- Freeradius-Users - lists.freeradius.org

EAP/TLS connection problem..
by Johan Nyman 29 Apr '08

29 Apr '08

Hello All, I can seem to connect to the radius server, this is the error code: Anyone has a clue on what It could be? ........................................ Ready to process requests. User-Name = "Linux1" NAS-IP-Address = 10.0.0.197 Called-Station-Id = "00-20-a2-64-c3-b1:devnet" Calling-Station-Id = "00-0e-33-fe-3a-36;devnet" NAS-Identifier = "MVG-1" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020a000b014c696e757831 Message-Authenticator = 0x68a4345956d14cfdd678854f4c955ac7 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "Linux1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 10 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry Linux1 at line 219 expand: Hello, %{User-Name} -> Hello, Linux1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Reply-Message = "Hello, Linux1" EAP-Message = 0x010b00060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x84a6103884ad1d7df7f1c190d83cc59f Finished request 16. ........................................ The wpa_supplican.conf loks like this: network={ ssid="devnet" scan_ssid=1 key_mgmt=WPA-EAP pairwise=CCMP TKIP group=CCMP TKIP auth_alg=OPEN proto=RSN eap=TLS identity="Linux1" ca_cert="/Certs/ca.pem" client_cert="/Certs/client.pem" private_key="/Certs/client.pem" private_key_passwd="secret" } ........................................

3 4

can peap and ttls live together?
by Sergio Belkin 29 Apr '08

29 Apr '08

Hi, I had been using EAP-TTLS, but I've commented in an earlier post, I have no luck with securew2 and Vista. So I am planning use a "secondary password" for radius in clear-text. But I'd want to know if TTLS and PEAP can live together, my current eap.conf is as follow: eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_file = /etc/pki/tls/certs/ips-spectrum-key.pem certificate_file = /etc/pki/tls/certs/ips-spectrum-crt.pem CA_file = /etc/pki/tls/certs/ips-ca-bundle.crt dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random cipher_list = "DEFAULT" } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = yes } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { } } -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

4 9

Expiration?
by Marco Gaiarin 29 Apr '08

29 Apr '08

Using: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO as a base, i've setup freeradius to authenticate against my domain (samba, not AD, but little difference). In this way users can access my wireless network, using their domain account with password expiration and so on. Perfect. But could be that i will need some 'guest access': for, ahem, guests, or for speakers at a conference, ... Creating and deleting domain accounts only for that it is not my preferred choice. The same HOWTO above say: Configuration of users The configuration of this file is not necesary to get work the freeradius against the Active Directory, it is only necessary for advanced usage of FreeRADIUS. One of this advanced features, (among others) is the case when we want to have some local users that does not rely on the Active Directory that is working, but in the local file of users under ${sysconfdir}/raddb directory, an with the same authentication schema of PEAP. Open your users file with your favorite editor and put a line like this: username1 Cleartext-Password := "user-password1", MS-CHAP-Use-NTLM-Auth := 0 Perfectly, also this works. But i'm lazy as many system administrators, and i know that probably i will forgot to have account like this. Googling around i've found the Expiration radius tag that seems suit my needs, but i've found no example around, nor an expalnation if can be used and how on 'users' file. Speaking clearly: can i define in 'users' file some users with an explicit 'expiration date'? Someone can explain me how? Thanks. -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/ Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN) marco.gaiarin(at)sv.lnf.it tel +39-0434-842711 fax +39-0434-842797 Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA! http://www.lanostrafamiglia.it/chi_siamo/5xmille.php (cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

3 5

radius user-password on the wire
by Riccardo Veraldi 29 Apr '08

29 Apr '08

Hello, I used wireshark to sniff communication between my radisu server and the user-password attribute is encrypted 0000 3e ca 2d b0 97 2b b3 f9 0c e9 fc e7 e0 ed e9 fd to test if this is strong enough I wanted to ask if there is a way to decrypt this user-password attribute since my radisu server is doign proxy to other radius server. actually my radius server is authenticating a WiFi captive portal and is prosying requests upon username@domainname user attributes are stripped from domain and sent to proper radius server my question is how much is risky to have user-passsword attribute travellign across the network ? is the encryption applyed to the user-password strong enough ? thanks Rick

5 4

Re: Radius-based windows authentication
by Phil Mayers 29 Apr '08

29 Apr '08

Julien MIOTTE wrote: >> 1. Using the windows native supplicant and machine account >> authentication. Basically the process is this: >> * machine powers on - no-one logged in >> * machine uses its own domain account to login "host/$machinename" >> * user presses ctrl+alt+del >> * machine validates credentials to the domain controller, over the >> current network connection >> * machine downloads the users profile >> * once the profile is download, the machine does an EAP-Logoff and >> then re-authenticates using the user credentials >> * when the user logs out, the machine does and EAP-Logoff and then >> logs back in using the machine account > > Hi, I've been trying to do as you told me. There's no need to CC me. I read the list. > Using the native supplicant and MSCHAPv2 on PEAP, the machine sends now it's > own credentials. My problem is that the login is sent with the > prefix "host/". In my LDAP, the entry of the machine is machine_name$. > > I tried to fix this trough various ways, and I succeded by adding an entry in > the hint file : > DEFAULT Prefix == "host/", Strip-User-Name = "Yes" > > and by changing the filter in the LDAP section : > filter="(uid=%{Stripped-User-Name:-%{User-Name}})" > to > filter="(uid=%{Stripped-User-Name:-%{User-Name}}$)" > > Now the authorization works fine, but when the authenticate section is > processed, the debug prints this : > rlm_eap: Identity does not match User-Name, setting from EAP Identity. > > Am I doing all of this right ? > There's a better way; use the mschap module expansion function, which will both strip and suffix for you: filter = "(uid=%{mschap:User-Name})"

2 1

RE: SQLippool problems (duplicate IPs handed out)
by rsg 29 Apr '08

29 Apr '08

This is with reference to the email with subject "SQLippool problems (duplicate IPs handed out)" posted by Dave on Jan 14 2008. According to him when the number of connections are increased(30+), it was unavoidable that duplicate IPs being handed out. I would like to know the MySQL storage used. Even if it is of type InnoDB was end result the same? Thanks, rg

1 0

Help needed with freeradius, solaris and trapeze
by Miguel Dias 29 Apr '08

29 Apr '08

Hello all, I'm new with Freeradius... I've a machine with solaris 10 installed and with freeradius installed too but I'm taking a lot of problems to use it with my Trapeze infrastructure. Can anyone help? I'm starting with WPA2 - TKIP and I would Like to configure FreeRadius to Authenticate some test users that I can create on freeradius. please help really needed... Where should I start??? thank you all.

4 6

Newbie & EAP/TLS
by Mauro Iorio - Smart Soft s.r.l. 28 Apr '08

28 Apr '08

Hi all, sorry for this newbie question, but I was wondering if there's a way to implement EAP/TLS in freeradius. Does freeradius support TLS? Is there any documentation about it? Any information would be very appreciated. Thank You, Mauro Iorio

3 2

Redundant SQL
by Breuer Nicolas 28 Apr '08

28 Apr '08

Hello I'm using a redundant config for the module ip_pooling # Get an address from the IP Pool. redundant { ip_pooling ip_pooling2 handled } If ip_pooling failed > go to ip_pooling2 using the sql2 connection to an other mysql server. SQL2 is correctly loaded I started radius. Ok - on SQL1. If i kill mysqld without restarting the server. rlm_sql_mysql: MYSQL check_error: 2002 received sqlippool_command: database query error in: 'COMMIT' rlm_sql (sql): Released sql socket id: 2 rlm_sqlippool: IP address could not be allocated. +++[ip_pooling] returns noop IP Allocation FAILED from ip_pooling (did cli port user XXX) The system doesn't load the SQL2. I need to restart the radius to have the sql2 working and the ip allocated.

2 1

Use passwd for MAC filtering?
by Wolfgang Burger 28 Apr '08

28 Apr '08

Hi, I`m trying to add a MAC-Filter to my existing FreeRadius deployment. For some of my users I`m using TLS and want to be able to bind the certificates to a MAC address. I`ve tried to use passwd. In my radiusd.conf ... passwd maclist { filename = /etc/raddb/maclist format = "*User-Name:mac-add" } ... mac-add is added in dictionary ... ATTRIBUTE mac-add 3005 string ... Then, in sites-enabled/default: ... authorize { ... maclist if ( mac-add != Calling-Station-ID ) { reject } ... maclist (for now): Mac445:0017F2ECCC75 What I get is this: rlm_passwd: Added mac-add: '0017F2ECCC75' to config_items +++[maclist] returns ok +++? if (mac-add != Calling-Station-ID ) (Attribute mac-add was not found) So I changed radiusd.conf to: ... passwd maclist { filename = /etc/raddb/maclist format = "*User-Name:~mac-add" } ... Result (full log at end of message): rlm_passwd: Added mac-add: '0017F2ECCC75' to request_items +++[maclist] returns ok +++? if (mac-add != Calling-Station-ID ) ? Evaluating (mac-add != Calling-Station-ID ) -> TRUE +++? if (mac-add != Calling-Station-ID ) -> TRUE +++- entering if (mac-add != Calling-Station-ID ) ++++[reject] returns reject +++- if (mac-add != Calling-Station-ID ) returns reject Is it even possible to add setup a MAC-Filter this way? Or is it just some sort of datatype missmatch (" vs ')? Thank you all Best regards Wolfgang Burger <burgerw(a)immunbio.mpg.de> mac339:~ system$ sudo radiusd -X FreeRADIUS Version 2.0.2, for host powerpc-apple-darwin8.11.0, built on Feb 14 2008 at 15:25:18 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file //etc/raddb/radiusd.conf including configuration file //etc/raddb/proxy.conf including configuration file //etc/raddb/clients.conf including configuration file //etc/raddb/snmp.conf including configuration file //etc/raddb/eap.conf including configuration file //etc/raddb/sql.conf including configuration file //etc/raddb/sql/mysql/dialup.conf including configuration file //etc/raddb/sql/mysql/counter.conf including configuration file //etc/raddb/policy.conf including files in directory //etc/raddb/sites-enabled/ including configuration file //etc/raddb/sites-enabled/default including dictionary file //etc/raddb/dictionary main { prefix = "/" localstatedir = "//var" logdir = "//var/log/radius" libdir = "//lib" radacctdir = "//var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "//var/run/radiusd/radiusd.pid" checkrad = "//sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client 192.168.1.24 { require_message_authenticator = no secret = "xxx" shortname = "netgear1" } client 192.168.1.132 { require_message_authenticator = no secret = "xxx" shortname = "netgear2" } client 192.168.1.133 { require_message_authenticator = no secret = "xxx" shortname = "netgear3" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "xxx" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "xxx" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no use_open_directory = yes } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "//var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eapuser eap eapuser { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "//etc/raddb/certs/server.pem" certificate_file = "//etc/raddb/certs/server.pem" CA_file = "//etc/raddb/certs/ca.pem" private_key_password = "xxx" dh_file = "//etc/raddb/certs/dh" random_file = "//etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Instantiating eapguest eap eapguest { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "//etc/raddb/mpiibcerts/Mac339.pem" certificate_file = "//etc/raddb/mpiibcerts/Mac339.pem" CA_file = "//etc/raddb/mpiibcerts/root.pem" private_key_password = "xxx" dh_file = "//etc/raddb/mpiibcerts/dh" random_file = "//etc/raddb/mpiibcerts/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "//etc/raddb/mpiibcerts/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "//etc/raddb/huntgroups" hints = "//etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "//etc/raddb/users" acctusersfile = "//etc/raddb/acct_users" preproxy_usersfile = "//etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_passwd Module: Instantiating guestlist passwd guestlist { filename = "/Library/WebServer/path/guestlist" format = "*User-Name:Cleartext-Password::Simultaneous-Use" delimiter = ":" ignorenislike = yes ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 4 keyfield 0(User-Name) listable: no Module: Instantiating maclist passwd maclist { filename = "/etc/raddb/maclist" format = "*User-Name:~mac-add" delimiter = ":" ignorenislike = yes ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 2 keyfield 0(User-Name) listable: no Module: Linked to module rlm_always Module: Instantiating reject always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "//var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "//etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "//etc/raddb/certs/server.pem" certificate_file = "//etc/raddb/certs/server.pem" CA_file = "//etc/raddb/certs/ca.pem" private_key_password = "xxx" dh_file = "//etc/raddb/certs/dh" random_file = "//etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "//etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.24 port 1034, id=52, length=177 Message-Authenticator = 0xa5734a24826bc1b4f6f1cd74965941a1 Service-Type = Framed-User User-Name = "Mac445" Framed-MTU = 1488 Called-Station-Id = "00184DFCC7B8:MPIIB-Users" Calling-Station-Id = "0017F2ECCC75" NAS-Identifier = "netgear1" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000b014d6163343435 NAS-IP-Address = 192.168.1.24 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "Mac445", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++? if (Called-Station-ID =~ /:MPIIB-Guests$/) ? Evaluating (Called-Station-ID =~ /:MPIIB-Guests$/) -> FALSE ++? if (Called-Station-ID =~ /:MPIIB-Guests$/) -> FALSE ++? if (Called-Station-ID =~ /:MPIIB-Users$/) ? Evaluating (Called-Station-ID =~ /:MPIIB-Users$/) -> TRUE ++? if (Called-Station-ID =~ /:MPIIB-Users$/) -> TRUE ++- entering if (Called-Station-ID =~ /:MPIIB-Users$/) rlm_eap: EAP packet type response id 0 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation +++[eapuser] returns updated expand: %{Called-Station-Id} -> 00184DFCC7B8:MPIIB-Users +++[files] returns noop rlm_passwd: Added mac-add: '0017F2ECCC75' to request_items +++[maclist] returns ok +++? if (mac-add != Calling-Station-ID ) ? Evaluating (mac-add != Calling-Station-ID ) -> TRUE +++? if (mac-add != Calling-Station-ID ) -> TRUE +++- entering if (mac-add != Calling-Station-ID ) ++++[reject] returns reject +++- if (mac-add != Calling-Station-ID ) returns reject ++- if (Called-Station-ID =~ /:MPIIB-Users$/) returns reject Invalid user: [Mac445/<via Auth-Type = EAP>] (from client netgear1 port 1 cli 0017F2ECCC75) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> Mac445 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.1.24 port 1034, id=52, length=177 Waiting to send Access-Reject to client netgear1 port 1034 - ID: 52 Sending delayed reject for request 1 Sending Access-Reject of id 52 to 192.168.1.24 port 1034 Waking up in 4.9 seconds. Cleaning up request 1 ID 52 with timestamp +8 Ready to process requests.

2 2