 1 11:22:37 2008 : Debug: num_pings_to_alive = 3 Wed Oct 1 11:22:37 2008 : Debug: revive_interval = 120 Wed Oct 1 11:22:37 2008 : Debug: status_check_timeout = 4 Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: home_server_pool my_auth_failover { Wed Oct 1 11:22:37 2008 : Debug: type = fail-over Wed Oct 1 11:22:37 2008 : Debug: home_server = localhost Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: realm example.com { Wed Oct 1 11:22:37 2008 : Debug: auth_pool = my_auth_failover Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: realm LOCAL { Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: radiusd: #### Instantiating modules #### Wed Oct 1 11:22:37 2008 : Debug: instantiate { Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_exec, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_exec Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating exec Wed Oct 1 11:22:37 2008 : Debug: exec { Wed Oct 1 11:22:37 2008 : Debug: wait = no Wed Oct 1 11:22:37 2008 : Debug: input_pairs = "request" Wed Oct 1 11:22:37 2008 : Debug: shell_escape = yes Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_expr, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_expr Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating expr Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_expiration, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_expiration Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating expiration Wed Oct 1 11:22:37 2008 : Debug: expiration { Wed Oct 1 11:22:37 2008 : Debug: reply-message = "Password Has Expired " Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_logintime, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_logintime Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating logintime Wed Oct 1 11:22:37 2008 : Debug: logintime { Wed Oct 1 11:22:37 2008 : Debug: reply-message = "You are calling outside your allowed timespan " Wed Oct 1 11:22:37 2008 : Debug: minimum-timeout = 60 Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: radiusd: #### Loading Virtual Servers #### Wed Oct 1 11:22:37 2008 : Debug: server inner-tunnel { Wed Oct 1 11:22:37 2008 : Debug: modules { Wed Oct 1 11:22:37 2008 : Debug: Module: Checking authenticate {...} for more modules to load Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_pap, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_pap Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating pap Wed Oct 1 11:22:37 2008 : Debug: pap { Wed Oct 1 11:22:37 2008 : Debug: encryption_scheme = "auto" Wed Oct 1 11:22:37 2008 : Debug: auto_header = no Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_chap, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_chap Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating chap Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_mschap, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_mschap Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating mschap Wed Oct 1 11:22:37 2008 : Debug: mschap { Wed Oct 1 11:22:37 2008 : Debug: use_mppe = yes Wed Oct 1 11:22:37 2008 : Debug: require_encryption = no Wed Oct 1 11:22:37 2008 : Debug: require_strong = no Wed Oct 1 11:22:37 2008 : Debug: with_ntdomain_hack = no Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_unix, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_unix Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating unix Wed Oct 1 11:22:37 2008 : Debug: unix { Wed Oct 1 11:22:37 2008 : Debug: radwtmp = "/home/radius2.11/var/log/radius/radwtmp" Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_eap, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_eap Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating eap Wed Oct 1 11:22:37 2008 : Debug: eap { Wed Oct 1 11:22:37 2008 : Debug: default_eap_type = "md5" Wed Oct 1 11:22:37 2008 : Debug: timer_expire = 60 Wed Oct 1 11:22:37 2008 : Debug: ignore_unknown_eap_types = no Wed Oct 1 11:22:37 2008 : Debug: cisco_accounting_username_bug = no Wed Oct 1 11:22:37 2008 : Debug: max_sessions = 2048 Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to sub-module rlm_eap_md5 Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating eap-md5 Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to sub-module rlm_eap_leap Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating eap-leap Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to sub-module rlm_eap_gtc Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating eap-gtc Wed Oct 1 11:22:37 2008 : Debug: gtc { Wed Oct 1 11:22:37 2008 : Debug: challenge = "Password: " Wed Oct 1 11:22:37 2008 : Debug: auth_type = "PAP" Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to sub-module rlm_eap_tls Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating eap-tls Wed Oct 1 11:22:37 2008 : Debug: tls { Wed Oct 1 11:22:37 2008 : Debug: rsa_key_exchange = no Wed Oct 1 11:22:37 2008 : Debug: dh_key_exchange = yes Wed Oct 1 11:22:37 2008 : Debug: rsa_key_length = 512 Wed Oct 1 11:22:37 2008 : Debug: dh_key_length = 512 Wed Oct 1 11:22:37 2008 : Debug: verify_depth = 0 Wed Oct 1 11:22:37 2008 : Debug: pem_file_type = yes Wed Oct 1 11:22:37 2008 : Debug: private_key_file = "/home/radius2.11/etc/raddb/certs/server.pem" Wed Oct 1 11:22:37 2008 : Debug: certificate_file = "/home/radius2.11/etc/raddb/certs/server.pem" Wed Oct 1 11:22:37 2008 : Debug: CA_file = "/home/radius2.11/etc/raddb/certs/ca.pem" Wed Oct 1 11:22:37 2008 : Debug: private_key_password = "whatever" Wed Oct 1 11:22:37 2008 : Debug: dh_file = "/home/radius2.11/etc/raddb/certs/dh" Wed Oct 1 11:22:37 2008 : Debug: random_file = "/home/radius2.11/etc/raddb/certs/random" Wed Oct 1 11:22:37 2008 : Debug: fragment_size = 1024 Wed Oct 1 11:22:37 2008 : Debug: include_length = yes Wed Oct 1 11:22:37 2008 : Debug: check_crl = no Wed Oct 1 11:22:37 2008 : Debug: cipher_list = "DEFAULT" Wed Oct 1 11:22:37 2008 : Debug: make_cert_command = "/home/radius2.11/etc/raddb/certs/bootstrap" Wed Oct 1 11:22:37 2008 : Debug: cache { Wed Oct 1 11:22:37 2008 : Debug: enable = no Wed Oct 1 11:22:37 2008 : Debug: lifetime = 24 Wed Oct 1 11:22:37 2008 : Debug: max_entries = 255 Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to sub-module rlm_eap_ttls Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating eap-ttls Wed Oct 1 11:22:37 2008 : Debug: ttls { Wed Oct 1 11:22:37 2008 : Debug: default_eap_type = "md5" Wed Oct 1 11:22:37 2008 : Debug: copy_request_to_tunnel = no Wed Oct 1 11:22:37 2008 : Debug: use_tunneled_reply = no Wed Oct 1 11:22:37 2008 : Debug: virtual_server = "inner-tunnel" Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to sub-module rlm_eap_peap Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating eap-peap Wed Oct 1 11:22:37 2008 : Debug: peap { Wed Oct 1 11:22:37 2008 : Debug: default_eap_type = "mschapv2" Wed Oct 1 11:22:37 2008 : Debug: copy_request_to_tunnel = no Wed Oct 1 11:22:37 2008 : Debug: use_tunneled_reply = no Wed Oct 1 11:22:37 2008 : Debug: proxy_tunneled_request_as_eap = yes Wed Oct 1 11:22:37 2008 : Debug: virtual_server = "inner-tunnel" Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating eap-mschapv2 Wed Oct 1 11:22:37 2008 : Debug: mschapv2 { Wed Oct 1 11:22:37 2008 : Debug: with_ntdomain_hack = no Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Module: Checking authorize {...} for more modules to load Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_realm, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_realm Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating suffix Wed Oct 1 11:22:37 2008 : Debug: realm suffix { Wed Oct 1 11:22:37 2008 : Debug: format = "suffix" Wed Oct 1 11:22:37 2008 : Debug: delimiter = "@" Wed Oct 1 11:22:37 2008 : Debug: ignore_default = no Wed Oct 1 11:22:37 2008 : Debug: ignore_null = no Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_files, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_files Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating files Wed Oct 1 11:22:37 2008 : Debug: files { Wed Oct 1 11:22:37 2008 : Debug: usersfile = "/home/radius2.11/etc/raddb/users" Wed Oct 1 11:22:37 2008 : Debug: acctusersfile = "/home/radius2.11/etc/raddb/acct_users" Wed Oct 1 11:22:37 2008 : Debug: preproxy_usersfile = "/home/radius2.11/etc/raddb/preproxy_users" Wed Oct 1 11:22:37 2008 : Debug: compat = "no" Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Module: Checking session {...} for more modules to load Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_radutmp, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_radutmp Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating radutmp Wed Oct 1 11:22:37 2008 : Debug: radutmp { Wed Oct 1 11:22:37 2008 : Debug: filename = "/home/radius2.11/var/log/radius/radutmp" Wed Oct 1 11:22:37 2008 : Debug: username = "%{User-Name}" Wed Oct 1 11:22:37 2008 : Debug: case_sensitive = yes Wed Oct 1 11:22:37 2008 : Debug: check_with_nas = yes Wed Oct 1 11:22:37 2008 : Debug: perm = 384 Wed Oct 1 11:22:37 2008 : Debug: callerid = yes Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Module: Checking post-proxy {...} for more modules to load Wed Oct 1 11:22:37 2008 : Debug: Module: Checking post-auth {...} for more modules to load Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_attr_filter Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating attr_filter.access_reject Wed Oct 1 11:22:37 2008 : Debug: attr_filter attr_filter.access_reject { Wed Oct 1 11:22:37 2008 : Debug: attrsfile = "/home/radius2.11/etc/raddb/attrs.access_reject" Wed Oct 1 11:22:37 2008 : Debug: key = "%{User-Name}" Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: modules { Wed Oct 1 11:22:37 2008 : Debug: Module: Checking authenticate {...} for more modules to load Wed Oct 1 11:22:37 2008 : Debug: Module: Checking authorize {...} for more modules to load Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_preprocess, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_preprocess Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating preprocess Wed Oct 1 11:22:37 2008 : Debug: preprocess { Wed Oct 1 11:22:37 2008 : Debug: huntgroups = "/home/radius2.11/etc/raddb/huntgroups" Wed Oct 1 11:22:37 2008 : Debug: hints = "/home/radius2.11/etc/raddb/hints" Wed Oct 1 11:22:37 2008 : Debug: with_ascend_hack = no Wed Oct 1 11:22:37 2008 : Debug: ascend_channels_per_line = 23 Wed Oct 1 11:22:37 2008 : Debug: with_ntdomain_hack = no Wed Oct 1 11:22:37 2008 : Debug: with_specialix_jetstream_hack = no Wed Oct 1 11:22:37 2008 : Debug: with_cisco_vsa_hack = no Wed Oct 1 11:22:37 2008 : Debug: with_alvarion_vsa_hack = no Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Module: Checking preacct {...} for more modules to load Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_acct_unique Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating acct_unique Wed Oct 1 11:22:37 2008 : Debug: acct_unique { Wed Oct 1 11:22:37 2008 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Module: Checking accounting {...} for more modules to load Wed Oct 1 11:22:37 2008 : Debug: (Loaded rlm_detail, checking if it's valid) Wed Oct 1 11:22:37 2008 : Debug: Module: Linked to module rlm_detail Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating detail Wed Oct 1 11:22:37 2008 : Debug: detail { Wed Oct 1 11:22:37 2008 : Debug: detailfile = "/home/radius2.11/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Wed Oct 1 11:22:37 2008 : Debug: header = "%t" Wed Oct 1 11:22:37 2008 : Debug: detailperm = 384 Wed Oct 1 11:22:37 2008 : Debug: dirperm = 493 Wed Oct 1 11:22:37 2008 : Debug: locking = no Wed Oct 1 11:22:37 2008 : Debug: log_packet_header = no Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Module: Instantiating attr_filter.accounting_response Wed Oct 1 11:22:37 2008 : Debug: attr_filter attr_filter.accounting_response { Wed Oct 1 11:22:37 2008 : Debug: attrsfile = "/home/radius2.11/etc/raddb/attrs.accounting_response" Wed Oct 1 11:22:37 2008 : Debug: key = "%{User-Name}" Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Module: Checking session {...} for more modules to load Wed Oct 1 11:22:37 2008 : Debug: Module: Checking post-proxy {...} for more modules to load Wed Oct 1 11:22:37 2008 : Debug: Module: Checking post-auth {...} for more modules to load Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: radiusd: #### Opening IP addresses and Ports #### Wed Oct 1 11:22:37 2008 : Debug: listen { Wed Oct 1 11:22:37 2008 : Debug: type = "auth" Wed Oct 1 11:22:37 2008 : Debug: ipaddr = * Wed Oct 1 11:22:37 2008 : Debug: port = 0 Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: listen { Wed Oct 1 11:22:37 2008 : Debug: type = "acct" Wed Oct 1 11:22:37 2008 : Debug: ipaddr = * Wed Oct 1 11:22:37 2008 : Debug: port = 0 Wed Oct 1 11:22:37 2008 : Debug: } Wed Oct 1 11:22:37 2008 : Debug: Listening on authentication address * port 1812 Wed Oct 1 11:22:37 2008 : Debug: Listening on accounting address * port 1813 Wed Oct 1 11:22:37 2008 : Debug: Listening on proxy address * port 1814 Wed Oct 1 11:22:37 2008 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 10.241.21.202 port 4870, id=80, length=41 User-Name = "a" User-Password = "a" Wed Oct 1 11:22:43 2008 : Info: +- entering group authorize {...} Wed Oct 1 11:22:43 2008 : Info: ++[preprocess] returns ok Wed Oct 1 11:22:43 2008 : Info: ++[chap] returns noop Wed Oct 1 11:22:43 2008 : Info: ++[mschap] returns noop Wed Oct 1 11:22:43 2008 : Info: [suffix] No '@' in User-Name = "a", looking up realm NULL Wed Oct 1 11:22:43 2008 : Info: [suffix] No such realm "NULL" Wed Oct 1 11:22:43 2008 : Info: ++[suffix] returns noop Wed Oct 1 11:22:43 2008 : Info: [eap] No EAP-Message, not doing EAP Wed Oct 1 11:22:43 2008 : Info: ++[eap] returns noop Wed Oct 1 11:22:43 2008 : Info: ++[unix] returns notfound Wed Oct 1 11:22:43 2008 : Info: [files] users: Matched entry a at line 1 Wed Oct 1 11:22:43 2008 : Info: ++[files] returns ok Wed Oct 1 11:22:43 2008 : Info: [expiration] Checking Expiration time: '10 Jan 2009' Wed Oct 1 11:22:43 2008 : Info: [expiration] Account has expired Wed Oct 1 11:22:43 2008 : Info: [expiration] expand: Password Has Expired -> Password Has Expired Wed Oct 1 11:22:43 2008 : Info: ++[expiration] returns userlock Wed Oct 1 11:22:43 2008 : Info: Using Post-Auth-Type Reject Wed Oct 1 11:22:43 2008 : Info: +- entering group REJECT {...} Wed Oct 1 11:22:43 2008 : Info: [attr_filter.access_reject] expand: %{User-Name} -> a Wed Oct 1 11:22:43 2008 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Oct 1 11:22:43 2008 : Info: ++[attr_filter.access_reject] returns updated Wed Oct 1 11:22:43 2008 : Info: Delaying reject of request 0 for 1 seconds Wed Oct 1 11:22:43 2008 : Debug: Going to the next request Wed Oct 1 11:22:43 2008 : Debug: Waking up in 0.9 seconds. Wed Oct 1 11:22:44 2008 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 80 to 10.241.21.202 port 4870 Reply-Message += "Password Has Expired\r\n" Wed Oct 1 11:22:44 2008 : Debug: Waking up in 4.9 seconds. Thanks, Flamur

4 4

Suggestions
by Bert Beaudin 03 Oct '08

03 Oct '08

Hello all I am looking to use Freeradius and Active Directory along with adding members to a group to secure telnet access to Cisco devices. I am looking for sugestions on the best way to do this. I have read though the how to at:http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HO WTO But I am not sure this is what I am trying to do. Any input is welcomed. Thanks, Bert Beaudin Systems Administrator RelianceGlobalcom Services, Inc. Office:303-785-6641 Cell:303-478-7789 Fax:415-677-9534 bbeaudin(a)relianceglobalcom.com <mailto:bbeaudin@relianceglobalcom.com> www.relianceglobalcom.com <blocked::http://www.yipes.com/>

3 2

The client does not connect _*_*_*_
by Martin Silvero 02 Oct '08

02 Oct '08

I do not understand what I want to say

1 0

Compile Error :FreeRadius v 2.1.1 RPM build error
by Syed Anwarul Hasan 02 Oct '08

02 Oct '08

Hi Ala, Ivan and all, Alan as I having backtrace problem in my FreeRadius v 2.0.5. I deleted all the old binaries and libraries for the earlier version.Then I got the latest FreeRadius v 2.1.1 tarball (Compresses tar.bz2) from freeradius.orgwebsite and started to build on SLES 10 SP2. And I copied the freeradius.spec in SPECS folder. When I try to compile, I got an rpm build error and compilation stopped. Please help me in this regard. SYED pc1138: /usr/src/packages/SOURCES # *rpmbuild -ba /usr/src/packages/SPECS/freeradius.spec* Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.25117 + umask 022 + cd /usr/src/packages/BUILD + cd /usr/src/packages/BUILD + rm -rf freeradius-server-2.1.1 + /usr/bin/bzip2 -dc /usr/src/packages/SOURCES/freeradius-server-2.1.1.tar.bz2 + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd freeradius-server-2.1.1 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . ++ find . -name CVS + rm -rf + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.27085 + umask 022 + cd /usr/src/packages/BUILD + /bin/rm -rf /var/tmp/freeradius-server-2.1.1-build ++ dirname /var/tmp/freeradius-server-2.1.1-build + /bin/mkdir -p /var/tmp + /bin/mkdir /var/tmp/freeradius-server-2.1.1-build + cd freeradius-server-2.1.1 + export 'CFLAGS=-O2 -g -m32 -march=i586 -mtune=i686 -fmessage-length=0 -D_FORTIFY_SOURCE=2 -fno-strict-aliasing -DLDAP_DEPRECATED -fPIC -DPIC' + CFLAGS='-O2 -g -m32 -march=i586 -mtune=i686 -fmessage-length=0 -D_FORTIFY_SOURCE=2 -fno-strict-aliasing -DLDAP_DEPRECATED -fPIC -DPIC' + autoreconf configure.in:1140: warning: AC_CONFIG_SUBDIRS: you should use literals autoconf/status.m4:1077: AC_CONFIG_SUBDIRS is expanded from... configure.in:1140: the top level configure.in:1140: warning: AC_CONFIG_SUBDIRS: you should use literals autoconf/status.m4:1077: AC_CONFIG_SUBDIRS is expanded from... configure.in:1140: the top level configure.in:1140: warning: AC_CONFIG_SUBDIRS: you should use literals autoconf/status.m4:1077: AC_CONFIG_SUBDIRS is expanded from... configure.in:1140: the top level configure.in:547: error: possibly undefined macro: AC_LIB_READLINE If this token and others are legitimate, please use m4_pattern_allow. * * See the Autoconf documentation.* autoreconf: /usr/bin/autoconf failed with exit status: 1 error: Bad exit status from /var/tmp/rpm-tmp.27085 (%build)* *RPM build errors: Bad exit status from /var/tmp/rpm-tmp.27085 (%build)*

2 2

FW: FreeRadius
by Marcel Grandemange 02 Oct '08

02 Oct '08

>I have a working FreeRadius installation used for PPPOE clients using a Mikrotik NAS (Essentialy Linux) >I am using Freeradius to limit data a user can send/receive within a month and automatically reset it every month. >I used an example from chilliuspot hotspot for this. >However what im noticing is sometimes a customer gets denied access because he has exceeded he's monthly allowance, however when I check the >Db this is not the case cause it's the beginning of month. >This only happens sometimes so im lost! >I use sqlcounter.conf for the counter part of things and INCLUDE this from radius.conf. >sqlcounter monthlytraffic { > counter-name = Monthly-Traffic > check-name = Max-Monthly-Traffic > reply-name = Mikrotik-Xmit-Limit-Gigawords > sqlmod-inst = sql > key = User-Name > reset = monthly >query = "SELECT SUM(AcctInputOctets - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0))+ SUM(AcctOutputOctets -GREATEST((%b - >UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" >} >Anybody for input? I would greately appreciate help here! A Work around is to simply increase he's allowance till he is allowed to connect! Here is an update. I have created an entirely new account that has NO history and yet I get same issue. Following in radius.log Wed Oct 1 17:51:46 2008 : Auth: Invalid user (rlm_sqlcounter: Maximum monthly usage time reached): [njale/<CHAP-Password>] (from client OldPPPOES port 40541 cli 00:0C:29:0B:44:66) I kept increasing the data limit via dialupadmin till it allowed me to connect. Ideas? __________ NOD32 3485 (20081001) Information __________ This message was checked by NOD32 antivirus system. http://www.eset.com

4 14