- Freeradius-Users - lists.freeradius.org

BCD decoding
by Stefan A. 23 Jul '08

23 Jul '08

Gurus, Would it be possible to BCD decode a VSA value coming from the NAS? I'm working in 3GPP environment. Some of my older GGSNs are sending the 3GPP-IMEISV as it will be delivered to them by the SGSN, which is BCD encoded. They just put the information into the 3GPP VSA. Times ago, it was not clearly defined by 3GPP, how the GGSN has to handle this attribute. Now it is defined, that it must be a string of 16 digits, which will be handled correctly by our new GGSNs. I can separate the different behaviors by the NAS IP, but will need the readable IMEI in the string format for later processing. How would I put such a decoding into a DEFAULT area, possibly in the hints file? Regards Stefan

1 0

FreeRadius Log
by Danilo Molini 23 Jul '08

23 Jul '08

Hi all, I have installed freeradius on a debian machine and it work well. In the log I see that freeradius record failed and accepted authentication, reporting the user, the password and the user client station, but not the device wich someone has tried to make access. For example: from my pc I try to connect to a router without the correct credentials. Freeradius log that my PC with IP address 1.1.1.1 has tried to make access with the user "admin" and password "admin", but do not report the address of the router to wich someone has tried to make access, so if I use freeradius for authenticating user on many device, I can't know on which device someone has tried to make access. There is a way to log also this information? Regards Danilo

3 5

how to set eap/ttls tunnel with auth-type pap work
by Andy An 23 Jul '08

23 Jul '08

Hi Alan/Ivan: As i configured my freeradius server 2.0.5 for our realm xxxx.ca with Ivan's guides it works well by local test or NTRadPing (from WinXP) which did not use any eap stuff. But as I tested by Netgear AP which needs to use eap/ttls/ tunnel and in the tunnel to use pap then it failed with message "rlm_pap: No clear-text password in the request. Not performing PAP. ++[pap] returns noop auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user." (no matter if my username with/without realm). Before I created realm xxxx.ca in proxy.conf file both types of tests( i.e. with/without eap/ttls tunnel)work fine. enclosed here the debugging output message: rad_recv: Access-Request packet from host 10.10.10.29 port 1265, id=52, length=153 User-Name = "andyan" NAS-IP-Address = 10.10.10.29 NAS-Port = 2 Called-Station-Id = "00-14-6C-CC-93-E8:eduroam" Calling-Station-Id = "00-17-F2-52-8A-C7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000b01616e6479616e Message-Authenticator = 0x9b0622cd28c0ca07a2894252266d9582 +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:18 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 0 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for andyan WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=andyan) expand: ou=People,dc=eciad,dc=ca -> ou=People,dc=eciad,dc=ca rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap1.eciad.ca:389, authentication 0 rlm_ldap: bind as cn=radius,ou=Applications,dc=eciad,dc=ca/#password to ldap1.eciad.ca:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=People,dc=eciad,dc=ca, with filter (uid=andyan) rlm_ldap: Added User-Password = {crypt}24234234fsdgfs2342 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user andyan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 52 to 10.10.10.29 port 1265 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c8576424c846361777cb0ac160f1e24 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.29 port 1265, id=53, length=272 User-Name = "andyan" NAS-IP-Address = 10.10.10.29 NAS-Port = 2 Called-Station-Id = "00-14-6C-CC-93-E8:eduroam" Calling-Station-Id = "00-17-F2-52-8A-C7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201007015800000006616030100610100005d030148867b68f229dc3370728c32f16cc8eba5dace189d85f03d39f18438ab70dbde000036002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a0017001900010100 State = 0x4c8576424c846361777cb0ac160f1e24 Message-Authenticator = 0x5d147b305a321b03b57beb1712544955 +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:18 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 1 length 112 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS TLS Length 102 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 53 to 10.10.10.29 port 1265 EAP-Message = 0x0102040015c0000008bb160301004a02000046030148867b5eef813368f7f8a4d7a1763bcb77f3abe2e302c009685f134c0dd2a5d820f3f04518281bc20040b6888ed2ac438c03f5acefad34e1e45c69a9d22ddd6349002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038303631383232303934315a170d3039303631383232303934315a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c5d8f1bfb0aec2555c5e034ee4677c814ac120afc2c6737fae65f755df4a EAP-Message = 0x2af9434f85596064fc5bcd9b5f2e16f426c39ff51614c80a65c2e067a3a4c7911a38a3b8839007ea4d03cbda93410f383e643cd8bd788e9e14d2b3abd1067ad10efcc6eb0f8b8c0302ff00327e8604af8c16debd1e6ca2195d2b8187ca25e77d5f7bd4c84b985981baf5fd0be7cabe98da5d14817bd3ad62f2ac4f281098433100a22663ddb348f2a6ed0dd82f1de13a8ad2a57a3afe6d1e82eca0bf7f708ef7b7999a1af5b78b30171d2a40ce03d8b4daedcacd5bd389559f4b7fc82a4c411712829a3b5a09686b33a1c50abe21e8cff6189d8a481e19871e6f8b629e79dbf5ff590203010001a317301530130603551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d01010405000382010100abdc8d29f0855dd309bd358b192e5c368fa45e161de5671519a4ae6db6c8ed586c8a6c3565dbc39b7c3c648061daabd6d1a220997c7caf6d105df85affd385a5dbae3b9b9040f59b066fa399496d909f04ffbe88e13cb90791e3fa8cb66577101e2967fe5a9d562b5c903c7f3625c59de375241836391ccb85aaad9d02a15af33203b928cdff6276ad00bfdaf17f5ef12d0370926d5dee595b22f0dd8a332ffe2c6e3f80d55551787a6b58e31933c44a6282f6eaaefc8c454955db064b742cf6907cf558d08da46b3a3e1925581fee05bb6ca641511d4f35c7880bbedfed8ea20f0276b21a85 EAP-Message = 0x2889877f5db3c70defc739be Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c8576424d876361777cb0ac160f1e24 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.29 port 1265, id=54, length=166 User-Name = "andyan" NAS-IP-Address = 10.10.10.29 NAS-Port = 2 Called-Station-Id = "00-14-6C-CC-93-E8:eduroam" Calling-Station-Id = "00-17-F2-52-8A-C7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061500 State = 0x4c8576424d876361777cb0ac160f1e24 Message-Authenticator = 0x0b5f2f4dbef2761860878e8a58a3fb97 +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:19 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 2 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 54 to 10.10.10.29 port 1265 EAP-Message = 0x0103040015c0000008bbcef8e8135051d22c8e604c46bbe50004ab308204a73082038fa003020102020900964407b7ca8a72e7300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038303631383232303933395a170d3038303731383232303933395a308193310b EAP-Message = 0x3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100e71a28d861d1bc000ead67dda77fc24c88fd7f4e6b154ec39e6c1328da93acb45c4203d45485a76bd3ebf28e55486d785b45f54c81ee601a8e73e1c07d16f606a1b6146055903f54ebc8a5 EAP-Message = 0x06d421fb703b664bc1a37493d95559d894f04a2ca09c3c5292e9d82cff10a031177cab034ab883b3871e6c2460325a0d8a2a68322698cde33ad81ed808a429177249ff720932bea36f3558c8037fba4110a20451ed263bdd7021686bc816249ff209de18ebc36a923977b852b198a70b3601fb87b263c740a0d191a59591300981709f9beb6987b67bdfa820db88dcb3c3af3fa827552afb43f6accf386739f292c311b7f6287609afec629a4b8f1c0c0d4a9e165d0203010001a381fb3081f8301d0603551d0e041604148fc1ab4304f6a473ea66c4512ef6f9a078dbe3623081c80603551d230481c03081bd80148fc1ab4304f6a473ea66c4512ef6 EAP-Message = 0xf9a078dbe362a18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900964407b7ca8a72e7300c0603551d13040530030101ff300d06092a864886f70d010105050003820101008c2687a029f098693008dbc4ee9968c7e71b0a4792003dc2d62403a142c75c227df610ac8979ffd430cf55103bab EAP-Message = 0xb78977c9a55b9a3571e655a3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c8576424e866361777cb0ac160f1e24 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.29 port 1265, id=55, length=166 User-Name = "andyan" NAS-IP-Address = 10.10.10.29 NAS-Port = 2 Called-Station-Id = "00-14-6C-CC-93-E8:eduroam" Calling-Station-Id = "00-17-F2-52-8A-C7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300061500 State = 0x4c8576424e866361777cb0ac160f1e24 Message-Authenticator = 0x427b0f9046aa0368441bfe10c2d7179a +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:19 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 55 to 10.10.10.29 port 1265 EAP-Message = 0x010400d91580000008bb04ae601515d34e563c02cc3de859401a836dc8d5b9e0c675cc610078839fc238a6f3ca30ce79381a61c588416489587635fe1fa874b66bc643d652e322305ad54f40382d23f7fe74c6df9df734c099780d8604e304ca13d8bc9e2bb3ebd9221731634de6099bb36ff584bae8b16bfd00d3b19ffe67c20b40e9d66366325f55810904fc6fa593c6186bf3cedd075e3c447a65a23d444547c434ec02220b377133980437496ee79601f296ea241e10ed902bcdf83adac9980a26ac91f4b034ef1e88febcd2e3a416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c8576424f816361777cb0ac160f1e24 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.29 port 1265, id=56, length=498 User-Name = "andyan" NAS-IP-Address = 10.10.10.29 NAS-Port = 2 Called-Station-Id = "00-14-6C-CC-93-E8:eduroam" Calling-Station-Id = "00-17-F2-52-8A-C7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0204015015800000014616030101061000010201004ceebe5f879c41a3395d900eea4eb9966d09e70dc9df76e62f4b0affb35186dbaf85a117a323524a163eaa6f96d26ed9c7e9e75bbf86c15067035166e9e00b5e7226527516b954ba6b671993562c37555bbfe8a01223163311723e6e54d4f799c84d5c31745b311c0ac699953c5b854eb6f490116780513148e5d1e65c5974824b5fb3d951969c0e631c0511f7a5e4362927de0802017cb1bddf30bcf459b83f4faf5c1bc0e9b3d2714121d5e8952ab7746f63747bfb56134f5943d006a9c08a66de60ee8f2bf08ecea6919f8c9b1fd54dd4ad4d4ceefe6ac7bdeb8a4618549b22278c2065efcff4 EAP-Message = 0x24092ced63af3d613749e3b3b718a8050e3598c26e4fa27914030100010116030100300e32ab01355213c817cdedc7514b16d9b5f9e654efa6b9719e0270680c1ba911b01901404fc087870162cdadcd55db30 State = 0x4c8576424f816361777cb0ac160f1e24 Message-Authenticator = 0x35b507b12476ef1128fe82146ce3a7eb +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:19 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 4 length 253 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS TLS Length 326 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 56 to 10.10.10.29 port 1265 EAP-Message = 0x0105004515800000003b1403010001011603010030fde8c6f00ff0117be406521d638021351155e4bf6e518fe011ae9856c9a02a77a7c883770992848eb3f5ef926cb0a2cd Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c85764248806361777cb0ac160f1e24 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.10.10.29 port 1265, id=57, length=319 User-Name = "andyan" NAS-IP-Address = 10.10.10.29 NAS-Port = 2 Called-Station-Id = "00-14-6C-CC-93-E8:eduroam" Calling-Station-Id = "00-17-F2-52-8A-C7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0205009f1580000000951703010090a9ab31a7f43c2c59f864f296d626095e508727aa6d4307653d6b9ecbe7650e8ea07fdb2154f9309e6beae535be1fff046b09d490cb1812abd04d9786a8581c5aff4c9bcded643edc67f71220341b01f4bcc1cd1eb13f3610fe7ddef6bb2b7b78f9d131f3c788f156c965e1fcd9fa219ae71b29e33f8cb796582208aa4155e240d2f19d32eb483e97707ca9d74e47924c State = 0x4c85764248806361777cb0ac160f1e24 Message-Authenticator = 0x0ae56b01a9b527a7ea9ec6b016b0f1c3 +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:19 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 5 length 159 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS TLS Length 149 rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:19 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for andyan WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=andyan) expand: ou=People,dc=eciad,dc=ca -> ou=People,dc=eciad,dc=ca rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=eciad,dc=ca, with filter (uid=andyan) rlm_ldap: Added User-Password = {crypt}26dafouiho8902 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user andyan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: No clear-text password in the request. Not performing PAP. ++[pap] returns noop auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> andyan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 57 to 10.10.10.29 port 1265 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 5. Going to the next request Thanks in advance for any guide/clue. -- Andy An Junior Programmer Information Technology Services Emily Carr University of Art and Design Tel: 604-630-4556 Fax: 604-844-3801 SB Room 341

2 1

ntlm_authentication for multiple supplicants
by splintered thoughts 23 Jul '08

23 Jul '08

Hello, I've trying to get ntlm_auth to authenticate several supplicants using freeradius 1.1.6, specifically with MacOS and Windows XP SP3, and I've attempting to inspect the contents of variables while doing the ntlm_auth authentication. My ntlm_auth command is: ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-%{mschap:User-Name}}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} Is there a way to use regular expressions or otherwise to inspect the Stripped-User-Name to adjust which radius attribute is used in the ntlm_auth command, in other words look for a value Stripped-User-Name =~ /^value(.*)$/ and then use, for instance, the %{mschap:User-Name}in its place to authenticate? Is there a better approach? Thanks, John

2 1

User-Profile per user per NAS via LDAP?
by Stephen Bowman 23 Jul '08

23 Jul '08

Running version 2.0.5, with LDAP backend for authentication/authorization. Needed functionality: A single user account needs a different ldap/radius profile depending on which huntgroup the request is coming in on... the reason is that each user has a different Framed-IP-Address for each VPN concentrator they are coming in on. So each user needs a profile per NAS, I believe. I have separated out each NAS into its appropriate huntgroup, and am matching on that in the users file. Also trying to dynamically set the User-Profile. DEFAULT Huntgroup-Name == jup-rtr-xauth, Ldap-Group == `cn=%{Huntgroup-Name},ou=Groups,ou=Radius,dc=geowireless,dc=net`, User-Profile := `uid=%{User-Name},ou=jup-rtr-xauth,ou=Profiles,ou=Radius,dc=geowireless,dc=net` Fall-Through = no (entire users file at the end of this message). The user is authenticated successfully (so the group matching and the %{Huntgroup-Name} expansion are working fine), but the User-Profile is not being set. If I hard code in the value for uid, it works, so the problem is in the variable. radiusd -X output: rad_recv: Access-Request packet from host 192.168.17.1 port 57383, id=124, length=121 User-Name = "sbowman" User-Password = "XXX" Acct-Session-Id = "NS-00000035" NAS-IP-Address = 192.168.17.1 NAS-Port = 24824 NAS-Port-Type = Virtual Called-Station-Id = "75.145.224.194" Calling-Station-Id = "140.32.244.99" Netscreen-Attr-10 = 0x00000003 +- entering group authorize expand: %{Packet-Src-IP-Address} -> 192.168.17.1 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "sbowman", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop rlm_ldap: Entering ldap_groupcmp() expand: ou=People,dc=domain,dc=net -> ou=People,dc=domain,dc=net WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=sbowman) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.domain.net:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/pki/tls/certs/ca-bundle.crt rlm_ldap: starting TLS request done: ld 0x84e1340 msgid 1 rlm_ldap: bind as uid=redpillradius,ou=Clients,dc=domain,dc=net/XXX to ldap.domain.net:389 rlm_ldap: waiting for bind result ... request done: ld 0x84e1340 msgid 2 rlm_ldap: Bind was successful rlm_ldap: performing search in ou=People,dc=domain,dc=net, with filter (uid=sbowman) request done: ld 0x84e1340 msgid 3 rlm_ldap: ldap_release_conn: Release Id: 0 expand: (|(&(objectClass=GroupOfNames)(member=%{check:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{check:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=domain,dc=net, with filter (&(cn=disabled)(|(&(objectClass=GroupOfNames)(member=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet)))) request done: ld 0x84e1340 msgid 4 rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group disabled not found or user is not a member. expand: cn=%{Huntgroup-Name},ou=Groups,ou=Radius,dc=domain,dc=net -> cn=jup-rtr-xauth,ou=Groups,ou=Radius,dc=domain,dc=net rlm_ldap: Entering ldap_groupcmp() expand: ou=People,dc=domain,dc=net -> ou=People,dc=domain,dc=net expand: (|(&(objectClass=GroupOfNames)(member=%{check:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{check:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=jup-rtr-xauth,ou=Groups,ou=Radius,dc=domain,dc=net, with filter (|(&(objectClass=GroupOfNames)(member=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))) request done: ld 0x84e1340 msgid 5 rlm_ldap::ldap_groupcmp: User found in group cn=jup-rtr-xauth,ou=Groups,ou=Radius,dc=domain,dc=net rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 209 ++[files] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for sbowman WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=sbowman) expand: ou=People,dc=domain,dc=net -> ou=People,dc=domain,dc=net rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=domain,dc=net, with filter (uid=sbowman) request done: ld 0x84e1340 msgid 6 rlm_ldap: performing search in uid=%{User-Name},ou=jup-rtr-xauth,ou=Profiles,ou=Radius,dc=domain,dc=net, with filter (objectclass=radiusprofile) request done: ld 0x84e1340 msgid 7 rlm_ldap: object not found or got ambiguous search result rlm_ldap: default_profile/user-profile search failed rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: Setting Auth-Type = LDAP rlm_ldap: user sbowman authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type LDAP auth: type "LDAP" +- entering group LDAP rlm_ldap: - authenticate rlm_ldap: login attempt by "sbowman" with password "XXX" rlm_ldap: user DN: uid=sbowman,ou=People,dc=domain,dc=net rlm_ldap: (re)connect to ldap.domain.net:389, authentication 1 rlm_ldap: setting TLS CACert File to /etc/pki/tls/certs/ca-bundle.crt rlm_ldap: starting TLS request done: ld 0x8572fe0 msgid 1 rlm_ldap: bind as uid=sbowman,ou=People,dc=domain,dc=net/XXX to ldap.domain.net:389 rlm_ldap: waiting for bind result ... request done: ld 0x8572fe0 msgid 2 rlm_ldap: Bind was successful rlm_ldap: user sbowman authenticated succesfully ++[ldap] returns ok Login OK: [sbowman] (from client jup-rtr-xauth port 24824 cli 140.32.244.99) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 124 to 192.168.17.1 port 57383 Finished request 1. ------ users ----- DEFAULT Ldap-Group == disabled, Auth-Type := Reject Reply-Message = "Account disabled. Please call the helpdesk." DEFAULT Huntgroup-Name == jup-rtr-xauth, Ldap-Group == `cn=%{Huntgroup-Name},ou=Groups,ou=Radius,dc=geowireless,dc=net`, User-Profile := `uid=%{User-Name},ou=jup-rtr-xauth,ou=Profiles,ou=Radius,dc=geowireless,dc=net` Fall-Through = no DEFAULT Huntgroup-Name == jup-rtr-xauth, Auth-Type := Reject Reply-Message = "Not authorized for XAuth access. Please call the helpdesk.", Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "Please call the helpdesk." -----------------

2 1

Re: Freeradius 2.0.5 - configure to use mysql radacct table instead of file
by Vidar Hatlemark 23 Jul '08

23 Jul '08

2 1

Cannot login with freeradius 2.0.5
by Asep Samsul 23 Jul '08

23 Jul '08

Hi, I'm using freeradius 1.1.7 , and now i want to try for the other machine to 2.0.5. I'm sure about configuration, : - Using Opensuse 10.2 - Using mysql and freeradius 2.0.5 - NAS from VPN Mikrotik Please help me,.... a'm using default configuration from installer. +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok rlm_realm: No '@' in User-Name = "asul", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated users: Matched entry DEFAULT at line 175 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type mschap auth: type "MSCHAP" +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for asul with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> asul attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 17 to 202.159.24.1 port 1025 Finished request 3. Going to the next request

3 4

Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 22 Jul '08

22 Jul '08

log: http://tinypaste.com/5b99b I am wondering something: some more questions: as i encounterd problem with included script for certificate files (bootstarp!! am i the one?), i created my own certificate... as I could! the fact is that running bootstrap, client certificate is on error cause it says that server certificate is not valid or not allowed to sign other certificate files... i created and imported my own on XP for the test: the one DER format of the CA, and the other one p12 format with EKU(of the client). it means, only two! so my question is, if the certificate (with server extension) is missing on the client, could it interfer in EAP-PEAP authentication success? thank you ----- Message d'origine ---- De : Reveal MAP <revealmapp(a)yahoo.fr> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mardi, 22 Juillet 2008, 12h02mn 26s Objet : Re : Re : Re : Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that? Hello Alan (and all the others too) I am sory about the delay! here is the entire log: http://tinypaste.com/5b99b EAP PEAP still don't work without giving an error message understandable by me! hope it will be clearer for you! I precise: NTLM_AUTH authenticate successfully against AD, same with winbind. and EAP-TLS runs Ok thank you ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Samedi, 19 Juillet 2008, 19h05mn 33s Objet : Re: Re : Re : Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that? Reveal MAP wrote: >> "f you want to authenticate PEAP users via SQL (which you seem >> to be saying), then don't configure the mschap module to use ntlm_auth." > > my mistake: i didn't know... Huh? You are aware that AD is not the same as SQL? > back to Users based on AD. >... > in etc/raddb/module/mschap, i have this for ntlm_auth: ... And then nothing for "radiusd -X". If you can't follow repeated instructions, I think it's impossible for me to help you. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ Envoyé avec Yahoo! Mail. Une boite mail plus intelligente. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Freeradius 2.0.5 - configure to use mysql radacct table instead of file
by Vidar Hatlemark 22 Jul '08

22 Jul '08

Hi After a long week of reading every config file, how-to's (old, outdated, new, faulty and what not) and reading this mailing list archive and tried many test installs of freeradius I now ask for some help. Short version: How to configure freeradius to populate the radacct mysql table. (need help) And based on the info in the table, make a php page to list online user with the ability to kick them off. (will be able to do this by my self, if radacct table is the right place to do this) Am I supposed to send extra parameters to the server when logging in to get it to populate this table? Long version: My system is Slackware 12.1 Kernel 2.6.24.5 mysql 5.0.51b php 5.2.5 Apache 2.2.8 And FreeRadius 2.0.5 from tar.gz source. What I've done so far: Extracted and doing the configure, make, make install. mysql -uroot -p CREATE DATABASE radius; GRANT ALL ON radius.* TO radius@localhost IDENTIFIED BY "radpass"; exit But in 2.0.5 I can't find the next two steps, cd /usr/share/doc/packages/freeradius/doc/examples/ mysql -uroot -p radius < mysql.sql In fact I can't find either the mysql.sql or the db_mysql.sql stated in the schema.sql header. So I imported the schema.sql from /usr/local/etc/raddb/sql/mysql/ folder. This gives me the radius tables that I need so far I guess. (or is this wrong?) Next up was sql.conf, added mysql credentials. Followed by editing the /usr/local/etc/raddb/sites-available/default, adding sql to the authorize and accounting. And added my pfSense to the client list aswell as my client pc (for NRradPing tool test). client 192.168.1.1 { secret = testing123 nastype = other } client 192.168.1.11 { secret = testing123 nastype = other } Then manually added a user to the radcheck table. id= 1 UserName= testuser Attribute= Cleartext-Password Value= testpasswd Op= := Testing this from pfSense' captive portal with radius support works. (And the NTradPing tool from my client pc) I'm also able to kick out the user from pfSense captive portal status page. And now to my problems/questions. I'm building this into a small webtool for admin the users (daloRadius only gave me plenty of sql errors and since I'm able to write my own in php I will). So far, adding the users to the radcheck table is easy. What's not - is understanding how the radacct table gets populated. All I get is new entries in the /usr/local/var/log/radius/radacct/192.168.1.1/auth-detail-yyymmdd As shown here : Tue Jul 22 14:06:55 2008 Packet-Type = Access-Request NAS-IP-Address = 88.88.54.181 NAS-Identifier = "router.local.lan" User-Name = "testuser" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Framed-IP-Address = 192.168.1.11 Called-Station-Id = "00:0d:9d:xx:xx:xx" (masked out to hide the mac) Calling-Station-Id = "00:50:8d:xx:xx:xx" (masked out to hide the mac) How do I redirect this (and more info) to populate the radacct table? (See the short version question on top of this post) Thank you for reading this long post. Feel free to ask any question about my setup, sorry if I've not included enough already. Kind regards

2 1

EAP-SIM authentication / Supplicant
by Geoffroy Arnoud 22 Jul '08

22 Jul '08

Hi all, I try to use FreeRADIUS to authenticate a wireless device using EAP-SIM. Currently, my SIM card can be authenticated using a Cisco supplicant (eap-sim-draft-v5) with a Cisco Access Registrar RADIUS server (eap-sim-draft-v5) that gets SIM triplets from an ITP and a HLR simulator. I extracted the triplets from the HLR and injected them into FreeRADIUS rlm_sim_files module. I use another laptop, with centrino chipset with Intel EAP-SIM supplicant. The FreeRADIUS server receives the EAP message and sends back a Challenge. The supplicant answers to the challenge. FreeRADIUS then sends back the same challenge. The supplicant stops I would like to know whether someone uses EAP-SIM, and which supplicant is used. Regading RFC compliancy, I assume that FreeRADIUS is eap-sim-draft-v12 compliant (present in RFC directory). The Intel supplicant can be RFC compliant. Here is my config : sites-enabled/default : authorize { eap { ok = return } sim_files } authenticate { eap } preacct { } accounting { } session { } post-auth { } pre-proxy { } post-proxy { } ************************ simtriplets.dat : 1102030405060708@ims.mnc030.mcc102.3gppnetwork.org,00000000000000000000000000000000,01234567,89ABCDEFFEDCBA98 1102030405060708@ims.mnc030.mcc102.3gppnetwork.org,00000000000000000000000000000000,01234567,89ABCDEFFEDCBA98 1102030405060708@ims.mnc030.mcc102.3gppnetwork.org,00000000000000000000000000000000,01234567,89ABCDEFFEDCBA98 I know that triplets are identical, but it is the exact content of my HLR ************************ FreeRADIUS debug output : rad_recv: Access-Request packet from host 10.67.141.66 port 1647, id=18, length=282 User-Name = "1102030405060708(a)ims.mnc030.mcc102.3gppnetwork.org" Framed-MTU = 1400 Called-Station-Id = "001a.6cf3.fd90" Calling-Station-Id = "0013.ce0d.e627" Cisco-AVPair = "ssid=MySSID" Service-Type = Login-User Message-Authenticator = 0xc30522798ef5169cf5e0c3807650d0ca EAP-Message = 0x02010037013131303230333034303530363037303840696d732e6d6e633033302e6d63633130322e336770706e6574776f726b2e6f7267 Cisco-NAS-Port = "611" NAS-Port = 611 NAS-Identifier = "AP4" Proxy-State = 0x535347 Proxy-State = 0x323234 NAS-IP-Address = 10.67.106.62 Event-Timestamp = "Jul 22 2008 07:58:15 GMT" NAS-Port-Type = Wireless-802.11 WISPr-Location-Name = "unknown" Proxy-State = 0x3432 +- entering group authorize rlm_eap: EAP packet type response id 1 length 55 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_sim_files: authorized user/imsi 1102030405060708(a)ims.mnc030.mcc102.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type sim rlm_eap: Underlying EAP-Type set EAP ID to 23 ++[eap] returns handled Sending Access-Challenge of id 18 to 10.67.141.66 port 1647 EAP-Message = 0x01170014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ef748f79ee05ae75aadbce935e2f4b8 Proxy-State = 0x535347 Proxy-State = 0x323234 Proxy-State = 0x3432 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.67.141.66 port 1647, id=19, length=333 User-Name = "1102030405060708(a)ims.mnc030.mcc102.3gppnetwork.org" Framed-MTU = 1400 Called-Station-Id = "001a.6cf3.fd90" Calling-Station-Id = "0013.ce0d.e627" Cisco-AVPair = "ssid=MySSID" Service-Type = Login-User Message-Authenticator = 0xd4899c4bcc876e21712e13b045ea773f EAP-Message = 0x02170058120a00000e0e00323131303230333034303530363037303840696d732e6d6e633033302e6d63633130322e336770706e6574776f726b2e6f726700001001000107050000e05543a4f8463a935b25152720718715 Cisco-NAS-Port = "611" NAS-Port = 611 State = 0x9ef748f79ee05ae75aadbce935e2f4b8 NAS-Identifier = "AP4" Proxy-State = 0x535347 Proxy-State = 0x323235 NAS-IP-Address = 10.67.106.62 Event-Timestamp = "Jul 22 2008 07:58:15 GMT" NAS-Port-Type = Wireless-802.11 WISPr-Location-Name = "unknown" Proxy-State = 0x3433 +- entering group authorize rlm_eap: EAP packet type response id 23 length 88 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_sim_files: authorized user/imsi 1102030405060708(a)ims.mnc030.mcc102.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/sim rlm_eap: processing type sim +++> EAP-sim decoded packet: User-Name = "1102030405060708(a)ims.mnc030.mcc102.3gppnetwork.org" Framed-MTU = 1400 Called-Station-Id = "001a.6cf3.fd90" Calling-Station-Id = "0013.ce0d.e627" Cisco-AVPair = "ssid=MySSID" Service-Type = Login-User Message-Authenticator = 0xd4899c4bcc876e21712e13b045ea773f EAP-Message = 0x02170058120a00000e0e00323131303230333034303530363037303840696d732e6d6e633033302e6d63633130322e336770706e6574776f726b2e6f726700001001000107050000e05543a4f8463a935b25152720718715 Cisco-NAS-Port = "611" NAS-Port = 611 State = 0x9ef748f79ee05ae75aadbce935e2f4b8 NAS-Identifier = "AP4" Proxy-State = 0x535347 Proxy-State = 0x323235 NAS-IP-Address = 10.67.106.62 Event-Timestamp = "Jul 22 2008 07:58:15 GMT" NAS-Port-Type = Wireless-802.11 WISPr-Location-Name = "unknown" Proxy-State = 0x3433 EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-IDENTITY = 0x00323131303230333034303530363037303840696d732e6d6e633033302e6d63633130322e336770706e6574776f726b2e6f72670000 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-NONCE_MT = 0x0000e05543a4f8463a935b25152720718715 rlm_eap: Underlying EAP-Type set EAP ID to 24 ++[eap] returns handled Sending Access-Challenge of id 19 to 10.67.141.66 port 1647 EAP-Message = 0x01180050120b0000010d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b05000045eec452c1f4a185a68788b07e757a52 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ef748f79fef5ae75aadbce935e2f4b8 Proxy-State = 0x535347 Proxy-State = 0x323235 Proxy-State = 0x3433 Finished request 3. Going to the next request Waking up in 4.9 seconds. ********************** Thanks in advance for any feedback. Geoff. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1