- Freeradius-Users - lists.freeradius.org

RE： TLS/wired fail
by 娟严 04 Jun '08

04 Jun '08

Hi,All! I 'd like to add some infos about this issue. TLS/wired is failed,but MD5/wired is successful. It's Ok when I use AP instead of switch authenticating eap/tls and eap/ttls with the same freeradius. Is it the problem of switch or the problem of radius? I think it's the problem of radius server,because md5 can authenticate successful, that means 802.1X works properly on switch. So how to configure freeradius as wired authentication? I don't use sql, I just add some items at the end of the users file,just like this: switch_client Cleartext-Password :="whatever" #################################### Hi,All! My freeradius version is v2.0.2,and I use cisco 2950 switch as Authenticator; the packet sent by server miss the EAP-TLS Fragments(server sent a packet which miss the server hello and ciper suilt messages after received a client hello packet),I don't kown what the prolbem.Can anybody help me? Here are the packets,the ip of radius server is:192.168.0.197,the ip of switch is:192.168.0.123. No. Time Source Destination Protocol Info 63 89.556162 192.168.0.123 192.168.0.197 RADIUS Access-Request(1) (id=3, l=116) Frame 63 (158 bytes on wire, 158 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.456040000 [Time delta from previous captured frame: 1.228814000 seconds] [Time delta from previous displayed frame: 89.556162000 seconds] [Time since reference or first frame: 89.556162000 seconds] Frame Number: 63 Frame Length: 158 bytes Capture Length: 158 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_44:1b:40 (00:0a:8a:44:1b:40), Dst: Micro-St_89:79:21 (00:19:db:89:79:21) Destination: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.123 (192.168.0.123), Dst: 192.168.0.197 (192.168.0.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 144 Identification: 0x0003 (3) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x38c9 [correct] [Good: True] [Bad : False] Source: 192.168.0.123 (192.168.0.123) Destination: 192.168.0.197 (192.168.0.197) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 124 Checksum: 0x12c3 [correct] [Good Checksum: True] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x3 (3) Length: 116 Authenticator: FE6787CBF64C4301CBAD5355610B9634 Attribute Value Pairs AVP: l=6 t=NAS-IP-Address(4): 192.168.0.123 NAS-IP-Address: 192.168.0.123 (192.168.0.123) AVP: l=6 t=NAS-Port(5): 50003 NAS-Port: 50003 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=15 t=User-Name(1): switch_client User-Name: switch_client AVP: l=19 t=Calling-Station-Id(31): 00-C0-02-2B-D6-04 Calling-Station-Id: 00-C0-02-2B-D6-04 AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=20 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 2 Length: 18 Type: Identity [RFC3748] (1) Identity (13 bytes): switch_client AVP: l=18 t=Message-Authenticator(80): 1C066799CF105346E40019AA2E291D22 Message-Authenticator: 1C066799CF105346E40019AA2E291D22 No. Time Source Destination Protocol Info 66 89.572574 192.168.0.197 192.168.0.123 RADIUS Access-challenge(11) (id=3, l=64) Frame 66 (106 bytes on wire, 106 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.472452000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.016412000 seconds] [Time since reference or first frame: 89.572574000 seconds] Frame Number: 66 Frame Length: 106 bytes Capture Length: 106 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Micro-St_89:79:21 (00:19:db:89:79:21), Dst: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Destination: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.197 (192.168.0.197), Dst: 192.168.0.123 (192.168.0.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 92 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb800 [correct] [Good: True] [Bad : False] Source: 192.168.0.197 (192.168.0.197) Destination: 192.168.0.123 (192.168.0.123) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 72 Checksum: 0x82ea [incorrect, should be 0xa1e2 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Radius Protocol Code: Access-challenge (11) Packet identifier: 0x3 (3) Length: 64 Authenticator: D2EF3D5B79C3B1A4742E4A8C5FB00BD0 Attribute Value Pairs AVP: l=8 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 3 Length: 6 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0x20): Start AVP: l=18 t=Message-Authenticator(80): A58A6FE1C598F8E9A979BABECD78BF65 Message-Authenticator: A58A6FE1C598F8E9A979BABECD78BF65 AVP: l=18 t=State(24): 6B1410EF6B171D4FB7BBF03DE9D33AFE State: 6B1410EF6B171D4FB7BBF03DE9D33AFE No. Time Source Destination Protocol Info 67 89.681078 192.168.0.123 192.168.0.197 RADIUS Access-Request(1) (id=4, l=224) Frame 67 (266 bytes on wire, 266 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.580956000 [Time delta from previous captured frame: 0.108504000 seconds] [Time delta from previous displayed frame: 0.108504000 seconds] [Time since reference or first frame: 89.681078000 seconds] Frame Number: 67 Frame Length: 266 bytes Capture Length: 266 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap:ssl] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_44:1b:40 (00:0a:8a:44:1b:40), Dst: Micro-St_89:79:21 (00:19:db:89:79:21) Destination: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.123 (192.168.0.123), Dst: 192.168.0.197 (192.168.0.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0004 (4) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x385c [correct] [Good: True] [Bad : False] Source: 192.168.0.123 (192.168.0.123) Destination: 192.168.0.197 (192.168.0.197) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 232 Checksum: 0x6329 [correct] [Good Checksum: True] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x4 (4) Length: 224 Authenticator: E1D8149F5F84CF6AB2EF07BC7AB683F2 Attribute Value Pairs AVP: l=6 t=NAS-IP-Address(4): 192.168.0.123 NAS-IP-Address: 192.168.0.123 (192.168.0.123) AVP: l=6 t=NAS-Port(5): 50003 NAS-Port: 50003 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=15 t=User-Name(1): switch_client User-Name: switch_client AVP: l=19 t=Calling-Station-Id(31): 00-C0-02-2B-D6-04 Calling-Station-Id: 00-C0-02-2B-D6-04 AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=18 t=State(24): 6B1410EF6B171D4FB7BBF03DE9D33AFE State: 6B1410EF6B171D4FB7BBF03DE9D33AFE AVP: l=110 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 3 Length: 108 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0x0): Secure Socket Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 97 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 93 Version: TLS 1.0 (0x0301) Random gmt_unix_time: Jun 3, 2008 00:35:22.000000000 random_bytes: 38DD0828D867BEEFB4B298B72518C35459979BC7ED92A0D7... Session ID Length: 0 Cipher Suites Length: 54 Cipher Suites (27 suites) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_IDEA_CBC_SHA (0x0007) Cipher Suite: TLS_DHE_DSS_WITH_RC4_128_SHA (0x0066) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA (0x0063) Cipher Suite: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA (0x0062) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 (0x0061) Cipher Suite: TLS_DHE_RSA_WITH_DES_CBC_SHA (0x0015) Cipher Suite: TLS_DHE_DSS_WITH_DES_CBC_SHA (0x0012) Cipher Suite: TLS_RSA_WITH_DES_CBC_SHA (0x0009) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA (0x0065) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA (0x0064) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 (0x0060) Cipher Suite: TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0014) Cipher Suite: TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x0011) Cipher Suite: TLS_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0008) Cipher Suite: TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 (0x0006) Cipher Suite: TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003) Compression Methods Length: 1 Compression Methods (1 method) Compression Method: null (0) AVP: l=18 t=Message-Authenticator(80): 4A1E0B1F9718533C8A225B0FC8EBB617 Message-Authenticator: 4A1E0B1F9718533C8A225B0FC8EBB617 No. Time Source Destination Protocol Info 68 89.725405 192.168.0.197 192.168.0.123 RADIUS Access-challenge(11) (id=4, l=1090) Frame 68 (1132 bytes on wire, 1132 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.625283000 [Time delta from previous captured frame: 0.044327000 seconds] [Time delta from previous displayed frame: 0.044327000 seconds] [Time since reference or first frame: 89.725405000 seconds] Frame Number: 68 Frame Length: 1132 bytes Capture Length: 1132 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Micro-St_89:79:21 (00:19:db:89:79:21), Dst: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Destination: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.197 (192.168.0.197), Dst: 192.168.0.123 (192.168.0.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1118 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb3fe [correct] [Good: True] [Bad : False] Source: 192.168.0.197 (192.168.0.197) Destination: 192.168.0.123 (192.168.0.123) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 1098 Checksum: 0x86ec [incorrect, should be 0x7116 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Radius Protocol Code: Access-challenge (11) Packet identifier: 0x4 (4) Length: 1090 Authenticator: BFFB901870A6B7784BF8FC427088FD1F Attribute Value Pairs AVP: l=255 t=EAP-Message(79) Segment[1] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[2] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[3] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[4] EAP fragment AVP: l=14 t=EAP-Message(79) Last Segment[5] EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 4 Length: 1024 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0xC0): Length More Length: 2669 AVP: l=18 t=Message-Authenticator(80): F7F26F81A3C0666CA9725E9E0C46907C Message-Authenticator: F7F26F81A3C0666CA9725E9E0C46907C AVP: l=18 t=State(24): 6B1410EF6A101D4FB7BBF03DE9D33AFE State: 6B1410EF6A101D4FB7BBF03DE9D33AFE back at one.... ________________________________ 雅虎邮箱，您的终生邮箱！ ___________________________________________________________ 雅虎邮箱，您的终生邮箱！ http://cn.mail.yahoo.com/

1 0

TLS/wired fail
by 娟严 04 Jun '08

04 Jun '08

Hi,All! My freeradius version is v2.0.2,and I use cisco 2950 switch as Authenticator; the packet sent by server miss the EAP-TLS Fragments(server sent a packet which miss the server hello and ciper suilt messages after received a client hello packet),I don't kown what the prolbem.Can anybody help me? Here are the packets,the ip of radius server is:192.168.0.197,the ip of switch is:192.168.0.123. No. Time Source Destination Protocol Info 63 89.556162 192.168.0.123 192.168.0.197 RADIUS Access-Request(1) (id=3, l=116) Frame 63 (158 bytes on wire, 158 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.456040000 [Time delta from previous captured frame: 1.228814000 seconds] [Time delta from previous displayed frame: 89.556162000 seconds] [Time since reference or first frame: 89.556162000 seconds] Frame Number: 63 Frame Length: 158 bytes Capture Length: 158 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_44:1b:40 (00:0a:8a:44:1b:40), Dst: Micro-St_89:79:21 (00:19:db:89:79:21) Destination: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.123 (192.168.0.123), Dst: 192.168.0.197 (192.168.0.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 144 Identification: 0x0003 (3) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x38c9 [correct] [Good: True] [Bad : False] Source: 192.168.0.123 (192.168.0.123) Destination: 192.168.0.197 (192.168.0.197) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 124 Checksum: 0x12c3 [correct] [Good Checksum: True] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x3 (3) Length: 116 Authenticator: FE6787CBF64C4301CBAD5355610B9634 Attribute Value Pairs AVP: l=6 t=NAS-IP-Address(4): 192.168.0.123 NAS-IP-Address: 192.168.0.123 (192.168.0.123) AVP: l=6 t=NAS-Port(5): 50003 NAS-Port: 50003 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=15 t=User-Name(1): switch_client User-Name: switch_client AVP: l=19 t=Calling-Station-Id(31): 00-C0-02-2B-D6-04 Calling-Station-Id: 00-C0-02-2B-D6-04 AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=20 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 2 Length: 18 Type: Identity [RFC3748] (1) Identity (13 bytes): switch_client AVP: l=18 t=Message-Authenticator(80): 1C066799CF105346E40019AA2E291D22 Message-Authenticator: 1C066799CF105346E40019AA2E291D22 No. Time Source Destination Protocol Info 66 89.572574 192.168.0.197 192.168.0.123 RADIUS Access-challenge(11) (id=3, l=64) Frame 66 (106 bytes on wire, 106 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.472452000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.016412000 seconds] [Time since reference or first frame: 89.572574000 seconds] Frame Number: 66 Frame Length: 106 bytes Capture Length: 106 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Micro-St_89:79:21 (00:19:db:89:79:21), Dst: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Destination: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.197 (192.168.0.197), Dst: 192.168.0.123 (192.168.0.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 92 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb800 [correct] [Good: True] [Bad : False] Source: 192.168.0.197 (192.168.0.197) Destination: 192.168.0.123 (192.168.0.123) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 72 Checksum: 0x82ea [incorrect, should be 0xa1e2 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Radius Protocol Code: Access-challenge (11) Packet identifier: 0x3 (3) Length: 64 Authenticator: D2EF3D5B79C3B1A4742E4A8C5FB00BD0 Attribute Value Pairs AVP: l=8 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 3 Length: 6 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0x20): Start AVP: l=18 t=Message-Authenticator(80): A58A6FE1C598F8E9A979BABECD78BF65 Message-Authenticator: A58A6FE1C598F8E9A979BABECD78BF65 AVP: l=18 t=State(24): 6B1410EF6B171D4FB7BBF03DE9D33AFE State: 6B1410EF6B171D4FB7BBF03DE9D33AFE No. Time Source Destination Protocol Info 67 89.681078 192.168.0.123 192.168.0.197 RADIUS Access-Request(1) (id=4, l=224) Frame 67 (266 bytes on wire, 266 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.580956000 [Time delta from previous captured frame: 0.108504000 seconds] [Time delta from previous displayed frame: 0.108504000 seconds] [Time since reference or first frame: 89.681078000 seconds] Frame Number: 67 Frame Length: 266 bytes Capture Length: 266 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap:ssl] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_44:1b:40 (00:0a:8a:44:1b:40), Dst: Micro-St_89:79:21 (00:19:db:89:79:21) Destination: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.123 (192.168.0.123), Dst: 192.168.0.197 (192.168.0.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0004 (4) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x385c [correct] [Good: True] [Bad : False] Source: 192.168.0.123 (192.168.0.123) Destination: 192.168.0.197 (192.168.0.197) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 232 Checksum: 0x6329 [correct] [Good Checksum: True] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x4 (4) Length: 224 Authenticator: E1D8149F5F84CF6AB2EF07BC7AB683F2 Attribute Value Pairs AVP: l=6 t=NAS-IP-Address(4): 192.168.0.123 NAS-IP-Address: 192.168.0.123 (192.168.0.123) AVP: l=6 t=NAS-Port(5): 50003 NAS-Port: 50003 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=15 t=User-Name(1): switch_client User-Name: switch_client AVP: l=19 t=Calling-Station-Id(31): 00-C0-02-2B-D6-04 Calling-Station-Id: 00-C0-02-2B-D6-04 AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=18 t=State(24): 6B1410EF6B171D4FB7BBF03DE9D33AFE State: 6B1410EF6B171D4FB7BBF03DE9D33AFE AVP: l=110 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 3 Length: 108 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0x0): Secure Socket Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 97 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 93 Version: TLS 1.0 (0x0301) Random gmt_unix_time: Jun 3, 2008 00:35:22.000000000 random_bytes: 38DD0828D867BEEFB4B298B72518C35459979BC7ED92A0D7... Session ID Length: 0 Cipher Suites Length: 54 Cipher Suites (27 suites) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_IDEA_CBC_SHA (0x0007) Cipher Suite: TLS_DHE_DSS_WITH_RC4_128_SHA (0x0066) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA (0x0063) Cipher Suite: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA (0x0062) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 (0x0061) Cipher Suite: TLS_DHE_RSA_WITH_DES_CBC_SHA (0x0015) Cipher Suite: TLS_DHE_DSS_WITH_DES_CBC_SHA (0x0012) Cipher Suite: TLS_RSA_WITH_DES_CBC_SHA (0x0009) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA (0x0065) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA (0x0064) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 (0x0060) Cipher Suite: TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0014) Cipher Suite: TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x0011) Cipher Suite: TLS_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0008) Cipher Suite: TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 (0x0006) Cipher Suite: TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003) Compression Methods Length: 1 Compression Methods (1 method) Compression Method: null (0) AVP: l=18 t=Message-Authenticator(80): 4A1E0B1F9718533C8A225B0FC8EBB617 Message-Authenticator: 4A1E0B1F9718533C8A225B0FC8EBB617 No. Time Source Destination Protocol Info 68 89.725405 192.168.0.197 192.168.0.123 RADIUS Access-challenge(11) (id=4, l=1090) Frame 68 (1132 bytes on wire, 1132 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.625283000 [Time delta from previous captured frame: 0.044327000 seconds] [Time delta from previous displayed frame: 0.044327000 seconds] [Time since reference or first frame: 89.725405000 seconds] Frame Number: 68 Frame Length: 1132 bytes Capture Length: 1132 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Micro-St_89:79:21 (00:19:db:89:79:21), Dst: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Destination: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.197 (192.168.0.197), Dst: 192.168.0.123 (192.168.0.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1118 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb3fe [correct] [Good: True] [Bad : False] Source: 192.168.0.197 (192.168.0.197) Destination: 192.168.0.123 (192.168.0.123) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 1098 Checksum: 0x86ec [incorrect, should be 0x7116 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Radius Protocol Code: Access-challenge (11) Packet identifier: 0x4 (4) Length: 1090 Authenticator: BFFB901870A6B7784BF8FC427088FD1F Attribute Value Pairs AVP: l=255 t=EAP-Message(79) Segment[1] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[2] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[3] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[4] EAP fragment AVP: l=14 t=EAP-Message(79) Last Segment[5] EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 4 Length: 1024 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0xC0): Length More Length: 2669 AVP: l=18 t=Message-Authenticator(80): F7F26F81A3C0666CA9725E9E0C46907C Message-Authenticator: F7F26F81A3C0666CA9725E9E0C46907C AVP: l=18 t=State(24): 6B1410EF6A101D4FB7BBF03DE9D33AFE State: 6B1410EF6A101D4FB7BBF03DE9D33AFE back at one.... ___________________________________________________________ 雅虎邮箱，您的终生邮箱！ http://cn.mail.yahoo.com/

1 0

Logs in radacct
by Daniel Davidson 03 Jun '08

03 Jun '08

For some ready my accounting information isnt being written at all, even though I cannot find a difference in the config file with another radius server I am running. I have included what I believe to be the appropriate parts or radiuxsd -x below. Seems like the %{Client-IP-Address} directories are not created, but I dont know why. I am using radius 1.1.5-1. thanks, Dan Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes .......(skipping stuff)..... Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Detail Portion: detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d:%H detailperm = 0600 }

2 1

Hints file and Strip-User-Name
by Paul Khavkine 03 Jun '08

03 Jun '08

Hi. I'm trying to match a suffix in the username using the hints file and strip the suffix. I have the following configured: raddb/hints: DEFAULT Suffix == ".d", Strip-User-Name = Yes Hint = "Dynamic" raddb/users: DEFAULT Hint == "Dynamic" Framed-IP-Address := 255.255.255.254, Fall-Through = Yes user Cleartext-Password := "password" Service-Type = Framed-User, Framed-IP-Address = XXX.XXX.XXX.XXX, Framed-Protocol = PPP, Framed-Routing = None, Session-Timeout = 604800, Idle-Timeout = 86400, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP When run radiusd -W I can see it enter the preprocess module and match an entry, but the suffix is not being stripped and entry in users file not being matched: Tue Jun 3 12:54:15 2008 : Debug: +- entering group authorize Tue Jun 3 12:54:15 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Tue Jun 3 12:54:15 2008 : Debug: rlm_realm: No '@' in User-Name = "user.d", looking up realm NULL Tue Jun 3 12:54:15 2008 : Debug: rlm_realm: No such realm "NULL" Tue Jun 3 12:54:15 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Tue Jun 3 12:54:15 2008 : Debug: ++[suffix] returns noop Tue Jun 3 12:54:15 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Tue Jun 3 12:54:15 2008 : Debug: hints: Matched DEFAULT at 79 Tue Jun 3 12:54:15 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Tue Jun 3 12:54:15 2008 : Debug: ++[preprocess] returns ok Tue Jun 3 12:54:15 2008 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue Jun 3 12:54:15 2008 : Debug: auth: Failed to validate the user. Tue Jun 3 12:54:15 2008 : Auth: Login incorrect: [user.d/password] (from client ERX-LAB port 2152726802 cli #ERX01.OTWODDS#BLC01.OTW23DS atm 3/1:0.35#) Tue Jun 3 12:54:15 2008 : Debug: Found Post-Auth-Type Reject Tue Jun 3 12:54:15 2008 : Debug: +- entering group REJECT Tue Jun 3 12:54:15 2008 : Debug: modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Tue Jun 3 12:54:15 2008 : Debug: expand: %{User-Name} -> user.d Tue Jun 3 12:54:15 2008 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Jun 3 12:54:15 2008 : Debug: modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Tue Jun 3 12:54:15 2008 : Debug: ++[attr_filter.access_reject] returns updated Tue Jun 3 12:54:15 2008 : Debug: Delaying reject of request 0 for 1 seconds Tue Jun 3 12:54:15 2008 : Debug: Going to the next request Tue Jun 3 12:54:15 2008 : Debug: Waking up in 0.9 seconds. Tue Jun 3 12:54:16 2008 : Debug: Sending delayed reject for request 0 Tue Jun 3 12:54:16 2008 : Debug: Waking up in 4.9 seconds. Tue Jun 3 12:54:21 2008 : Debug: Cleaning up request 0 ID 5 with timestamp +79 Tue Jun 3 12:54:21 2008 : Debug: Ready to process requests. Any ideas ? I'm running FreeRADIUS 2.0.3. Thanx Paul

2 4

Problem with EAP-MD5
by Adnan 03 Jun '08

03 Jun '08

I'm trying to authenticate my wireless users using EAP-MD5 protocol. This is what I have on verbose radiusd -X -s This is entry in my user file 001de03cf351 Cleartext-Password := "001de03cf351" Can some one help me with this problem: rlm_eap: No EAP session matching the State variable. rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Adnan. Going to the next request Waking up in 0.6 seconds. Acct-Session-Id = "2f85c35c" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 User-Name = "001de03cf351" Calling-Station-Id = "00-1D-E0-3C-F3-51" Called-Station-Id = "00-03-52-A1-B5-F0" EAP-Message = 0x024e002204103e504f11bd1ec75aa2a7d10c9761143b303031646530336366333531 State = 0xc6684373c61e47f3b7d0c70f4760f357 NAS-Identifier = "K068-00419" NAS-IP-Address = 192.168.1.43 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Login-User Chargeable-User-Identity = "\000" Colubris-AVPair = "ssid=Colubris Networks 3" Colubris-AVPair = "vsc-name=Studentski domovi 2" Colubris-Attr-254 = 0x00 Colubris-Attr-251 = 0x00000000 Colubris-Attr-253 = 0x01 Colubris-Attr-252 = 0x00000001 Message-Authenticator = 0x94c597ad490d05130436e281862cacb6 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "001de03cf351", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 78 length 34 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry DEFAULT at line 53 users: Matched entry 001de03cf351 at line 74 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: No EAP session matching the State variable. rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [001de03cf351/<via Auth-Type = EAP>] (from client mibo port 1 cli 00-1D-E0-3C-F3-51) Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.6 seconds. Cleaning up request 0 ID 203 with timestamp +72 Waking up in 0.3 seconds.

1 0

Rlm_sqlippool and dialupadmin
by Omer Faruk SEN 03 Jun '08

03 Jun '08

Hi, I am planning to develop a patch for dialupadmin so i can use radippool tablo for Rlm_sqlippool. I just wanted to be sure what to add to the GUI - dialupadmin- 1) There must a a new tab to add IP addresses to the radippool table. At http://wiki.freeradius.org/Rlm_sqlippool IP addresses are added like: INSERT INTO radippool (pool_name, framedipaddress) VALUES ('main_pool', '192.168.0.1'); INSERT INTO radippool (pool_name, framedipaddress) VALUES ('main_pool', '192.168.0.2'); INSERT INTO radippool (pool_name, framedipaddress) VALUES ('main_pool', '192.168.0.3'); INSERT INTO radippool (pool_name, framedipaddress) VALUES ('main_pool', '192.168.0.4 2) The code must edit radgroupcheck table (Not radgroupreply since it is a control attribute not a reply attribute) to add the group to the related pool (for example main_pool) just like in http://lists.cistron.nl/pipermail/freeradius-users/2006-October/057508.html Is there any additional steps that needs to be implemented? BTW am I right about radgroupcheck is used for Control Attributes but radgroupreply is used for reply attributes? Best Regards. -- Best regards, Omer mailto:omer@faruk.net

1 0

Freeradius and OpenVpn
by Sascha Kiefer 02 Jun '08

02 Jun '08

Hi, I set up a openvpn server with radius plugin. Everything seems to run. Now, i submit my username + password using the openvpn win client from openvpn.se . For debugging, i enabled password logging in radius Mon Jun 2 03:44:14 2008 : Auth: Login incorrect: [hugo/boss] (from client ds01 port 3 cli 1.2.3.4) Mon Jun 2 03:44:15 2008 : Auth: Login incorrect: [hugo/boss] (from client ds01 port 3 cli 1.2.3.4) But the hugo/boss combination is right. I also have a poptop server running which uses the same radius server. There i get the following message Mon Jun 2 04:13:33 2008 : Auth: Login OK: [hugo/<no User-Password attribute>] (from client ds01 port 1 cli 7.19) Well, now as i see this message, it it because i only support MsCHAPv2 ??? :-) So i guess, i have to allow something else? What is it? Regards, Sascha

3 2

"looking" into local db after Realm Default was found
by Hans Bornemann 02 Jun '08

02 Jun '08

Hi, I don't know why my radius does the following: my freeradius-server (1.1.7) retrieves the username from the local db AFTER "Found realm "DEFAULT". Then the query was send to the correct radius. Thanks Hans Debug: ....... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 50 modcall[authorize]: module "preprocess" returns ok for request 50 modcall[authorize]: module "chap" returns noop for request 50 modcall[authorize]: module "mschap" returns noop for request 50 rlm_realm: Looking up realm "dfn.de" for User-Name = "bornemann(a)dfn.de" rlm_realm: Found realm "DEFAULT" rlm_realm: Proxying request from user bornemann to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 50 rlm_eap: Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 50 radius_xlat: 'bornemann(a)dfn.de' rlm_sql (sql): sql_set_user escaped user --> 'bornemann(a)dfn.de' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'bornemann(a)dfn.de' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): User bornemann(a)dfn.de not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'bornemann(a)dfn.de' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'bornemann(a)dfn.de' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User bornemann(a)dfn.de not found in radgroupcheck rlm_sql (sql): Released sql socket id: 1 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 50 modcall[authorize]: module "pap" returns noop for request 50 modcall: leaving group authorize (returns updated) for request 50 Sending Access-Request of id 0 to 123.123.123.123 port 1812 ... -- Hans Bornemann Universitaet Dortmund - ITMC Tel. ++49 231 755 2132 Fax. ++49 231 755 2731

3 4

Online users
by Eduardo Cavalcanti 02 Jun '08

02 Jun '08

I want to list the online users, but I don't want to use a database such as mysql. Is there any alternative for me?? Is there any command to list the online users?? I tried "radwho" but it doesn't list any user... Any help?

2 1

if passwd returns notfound -> reject?
by Wolfgang Burger 02 Jun '08

02 Jun '08

Good morning to all, I`m using the passwd module to add an atribute to the request. How can I configure the server to reject the request if the modeule returns "notfound"? One idea would be to add an default value to the attribute and check wether it has changed after the module was called. Would this be possible? Or is there a better way? Thank you all, Wolfgang Burger

2 4