- Freeradius-Users - lists.freeradius.org

avoid accounting of identical requests
by Raffael Himmelreich 19 Jul '08

19 Jul '08

Hi, we're encountering that our radius clients - who don't send anything but access requests and session stop packets with accounting info - repeatedly send the same accounting stop request multiple times. We tried to filter those requests with increasing both the cleanup_delay and max_requests configuration settings, but were not really successful. Looks like the cleanup_delay counter is not effective per request's unique id but for all requests received so far. Are we misinterpreting the cleanup_delay setting? Is there any fast and reliable method built into freeradius to reject multiple identical accounting requests, or do you have any better suggestions? freeradius: FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu (Debian package) Thanks a lot

3 2

Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 18 Jul '08

18 Jul '08

Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no //i set "yes in /etc/raddb/module/mschap for this but still stay on "no" } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

To limit download size
by ELOM ETSE 18 Jul '08

18 Jul '08

Hello! I want to limit users downloaded and uploaded file size. I remark that WISPr-Bandwidth attributes can limit the band width.But this what i need: For example Hitchcock can never download more than file of 25 Mo Hopeson can upload file less than 12Mo of size. Please which attributes must i use? Is it possible to use them without reconfigure freeRADIUS server? Thanks _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

3 2

more than one user file
by TKocher＠spirit21.de 18 Jul '08

18 Jul '08

3 2

Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 18 Jul '08

18 Jul '08

true! there was a great problem with winbindwhich did'n want to run. I had to rename winbindd_priviledged to make it work. so now, the previous error: --------------------------------------------------- rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for glouglou with NT-Password expand: --username=%{mschap:User-Name} -> --username=glouglou mschap2: 8e expand: --challenge=%{mschap:Challenge:-00} -> --challenge=a41b12342f73ab07 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0a26a29835e2bceea879a42b1fcc7993228f9789da5c6087 Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/lib/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/lib/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. ---------------------------------------------------------------------------------------------------------------- could you tell me what autorisation winbindd_priviledge directory should have, please. thank a lot foryour for help. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

modules in unlang unknown?
by Norbert Wegener 18 Jul '08

18 Jul '08

Hello, I want to use a second database searching users, when not found in the first one. So I have setup two sql modules: sqldef and sqlps. In my server configuration there is: authorize { group sqlall { sqldef { notfound = 1 } sqlps } .. preprocess .. if ("%{sqlall:SELECT UserName from radcheck where UserName like '%{User-Name}' }" != "" ) { update control { .... } } .... When a query comes in I finally get: .... server cisco {^M +- entering group authorize^M ++- entering group sqlall^M Obviously the group is known... expand: %{User-Name} -> e0001323c4c3^M rlm_sql (sqldef): sql_set_user escaped user --> 'e0001323c4c3'^M rlm_sql (sqldef): Reserving sql socket id: 3^M ... rlm_sql (sqldef): Released sql socket id: 3^M +++[sqldef] returns ok^M expand: %{User-Name} -> e0001323c4c3^M rlm_sql (sqlps): sql_set_user escaped user --> 'e0001323c4c3'^M rlm_sql (sqlps): Released sql socket id: 4^M rlm_sql (sqlps): User e0001323c4c3 not found^M +++[sqlps] returns notfound^M ++- group sqlall returns ok^M ++? if (!User-Name)^M ? Evaluating !(User-Name) -> TRUE^M ++? if (!User-Name) -> FALSE^M ++[preprocess] returns ok^M ++? if ("%{sqlall:SELECT UserName from radcheck where UserName like '%{User-Name}' }" != "" )^M WARNING: Unknown module "sqlall" in string expansion "%{sqlall:SELECT UserName from radcheck where UserName like '%{User-Name}' }"^ Shouldn't that module be known here? Something wrong with my syntax or something else? Norbert Wegener

2 1

Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 18 Jul '08

18 Jul '08

well.... the entire output is so so long.... i guess it will be bounced!! --------------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 10.10.44.246 port 1031, id=36, length=168 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200001401504c55544f4e5c676c6f75676c6f75 Message-Authenticator = 0xcbb528f5292b11d67c080cc387f843bc +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "PLUTON\glouglou", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> PLUTON\glouglou rlm_sql (sql): sql_set_user escaped user --> 'PLUTON\glouglou' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'PLUTON=5Cglouglou' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'PLUTON=5Cglouglou' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): User PLUTON\glouglou not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 36 to 10.10.44.246 port 1031 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83d5d79483d4ce1dada70e42703d8db9 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1031, id=37, length=246 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201005019800000004616030100410100003d030148813744665ecdbe63b302d853648f2eee8bae6b5453ef683054af22f5caa22800001600040005000a000900640062000300060013001200630100 State = 0x83d5d79483d4ce1dada70e42703d8db9 Message-Authenticator = 0x7f20d5424c08d0debb4c7e3342fb34d9 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "PLUTON\glouglou", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 081b], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 37 to 10.10.44.246 port 1031 EAP-Message = 0x0102040019c000000878160301004a020000460301487fe7a483ef4daf3eb78afc912dbb12c2c415a45ae1c789645893327db8e38820c41a3627717a66af39e2a3a63f0c1138a06d729e6d36a2a4d6be80b3f58b9171000400160301081b0b000817000814000346308203423082022aa003020102020101300d06092a864886f70d010105050030819c310b3009060355040613024d41310e300c0603550408130552616261743110300e06035504071307536f756973736931263024060355040a141d556e69766572736974c3a9204d6f68616d6564205620536f756973736931143012060355040b130b43656e74726520496e666f310f300d0603 EAP-Message = 0x55040314065f5f5f414141311c301a06092a864886f70d010901160d61616140706c75746f6e2e6d61301e170d3038303731343034343233355a170d3133303731333034343233355a308196310b3009060355040613024d41310e300c06035504081305526162617431263024060355040a141d556e69766572736974c3a9204d6f68616d6564205620536f75697373693111300f060355040b13084574756469616e74311530130603550403130c7261646975737365727665723125302306092a864886f70d010901161672616469757373657276657240706c75746f6e2e6d6130819f300d06092a864886f70d010101050003818d003081890281 EAP-Message = 0x8100fb2d9fb89729da2158253e05d3f13a07ac5c7d8f704d5d4d252fe6d5a800025696037f40ccef2c89dd227f8b4b381d067fd3522f311e4f9c074834d8067cd79c59466c1cfc2fbf23e76abea2cd1b56e01f63be206334f9e5bff434d9086d7f4b01d68943a414c83b1aacdac240867545c20eed6e8b34aaaa389eebf824233adb0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003820101008adbb8dcc1bd2e966234a410aff3737b7b6b215e227bafe5791bef0a3cde30866ce9ddbf9747393b897b94746c26ede5383c3c65b86751ccf84f9780700d9c6e54372e41f9b0e0c1f4 EAP-Message = 0x80f459d0429a8ff91e628e907562daf98692ebba46adf1ed0ae3870c6762a34afa7d29993fd4ddd4f70c15ca9fecc678ce28199d69df44a2450bae8f791d5305d28ce5df59b4f20b8ff47b3e4392f26e95e3c97eaf3c7e7e702c7c0c4066324696ab44b821cc7176af64f355597a1d3654bdb2e8a67af503d130f343432aa7e7ea4970e5e137a6449efc4103dc2fd60b554e763ab92ec64129b91bf0a128ab274fc40987d2adf3e1eb008f291cc2dd4b9f17be2bba0db70004c8308204c4308203aca003020102020900996209457d2cc679300d06092a864886f70d010105050030819c310b3009060355040613024d41310e300c0603550408130552 EAP-Message = 0x616261743110300e06035504 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83d5d79482d7ce1dada70e42703d8db9 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1031, id=38, length=172 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 State = 0x83d5d79482d7ce1dada70e42703d8db9 Message-Authenticator = 0x7732bf9fad90dd26b294e9d7a9d3dcdf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "PLUTON\glouglou", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 38 to 10.10.44.246 port 1031 EAP-Message = 0x010303fc1940071307536f756973736931263024060355040a141d556e69766572736974c3a9204d6f68616d6564205620536f756973736931143012060355040b130b43656e74726520496e666f310f300d060355040314065f5f5f414141311c301a06092a864886f70d010901160d61616140706c75746f6e2e6d61301e170d3038303731343034333932345a170d3038303831333034333932345a30819c310b3009060355040613024d41310e300c0603550408130552616261743110300e06035504071307536f756973736931263024060355040a141d556e69766572736974c3a9204d6f68616d6564205620536f7569737369311430120603 EAP-Message = 0x55040b130b43656e74726520496e666f310f300d060355040314065f5f5f414141311c301a06092a864886f70d010901160d61616140706c75746f6e2e6d6130820122300d06092a864886f70d01010105000382010f003082010a0282010100a08601136d34839df53e736dbe50da12db4edae1263b8e41febd10b349933dd0a3348524ca2ca3512a63aeef81f5ee964d780b8e7f02dd99a1bb8c7beb15a09b0bf6a5ef7f444ffb5cb6b09519b55682c06ebd716b5d41e9c8c035d30252d9504c6c7d9c6332c60c3c8c3a7e617e326f9e5adf732c650759db5d1ec26305f7968c8db0b50685ba7803c1b6f36927d807be03e116f24efd0b93136079ab EAP-Message = 0x9ab7bfa264a6708a4d7c6787d0a614761998cce5f89d107affa7c890913557b22455794d042341be775b2adc05bf248ced74efd6e4423f90570ba82f9c6626ecc7b256aad6f6f7057eaafce0f738b4d115cd3c5e34a50689ec6d9397785010d943ff8b0203010001a382010530820101301d0603551d0e041604141b03359ed6e59efc2ea37bf5aad0181ece3537363081d10603551d230481c93081c680141b03359ed6e59efc2ea37bf5aad0181ece353736a181a2a4819f30819c310b3009060355040613024d41310e300c0603550408130552616261743110300e06035504071307536f756973736931263024060355040a141d556e6976657273 EAP-Message = 0x6974c3a9204d6f68616d6564205620536f756973736931143012060355040b130b43656e74726520496e666f310f300d060355040314065f5f5f414141311c301a06092a864886f70d010901160d61616140706c75746f6e2e6d61820900996209457d2cc679300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010041812ec7b34fb44923f615da9372941770dae14a5956ae6851e1501d13549abdfc745da70a38f7db222edc28a4067e63a9b711203ad28c9c27c03c2d422622394b6e119391399b0b32ab61b9b7c2b8b3b67101ac775d4c4028b3eb793788b5b0b53a6edad6e0503a4b5fb0074c0825ee91e9da4308 EAP-Message = 0x287d5f0755b00fed Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83d5d79481d6ce1dada70e42703d8db9 Finished request 2. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1031, id=39, length=172 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300061900 State = 0x83d5d79481d6ce1dada70e42703d8db9 Message-Authenticator = 0x0fe93834b2916e179db32a4a4e30c313 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "PLUTON\glouglou", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 39 to 10.10.44.246 port 1031 EAP-Message = 0x010400921900095073db63e65f0ab28178db3958c7113b9733a22a8b2a88fa045dc87b44d2b3b6e185637aa474de4281c0a67db8311af9c449169c06852467d7fbcc6ad90bf7d94485afdc559d0bedf973b713003b7f64bf8adfe5ab2b62aee86a630eb0d2a19d4c73cd73f8e74f727366c28e71679a191f5928b58406159ab8eb2bd5624051481c1816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83d5d79480d1ce1dada70e42703d8db9 Finished request 3. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1031, id=40, length=358 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400c01980000000b6160301008610000082008012e599c1dd65207a3e9ce50d8996f74ba03b6b2833f240610e877ffe3f99d554514a7a1e11ba5599978d3b12cad9e79f592ff16e78d0adc47d6688a2cb24d4eb5206249677e1ef4608a986e9f3532ca498f7f97bdcd2d3693aea0eefe6de02907ecfba98f4cf5b13d8d9de1384c62e869fc4dde32db5263bb925d3dd5f9dbd64140301000101160301002014688001ba47c255120cf9919f1f508f8a60ee01751ce9039f2f78a6fcd7dc45 State = 0x83d5d79480d1ce1dada70e42703d8db9 Message-Authenticator = 0xdc6a35211c08eac1516e2faf3a4103d0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "PLUTON\glouglou", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 192 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 182 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 40 to 10.10.44.246 port 1031 EAP-Message = 0x01050031190014030100010116030100202208f053e9a7b313afddf279d90493751e93be50d2edef23bf6194a7aada78cf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83d5d79487d0ce1dada70e42703d8db9 Finished request 4. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1031, id=41, length=172 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020500061900 State = 0x83d5d79487d0ce1dada70e42703d8db9 Message-Authenticator = 0xbac34e6b081e86a4b4a3af08c425a353 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "PLUTON\glouglou", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 41 to 10.10.44.246 port 1031 EAP-Message = 0x0106002019001703010015ae3bbf7b20f836fdbe2fba94d4adcab00f30c19d8a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83d5d79486d3ce1dada70e42703d8db9 Finished request 5. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1031, id=42, length=209 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0206002b1900170301002073de0b4508a37d44acb522cff78dd1c87acb6b0cf362bf9d5f54becdc6c47701 State = 0x83d5d79486d3ce1dada70e42703d8db9 Message-Authenticator = 0xb10bf08e6aa8e978b875c4cc5b9eaf47 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "PLUTON\glouglou", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 43 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - PLUTON\glouglou PEAP: Got tunneled EAP-Message EAP-Message = 0x0206001401504c55544f4e5c676c6f75676c6f75 PEAP: Got tunneled identity of PLUTON\glouglou PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to PLUTON\glouglou PEAP: Sending tunneled request EAP-Message = 0x0206001401504c55544f4e5c676c6f75676c6f75 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "PLUTON\\glouglou" server (null) { +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "PLUTON\glouglou", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> PLUTON\glouglou rlm_sql (sql): sql_set_user escaped user --> 'PLUTON\glouglou' rlm_sql (sql): Reserving sql socket id: 2 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'PLUTON=5Cglouglou' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'PLUTON=5Cglouglou' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): User PLUTON\glouglou not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server (null) PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010700291a0107002410143a5b03364fd869b4023ba4684793ae504c55544f4e5c676c6f75676c6f75 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0082521f0085488ca5623cd1d98000f3 PEAP: Processing from tunneled session code 0x81d6eb8 11 EAP-Message = 0x010700291a0107002410143a5b03364fd869b4023ba4684793ae504c55544f4e5c676c6f75676c6f75 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0082521f0085488ca5623cd1d98000f3 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 42 to 10.10.44.246 port 1031 EAP-Message = 0x010700401900170301003502eef878156b04a5701a286b125da5076e11baa135cd31da9c211836dc928e7221e2999df9ca197ffb848df97c76437b47181fdc20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83d5d79485d2ce1dada70e42703d8db9 Finished request 6. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1031, id=43, length=263 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02070061190017030100561cbc6e123c503a093fd6a673cbf7360f4e24bf73ba51460c1569983acc8c5108f97ab88d184e863b30ceabfe474b5eaa1cd03694078357040411d8b6ad42ac7b71344f92795d4fe103ea54ca25e8a7d03bc079a9d617 State = 0x83d5d79485d2ce1dada70e42703d8db9 Message-Authenticator = 0xb362d572e672ba6a8e839ac0ccad74b5 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "PLUTON\glouglou", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 7 length 97 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x0207004a1a020700453172c46d596461e157d2b122da27332a3c0000000000000000f3dd3327fd3672e1e3922e61ccfa5146ced3e82a830f157c00504c55544f4e5c676c6f75676c6f75 PEAP: Setting User-Name to PLUTON\glouglou PEAP: Sending tunneled request EAP-Message = 0x0207004a1a020700453172c46d596461e157d2b122da27332a3c0000000000000000f3dd3327fd3672e1e3922e61ccfa5146ced3e82a830f157c00504c55544f4e5c676c6f75676c6f75 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "PLUTON\\glouglou" State = 0x0082521f0085488ca5623cd1d98000f3 server (null) { +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "PLUTON\glouglou", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 7 length 74 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> PLUTON\glouglou rlm_sql (sql): sql_set_user escaped user --> 'PLUTON\glouglou' rlm_sql (sql): Reserving sql socket id: 1 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'PLUTON=5Cglouglou' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'PLUTON=5Cglouglou' ORDER BY priority rlm_sql (sql): Released sql socket id: 1 rlm_sql (sql): User PLUTON\glouglou not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for glouglou with NT-Password expand: --username=%{mschap:User-Name} -> --username=glouglou mschap2: 14 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=91426d1805c9df8e expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=f3dd3327fd3672e1e3922e61ccfa5146ced3e82a830f157c [2008/07/18 00:45:25, 0] utils/ntlm_auth.c:get_winbind_domain(173) could not obtain winbind domain name! Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. } # server (null) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x81db090 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled Sending Access-Challenge of id 43 to 10.10.44.246 port 1031 EAP-Message = 0x010800261900170301001b1cb26351afcada6fa00681d513a98baa4adc04a92d662a5e7d5801 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83d5d79484ddce1dada70e42703d8db9 Finished request 7. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1031, id=44, length=204 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800261900170301001bed50b902c220b64b1ad0983260196e80d5b6c8f60cd080fa9537eb State = 0x83d5d79484ddce1dada70e42703d8db9 Message-Authenticator = 0xbd133e03130add066fe0cdb5f7eead95 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "PLUTON\glouglou", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> PLUTON\glouglou attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 44 to 10.10.44.246 port 1031 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. Going to the next request Waking up in 4.6 seconds. Cleaning up request 0 ID 36 with timestamp +39 Cleaning up request 1 ID 37 with timestamp +39 Waking up in 0.1 seconds. Cleaning up request 2 ID 38 with timestamp +40 Cleaning up request 3 ID 39 with timestamp +40 Cleaning up request 4 ID 40 with timestamp +40 Cleaning up request 5 ID 41 with timestamp +40 Cleaning up request 6 ID 42 with timestamp +40 Cleaning up request 7 ID 43 with timestamp +40 Cleaning up request 8 ID 44 with timestamp +40 Ready to process requests. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

rlm_attr_rewrite question
by Evgeniy Kozhuhovskiy 18 Jul '08

18 Jul '08

I have some rewrites like this (in pre-proxy): attr_rewrite fixcboss6 { attribute = NAS-IP-Address searchin = "proxy" searchfor = "172.29.51.24" replacewith = "172.26.64.100" new_attribute = no append = no max_matches = 1 } Radius gets packet generated by radtest: User-Name = "guest" User-Password = "guest" NAS-IP-Address = 172.29.51.24 NAS-Port = 1 [...skipped...] +- entering group pre-proxy expand: 172.29.51.24 -> 172.29.51.24 fixcboss6: Does not match: NAS-IP-Address = ╛?3? fixcboss6: Could not find value pair for attribute NAS-IP-Address ++[fixcboss6] returns ok ++[pre_proxy_log] returns ok User-Name = "guest" User-Password = "guest" NAS-IP-Address = 172.29.51.24 NAS-Port = 1 Proxy-State = 0x3336 Proxying request 1 to home server 172.29.51.10 port 1812 User-Name = "guest" User-Password = "guest" NAS-IP-Address = 172.29.51.24 NAS-Port = 1 Proxy-State = 0x3336 Why it does not works? PS Here is the full debug - http://rafb.net/p/le0HmX69.html and here is parts of config: http://rafb.net/p/UB04Mr14.html -- With best regards, Evgeniy Kozhuhovskiy, Leader of Services team, Minsk State Phony Network, RUE Beltelecom.

2 3

rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line
by Venkat 18 Jul '08

18 Jul '08

Hi , I'm facing the above said problem can any one please give me the solution. [root@localhost sbin]# ./radiusd -xX Thu Jul 17 18:04:42 2008 : Info: FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Jul 7 2008 at 17:33:14 Thu Jul 17 18:04:42 2008 : Info: Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. Thu Jul 17 18:04:42 2008 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Thu Jul 17 18:04:42 2008 : Info: PARTICULAR PURPOSE. Thu Jul 17 18:04:42 2008 : Info: You may redistribute copies of FreeRADIUS under the terms of the Thu Jul 17 18:04:42 2008 : Info: GNU General Public License v2. Thu Jul 17 18:04:42 2008 : Info: Starting - reading configuration files ... Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/snmp.conf Thu Jul 17 18:04:42 2008 : Debug: including files in directory /usr/local/etc/raddb/modules/ Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/always Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/files Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/sql.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Thu Jul 17 18:04:42 2008 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Thu Jul 17 18:04:42 2008 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Thu Jul 17 18:04:42 2008 : Debug: main { Thu Jul 17 18:04:42 2008 : Debug: prefix = "/usr/local" Thu Jul 17 18:04:42 2008 : Debug: localstatedir = "/usr/local/var" Thu Jul 17 18:04:42 2008 : Debug: logdir = "/usr/local/var/log/radius" Thu Jul 17 18:04:42 2008 : Debug: libdir = "/usr/local/lib" Thu Jul 17 18:04:42 2008 : Debug: radacctdir = "/usr/local/var/log/radius/radacct" Thu Jul 17 18:04:42 2008 : Debug: hostname_lookups = no Thu Jul 17 18:04:42 2008 : Debug: max_request_time = 30 Thu Jul 17 18:04:42 2008 : Debug: cleanup_delay = 5 Thu Jul 17 18:04:42 2008 : Debug: max_requests = 1024 Thu Jul 17 18:04:42 2008 : Debug: allow_core_dumps = no Thu Jul 17 18:04:42 2008 : Debug: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Thu Jul 17 18:04:42 2008 : Debug: checkrad = "/usr/local/sbin/checkrad" Thu Jul 17 18:04:42 2008 : Debug: debug_level = 0 Thu Jul 17 18:04:42 2008 : Debug: proxy_requests = yes Thu Jul 17 18:04:42 2008 : Debug: log { Thu Jul 17 18:04:42 2008 : Debug: stripped_names = no Thu Jul 17 18:04:42 2008 : Debug: auth = no Thu Jul 17 18:04:42 2008 : Debug: auth_badpass = no Thu Jul 17 18:04:42 2008 : Debug: auth_goodpass = no Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: client 192.168.136.55 { Thu Jul 17 18:04:42 2008 : Debug: ipaddr = 192.168.136.55 Thu Jul 17 18:04:42 2008 : Debug: require_message_authenticator = no Thu Jul 17 18:04:42 2008 : Debug: secret = "sharedsecret" Thu Jul 17 18:04:42 2008 : Debug: nastype = "other" Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: radiusd: #### Loading Realms and Home Servers #### Thu Jul 17 18:04:42 2008 : Debug: proxy server { Thu Jul 17 18:04:42 2008 : Debug: retry_delay = 5 Thu Jul 17 18:04:42 2008 : Debug: retry_count = 3 Thu Jul 17 18:04:42 2008 : Debug: default_fallback = no Thu Jul 17 18:04:42 2008 : Debug: dead_time = 120 Thu Jul 17 18:04:42 2008 : Debug: wake_all_if_all_dead = no Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: home_server localhost { Thu Jul 17 18:04:42 2008 : Debug: ipaddr = 127.0.0.1 Thu Jul 17 18:04:42 2008 : Debug: port = 1812 Thu Jul 17 18:04:42 2008 : Debug: type = "auth" Thu Jul 17 18:04:42 2008 : Debug: secret = "testing123" Thu Jul 17 18:04:42 2008 : Debug: response_window = 20 Thu Jul 17 18:04:42 2008 : Debug: max_outstanding = 65536 Thu Jul 17 18:04:42 2008 : Debug: zombie_period = 40 Thu Jul 17 18:04:42 2008 : Debug: status_check = "status-server" Thu Jul 17 18:04:42 2008 : Debug: ping_check = "none" Thu Jul 17 18:04:42 2008 : Debug: ping_interval = 30 Thu Jul 17 18:04:42 2008 : Debug: check_interval = 30 Thu Jul 17 18:04:42 2008 : Debug: num_answers_to_alive = 3 Thu Jul 17 18:04:42 2008 : Debug: num_pings_to_alive = 3 Thu Jul 17 18:04:42 2008 : Debug: revive_interval = 120 Thu Jul 17 18:04:42 2008 : Debug: status_check_timeout = 4 Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: home_server_pool my_auth_failover { Thu Jul 17 18:04:42 2008 : Debug: type = fail-over Thu Jul 17 18:04:42 2008 : Debug: home_server = localhost Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: realm example.com { Thu Jul 17 18:04:42 2008 : Debug: auth_pool = my_auth_failover Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: realm LOCAL { Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: radiusd: #### Instantiating modules #### Thu Jul 17 18:04:42 2008 : Debug: instantiate { Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_exec, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_exec Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating exec Thu Jul 17 18:04:42 2008 : Debug: exec { Thu Jul 17 18:04:42 2008 : Debug: wait = no Thu Jul 17 18:04:42 2008 : Debug: input_pairs = "request" Thu Jul 17 18:04:42 2008 : Debug: shell_escape = yes Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_expr, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_expr Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating expr Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_expiration, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_expiration Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating expiration Thu Jul 17 18:04:42 2008 : Debug: expiration { Thu Jul 17 18:04:42 2008 : Debug: reply-message = "Password Has Expired " Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_logintime, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_logintime Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating logintime Thu Jul 17 18:04:42 2008 : Debug: logintime { Thu Jul 17 18:04:42 2008 : Debug: reply-message = "You are calling outside your allowed timespan " Thu Jul 17 18:04:42 2008 : Debug: minimum-timeout = 60 Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: radiusd: #### Loading Virtual Servers #### Thu Jul 17 18:04:42 2008 : Debug: server inner-tunnel { Thu Jul 17 18:04:42 2008 : Debug: modules { Thu Jul 17 18:04:42 2008 : Debug: Module: Checking authenticate {...} for more modules to load Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_pap, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_pap Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating pap Thu Jul 17 18:04:42 2008 : Debug: pap { Thu Jul 17 18:04:42 2008 : Debug: encryption_scheme = "auto" Thu Jul 17 18:04:42 2008 : Debug: auto_header = no Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_chap, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_chap Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating chap Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_mschap, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_mschap Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating mschap Thu Jul 17 18:04:42 2008 : Debug: mschap { Thu Jul 17 18:04:42 2008 : Debug: use_mppe = yes Thu Jul 17 18:04:42 2008 : Debug: require_encryption = no Thu Jul 17 18:04:42 2008 : Debug: require_strong = no Thu Jul 17 18:04:42 2008 : Debug: with_ntdomain_hack = no Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_unix, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_unix Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating unix Thu Jul 17 18:04:42 2008 : Debug: unix { Thu Jul 17 18:04:42 2008 : Debug: radwtmp = "/usr/local/var/log/radius/radwtmp" Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_eap, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_eap Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating eap Thu Jul 17 18:04:42 2008 : Debug: eap { Thu Jul 17 18:04:42 2008 : Debug: default_eap_type = "md5" Thu Jul 17 18:04:42 2008 : Debug: timer_expire = 60 Thu Jul 17 18:04:42 2008 : Debug: ignore_unknown_eap_types = no Thu Jul 17 18:04:42 2008 : Debug: cisco_accounting_username_bug = no Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to sub-module rlm_eap_md5 Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating eap-md5 Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to sub-module rlm_eap_leap Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating eap-leap Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to sub-module rlm_eap_gtc Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating eap-gtc Thu Jul 17 18:04:42 2008 : Debug: gtc { Thu Jul 17 18:04:42 2008 : Debug: challenge = "Password: " Thu Jul 17 18:04:42 2008 : Debug: auth_type = "PAP" Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to sub-module rlm_eap_tls Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating eap-tls Thu Jul 17 18:04:42 2008 : Debug: tls { Thu Jul 17 18:04:42 2008 : Debug: rsa_key_exchange = no Thu Jul 17 18:04:42 2008 : Debug: dh_key_exchange = yes Thu Jul 17 18:04:42 2008 : Debug: rsa_key_length = 512 Thu Jul 17 18:04:42 2008 : Debug: dh_key_length = 512 Thu Jul 17 18:04:42 2008 : Debug: verify_depth = 0 Thu Jul 17 18:04:42 2008 : Debug: CA_path = "/path/to/directory/with/ca_certs/and/crls/" Thu Jul 17 18:04:42 2008 : Debug: pem_file_type = yes Thu Jul 17 18:04:42 2008 : Debug: private_key_file = "/usr/local/etc/raddb/certs/test_SAI.pem" Thu Jul 17 18:04:42 2008 : Debug: certificate_file = "/usr/local/etc/raddb/certs/test_SAI.pem" Thu Jul 17 18:04:42 2008 : Debug: CA_file = "/usr/local/etc/raddb/certs/cacert.pem" Thu Jul 17 18:04:42 2008 : Debug: private_key_password = "whatever" Thu Jul 17 18:04:42 2008 : Debug: dh_file = "/usr/local/etc/raddb/certs/dh" Thu Jul 17 18:04:42 2008 : Debug: random_file = "/dev/urandom" Thu Jul 17 18:04:42 2008 : Debug: fragment_size = 1024 Thu Jul 17 18:04:42 2008 : Debug: include_length = yes Thu Jul 17 18:04:42 2008 : Debug: check_crl = no Thu Jul 17 18:04:42 2008 : Debug: cipher_list = "DEFAULT" Thu Jul 17 18:04:42 2008 : Debug: make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Error: rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line Thu Jul 17 18:04:42 2008 : Error: rlm_eap_tls: Error reading private key file /usr/local/etc/raddb/certs/test_SAI.pem Thu Jul 17 18:04:42 2008 : Error: rlm_eap: Failed to initialize type tls Thu Jul 17 18:04:42 2008 : Error: /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" Thu Jul 17 18:04:42 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". Thu Jul 17 18:04:42 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Error: Errors initializing modules -- regards, Venkat 9885480745 'take the things and as and when the way they come ...'

1 0

Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 17 Jul '08

17 Jul '08

well... i am not sure, but it might be: the fact that peap needs user/password and i just sent username... or that realm is null... i read the entire output and am still no sure. anyway, i'll check it as soon as i will be in front of the machine again! thank you - ----- Message d'origine ---- De : Reveal MAP <revealmapp(a)yahoo.fr> À : Freeradius Mailing-List <freeradius-users(a)lists.freeradius.org> Envoyé le : Jeudi, 17 Juillet 2008, 12h35mn 15s Objet : EAP-TLS OK - EAP-PEAP KO!! why that? Why could EAP-TLS run OK and not EAP-PEAP, giving a message like that: "rlm_eap_peap: Received EAP-TLV response." below is the entire output. Thanx for the response!! --------------------------------------- rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=99, length=194 User-Name = "maman" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800261900170301001b97054012345511dfddf34251f30af4349bfda0f83797d643a3cea1 State = 0x766398ac716b81afdd1454abb61d46ce Message-Authenticator = 0xf76a88f5654802fac4faed08e055d5fb +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "maman", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> maman attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 99 to 10.10.44.246 port 1027 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 91 with timestamp +139 Cleaning up request 1 ID 92 with timestamp +139 Cleaning up request 2 ID 93 with timestamp +139 Cleaning up request 3 ID 94 with timestamp +139 Cleaning up request 4 ID 95 with timestamp +139 Cleaning up request 5 ID 96 with timestamp +140 Cleaning up request 6 ID 97 with timestamp +140 Cleaning up request 7 ID 98 with timestamp +140 Cleaning up request 8 ID 99 with timestamp +140 Ready to process requests. ________________________________ Envoyé avec Yahoo! Mail. Une boite mail plus intelligente. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1