- Freeradius-Users - lists.freeradius.org

compile freeradius 2.1.1 with eap-tls mysql openldap openssl
by Broussard Philippe 05 Oct '08

05 Oct '08

Hi, I try to compile freeradius with mysql and openldap aned eap-tls. Mysql and Openssl and Openldap are compiled with sources I use this configure's command line : CFLAGS="-I/opt/mysql/include -I/opt/openssl/include" LDFLAGS="-L/opt/mysql/lib -L/opt/openssl/lib" ./configure --prefix=/opt/freeradius-server-2.2.11 --localstatedir=/data/freeradius-server --with-threads --with-openssl --with-openssl-includes=/opt/openssl/includes --with-openssl-libraries=/opt/openssl/lib --enable-rlm-sql --enable-rlm-ldap --enable-rlm-eap --with-rlm-ldap-lib-dir=/opt/openldap/lib --with-rlm-ldap-include-dir=/opt/openldap/include --with-mysql-lib-dir=/opt/mysql/lib --with-mysql-include-dir=/opt/mysql/include I must have an error (syntax or not) in this line but i don't see. Could you help me, please, to find the correct command line ? Philippe System : Debian etch Openldap 2.3.35 or 2.4.11 Mysql 5.0.41 Openssl 0.9.8i Freeradius 2.1.1 See below the result of the configure : === configure: configuring in ./types/rlm_eap_tls configure: running /bin/sh './configure' --prefix=/opt/freeradius-server-2.2.11 '--prefix=/opt/freeradius-server-2.2.11' '--localstatedir=/data/freeradius-server' '--with-threads' '--with-openssl' '--with-openssl-includes=/opt/openssl/includes' '--with-openssl-libraries=/opt/openssl/lib' '--enable-rlm-sql' '--enable-rlm-ldap' '--enable-rlm-eap' '--with-rlm-ldap-lib-dir=/opt/openldap/lib' '--with-rlm-ldap-include-dir=/opt/openldap/include' '--with-mysql-lib-dir=/opt/mysql/lib' '--with-mysql-include-dir=/opt/mysql/include' '--enable-ltdl-install=no' '--cache-file=/dev/null' '--srcdir=.' --cache-file=/dev/null --srcdir=. checking for OpenSSL support... no configure: WARNING: silently not building rlm_eap_tls. configure: WARNING: FAILURE: rlm_eap_tls requires: OpenSSL. configure: creating ./config.status config.status: creating Makefile config.status: creating config.h === configuring in src/modules/rlm_ldap (/opt/sources/freeradius-server-2.1.1/src/modules/rlm_ldap) configure: running /bin/sh ./configure '--prefix=/opt/freeradius-server-2.2.11' '--localstatedir=/data/freeradius-server' '--with-threads' '--with-openssl' '--with-openssl-includes=/opt/openssl/includes' '--with-openssl-libraries=/opt/openssl/lib' '--enable-rlm-sql' '--enable-rlm-ldap' '--enable-rlm-eap' '--with-rlm-ldap-lib-dir=/opt/openldap/lib' '--with-rlm-ldap-include-dir=/opt/openldap/include' '--with-mysql-lib-dir=/opt/mysql/lib' '--with-mysql-include-dir=/opt/mysql/include' '--enable-ltdl-install=no' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for pthread_create in -lpthread... yes checking for ldap_init in -lldap_r... yes checking for ldap.h... yes checking for ldap_start_tls_s... yes checking for ldap_initialize... yes checking for ldap_int_tls_config... yes configure: creating ./config.status config.status: creating Makefile === configuring in ./drivers/rlm_sql_mysql (/opt/sources/freeradius-server-2.1.1/src/modules/rlm_sql/./drivers/rlm_sql_mysql) configure: running /bin/sh ./configure '--prefix=/opt/freeradius-server-2.2.11' '--localstatedir=/data/freeradius-server' '--with-threads' '--with-openssl' '--with-openssl-includes=/opt/openssl/includes' '--with-openssl-libraries=/opt/openssl/lib' '--enable-rlm-sql' '--enable-rlm-ldap' '--enable-rlm-eap' '--with-rlm-ldap-lib-dir=/opt/openldap/lib' '--with-rlm-ldap-include-dir=/opt/openldap/include' '--with-mysql-lib-dir=/opt/mysql/lib' '--with-mysql-include-dir=/opt/mysql/include' '--enable-ltdl-install=no' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for mysql_config... no checking for pthread_create in -lpthread... yes checking for mysql_init in -lmysqlclient_r... no configure: WARNING: MySQL libraries not found. Use --with-mysql-lib-dir=<path>. checking for mysql/mysql.h... yes configure: WARNING: silently not building rlm_sql_mysql. configure: WARNING: FAILURE: rlm_sql_mysql requires: libmysqlclient_r. configure: creating ./config.status config.status: creating Makefile config.status: creating config.h

2 1

EAP-TTLS first connection works, other won't
by Giovanni Lovato 05 Oct '08

05 Oct '08

I set up freeradius 2.1.1 for EAP-TTLS, on Debian Lenny. As client I'm using Ubuntu. When I try to connect, first user, (on the logs, "heruan") connect successfully, but subsequent users (e.g. "jamila") won't. If I restart freeradius, and try to connect first with "jamila" and then with "heruan", "jamila" connects and "heruan" doesn't. The only error I'm able to see on the log is: 798:[ttls] FAIL: Forcibly stopping session resumption as it is not allowed. 799-[eap] Freeing handler 800-++[eap] returns reject 801-Failed to authenticate the user. 802-Using Post-Auth-Type Reject 803-+- entering group REJECT {...} But I really don't know what it means. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=125 User-Name = "heruan" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000b0168657275616e Message-Authenticator = 0x4bd473610ad7dcfdcb6b1016a23acb10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "heruan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for heruan [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (|(uid=%{Stripped-User-Name:-%{User-Name}})(cn=%{Stripped-User-Name:-%{User-Name}})) -> (|(uid=heruan)(cn=heruan)) [ldap] expand: dc=aldu,dc=net -> dc=aldu,dc=net rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.laurelin.aldu.net:389, authentication 0 rlm_ldap: bind as cn=radius,dc=aldu,dc=net/RaD-802.1X to ldap.laurelin.aldu.net:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=aldu,dc=net, with filter (|(uid=heruan)(cn=heruan)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x30... rlm_ldap: sambaLmPassword -> LM-Password == 0x35... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user heruan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x010100160410faf366dabc0e2d2eada92aed8a1beef5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf46f03b2f46e07fbc157e3e44121daf3 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=138 Cleaning up request 0 ID 1 with timestamp +11 User-Name = "heruan" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 State = 0xf46f03b2f46e07fbc157e3e44121daf3 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100060315 Message-Authenticator = 0x24f629997ec0167cb1d9418bb69bf17a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "heruan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for heruan [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (|(uid=%{Stripped-User-Name:-%{User-Name}})(cn=%{Stripped-User-Name:-%{User-Name}})) -> (|(uid=heruan)(cn=heruan)) [ldap] expand: dc=aldu,dc=net -> dc=aldu,dc=net rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=aldu,dc=net, with filter (|(uid=heruan)(cn=heruan)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x30... rlm_ldap: sambaLmPassword -> LM-Password == 0x35... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user heruan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf46f03b2f56d16fbc157e3e44121daf3 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=393 Cleaning up request 1 ID 1 with timestamp +12 User-Name = "heruan" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 State = 0xf46f03b2f56d16fbc157e3e44121daf3 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02020103150016030100f8010000f4030148e4e7f928c698fc14284694b68c2ce5e5ad5c04a1d79037c24cd9813e14d02400002600390038003500160013000a00330032002f000500040015001200090014001100080006000302010000a4002300a0f3f755f03310a19873fb5975ca54ee2c19ae8be02615dec2639ee3cc859117d420ddfa88ee933ba72797d57219d2866acb542fa1265c6b02b394ac5cc64d3966bf0734b6513619c825c30980461030e1061454aa062afeb5eeebf04c88d7e5aa76a89c98782c6555301c0f8ade20b29e4e83f7c9e005e07cd2c05173f63f944d065e5000f82e19c313290db58e8cb15f75639d97d17ad3a2da20 EAP-Message = 0x1884e21d7209 Message-Authenticator = 0x5ef1bef4e588c171b000e3c9c399544b +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "heruan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 00f8], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 0030], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 0d44], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 030d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x0103040015c00000109916030100300200002c030148e4e7f9c882e287b5388f22b083365b35904cc0abea3dea125ea2354b8f4df4000039010004002300001603010d440b000d40000d3d0006d2308206ce308204b6a003020102020114300d06092a864886f70d0101050500308181310b30090603550406130249543110300e06035504081307566963656e7a6131153013060355040a130c416c6475204e6574776f726b312d302b06035504031324416c6475204e6574776f726b2043657274696669636174696f6e20417574686f72697479311a301806092a864886f70d010901160b636140616c64752e6e6574301e170d3038303532353137 EAP-Message = 0x343933375a170d3131303532353137343933375a30818a310b3009060355040613024954310f300d060355040813065665726f6e6131153013060355040a130c416c6475204e6574776f726b3111300f060355040b13084c617572656c696e3121301f060355040313187261646975732e6c617572656c696e2e616c64752e6e6574311d301b06092a864886f70d010901160e61646d696e40616c64752e6e657430820222300d06092a864886f70d01010105000382020f003082020a0282020100e1506dc7d5db924cd5f782f63b4a6e95fbe1fbab0a411397f249f7447e65d266d5fcc166684fd5409a0d2ff5b034972c8b69a7e4fd286b102c7d9a EAP-Message = 0x9a0bd886919dfd9788b679df6ad937124cde203e89c863f10fe1155e09449ef630bb489fe2ec1aac506107ec5f9ce1bd73100992ff5b7863452a6b73e8274e8d4d8ffe8250ed90f83b0739f66bf47fa8d2c6a23f7fd3413b9bb090762d951e4b873ca983e3aaf2690e92b1b2031765f177eecf6046105b6eea4ea422b130eb338aed9be7126ddff6fca11b398463a3e787c33b33851e231721e312da0b979ee794c48b01dc4f59a5cf79cb294c4dc4102abc8e0c93cdcff7ad4228ee4fe5c7ab2a8f4ba2373d0c86d159a2b43e314281120642a1dbe53c7fc5e77c0c32dc5ab8e8cce23e002480f23c31ee7371b2674205b9e48d62f2153082ae67d061 EAP-Message = 0xc368d86793cf6bf20a5721425d2af0e7ffc1a16ebc5d961a44a8d3e11239282767cf346e4c6205d86fc37be511f70dcb5f5f1cb03c971fd8ab68162146ed68476b2c019d1517397bfb956dead83ba2bc3a04a32c071b8654c6bd5b4f0be5e0a144a79bcbc01c259913808239e5ab6c1af15ae2ae5cb21191432312835ead8a68f7e5cb47c5e9ee5fff4d199d8619ad6ad297003fe2b8df4029872064b60c958bb66e41f45da69d5e80f7bceff2817e562fb3e047952f4f821341d039aee30fe5f5b65989bc14826f0203010001a38201443082014030090603551d1304023000301106096086480186f8420101040403020640302e06096086480186f8 EAP-Message = 0x42010d0421161f416c647520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf46f03b2f66c16fbc157e3e44121daf3 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=138 Cleaning up request 2 ID 1 with timestamp +12 User-Name = "heruan" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 State = 0xf46f03b2f66c16fbc157e3e44121daf3 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061500 Message-Authenticator = 0x0014a82ba883ba4ae3b8e24f61745d69 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "heruan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x0104040015c0000010994e6574776f726b20736572766572206365727469666963617465301d0603551d0e0416041486c2b9b3402bae0cb4ed277cd43364ab5d483ceb3081ae0603551d230481a63081a38014fe54771221d91a1005efa50f6f8f886af9cf6447a18187a48184308181310b30090603550406130249543110300e06035504081307566963656e7a6131153013060355040a130c416c6475204e6574776f726b312d302b06035504031324416c6475204e6574776f726b2043657274696669636174696f6e20417574686f72697479311a301806092a864886f70d010901160b636140616c64752e6e6574820100300b0603551d0f0404 EAP-Message = 0x030205a030130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038202010081e6d66dea240cd1b99aa67bf1fc1c33f59c3e28412ca6694b1be9bfe8b475c0954b7bee98ed5779654f98edd32d070761641d0b0977704bf918dc81002f6ac48ba27db0b71bfeed4bc8199af442038c9f4bc15e025fe4f86fb5c1b84663d5f3061bff74fe017f3a2e4706b70a6a809c0178b20d98a8af55a3c2cedeba3842d3d120fbc08727984435fac4d4c0dc56ec5ae8b75412935f70242c3c5ff047f8508104b912a2a36ff6cd8860ce938fbcaee40e0b5efb95875b430479d6d3953258a1b824b294be10bae0cf10f2f2983875 EAP-Message = 0x43cdee650acf20db20609ec9df5ee0c144897eb32fe03e5224fb54478169203af95f81345a1f65f589f8115e24fb3e4a9a51b0504751a85dcc79fed0a515c42f1d0e98d55a69f40f3485b3691d2c8fc2ac458c024f911fecf9f87f1319039e129a8da222a245a7822db409b17bc2feca66ecbcd34ff4ffb7f7fb48f472de6bec8227bc2a8b8626b297c4afc54a7165000fe6d34bc56a5119f4b399fd46b5cd77f36f7cc15b884c54348cfc388d2c510a7ff279bf003760f06eee2be7d14e8aef714a65834748992443d7912e7555ba6c842d47eb34cf2a6d8267c4888eb6920b33e23cf1fe1281da00dfacdad69f88fabbbc1fbd034e17a685f07d02fc EAP-Message = 0xb3b3164bf7c1c959a72bcf820a3f8cd4d9fd1c72bdbfcc9031a62642dcc2fe447440eb99a571b10c936c35036d46e0ba5cb9b70006653082066130820449a003020102020100300d06092a864886f70d0101050500308181310b30090603550406130249543110300e06035504081307566963656e7a6131153013060355040a130c416c6475204e6574776f726b312d302b06035504031324416c6475204e6574776f726b2043657274696669636174696f6e20417574686f72697479311a301806092a864886f70d010901160b636140616c64752e6e6574301e170d3038303532353137313532335a170d3133303532343137313532335a30818131 EAP-Message = 0x0b3009060355040613024954 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf46f03b2f76b16fbc157e3e44121daf3 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=138 Cleaning up request 3 ID 1 with timestamp +12 User-Name = "heruan" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 State = 0xf46f03b2f76b16fbc157e3e44121daf3 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061500 Message-Authenticator = 0x7d696164144cc750f1bdd7cca30cc641 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "heruan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x0105040015c0000010993110300e06035504081307566963656e7a6131153013060355040a130c416c6475204e6574776f726b312d302b06035504031324416c6475204e6574776f726b2043657274696669636174696f6e20417574686f72697479311a301806092a864886f70d010901160b636140616c64752e6e657430820222300d06092a864886f70d01010105000382020f003082020a0282020100e352d800a194047d72504330b65278cf22b0a7211472a77939e369cd5121e27e119f05cb3c660aefda12d90bad75dda2b965f831d5a2e1038bbe7c9f8addb1c5ab1efe5be47d2eac1b3972b68bba4c406916c302c35dfd5ef11d36f1a563 EAP-Message = 0x7ae33661b27f2e9bb8843a5319061eb7167d274bb6942dfc1878b7f638ed9b9ff4ac4b9b5bdf094e275ff5b53a0551f24d1e63f35d7cfa96c2e00a5ca504b62f5f32cfc3d8aa6f589de482bedeb65224d6e425144be81e36eab9844dbb0fc5388a29b55a23f34798a90f534e626e102a0f0df13ae0f72fe99fe9dcf3575bd85a628c06fe8f6cc51f69271b4203ebebfa52b49df5fd0171c36f204bd64c8989d1fa45628140ffa19d8285702462b34ae01721197aefcd87fb79d2417705f8ef205f2b59bafe222a077c91c22e2481dfcc02eb6a0be6fc6317bd52289ef787f1bd9fe34b5b92b7485408ef15ebe685d408d77dcbd9ba07755e4ecf657479 EAP-Message = 0x3855e64291199a5a77440faa0101f2b4c85a3a92c62aa075cd4f535b0b0321d7839c7b59c02d61cc77cbf1ec4425b8726d315a3228fba109abe1ede78e13f5cf82fa216cf0193fcc641cf3a4e97b43dd425b7e95cfd5d3c692332ced3bb96d9b6d5a2fbb3777a951e0cbeee0e23cb7b911c728db165f153c1e4e1c68ba690d7fbcb04fb05e78b0363308ca5a67f4a3ba844407f51d3a4796dbdf3bb01739e33a60720418dd0203010001a381e13081de301d0603551d0e04160414fe54771221d91a1005efa50f6f8f886af9cf64473081ae0603551d230481a63081a38014fe54771221d91a1005efa50f6f8f886af9cf6447a18187a4818430818131 EAP-Message = 0x0b30090603550406130249543110300e06035504081307566963656e7a6131153013060355040a130c416c6475204e6574776f726b312d302b06035504031324416c6475204e6574776f726b2043657274696669636174696f6e20417574686f72697479311a301806092a864886f70d010901160b636140616c64752e6e6574820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382020100a53bd0a1d836628f9e26a6c7267136549f18ca3cb6d234a5d055d43abdbcbe0e825def229bdc0cbf3c9f38997a15da051b0ce615e8941940dccd43fb24dbea1ee66af0942af577240d47b79a20ecf28741253f7caef99281 EAP-Message = 0x6fb6b25244e2b2eac310fef7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf46f03b2f06a16fbc157e3e44121daf3 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=138 Cleaning up request 4 ID 1 with timestamp +12 User-Name = "heruan" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 State = 0xf46f03b2f06a16fbc157e3e44121daf3 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061500 Message-Authenticator = 0x11fda5dbe435a0608c3a63c5155aa8b1 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "heruan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x0106040015c000001099d7a86f60a2b967aa0d28ae7fe86fbf4a029e4a6e8ebedbef1eb7c7a344d87591be5b8bb28140d1faec4c4753fac13fb77dab34db643e84a0cb961f8947fc1fc6b0861993319ac5b28086aa3f5b0847b15bb97d24cf1690a3aab0ccff85403dd201abcb1b8b279b4b9ecb641d70269ebc603614afd6c56cbc44c8e0e9ba67661e63c195e60738ae589ce857a6a9e7a38ff15cc4c17f5872efdd743641ce8bf543883c98c8d468635d8c8801b6c8825cd26537ca4f7e1789d4c3bde7c9d1314a1ac5bb5d1eeb2e12ef7a5bb1c3ddef303a68284cd5a53d58aa612852d92b81911302468572546831641111a81733a42bbe129cf9 EAP-Message = 0x85b42790a5eb675e742364bc2cb449da2955062efeaa1f1a661933e9ef6a2d4a85c2611e6cf3b5c42511555c4fcab1e5ea237f8017f3f38d5f84e9adae7549f05128f89779b28586d38257a9883f71939263b4dce4945c13b3048e5f8d6ac94e8eab4c2742671ae683451cfff0bf5aa169f15edf30a7cad9f02ef7d004df5db2d4a8001e10730cdf3b140bc1251ea71d8332b2ddebf0117d6f52cefdde1ba9b055795c10c57b3e53c2160301030d0c000309008080ce0d83f98bb5b938122f41183619678af4e0164cd24f47cb6c69ecf7313e7ac43d06f6fb34b5325985920c43936299b311d655257ed4cb8d3607967a75527d17da7e84e8390ff18b EAP-Message = 0xc461727d7da6f39a11b49f86374fec2f331e878965be0d120ad32452a0d9b351b542cde08bc415b8cd80d966ff4ca1371789b1853940e300010200807cc6f6044995fd93a17e053ddf0bbe507d882e3d8f3b27b0603f2353af138687dcfe87cb5cb7501fdcea18cc6cf67355c9896c4b0818a0163b9f3679059dc182902310021277c8ffe55414a8e99619a2a24a5e2cb5662ab30c75ec82133715ad9e06688b2bc6963521c823eefb086bd740e00951447f4e4fefd88e19c3e14aaf0200016f9884de001868763f3384f0a37c2d5e5f2c546e5651124ff7d87876d0c6106454b23e7727ce9dad73013ebfd31fea3c127dec695615e88bae6c78975129 EAP-Message = 0xcc255fec0bd31afdd66675c29fb77401b7ec5937c8fa709aeea8a776c95a0cf89bd71b3bbb464ef8e36a22c544f16ae465f82d56b96bd677ef57a679da1d55ac3854111535781c9d7b9669d1981a2dfabe289903cc5b85385e7b30b66d1f6c5aadb55a62dcda6d73fc9eea9a2018376dc0cfeac620c890a0488e14fe3803b4aea478d8c56f1b7e54fbc4871b3a5ead95dae254ac8928fadd6a8051ec5c930834f2b1b18a4de92835fe8e048d8f2bc33fc3a1873813afef40a8c657847def19ac8d8741ec4e812d2cc704dfce92977bcbe1555bbdedf75e569423eb02001d5771060506e05ea83daccecdc39c81c53c66f2970e018b5ae548b7a49d8c1c EAP-Message = 0xa6fca7afb134ff1b5e08890f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf46f03b2f16916fbc157e3e44121daf3 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=138 Cleaning up request 5 ID 1 with timestamp +12 User-Name = "heruan" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 State = 0xf46f03b2f16916fbc157e3e44121daf3 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600061500 Message-Authenticator = 0xff6b6c02b603f2c9cc862800ffbc096c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "heruan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x010700cb158000001099c703820dae9f500e0be2f038c86fd40cf924c4f49781eaca0617a4348a94f66f6013842f7a5c4c6734194d13e75aad29a67799ad0847d46ebfa076adf64fbb05b63f74cf48162ca2a4f1f6a693fae9a8306134d36da2bd8acfca12e55cfa1b900130559d56e6d67806ed885cc680d7d1615f75fdbbfcedbfff275d973b76e16a92a6306c6ba48597d24e322daa794d8b5b08232c204de060884e7d87b351ab3b707c586b1f30ac8d1fe689217a0fef590288d2e43eed6d3616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf46f03b2f26816fbc157e3e44121daf3 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=336 Cleaning up request 6 ID 1 with timestamp +12 User-Name = "heruan" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 State = 0xf46f03b2f26816fbc157e3e44121daf3 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700cc15001603010086100000820080673f637cef57b74512a57a131307458ae072e52dfbe740e3cbdec7fea4eb4fd68ad80762590666712aadd701da61f1f89e590be9e4f15d0dfcc7b70736b35ae1467b545d59317ef639995905c98045969583090d2f0f92152b475fcdcaafa228da295afc34ee4d671f41c9b737810956da9ece2877c4bec44d24db7f4c53f354140301000101160301003038789a08b245fc126bbe3a24a5624b34f496185bbefc58f52ba017868c9bcc17a8e50158c370342e857fe3e77b61549f Message-Authenticator = 0xb9d62831c9c7caefdf69c3b99c4d8957 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "heruan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 Handshake [length 00aa]??? [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x010800f41580000000ea16030100aa040000a60000000000a060ca7c093b0c08609eda8927d1b01099807479bd89282e811614e29108fea13762dd72c299cdd17f1562f34bf674fc2f08625e4fb6c5538c8505002a70f6343a67f117db650d06a50bcab321e759fcb25d0d64732dada6031d6b5597734f447a9ae20c2f490b02262094c018490ec5489cb437f4c93c328c096a73640dbd921b0930f0f3d7f1885822184235fcd23f2cf7bf739a496de5b4dc6a6480b89d4c5a1403010001011603010030e721d41d48f9ebbf90b0d949e20669215f2fa79c9f55b2a6178276e03b4e1fea4d694027607ef7622edb42291c72ee4a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf46f03b2f36716fbc157e3e44121daf3 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=308 Cleaning up request 7 ID 1 with timestamp +12 User-Name = "heruan" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 State = 0xf46f03b2f36716fbc157e3e44121daf3 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800b015001703010020dcff405e309bcc0a01d21f9df29f7399f13a55b30378b767595bc3b11024b5a91703010080aee67219dc7dcd15dfe508647563e4f24f003113bae2c10d9d6fb8dd023da2d3c81bcff3a18c4a2d07c6e27d1e0e2385e3fd86058abe23a074078053446409d45e7ef65e5a6977899a95604f943fa43fdd9d2b70186f66644a916f0cc7673748bf09837d8cc0c3926cc6920a681fd549bd8061977cdc0e7e6c5ff21c849fb5a3 Message-Authenticator = 0x8486851c6545cab5b42fd05d3a183a04 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "heruan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 176 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "heruan" MS-CHAP-Challenge = 0x21baa0943340f88f07f8802a8ac6690f MS-CHAP2-Response = 0x7e0000000019000000c84e1909b04e190903000000000000000085749071e94c2f3f736d3aba3d7874e3961c739ea28340db FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "heruan" MS-CHAP-Challenge = 0x21baa0943340f88f07f8802a8ac6690f MS-CHAP2-Response = 0x7e0000000019000000c84e1909b04e190903000000000000000085749071e94c2f3f736d3aba3d7874e3961c739ea28340db FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[unix] returns notfound [suffix] No '@' in User-Name = "heruan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ldap] performing user authorization for heruan [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (|(uid=%{Stripped-User-Name:-%{User-Name}})(cn=%{Stripped-User-Name:-%{User-Name}})) -> (|(uid=heruan)(cn=heruan)) [ldap] expand: dc=aldu,dc=net -> dc=aldu,dc=net rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=aldu,dc=net, with filter (|(uid=heruan)(cn=heruan)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x30... rlm_ldap: sambaLmPassword -> LM-Password == 0x35... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user heruan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Found LM-Password [mschap] Found NT-Password [mschap] Told to do MS-CHAPv2 for heruan with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok } # server inner-tunnel [ttls] Got tunneled reply code 2 MS-CHAP2-Success = 0x7e533d31324145363332353036363734304334343836353236363239423738453843303538363539334346 MS-MPPE-Recv-Key = 0x90e46fe588c50f30b1fabcf942019be5 MS-MPPE-Send-Key = 0xea3ea373e2e1e279c847a7beb2c5f588 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 [ttls] Got tunneled Access-Accept [ttls] Got MS-CHAP2-Success, tunneling it to the client in a challenge. ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x0109006f1580000000651703010060616bdc70b991cb3ccc5449f13e93a374a0be21787fc7a91d0195a68017ddc3e1c4bcbbcee2e5aaf6bcae29b09aefd237f693eebc4b3ebcba8068dbe3b71e9d6af3236bee9a2efa8358d594a74f65490319ed9e64ef06f10fe8212068c05844a9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf46f03b2fc6616fbc157e3e44121daf3 Finished request 8. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=138 Cleaning up request 8 ID 1 with timestamp +12 User-Name = "heruan" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 State = 0xf46f03b2fc6616fbc157e3e44121daf3 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020900061500 Message-Authenticator = 0xa01f486fa472b238ae70656c633e9340 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "heruan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake is finished [ttls] eaptls_verify returned 3 [ttls] eaptls_process returned 3 [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 1 to 192.168.22.1 port 3073 MS-MPPE-Recv-Key = 0xa7d9381f75ce74495aa1f0e6aa017f40e573239eb999d715d95e9ff50ae10569 MS-MPPE-Send-Key = 0xbcc49edaa0afd7e62cbe97392c3c01dd52267bd6454a24b4b1f335618528ec18 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "heruan" Finished request 9. Going to the next request Waking up in 4.9 seconds. Cleaning up request 9 ID 1 with timestamp +12 Ready to process requests. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=125 User-Name = "jamila" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000b016a616d696c61 Message-Authenticator = 0xcdae13a716b61cabbcb70e726276d665 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jamila", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for jamila [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (|(uid=%{Stripped-User-Name:-%{User-Name}})(cn=%{Stripped-User-Name:-%{User-Name}})) -> (|(uid=jamila)(cn=jamila)) [ldap] expand: dc=aldu,dc=net -> dc=aldu,dc=net rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=aldu,dc=net, with filter (|(uid=jamila)(cn=jamila)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x44... rlm_ldap: sambaLmPassword -> LM-Password == 0x42... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user jamila authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x01010016041067c2d2ac231b541d1ebb9d5e9aef272e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7d75f9417d74fd26c22394ad8dcd0b12 Finished request 10. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=138 Cleaning up request 10 ID 1 with timestamp +25 User-Name = "jamila" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 State = 0x7d75f9417d74fd26c22394ad8dcd0b12 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100060315 Message-Authenticator = 0xa8d0e7d17c0e5240d1bb804c2703807d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jamila", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for jamila [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (|(uid=%{Stripped-User-Name:-%{User-Name}})(cn=%{Stripped-User-Name:-%{User-Name}})) -> (|(uid=jamila)(cn=jamila)) [ldap] expand: dc=aldu,dc=net -> dc=aldu,dc=net rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=aldu,dc=net, with filter (|(uid=jamila)(cn=jamila)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x44... rlm_ldap: sambaLmPassword -> LM-Password == 0x42... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user jamila authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7d75f9417c77ec26c22394ad8dcd0b12 Finished request 11. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=393 Cleaning up request 11 ID 1 with timestamp +25 User-Name = "jamila" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 State = 0x7d75f9417c77ec26c22394ad8dcd0b12 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02020103150016030100f8010000f4030148e4e806522dfb2b7aec334d620648c3c4485a1e0b6d2b0dc25fdd747efeee4600002600390038003500160013000a00330032002f000500040015001200090014001100080006000302010000a4002300a060ca7c093b0c08609eda8927d1b01099807479bd89282e811614e29108fea13762dd72c299cdd17f1562f34bf674fc2f08625e4fb6c5538c8505002a70f6343a67f117db650d06a50bcab321e759fcb25d0d64732dada6031d6b5597734f447a9ae20c2f490b02262094c018490ec5489cb437f4c93c328c096a73640dbd921b0930f0f3d7f1885822184235fcd23f2cf7bf739a496de5b4dc6a EAP-Message = 0x6480b89d4c5a Message-Authenticator = 0x89044f83ea2af62d3bcf0b6260d427df +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jamila", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 00f8], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read finished A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x0103007415800000006a160301002a02000026030148e4e8063dbbed9ca6725e2645bd72a6173fb03e4cb690ea59de42089734b392000039011403010001011603010030d93ac0e280be40fbe5c37337e666f049168441db2ab2559b2c80603a9f691dfa54793f42b378988c90a4dde60351e7b7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7d75f9417f76ec26c22394ad8dcd0b12 Finished request 12. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.22.1 port 3073, id=1, length=197 Cleaning up request 12 ID 1 with timestamp +25 User-Name = "jamila" NAS-IP-Address = 192.168.22.1 Called-Station-Id = "00c049d3f40e" Calling-Station-Id = "002268c0eb93" NAS-Identifier = "00c049d3f40e" NAS-Port = 184 Framed-MTU = 1400 State = 0x7d75f9417f76ec26c22394ad8dcd0b12 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300411500140301000101160301003013ca1053acec332d812ff938d32329665b95b49a397a3b018a5ada0c8f43cac051573f2c7f0e18b21941acd317161ed3 Message-Authenticator = 0x600117a5ce085e9040580d94a1a0becf +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jamila", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 65 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] (other): SSL negotiation finished successfully SSL Connection Established SSL Application Data [ttls] eaptls_process returned 3 [ttls] Skipping Phase2 due to session resumption [ttls] FAIL: Forcibly stopping session resumption as it is not allowed. [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jamila attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 13 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 13 Sending Access-Reject of id 1 to 192.168.22.1 port 3073 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 13 ID 1 with timestamp +25 Ready to process requests. giovanni@radius.laurelin.aldu.net:~$ xit

3 5

Make Install Errot : FreeRadius V 2.1.1 on Suse
by Syed Anwarul Hasan 04 Oct '08

04 Oct '08

Dear Alan,Ivan and all, I have compiled FreeRadius V 2.1.1 on SLES 10 SP2 .And after config and make steps when I tried the 'make Install' to install the binaries. I got an libtool error and Installation stopped. Please help in this regard. SYED pc1138:/usr/src/packages/BUILD/freeradius-server-2.1.1 #* make install* gmake[1]: Entering directory `/usr/src/packages/BUILD/freeradius-server-2.1.1' Making install in src... gmake[2]: Entering directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src' gmake[3]: Entering directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src' Making install in include... gmake[4]: Entering directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src/include' /usr/src/packages/BUILD/freeradius-server-2.1.1/install-sh -c -d -m 755 /usr/local/include/freeradius for i in hash.h libradius.h md4.h md5.h missing.h packet.h radius.h radpaths.h sha1.h token.h udpfromto.h vqp.h ident.h ; do \ sed 's/^#include <freeradius-devel/#include <freeradius/' $i > .inst.$$ ; \ /usr/src/packages/BUILD/freeradius-server-2.1.1/install-sh -c -m 644 .inst.$$ /usr/local/include/freeradius/$i; \ rm -f .inst.$$ ; \ done gmake[4]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src/include' Making install in lib... gmake[4]: Entering directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src/lib' /usr/src/packages/BUILD/freeradius-server-2.1.1/install-sh -c -d -m 755 /usr/local/lib /usr/src/packages/BUILD/freeradius-server-2.1.1/libtool --mode=install /usr/src/packages/BUILD/freeradius-server-2.1.1/install-sh -c -c libfreeradius-radius.la \ /usr/local/lib/libfreeradius-radius.la /usr/src/packages/BUILD/freeradius-server-2.1.1/install-sh -c -c .libs/ libfreeradius-radius-2.1.1.so /usr/local/lib/libfreeradius-radius-2.1.1.so (cd /usr/local/lib && { ln -s -f libfreeradius-radius-2.1.1.solibfreeradius-radius.so || { rm -f libfreeradius-radius.so && ln -s libfreeradius-radius-2.1.1.so libfreeradius-radius.so; }; }) /usr/src/packages/BUILD/freeradius-server-2.1.1/install-sh -c -c .libs/libfreeradius-radius.lai /usr/local/lib/libfreeradius-radius.la /usr/src/packages/BUILD/freeradius-server-2.1.1/install-sh -c -c .libs/libfreeradius-radius.a /usr/local/lib/libfreeradius-radius.a chmod 644 /usr/local/lib/libfreeradius-radius.a ranlib /usr/local/lib/libfreeradius-radius.a PATH="$PATH:/sbin" ldconfig -n /usr/local/lib ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - add LIBDIR to the `LD_RUN_PATH' environment variable during linking - use the `-Wl,--rpath -Wl,LIBDIR' linker flag - have your system administrator add LIBDIR to `/etc/ld.so.conf' See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- rm -f /usr/local/lib/libfreeradius-radius-2.1.1.la; ln -s libfreeradius-radius.la /usr/local/lib/libfreeradius-radius-2.1.1.la gmake[4]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src/lib' Making install in modules... gmake[4]: Entering directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src/modules' /usr/src/packages/BUILD/freeradius-server-2.1.1/install-sh -c -d -m 755 /usr/local/lib gmake[5]: Entering directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src/modules' Making install in rlm_acctlog... gmake[6]: Entering directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src/modules/rlm_acctlog' if [ "xrlm_acctlog" != "x" ]; then \ /usr/src/packages/BUILD/freeradius-server-2.1.1/libtool --mode=install /usr/src/packages/BUILD/freeradius-server-2.1.1/install-sh -c -c \ rlm_acctlog.la /usr/local/lib/rlm_acctlog.la || exit $?; \ rm -f /usr/local/lib/rlm_acctlog-2.1.1.la; \ ln -s rlm_acctlog.la /usr/local/lib/rlm_acctlog-2.1.1.la || exit $?; \ fi li*btool: install: error: cannot install `rlm_acctlog.la' to a directory not ending in /usr/lib/freeradius gmake[6]: *** [install] Error 1 gmake[6]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src/modules/rlm_acctlog' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src/modules' gmake[4]: *** [install] Error 2 gmake[4]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src' gmake[2]: *** [install] Error 2 gmake[2]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.1.1' make: *** [install] Error 2 *

2 3

unable to write 'random state' when starting freeradius
by Madwifi Wireless 04 Oct '08

04 Oct '08

Has anyone come across this error? This happens when I start freeradius for the first time. Platform: RedHat ES 4.0 Version: FreeRadius 2.1.1 I have highlighted the message in read. It doesn't matter if I run this command as root. Thanks for you help. AM sudo ./radiusd -XXXX Fri Oct 3 14:34:04 2008 : Info: FreeRADIUS Version 2.1.1, for host i686-pc-linux-gnu, built on Oct 3 2008 at 14:30:11 Fri Oct 3 14:34:04 2008 : Info: Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. Fri Oct 3 14:34:04 2008 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Fri Oct 3 14:34:04 2008 : Info: PARTICULAR PURPOSE. Fri Oct 3 14:34:04 2008 : Info: You may redistribute copies of FreeRADIUS under the terms of the Fri Oct 3 14:34:04 2008 : Info: GNU General Public License v2. Fri Oct 3 14:34:04 2008 : Info: Starting - reading configuration files ... Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/radiusd.conf Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/proxy.conf Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/clients.conf Fri Oct 3 14:34:04 2008 : Debug: including files in directory /usr/local/freeradius-2.1.1/etc/raddb/modules/ Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/attr_filter Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/always Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/expiration Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/digest Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/echo Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/exec Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/detail.log Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/sradutmp Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/wimax Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/checkval Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/acct_unique Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/preprocess Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/linelog Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/mac2vlan Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/counter Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/etc_group Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/ippool Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/radutmp Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/pap Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/krb5 Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/mac2ip Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/detail.example.com Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/ldap Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/files Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/passwd Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/inner-eap Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/mschap Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/expr Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/detail Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/attr_rewrite Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/unix Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/smbpasswd Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/chap Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/pam Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/realm Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/sql_log Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/policy Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/logintime Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/eap.conf Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/sql.conf Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/sql/mysql/dialup.conf Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/sql/mysql/counter.conf Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/policy.conf Fri Oct 3 14:34:04 2008 : Debug: including files in directory /usr/local/freeradius-2.1.1/etc/raddb/sites-enabled/ Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/sites-enabled/default Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/sites-enabled/inner-tunnel Fri Oct 3 14:34:04 2008 : Debug: including dictionary file /usr/local/freeradius-2.1.1/etc/raddb/dictionary Fri Oct 3 14:34:05 2008 : Debug: main { Fri Oct 3 14:34:05 2008 : Debug: prefix = "/usr/local/freeradius-2.1.1" Fri Oct 3 14:34:05 2008 : Debug: localstatedir = "/usr/local/freeradius-2.1.1/var" Fri Oct 3 14:34:05 2008 : Debug: logdir = "/usr/local/freeradius-2.1.1/var/log/radius" Fri Oct 3 14:34:05 2008 : Debug: libdir = "/usr/local/freeradius-2.1.1/lib" Fri Oct 3 14:34:05 2008 : Debug: radacctdir = "/usr/local/freeradius-2.1.1/var/log/radius/radacct" Fri Oct 3 14:34:05 2008 : Debug: hostname_lookups = no Fri Oct 3 14:34:05 2008 : Debug: max_request_time = 30 Fri Oct 3 14:34:05 2008 : Debug: cleanup_delay = 5 Fri Oct 3 14:34:05 2008 : Debug: max_requests = 1024 Fri Oct 3 14:34:05 2008 : Debug: allow_core_dumps = no Fri Oct 3 14:34:05 2008 : Debug: pidfile = "/usr/local/freeradius-2.1.1/var/run/radiusd/radiusd.pid" Fri Oct 3 14:34:05 2008 : Debug: checkrad = "/usr/local/freeradius-2.1.1/sbin/checkrad" Fri Oct 3 14:34:05 2008 : Debug: debug_level = 0 Fri Oct 3 14:34:05 2008 : Debug: proxy_requests = yes Fri Oct 3 14:34:05 2008 : Debug: log { Fri Oct 3 14:34:05 2008 : Debug: stripped_names = no Fri Oct 3 14:34:05 2008 : Debug: auth = no Fri Oct 3 14:34:05 2008 : Debug: auth_badpass = no Fri Oct 3 14:34:05 2008 : Debug: auth_goodpass = no Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: security { Fri Oct 3 14:34:05 2008 : Debug: max_attributes = 200 Fri Oct 3 14:34:05 2008 : Debug: reject_delay = 1 Fri Oct 3 14:34:05 2008 : Debug: status_server = yes Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: client localhost { Fri Oct 3 14:34:05 2008 : Debug: ipaddr = 127.0.0.1 Fri Oct 3 14:34:05 2008 : Debug: require_message_authenticator = no Fri Oct 3 14:34:05 2008 : Debug: secret = "testing123" Fri Oct 3 14:34:05 2008 : Debug: nastype = "other" Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: radiusd: #### Loading Realms and Home Servers #### Fri Oct 3 14:34:05 2008 : Debug: proxy server { Fri Oct 3 14:34:05 2008 : Debug: retry_delay = 5 Fri Oct 3 14:34:05 2008 : Debug: retry_count = 3 Fri Oct 3 14:34:05 2008 : Debug: default_fallback = no Fri Oct 3 14:34:05 2008 : Debug: dead_time = 120 Fri Oct 3 14:34:05 2008 : Debug: wake_all_if_all_dead = no Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: home_server localhost { Fri Oct 3 14:34:05 2008 : Debug: ipaddr = 127.0.0.1 Fri Oct 3 14:34:05 2008 : Debug: port = 1812 Fri Oct 3 14:34:05 2008 : Debug: type = "auth" Fri Oct 3 14:34:05 2008 : Debug: secret = "testing123" Fri Oct 3 14:34:05 2008 : Debug: response_window = 20 Fri Oct 3 14:34:05 2008 : Debug: max_outstanding = 65536 Fri Oct 3 14:34:05 2008 : Debug: zombie_period = 40 Fri Oct 3 14:34:05 2008 : Debug: status_check = "status-server" Fri Oct 3 14:34:05 2008 : Debug: ping_interval = 30 Fri Oct 3 14:34:05 2008 : Debug: check_interval = 30 Fri Oct 3 14:34:05 2008 : Debug: num_answers_to_alive = 3 Fri Oct 3 14:34:05 2008 : Debug: num_pings_to_alive = 3 Fri Oct 3 14:34:05 2008 : Debug: revive_interval = 120 Fri Oct 3 14:34:05 2008 : Debug: status_check_timeout = 4 Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: home_server_pool my_auth_failover { Fri Oct 3 14:34:05 2008 : Debug: type = fail-over Fri Oct 3 14:34:05 2008 : Debug: home_server = localhost Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: realm example.com { Fri Oct 3 14:34:05 2008 : Debug: auth_pool = my_auth_failover Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: realm LOCAL { Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: radiusd: #### Instantiating modules #### Fri Oct 3 14:34:05 2008 : Debug: instantiate { Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_exec, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_exec Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating exec Fri Oct 3 14:34:05 2008 : Debug: exec { Fri Oct 3 14:34:05 2008 : Debug: wait = no Fri Oct 3 14:34:05 2008 : Debug: input_pairs = "request" Fri Oct 3 14:34:05 2008 : Debug: shell_escape = yes Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_expr, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_expr Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating expr Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_expiration, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_expiration Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating expiration Fri Oct 3 14:34:05 2008 : Debug: expiration { Fri Oct 3 14:34:05 2008 : Debug: reply-message = "Password Has Expired " Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_logintime, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_logintime Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating logintime Fri Oct 3 14:34:05 2008 : Debug: logintime { Fri Oct 3 14:34:05 2008 : Debug: reply-message = "You are calling outside your allowed timespan " Fri Oct 3 14:34:05 2008 : Debug: minimum-timeout = 60 Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: radiusd: #### Loading Virtual Servers #### Fri Oct 3 14:34:05 2008 : Debug: server inner-tunnel { Fri Oct 3 14:34:05 2008 : Debug: modules { Fri Oct 3 14:34:05 2008 : Debug: Module: Checking authenticate {...} for more modules to load Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_pap, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_pap Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating pap Fri Oct 3 14:34:05 2008 : Debug: pap { Fri Oct 3 14:34:05 2008 : Debug: encryption_scheme = "auto" Fri Oct 3 14:34:05 2008 : Debug: auto_header = no Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_chap, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_chap Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating chap Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_mschap, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_mschap Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating mschap Fri Oct 3 14:34:05 2008 : Debug: mschap { Fri Oct 3 14:34:05 2008 : Debug: use_mppe = yes Fri Oct 3 14:34:05 2008 : Debug: require_encryption = no Fri Oct 3 14:34:05 2008 : Debug: require_strong = no Fri Oct 3 14:34:05 2008 : Debug: with_ntdomain_hack = no Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_unix, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_unix Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating unix Fri Oct 3 14:34:05 2008 : Debug: unix { Fri Oct 3 14:34:05 2008 : Debug: radwtmp = "/usr/local/freeradius-2.1.1/var/log/radius/radwtmp" Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_eap, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_eap Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating eap Fri Oct 3 14:34:05 2008 : Debug: eap { Fri Oct 3 14:34:05 2008 : Debug: default_eap_type = "md5" Fri Oct 3 14:34:05 2008 : Debug: timer_expire = 60 Fri Oct 3 14:34:05 2008 : Debug: ignore_unknown_eap_types = no Fri Oct 3 14:34:05 2008 : Debug: cisco_accounting_username_bug = no Fri Oct 3 14:34:05 2008 : Debug: max_sessions = 2048 Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to sub-module rlm_eap_md5 Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating eap-md5 Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to sub-module rlm_eap_leap Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating eap-leap Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to sub-module rlm_eap_gtc Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating eap-gtc Fri Oct 3 14:34:05 2008 : Debug: gtc { Fri Oct 3 14:34:05 2008 : Debug: challenge = "Password: " Fri Oct 3 14:34:05 2008 : Debug: auth_type = "PAP" Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to sub-module rlm_eap_tls Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating eap-tls Fri Oct 3 14:34:05 2008 : Debug: tls { Fri Oct 3 14:34:05 2008 : Debug: rsa_key_exchange = no Fri Oct 3 14:34:05 2008 : Debug: dh_key_exchange = yes Fri Oct 3 14:34:05 2008 : Debug: rsa_key_length = 512 Fri Oct 3 14:34:05 2008 : Debug: dh_key_length = 512 Fri Oct 3 14:34:05 2008 : Debug: verify_depth = 0 Fri Oct 3 14:34:05 2008 : Debug: pem_file_type = yes Fri Oct 3 14:34:05 2008 : Debug: private_key_file = "/usr/local/freeradius-2.1.1/etc/raddb/certs/server.pem" Fri Oct 3 14:34:05 2008 : Debug: certificate_file = "/usr/local/freeradius-2.1.1/etc/raddb/certs/server.pem" Fri Oct 3 14:34:05 2008 : Debug: CA_file = "/usr/local/freeradius-2.1.1/etc/raddb/certs/ca.pem" Fri Oct 3 14:34:05 2008 : Debug: private_key_password = "whatever" Fri Oct 3 14:34:05 2008 : Debug: dh_file = "/usr/local/freeradius-2.1.1/etc/raddb/certs/dh" Fri Oct 3 14:34:05 2008 : Debug: random_file = "/usr/local/freeradius-2.1.1/etc/raddb/certs/random" Fri Oct 3 14:34:05 2008 : Debug: fragment_size = 1024 Fri Oct 3 14:34:05 2008 : Debug: include_length = yes Fri Oct 3 14:34:05 2008 : Debug: check_crl = no Fri Oct 3 14:34:05 2008 : Debug: cipher_list = "DEFAULT" Fri Oct 3 14:34:05 2008 : Debug: make_cert_command = "/usr/local/freeradius-2.1.1/etc/raddb/certs/bootstrap" Fri Oct 3 14:34:05 2008 : Debug: cache { Fri Oct 3 14:34:05 2008 : Debug: enable = no Fri Oct 3 14:34:05 2008 : Debug: lifetime = 24 Fri Oct 3 14:34:05 2008 : Debug: max_entries = 255 Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: } Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ..............................+....................+..............+....+....................................................................+.......................................................................... ...................................+..................................................................................+.......+.......................................................................+................. ..............+.....+..+.................+...............................+......+..................................................................................................................................+.. .........................................+.......+.....................................................+...............+............................................................................................. ..................+.........+.............+...................................+...+.......+......+.............+......................+.....................+......+.+.......................................... .............+.........................................+......................+..............+...........................+............................................................................................. ............................................................................................................................+.............................................................+............................... ...................................................................................................................................................................................................+....................... ............+...+.................................................................+ +........................+......................................................++*++*++* *unable to write 'random state' Generating a 2048 bit RSA private key* ....................................+++ ....................+++ *unable to write 'random state' writing new private key to 'server.key'* ----- Generating a 2048 bit RSA private key ..............+++ .*+++ unable to write 'random state' writing new private key to 'ca.key'* ----- Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Oct 3 18:34:45 2008 GMT Not After : Oct 3 18:34:45 2009 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin(a)example.com X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Certificate is to be certified until Oct 3 18:34:45 2009 GMT (365 days) *Write out database with 1 new entries Data Base Updated unable to write 'random state' unable to write 'random state'* MAC verified OK Fri Oct 3 14:34:45 2008 : Debug: Exec-Program output: openssl dhparam -out dh 1024 openssl req -new -out server.csr -keyout server.key -config ./server.cnf openssl req -new -x509 -keyout ca.key -out ca.pem -config ./ca.cnf openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der Fri Oct 3 14:34:45 2008 : Debug: Exec-Program-Wait: plaintext: openssl dhparam -out dh 1024 openssl req -new -out server.csr -keyout server.key -config ./server.cnf openssl req -new -x509 -keyout ca.key -out ca.pem -config ./ca.cnf openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der Fri Oct 3 14:34:45 2008 : Debug: Exec-Program: returned: 0 Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to sub-module rlm_eap_ttls Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating eap-ttls Fri Oct 3 14:34:45 2008 : Debug: ttls { Fri Oct 3 14:34:45 2008 : Debug: default_eap_type = "md5" Fri Oct 3 14:34:45 2008 : Debug: copy_request_to_tunnel = no Fri Oct 3 14:34:45 2008 : Debug: use_tunneled_reply = no Fri Oct 3 14:34:45 2008 : Debug: virtual_server = "inner-tunnel" Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to sub-module rlm_eap_peap Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating eap-peap Fri Oct 3 14:34:45 2008 : Debug: peap { Fri Oct 3 14:34:45 2008 : Debug: default_eap_type = "mschapv2" Fri Oct 3 14:34:45 2008 : Debug: copy_request_to_tunnel = no Fri Oct 3 14:34:45 2008 : Debug: use_tunneled_reply = no Fri Oct 3 14:34:45 2008 : Debug: proxy_tunneled_request_as_eap = yes Fri Oct 3 14:34:45 2008 : Debug: virtual_server = "inner-tunnel" Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating eap-mschapv2 Fri Oct 3 14:34:45 2008 : Debug: mschapv2 { Fri Oct 3 14:34:45 2008 : Debug: with_ntdomain_hack = no Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Checking authorize {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_realm, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_realm Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating suffix Fri Oct 3 14:34:45 2008 : Debug: realm suffix { Fri Oct 3 14:34:45 2008 : Debug: format = "suffix" Fri Oct 3 14:34:45 2008 : Debug: delimiter = "@" Fri Oct 3 14:34:45 2008 : Debug: ignore_default = no Fri Oct 3 14:34:45 2008 : Debug: ignore_null = no Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_files, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_files Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating files Fri Oct 3 14:34:45 2008 : Debug: files { Fri Oct 3 14:34:45 2008 : Debug: usersfile = "/usr/local/freeradius-2.1.1/etc/raddb/users" Fri Oct 3 14:34:45 2008 : Debug: acctusersfile = "/usr/local/freeradius-2.1.1/etc/raddb/acct_users" Fri Oct 3 14:34:45 2008 : Debug: preproxy_usersfile = "/usr/local/freeradius-2.1.1/etc/raddb/preproxy_users" Fri Oct 3 14:34:45 2008 : Debug: compat = "no" Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Checking session {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_radutmp, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_radutmp Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating radutmp Fri Oct 3 14:34:45 2008 : Debug: radutmp { Fri Oct 3 14:34:45 2008 : Debug: filename = "/usr/local/freeradius-2.1.1/var/log/radius/radutmp" Fri Oct 3 14:34:45 2008 : Debug: username = "%{User-Name}" Fri Oct 3 14:34:45 2008 : Debug: case_sensitive = yes Fri Oct 3 14:34:45 2008 : Debug: check_with_nas = yes Fri Oct 3 14:34:45 2008 : Debug: perm = 384 Fri Oct 3 14:34:45 2008 : Debug: callerid = yes Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Checking post-proxy {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: Module: Checking post-auth {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_attr_filter Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating attr_filter.access_reject Fri Oct 3 14:34:45 2008 : Debug: attr_filter attr_filter.access_reject { Fri Oct 3 14:34:45 2008 : Debug: attrsfile = "/usr/local/freeradius-2.1.1/etc/raddb/attrs.access_reject" Fri Oct 3 14:34:45 2008 : Debug: key = "%{User-Name}" Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: modules { Fri Oct 3 14:34:45 2008 : Debug: Module: Checking authenticate {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: Module: Checking authorize {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_preprocess, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_preprocess Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating preprocess Fri Oct 3 14:34:45 2008 : Debug: preprocess { Fri Oct 3 14:34:45 2008 : Debug: huntgroups = "/usr/local/freeradius-2.1.1/etc/raddb/huntgroups" Fri Oct 3 14:34:45 2008 : Debug: hints = "/usr/local/freeradius-2.1.1/etc/raddb/hints" Fri Oct 3 14:34:45 2008 : Debug: with_ascend_hack = no Fri Oct 3 14:34:45 2008 : Debug: ascend_channels_per_line = 23 Fri Oct 3 14:34:45 2008 : Debug: with_ntdomain_hack = no Fri Oct 3 14:34:45 2008 : Debug: with_specialix_jetstream_hack = no Fri Oct 3 14:34:45 2008 : Debug: with_cisco_vsa_hack = no Fri Oct 3 14:34:45 2008 : Debug: with_alvarion_vsa_hack = no Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Checking preacct {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_acct_unique Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating acct_unique Fri Oct 3 14:34:45 2008 : Debug: acct_unique { Fri Oct 3 14:34:45 2008 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Checking accounting {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_detail, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_detail Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating detail Fri Oct 3 14:34:45 2008 : Debug: detail { Fri Oct 3 14:34:45 2008 : Debug: detailfile = "/usr/local/freeradius-2.1.1/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Fri Oct 3 14:34:45 2008 : Debug: header = "%t" Fri Oct 3 14:34:45 2008 : Debug: detailperm = 384 Fri Oct 3 14:34:45 2008 : Debug: dirperm = 493 Fri Oct 3 14:34:45 2008 : Debug: locking = no Fri Oct 3 14:34:45 2008 : Debug: log_packet_header = no Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating attr_filter.accounting_response Fri Oct 3 14:34:45 2008 : Debug: attr_filter attr_filter.accounting_response { Fri Oct 3 14:34:45 2008 : Debug: attrsfile = "/usr/local/freeradius-2.1.1/etc/raddb/attrs.accounting_response" Fri Oct 3 14:34:45 2008 : Debug: key = "%{User-Name}" Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Checking session {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: Module: Checking post-proxy {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: Module: Checking post-auth {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: radiusd: #### Opening IP addresses and Ports #### Fri Oct 3 14:34:45 2008 : Debug: listen { Fri Oct 3 14:34:45 2008 : Debug: type = "auth" Fri Oct 3 14:34:45 2008 : Debug: ipaddr = * Fri Oct 3 14:34:45 2008 : Debug: port = 0 Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: listen { Fri Oct 3 14:34:45 2008 : Debug: type = "acct" Fri Oct 3 14:34:45 2008 : Debug: ipaddr = * Fri Oct 3 14:34:45 2008 : Debug: port = 0 Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Listening on authentication address * port 1812 Fri Oct 3 14:34:45 2008 : Debug: Listening on accounting address * port 1813 Fri Oct 3 14:34:45 2008 : Debug: Listening on proxy address * port 1814 Fri Oct 3 14:34:45 2008 : Debug: Ready to process requests.

3 3

unable to write 'random state' on startup
by Madwifi Wireless 03 Oct '08

03 Oct '08

Has anyone come across this error? This happens when I start freeradius for the first time. Platform: RedHat ES 4.0 Version: FreeRadius 2.1.1 I have highlighted the message in read. It doesn't matter if I run this command as root. Thanks for you help. Sorry if this is posted twice. AM sudo ./radiusd -XXXX Fri Oct 3 14:34:04 2008 : Info: FreeRADIUS Version 2.1.1, for host i686-pc-linux-gnu, built on Oct 3 2008 at 14:30:11 Fri Oct 3 14:34:04 2008 : Info: Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. Fri Oct 3 14:34:04 2008 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Fri Oct 3 14:34:04 2008 : Info: PARTICULAR PURPOSE. Fri Oct 3 14:34:04 2008 : Info: You may redistribute copies of FreeRADIUS under the terms of the Fri Oct 3 14:34:04 2008 : Info: GNU General Public License v2. Fri Oct 3 14:34:04 2008 : Info: Starting - reading configuration files ... Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/radiusd.conf Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/proxy.conf Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/clients.conf Fri Oct 3 14:34:04 2008 : Debug: including files in directory /usr/local/freeradius-2.1.1/etc/raddb/modules/ Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/attr_filter Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/always Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/expiration Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/digest Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/echo Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/exec Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/detail.log Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/sradutmp Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/wimax Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/checkval Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/acct_unique Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/preprocess Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/linelog Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/mac2vlan Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/counter Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/etc_group Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/ippool Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/radutmp Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/pap Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/krb5 Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/mac2ip Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/detail.example.com Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/ldap Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/files Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/passwd Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/inner-eap Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/mschap Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/expr Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/detail Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/attr_rewrite Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/unix Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/smbpasswd Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/chap Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/pam Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/realm Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/sql_log Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/policy Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/modules/logintime Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/eap.conf Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/sql.conf Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/sql/mysql/dialup.conf Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/sql/mysql/counter.conf Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/policy.conf Fri Oct 3 14:34:04 2008 : Debug: including files in directory /usr/local/freeradius-2.1.1/etc/raddb/sites-enabled/ Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/sites-enabled/default Fri Oct 3 14:34:04 2008 : Debug: including configuration file /usr/local/freeradius-2.1.1/etc/raddb/sites-enabled/inner-tunnel Fri Oct 3 14:34:04 2008 : Debug: including dictionary file /usr/local/freeradius-2.1.1/etc/raddb/dictionary Fri Oct 3 14:34:05 2008 : Debug: main { Fri Oct 3 14:34:05 2008 : Debug: prefix = "/usr/local/freeradius-2.1.1" Fri Oct 3 14:34:05 2008 : Debug: localstatedir = "/usr/local/freeradius-2.1.1/var" Fri Oct 3 14:34:05 2008 : Debug: logdir = "/usr/local/freeradius-2.1.1/var/log/radius" Fri Oct 3 14:34:05 2008 : Debug: libdir = "/usr/local/freeradius-2.1.1/lib" Fri Oct 3 14:34:05 2008 : Debug: radacctdir = "/usr/local/freeradius-2.1.1/var/log/radius/radacct" Fri Oct 3 14:34:05 2008 : Debug: hostname_lookups = no Fri Oct 3 14:34:05 2008 : Debug: max_request_time = 30 Fri Oct 3 14:34:05 2008 : Debug: cleanup_delay = 5 Fri Oct 3 14:34:05 2008 : Debug: max_requests = 1024 Fri Oct 3 14:34:05 2008 : Debug: allow_core_dumps = no Fri Oct 3 14:34:05 2008 : Debug: pidfile = "/usr/local/freeradius-2.1.1/var/run/radiusd/radiusd.pid" Fri Oct 3 14:34:05 2008 : Debug: checkrad = "/usr/local/freeradius-2.1.1/sbin/checkrad" Fri Oct 3 14:34:05 2008 : Debug: debug_level = 0 Fri Oct 3 14:34:05 2008 : Debug: proxy_requests = yes Fri Oct 3 14:34:05 2008 : Debug: log { Fri Oct 3 14:34:05 2008 : Debug: stripped_names = no Fri Oct 3 14:34:05 2008 : Debug: auth = no Fri Oct 3 14:34:05 2008 : Debug: auth_badpass = no Fri Oct 3 14:34:05 2008 : Debug: auth_goodpass = no Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: security { Fri Oct 3 14:34:05 2008 : Debug: max_attributes = 200 Fri Oct 3 14:34:05 2008 : Debug: reject_delay = 1 Fri Oct 3 14:34:05 2008 : Debug: status_server = yes Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: client localhost { Fri Oct 3 14:34:05 2008 : Debug: ipaddr = 127.0.0.1 Fri Oct 3 14:34:05 2008 : Debug: require_message_authenticator = no Fri Oct 3 14:34:05 2008 : Debug: secret = "testing123" Fri Oct 3 14:34:05 2008 : Debug: nastype = "other" Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: radiusd: #### Loading Realms and Home Servers #### Fri Oct 3 14:34:05 2008 : Debug: proxy server { Fri Oct 3 14:34:05 2008 : Debug: retry_delay = 5 Fri Oct 3 14:34:05 2008 : Debug: retry_count = 3 Fri Oct 3 14:34:05 2008 : Debug: default_fallback = no Fri Oct 3 14:34:05 2008 : Debug: dead_time = 120 Fri Oct 3 14:34:05 2008 : Debug: wake_all_if_all_dead = no Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: home_server localhost { Fri Oct 3 14:34:05 2008 : Debug: ipaddr = 127.0.0.1 Fri Oct 3 14:34:05 2008 : Debug: port = 1812 Fri Oct 3 14:34:05 2008 : Debug: type = "auth" Fri Oct 3 14:34:05 2008 : Debug: secret = "testing123" Fri Oct 3 14:34:05 2008 : Debug: response_window = 20 Fri Oct 3 14:34:05 2008 : Debug: max_outstanding = 65536 Fri Oct 3 14:34:05 2008 : Debug: zombie_period = 40 Fri Oct 3 14:34:05 2008 : Debug: status_check = "status-server" Fri Oct 3 14:34:05 2008 : Debug: ping_interval = 30 Fri Oct 3 14:34:05 2008 : Debug: check_interval = 30 Fri Oct 3 14:34:05 2008 : Debug: num_answers_to_alive = 3 Fri Oct 3 14:34:05 2008 : Debug: num_pings_to_alive = 3 Fri Oct 3 14:34:05 2008 : Debug: revive_interval = 120 Fri Oct 3 14:34:05 2008 : Debug: status_check_timeout = 4 Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: home_server_pool my_auth_failover { Fri Oct 3 14:34:05 2008 : Debug: type = fail-over Fri Oct 3 14:34:05 2008 : Debug: home_server = localhost Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: realm example.com { Fri Oct 3 14:34:05 2008 : Debug: auth_pool = my_auth_failover Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: realm LOCAL { Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: radiusd: #### Instantiating modules #### Fri Oct 3 14:34:05 2008 : Debug: instantiate { Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_exec, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_exec Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating exec Fri Oct 3 14:34:05 2008 : Debug: exec { Fri Oct 3 14:34:05 2008 : Debug: wait = no Fri Oct 3 14:34:05 2008 : Debug: input_pairs = "request" Fri Oct 3 14:34:05 2008 : Debug: shell_escape = yes Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_expr, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_expr Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating expr Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_expiration, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_expiration Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating expiration Fri Oct 3 14:34:05 2008 : Debug: expiration { Fri Oct 3 14:34:05 2008 : Debug: reply-message = "Password Has Expired " Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_logintime, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_logintime Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating logintime Fri Oct 3 14:34:05 2008 : Debug: logintime { Fri Oct 3 14:34:05 2008 : Debug: reply-message = "You are calling outside your allowed timespan " Fri Oct 3 14:34:05 2008 : Debug: minimum-timeout = 60 Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: radiusd: #### Loading Virtual Servers #### Fri Oct 3 14:34:05 2008 : Debug: server inner-tunnel { Fri Oct 3 14:34:05 2008 : Debug: modules { Fri Oct 3 14:34:05 2008 : Debug: Module: Checking authenticate {...} for more modules to load Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_pap, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_pap Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating pap Fri Oct 3 14:34:05 2008 : Debug: pap { Fri Oct 3 14:34:05 2008 : Debug: encryption_scheme = "auto" Fri Oct 3 14:34:05 2008 : Debug: auto_header = no Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_chap, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_chap Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating chap Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_mschap, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_mschap Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating mschap Fri Oct 3 14:34:05 2008 : Debug: mschap { Fri Oct 3 14:34:05 2008 : Debug: use_mppe = yes Fri Oct 3 14:34:05 2008 : Debug: require_encryption = no Fri Oct 3 14:34:05 2008 : Debug: require_strong = no Fri Oct 3 14:34:05 2008 : Debug: with_ntdomain_hack = no Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_unix, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_unix Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating unix Fri Oct 3 14:34:05 2008 : Debug: unix { Fri Oct 3 14:34:05 2008 : Debug: radwtmp = "/usr/local/freeradius-2.1.1/var/log/radius/radwtmp" Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: (Loaded rlm_eap, checking if it's valid) Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to module rlm_eap Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating eap Fri Oct 3 14:34:05 2008 : Debug: eap { Fri Oct 3 14:34:05 2008 : Debug: default_eap_type = "md5" Fri Oct 3 14:34:05 2008 : Debug: timer_expire = 60 Fri Oct 3 14:34:05 2008 : Debug: ignore_unknown_eap_types = no Fri Oct 3 14:34:05 2008 : Debug: cisco_accounting_username_bug = no Fri Oct 3 14:34:05 2008 : Debug: max_sessions = 2048 Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to sub-module rlm_eap_md5 Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating eap-md5 Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to sub-module rlm_eap_leap Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating eap-leap Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to sub-module rlm_eap_gtc Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating eap-gtc Fri Oct 3 14:34:05 2008 : Debug: gtc { Fri Oct 3 14:34:05 2008 : Debug: challenge = "Password: " Fri Oct 3 14:34:05 2008 : Debug: auth_type = "PAP" Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: Module: Linked to sub-module rlm_eap_tls Fri Oct 3 14:34:05 2008 : Debug: Module: Instantiating eap-tls Fri Oct 3 14:34:05 2008 : Debug: tls { Fri Oct 3 14:34:05 2008 : Debug: rsa_key_exchange = no Fri Oct 3 14:34:05 2008 : Debug: dh_key_exchange = yes Fri Oct 3 14:34:05 2008 : Debug: rsa_key_length = 512 Fri Oct 3 14:34:05 2008 : Debug: dh_key_length = 512 Fri Oct 3 14:34:05 2008 : Debug: verify_depth = 0 Fri Oct 3 14:34:05 2008 : Debug: pem_file_type = yes Fri Oct 3 14:34:05 2008 : Debug: private_key_file = "/usr/local/freeradius-2.1.1/etc/raddb/certs/server.pem" Fri Oct 3 14:34:05 2008 : Debug: certificate_file = "/usr/local/freeradius-2.1.1/etc/raddb/certs/server.pem" Fri Oct 3 14:34:05 2008 : Debug: CA_file = "/usr/local/freeradius-2.1.1/etc/raddb/certs/ca.pem" Fri Oct 3 14:34:05 2008 : Debug: private_key_password = "whatever" Fri Oct 3 14:34:05 2008 : Debug: dh_file = "/usr/local/freeradius-2.1.1/etc/raddb/certs/dh" Fri Oct 3 14:34:05 2008 : Debug: random_file = "/usr/local/freeradius-2.1.1/etc/raddb/certs/random" Fri Oct 3 14:34:05 2008 : Debug: fragment_size = 1024 Fri Oct 3 14:34:05 2008 : Debug: include_length = yes Fri Oct 3 14:34:05 2008 : Debug: check_crl = no Fri Oct 3 14:34:05 2008 : Debug: cipher_list = "DEFAULT" Fri Oct 3 14:34:05 2008 : Debug: make_cert_command = "/usr/local/freeradius-2.1.1/etc/raddb/certs/bootstrap" Fri Oct 3 14:34:05 2008 : Debug: cache { Fri Oct 3 14:34:05 2008 : Debug: enable = no Fri Oct 3 14:34:05 2008 : Debug: lifetime = 24 Fri Oct 3 14:34:05 2008 : Debug: max_entries = 255 Fri Oct 3 14:34:05 2008 : Debug: } Fri Oct 3 14:34:05 2008 : Debug: } Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ..............................+....................+..............+....+....................................................................+.......................................................................... ...................................+..................................................................................+.......+.......................................................................+................. ..............+.....+..+.................+...............................+......+..................................................................................................................................+.. .........................................+.......+.....................................................+...............+............................................................................................. ..................+.........+.............+...................................+...+.......+......+.............+......................+.....................+......+.+.......................................... .............+.........................................+......................+..............+...........................+............................................................................................. ............................................................................................................................+.............................................................+............................... ...................................................................................................................................................................................................+....................... ............+...+.................................................................+ +........................+......................................................++*++*++* *unable to write 'random state' Generating a 2048 bit RSA private key* ....................................+++ ....................+++ *unable to write 'random state' writing new private key to 'server.key'* ----- Generating a 2048 bit RSA private key ..............+++ .*+++ unable to write 'random state' writing new private key to 'ca.key'* ----- Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Oct 3 18:34:45 2008 GMT Not After : Oct 3 18:34:45 2009 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin(a)example.com X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Certificate is to be certified until Oct 3 18:34:45 2009 GMT (365 days) *Write out database with 1 new entries Data Base Updated unable to write 'random state' unable to write 'random state'* MAC verified OK Fri Oct 3 14:34:45 2008 : Debug: Exec-Program output: openssl dhparam -out dh 1024 openssl req -new -out server.csr -keyout server.key -config ./server.cnf openssl req -new -x509 -keyout ca.key -out ca.pem -config ./ca.cnf openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der Fri Oct 3 14:34:45 2008 : Debug: Exec-Program-Wait: plaintext: openssl dhparam -out dh 1024 openssl req -new -out server.csr -keyout server.key -config ./server.cnf openssl req -new -x509 -keyout ca.key -out ca.pem -config ./ca.cnf openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der Fri Oct 3 14:34:45 2008 : Debug: Exec-Program: returned: 0 Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to sub-module rlm_eap_ttls Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating eap-ttls Fri Oct 3 14:34:45 2008 : Debug: ttls { Fri Oct 3 14:34:45 2008 : Debug: default_eap_type = "md5" Fri Oct 3 14:34:45 2008 : Debug: copy_request_to_tunnel = no Fri Oct 3 14:34:45 2008 : Debug: use_tunneled_reply = no Fri Oct 3 14:34:45 2008 : Debug: virtual_server = "inner-tunnel" Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to sub-module rlm_eap_peap Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating eap-peap Fri Oct 3 14:34:45 2008 : Debug: peap { Fri Oct 3 14:34:45 2008 : Debug: default_eap_type = "mschapv2" Fri Oct 3 14:34:45 2008 : Debug: copy_request_to_tunnel = no Fri Oct 3 14:34:45 2008 : Debug: use_tunneled_reply = no Fri Oct 3 14:34:45 2008 : Debug: proxy_tunneled_request_as_eap = yes Fri Oct 3 14:34:45 2008 : Debug: virtual_server = "inner-tunnel" Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating eap-mschapv2 Fri Oct 3 14:34:45 2008 : Debug: mschapv2 { Fri Oct 3 14:34:45 2008 : Debug: with_ntdomain_hack = no Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Checking authorize {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_realm, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_realm Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating suffix Fri Oct 3 14:34:45 2008 : Debug: realm suffix { Fri Oct 3 14:34:45 2008 : Debug: format = "suffix" Fri Oct 3 14:34:45 2008 : Debug: delimiter = "@" Fri Oct 3 14:34:45 2008 : Debug: ignore_default = no Fri Oct 3 14:34:45 2008 : Debug: ignore_null = no Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_files, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_files Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating files Fri Oct 3 14:34:45 2008 : Debug: files { Fri Oct 3 14:34:45 2008 : Debug: usersfile = "/usr/local/freeradius-2.1.1/etc/raddb/users" Fri Oct 3 14:34:45 2008 : Debug: acctusersfile = "/usr/local/freeradius-2.1.1/etc/raddb/acct_users" Fri Oct 3 14:34:45 2008 : Debug: preproxy_usersfile = "/usr/local/freeradius-2.1.1/etc/raddb/preproxy_users" Fri Oct 3 14:34:45 2008 : Debug: compat = "no" Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Checking session {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_radutmp, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_radutmp Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating radutmp Fri Oct 3 14:34:45 2008 : Debug: radutmp { Fri Oct 3 14:34:45 2008 : Debug: filename = "/usr/local/freeradius-2.1.1/var/log/radius/radutmp" Fri Oct 3 14:34:45 2008 : Debug: username = "%{User-Name}" Fri Oct 3 14:34:45 2008 : Debug: case_sensitive = yes Fri Oct 3 14:34:45 2008 : Debug: check_with_nas = yes Fri Oct 3 14:34:45 2008 : Debug: perm = 384 Fri Oct 3 14:34:45 2008 : Debug: callerid = yes Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Checking post-proxy {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: Module: Checking post-auth {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_attr_filter Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating attr_filter.access_reject Fri Oct 3 14:34:45 2008 : Debug: attr_filter attr_filter.access_reject { Fri Oct 3 14:34:45 2008 : Debug: attrsfile = "/usr/local/freeradius-2.1.1/etc/raddb/attrs.access_reject" Fri Oct 3 14:34:45 2008 : Debug: key = "%{User-Name}" Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: modules { Fri Oct 3 14:34:45 2008 : Debug: Module: Checking authenticate {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: Module: Checking authorize {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_preprocess, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_preprocess Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating preprocess Fri Oct 3 14:34:45 2008 : Debug: preprocess { Fri Oct 3 14:34:45 2008 : Debug: huntgroups = "/usr/local/freeradius-2.1.1/etc/raddb/huntgroups" Fri Oct 3 14:34:45 2008 : Debug: hints = "/usr/local/freeradius-2.1.1/etc/raddb/hints" Fri Oct 3 14:34:45 2008 : Debug: with_ascend_hack = no Fri Oct 3 14:34:45 2008 : Debug: ascend_channels_per_line = 23 Fri Oct 3 14:34:45 2008 : Debug: with_ntdomain_hack = no Fri Oct 3 14:34:45 2008 : Debug: with_specialix_jetstream_hack = no Fri Oct 3 14:34:45 2008 : Debug: with_cisco_vsa_hack = no Fri Oct 3 14:34:45 2008 : Debug: with_alvarion_vsa_hack = no Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Checking preacct {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_acct_unique Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating acct_unique Fri Oct 3 14:34:45 2008 : Debug: acct_unique { Fri Oct 3 14:34:45 2008 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Checking accounting {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: (Loaded rlm_detail, checking if it's valid) Fri Oct 3 14:34:45 2008 : Debug: Module: Linked to module rlm_detail Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating detail Fri Oct 3 14:34:45 2008 : Debug: detail { Fri Oct 3 14:34:45 2008 : Debug: detailfile = "/usr/local/freeradius-2.1.1/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Fri Oct 3 14:34:45 2008 : Debug: header = "%t" Fri Oct 3 14:34:45 2008 : Debug: detailperm = 384 Fri Oct 3 14:34:45 2008 : Debug: dirperm = 493 Fri Oct 3 14:34:45 2008 : Debug: locking = no Fri Oct 3 14:34:45 2008 : Debug: log_packet_header = no Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Instantiating attr_filter.accounting_response Fri Oct 3 14:34:45 2008 : Debug: attr_filter attr_filter.accounting_response { Fri Oct 3 14:34:45 2008 : Debug: attrsfile = "/usr/local/freeradius-2.1.1/etc/raddb/attrs.accounting_response" Fri Oct 3 14:34:45 2008 : Debug: key = "%{User-Name}" Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Module: Checking session {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: Module: Checking post-proxy {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: Module: Checking post-auth {...} for more modules to load Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: radiusd: #### Opening IP addresses and Ports #### Fri Oct 3 14:34:45 2008 : Debug: listen { Fri Oct 3 14:34:45 2008 : Debug: type = "auth" Fri Oct 3 14:34:45 2008 : Debug: ipaddr = * Fri Oct 3 14:34:45 2008 : Debug: port = 0 Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: listen { Fri Oct 3 14:34:45 2008 : Debug: type = "acct" Fri Oct 3 14:34:45 2008 : Debug: ipaddr = * Fri Oct 3 14:34:45 2008 : Debug: port = 0 Fri Oct 3 14:34:45 2008 : Debug: } Fri Oct 3 14:34:45 2008 : Debug: Listening on authentication address * port 1812 Fri Oct 3 14:34:45 2008 : Debug: Listening on accounting address * port 1813 Fri Oct 3 14:34:45 2008 : Debug: Listening on proxy address * port 1814 Fri Oct 3 14:34:45 2008 : Debug: Ready to process requests.

1 0

The client does not connect _*_*_*_
by Martin Silvero 03 Oct '08

03 Oct '08

I apologize to you for not knowing English well, I live in Argentina and my native language is spanish (I doubt you know Spanish), if you are unable to interpret what I am trying to say is your problem with your gray matter , but please if I express ticket that I am not wrong understanding and can write differently, but stay on the sidelines and do not interfere because the kids have no trouble understanding what I write. thanks.

1 0

The client does not connect _*_*_*_
by Martin Silvero 03 Oct '08

03 Oct '08

yes, I imported "client.p12" and "ca.der" to the notebook, the checked again and are fine

2 1

Freeradius, PEAP, Active Directory and --require-membership-of
by Vieri 03 Oct '08

03 Oct '08

Hi, I'm running freeradius-2.0.5 on Linux. My setup is as follows: Windows Vista native client - Linksys AP - FreeRadius Linux server (PEAP/mschapv2) - Active Directory Windows server Everything works smoothly with the following ntlm_auth parameters in the mschap module: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" However, user authentication is rejected when I add the --domain parameter: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-D omain} --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" (from the Windows Vista client I obviously set the DOMAIN filed; besides, if I run the freeradius daemon with debug enabled I see that it "correclty" reeives 'DOMAIN\username') For starters, I don't understand why authentication fails if I add --domain. How can I find out why? Then, adding --require-membership-of with or without --domain also fails. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-D omain} --username=%{Stripped-User-Name:-%{User-Name:-None}} --require-membership-of='DOMAIN\\WIFI' --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Finally, running ntlm_auth from the command line yields: # ntlm_auth --request-nt-key --domain=DOMAIN --username=myuser --require-membership-of='DOMAIN\\WIFI' password: NT_STATUS_OK: Success (0x0) Could it be a "bug" in the freeradius version I'm running? Can anyone please suggest how I can debug this (not a radius expert ;-) )? Regards, Vieri

6 10

The client does not connect _*_*_*_
by Martin Silvero 03 Oct '08

03 Oct '08

Well, monitoring and testing in the log have this: Going to the next request Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=68, length=144 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xb7ec9c58aef5995fa1beeaf9fb22d535 EAP-Message = 0x0201000d016d73696c7665726f NAS-Port-Type = Wireless-802.11 NAS-Port = 278 NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 68 to 10.0.31.40 port 1645 EAP-Message = 0x0102001604100150e2e5a3af2f9bf6b494482cd5b15c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c4703a0f252b64ab3b8aac1c Finished request 63. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=69, length=155 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x32c823b2ce943c46fe0003306353f899 EAP-Message = 0x02020006030d NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c4703a0f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/tls rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 69 to 10.0.31.40 port 1645 EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c571330f252b64ab3b8aac1c Finished request 64. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=70, length=259 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x81272adb33bde6be5f5504b71ab4a408 EAP-Message = 0x0203006e0d8000000064160301005f0100005b030148e6393e196c12f7838dcd0d7a1694260cf59192b892175d80ab559c8c0d2a2c00003400390038003500160013000a00330032002f006600050004006500640063006200610060001500120009001400110008000600030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c571330f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 110 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 100 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 005f], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 084d], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a4], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 70 to 10.0.31.40 port 1645 EAP-Message = 0x010404000dc000000b5c160301004a02000046030148e6393f8cf1a3361f16721360b5d45888974900d9d8b23589586a54fe51948e20d797947a00be4bc79252c1053e25d5fce0cedf6011d6ec9db492fd852b63101f003900160301084d0b00084900084600039e3082039a30820282a003020102020101300d06092a864886f70d0101040500308190310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e30 EAP-Message = 0x1c06035504031315436572746966696361746520417574686f72697479301e170d3038303931313139333132345a170d3039303931313139333132345a3077310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c060355040a130549504c414e311b3019060355040313125365727665722043657274696669636174653124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e617230820122300d06092a864886f70d01010105000382010f003082010a0282010100cb176f82821ac53bae0ad6d892dc2fbc02bd709cfd64b2f81bf01398427a953dc2b95534af53 EAP-Message = 0xad5703b2d29b3907f7024d696fe1052b8a17e4e75a68ddaa7c71cae9e65a97275165e2c70edcaa483683b0dcd11b16eb3390c227d7dd513bcd994aae66c7edd36e527c7252c9100d6393d6f61b8a3f3a33bc2f010bd55f4d235582390de19faeb2c875d8d16abe3fc6c7ad9584c90f14e921e374873ab54996ae6e1e913105cccd7b3b17d9b7549e763a5e1a2bd5275bdb2a22326801738ef91eebe62254ed7169c4e228001e2632103b1f38440018088f1eaf6a67c4aa787e0b7742fd4b079bb054222f70b468d2beeed58097b09b1431aa547805ca87260e090203010001a317301530130603551d25040c300a06082b06010505070301300d06092a EAP-Message = 0x864886f70d0101040500038201010006bd989e695b4fc7051fed5d91b62cf1a0d75072e293faf15aa1b638ef07fecded678c1b5533c133c1a0ee2ee602a00def36556a8949260a6772f910c440a42fac024f1827575721130d2f6b5cedd85e0340439a0f651d2c9467054fb89817af3aef0d8a2a41168ff857d047d8ff5e9803dadd7f7946106856fc04fb9f38ff21bd3ff5999113806e7d01669f0e27c1e6be50228a4151e3d39acdc5a6c29ec9b9730055cca50e4d33f8a1c071d84d5df62823125a61a4e3c4d958e83c9218b2a6c3635da4e41c12e403ded5b2c2450e8f04ca53684d2e64cbbc6ccb2351e38207a19f7a9352bec178c892deace531 EAP-Message = 0x99099dcd2c06b6668361b45a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c676330f252b64ab3b8aac1c Finished request 65. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=71, length=155 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xb611e618564f594f59b8a57688c4fc6a EAP-Message = 0x020400060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c676330f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 71 to 10.0.31.40 port 1645 EAP-Message = 0x010504000dc000000b5ce3115e02e0670004a23082049e30820386a003020102020900d9dcff3987698a72300d06092a864886f70d0101050500308190310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f72697479301e170d3038303931313139323934345a170d3038313031313139323934345a308190310b3009060355040613024152 EAP-Message = 0x311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100b326eafca1440742350e357c49fc3ee99823cf82af887f2dab58faf782484e2b9a485b317ded6bd95fa746ef0432c96862dccbaad3d3a619da14c1cf684e530ca3003e18d9ab94284e31330b287dfe3e008c9ac54abc5acde9 EAP-Message = 0x1c85dd20c770467b546d8318c8d17e35709e704dec48b86afca059031c13a2130af97820bd7cfe73ab906acf847bc711184d0e9fba4377647754f6ab75717a7eda6ecc046bda89a0b147271fcdb84b094da53e168e2f83710e72f79fb4a4153ead2b7548dcf5f9d9789b3e0a46f21540659a9b30e834d5ab33184feec0ded43ba366d7b45bf5dec22d5670a7e8c34eb55aa593fc9021c7ec114a6bc0e116711efa8d39ec5617e90203010001a381f83081f5301d0603551d0e04160414783ebd2ad86bb68a828aa2e0b63806cfd5bf7ab03081c50603551d230481bd3081ba8014783ebd2ad86bb68a828aa2e0b63806cfd5bf7ab0a18196a481933081 EAP-Message = 0x90310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f72697479820900d9dcff3987698a72300c0603551d13040530030101ff300d06092a864886f70d010105050003820101001ec43670817b76126b2433fb85bf51d67870b4c4d7e6774e3c5f450c8d1e5d0d7a878812c09decd07d3aa00386d7e9a3f0ff78015767d94a7063fbc62418fc EAP-Message = 0x66d1badfb2f5a6654185c9e8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c777330f252b64ab3b8aac1c Finished request 66. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=72, length=155 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x2851fcc991a9202cc513a5ad8b42d88d EAP-Message = 0x020500060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c777330f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 72 to 10.0.31.40 port 1645 EAP-Message = 0x0106037a0d8000000b5c84d54ba8eb7d1802bb33ae272c6ae33a1f371394cacbfdc36c0dd90cd2a45b27e851fa308b5afba9c3084e6fe8eb04a2c296f328c401c5fd131e275d36db6fe471266bac60ac03bc52671946d3813931fa806d21dd0ad1bf1d243efb8c87cfac21b3bc3f6388cee5f661fcbc6f4f101d4e70989b243cb7a2612249a8918caef66497b10c9d61628506926941bd2d114d976fb8cbe71258686aaea6a0bb5e5c1527ec23b08c068a530e03a74878d6865971666abb10160301020d0c0002090080ad2df571269b93a787f80235487c28f730b4907620fed69ef713bb4f43d3579e11b02fbf45ab4e74cf79b5d447af0fe6805157 EAP-Message = 0x482f2b5f8185c4cc59061e6882ab9e4dd6def0736c0583158ab64a30e9a2de020c5e4f7a41b4c58149a9b110a6d3b521f30e96e82b2b43f2d0d1a699b6484f8c814f72d4fe8fc11d7943f2c6a300010200807eb17e2cd3bfe68954119040daeedff8b2dc0f3023ecc737b3a453b849a6725a6a17f801675e8821a4fc4cddb378120790c895fe52327e02e8f9c6e8f9ec839f7defbb6ff24ce37109716f9036c08068ff8831d267f1bad81afb6e34b1bf3311e69fece8ba8a23f36cd8d30950fb02bf350c76523ca7648447a0cf838438d6230100a9bd246a3c125ff2d25837a5df1922c8e4e41cc543755bee745d052ab78c4166ba6f335041d76861c5 EAP-Message = 0xc740bad59cc9d2b8901fba33e059f7f57eee59d50dff516179b5711c69c66b23f84f4c23976bfcb43b165784d36e4cdf6fae15d73158919ac4399fa34e7d072443949445c14474daa34cf2879b6af859b0ae20854b3b884baa36d9a3efa6ba97011e1d1f7b4807341d9386dc3d6047ed366d83a9c5b511071cc08bc7fa680064cad079a244fed8702ff7176d54f3de6a49fa7de1724dfa657681c3a762f16e264bfe145511225959cbe539409a8cfe85d4bb384d1a05e928d5de903c99dd5da60549dcbd39bba7953a3ead5575372e0f37f8ebf688e82516030100a40d00009c040304010200950093308190310b300906035504061302415231153013 EAP-Message = 0x0603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f726974790e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c074330f252b64ab3b8aac1c Finished request 67. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=73, length=1539 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xab3523198d100765a920a24032159941 EAP-Message = 0x020605640d800000055a16030103840b00038000037d00037a308203763082025ea003020102020102300d06092a864886f70d01010405003077310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c060355040a130549504c414e311b3019060355040313125365727665722043657274696669636174653124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172301e170d3038303931313139333731355a170d3039303931313139333731355a306d310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c0603 EAP-Message = 0x55040a130549504c414e3111300f060355040313086d73696c7665726f3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e617230820122300d06092a864886f70d01010105000382010f003082010a0282010100df4cf6b433a99e968c3032dc86887f26d20b302e996519460cd0c816fe3b4513794e0dd0c40ad573e59684615ab282db1af575f30ab44493abfeaf28154490523082d8531d282d79b4074aae96899c864baf660ebffe60ce1321de0a92cd6fc39b068e068195e4c9e6796de0c812420773f104d59b68f4e2ebc62ac86c02fdc22be08f0da9f12fece103fcaf1d3b45f0c63a0fa55da1aeeb26 EAP-Message = 0x9abff0c6a02984eaea3005d9b8e5c7e1c8bf191f326dd809ea05de48f245223e1ba582587119ded08144006ab2601daf6a405720ed912c9fa976bf8c3450f9a343ffd630530f144dca9e338915de3c1bee28a4d62142bc12541caeb7e6f5315da70fa7879fd79d0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d01010405000382010100c7b5c38930036400b1bba7dc9dcceef40b155059e124b445dd9600c8a00bab47396d76f2f9c42f40ae4a799dd9ef67169d7d748f6967f0474f46366ae80b325dad23879616f8889a5e182d89bdab15e1bbbf6b708054059e55e21eceab9115bc7d494753 EAP-Message = 0xfdcd0cb2c1323d872065465f112d9faabf1ebaef18cb615b818523e10b1c097b9dd4e170c9520bbf3e38e07c4001f6636739e2a756ccd7fc92d180edd66d493dc87a351b4f9203d8c9c034a1efc4b735727b7d04d3e9192ac68a4b33179eb1d2c671486551668a27d712e315aa7cd3f1d2ab328d89a41ccb3404435a493d644b67e64696d642c01c06f54f872d6a8744c6478cfd22f42d42b4021be3160301008610000082008009d50971946c422ae7a50a343bf17f7e5fc6097c5f8cddde0c246670bdd56771841c746db55bd3b8c450850b9ad84e4a99aea116ef578aed3102a603be729aef0fdc879a7578b5a98d94549f9810d1be6a06113673a2 EAP-Message = 0x30e516579b67463d93e885e58c9adced68eecb9f106a7b1554c83307f5b993acf3beb4b9016ef5a19fa116030101060f0001020100a6276e0d6682c25fe886c3d80cb517f574b630e6d1ffc2cf8a90b699b8a0c98e7317b6b4a391330a221c1c23717d9fce471df755ddcb5a49e3ad3417d096dda1d8f55fdb80fe095e7f50e950d66b1be490f52fc97e3c47364cac2391e25d24f196ea4d57e7059dae449cd52c47d3b660b49f5d3b180956a56d9897c46e61f5a9ea862b89807f1ce792ce5b9f99d8be3126eabbbb4fb6fbb93e13223c203ccd159c43afd3bce3538b22d4187c31f4a7cb583efa74a34bf2ce2d22bb7f455ad67b2a9928e0b5deb8d2 EAP-Message = 0x2c8c0542ba87680a7062650816c023c0f3c1fdfa5f1aa4d89030a65b59673d6b9990835818a5ad2d986f3ee9732c6c73bbd24646007fc2ef140301000101160301003029d9e8b20a09e539534830d4eaa73fc19de54c7b9ed0d2586ac9c1adda6438ef3ba746c7c1fa18ad064d0a222d1489ce NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c074330f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 1370 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0384], Certificate --> verify error:num=20:unable to get local issuer certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> msilvero attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 73 to 10.0.31.40 port 1645 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000

2 1

The client does not connect _*_*_*_
by Martin Silvero 03 Oct '08

03 Oct '08

ok tnt, I try that with the application, testing and do you notice. Thank you very much!

1 0