- Freeradius-Users - lists.freeradius.org

R: R: R: Ip pool lease migration
by Francesco Cristofori 24 Oct '07

24 Oct '07

> You didn't say that... Sorry, I thought it wasn't so relevant. :-) > Use sqlippool. It's the easiest way to get what you want. Ok, thanks for helping. Francesco.

1 0

R: R: Ip pool lease migration
by Francesco Cristofori 24 Oct '07

24 Oct '07

> Then there's a lot less reason to run two servers. You > still have one central point of failure: the SQL server. The sql server is actually a mysql master/master replication cluster with one virtual IP address I pointed the servers to. I think this solution avoids s.p.o.f., isn't it? > If you're insistent on running just one SQL server, you > don't need to do anything on the RADIUS side for IP pools. > Just point both RADIUS servers to the same SQL DB and tables, > and the SQL server will sort it out. Hmmmm... But ip pools are managed through local files on each radius server, the sql backend stores sessions but not ip assignement. Do I miss something? Thanks, Francesco.

2 1

R: Ip pool lease migration
by Francesco Cristofori 24 Oct '07

24 Oct '07

> I'm going to try it, thanks for the suggestion. > Is it correct to set up two servers radA relaying to radB and > radB relaying to radA ? > I'd like to have an active/active radius server setup. Sorry, I didn't read the docs. :-) I have both servers using the same sql backend for accounting (not sql_ippool at the moment), so I have a doubt: If I relay one request to radB, will radB write an entry in radacct so I end up with two accounting records for the same accounting request? How could I prevent this from happening? Thanks in advance, Francesco.

2 1

R: Ip pool lease migration
by Francesco Cristofori 24 Oct '07

24 Oct '07

> > Is it a good idea to use rlm_ippool_tool to extract leases > from radA > > and then inserting them in radB with rlm_ippool_tool -n ? > > Why? Because I thought radrelay would send only accounting records and not ip lease information. :-) > If you need to copy information from one server to another, > see "radrelay". I'm going to try it, thanks for the suggestion. Is it correct to set up two servers radA relaying to radB and radB relaying to radA ? I'd like to have an active/active radius server setup. > Alan DeKok. Thanks for helping, Francesco.

1 0

FreeRadius Server: Installation problem
by j v 24 Oct '07

24 Oct '07

Hey all, > > I am trying to install 1.1.6. When i try to make the SUSE Linux Package > and run the rpm build command then an error message comes which reads: > freeRadius 1.1.5.gz file not present. > > Please guide. > > --------------------------------- Now you can chat without downloading messenger. Click here to know how.

2 1

Please help with my EAP config - PEAP/MSCHAP
by Nyle 24 Oct '07

24 Oct '07

Hello, I'm trying to set up Freeradius on SuSe 9 to authenticate against LDAP on the same box. I can use radtest locally and ntradping from a remote workstation and receive an accept. So it looks like it's configured well enough for the direct LDAP with clients.conf. However, when I try and use a Windows XP Pro client with my 3COM AP it returned a reject. I've tried searching on the what appears to be the errors in the below log but nothing seems to stand out. I'm sure it's something simple I missed when following the online setup guides that are supposed to walk you through. I've checked and re-checked my eap.conf and rediusd.conf. Below is the output from radiusd. Any help is greatly appreciated and thanks in advance. :-D http://www.nabble.com/file/p13363453/radiusd.conf radiusd.conf http://www.nabble.com/file/p13363453/eap.conf eap.conf -Nyle Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 636 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=RADMIN,o=SuSeRadius" ldap: tls_mode = yes ldap: start_tls = no ldap: tls_cacertfile = "/etc/raddb/certs/rootcert.pem" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "XXXXXX" ldap: basedn = "ou=TechSupport,ou=JeffS,o=Jeff" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "nspmPassword" ldap: access_attr = "wirelessAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x8115d60 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/servercert.pem" tls: certificate_file = "/etc/raddb/certs/servercert.pem" tls: CA_file = "/etc/raddb/certs/rootcert.pem" tls: private_key_password = "XXXXX" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (pre_proxy_log) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. INCOMING REQUEST rad_recv: Access-Request packet from host 172.18.184.107:1560, id=178, length=142 NAS-IP-Address = 172.18.184.107 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "auser" Calling-Station-Id = "00197e1c4ec5" Called-Station-Id = "00186ed1f900" NAS-Identifier = "Admin Conference Rooms AP" EAP-Message = 0x0201000d01706f73746d617374 Message-Authenticator = 0xda0a35d82f7138842de8ee671b060596 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/172.18.184.107/auth-detail-20071022' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.184.107/auth-detail-20071022 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "auser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for auser radius_xlat: '(cn=auser)' radius_xlat: 'ou=TechSupport,ou=JeffS,o=Jeff' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootcert.pem rlm_ldap: bind as cn=RADMIN,o=SuSeRadius/XXXXXX to localhost:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=TechSupport,ou=JeffS,o=Jeff, with filter (cn=auser) rlm_ldap: checking if remote access for auser is allowed by wirelessAccess ???? -> rlm_ldap: Error reading Universal Password.Return Code = -16049 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user auser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 178 to 172.18.184.107:1560 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xee5a698022ff2eb6b0f1e6b2f5e19821 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.18.184.107:1561, id=179, length=227 NAS-IP-Address = 172.18.184.107 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "auser" Calling-Station-Id = "00197e1c4ec5" Called-Station-Id = "00186ed1f900" NAS-Identifier = "Admin Conference Rooms AP" State = 0xee5a698022ff2eb6b0f1e6b2f5e19821 EAP-Message = 0x0202005019800000004616030100410100003d0301471ccf5bfea2fa4cc6404c28ccf0476c5bf7fff461d7c61159d6d1b0b93c442200001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xa716a9ef06ec71a52ecd874a2f3ee72c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radius/radacct/172.18.184.107/auth-detail-20071022' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.184.107/auth-detail-20071022 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "auser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "files" returns notfound for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for auser radius_xlat: '(cn=auser)' radius_xlat: 'ou=TechSupport,ou=JeffS,o=Jeff' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=TechSupport,ou=JeffS,o=Jeff, with filter (cn=auser) rlm_ldap: checking if remote access for auser is allowed by wirelessAccess rlm_ldap: Error reading Universal Password.Return Code = -16049 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user auser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 08e4], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 179 to 172.18.184.107:1561 EAP-Message = 0x0103040a19c000000941160301004a020000460301471ccf2959daf6739571a5b35b5165971d6974618fa6e74f008070dda8391bc42033b51eb14ba658f5f5c0793474217f46479b7aec718156996cd6fcc3cec0ec3200040016030108e40b0008e00008dd0004653082046130820349a003020102020101300d06092a864886f70d01010505003058310b3009060355040613025553312730250603550403131e596153542044656661756c7420434120286c696e75782d726164697573293120301e06092a864886f70d0109011611706f73746d617374657240424f4345534a301e170d3037303530383132323633375a170d303830353037313232 EAP-Message = 0x3633375a304d310b3009060355040613025553311c301a060355040313136c696e75782d7261646975732e424f4345534a3120301e06092a864886f70d0109011611706f73746d617374657240424f4345534a30820122300d06092a864886f70d01010105000382010f003082010a0282010100cee82cec650aad990f76f2ba1baf9c1e8536c9ba33867b6b9c0507bc14fae17467616ed705333cb6517283a805c834cef0449dc3afbfa4b2f3a245bf58fc0dfed8df2758289eb71b666aa150bded030132057f4b6198c007cfdcd546be47c72525bb257c4967c1720cb368338db2c8ab4c9722dc78d3018650d39a3a66e6e32a22e49089418d771379 EAP-Message = 0x6cb8af132c17db49fbd751a7d1ea2e2f2dac8bdeb2e6e694d43b0e6c69cfd535cca9d6d86c502eae4654562e9a513ea29d68b9e86b9416206f958d42b8315f793e6dc887463fc61347369b06a4194788bb9a9856377e7b1e37ba5e3dbc0d4b76e68f8b8e4fde9c86c8f8d8f0d79770e574513e822aea0d0203010001a382013f3082013b30090603551d1304023000303006096086480186f842010d04231621596153542047656e65726174656420536572766572204365727469666963617465301106096086480186f8420101040403020640300b0603551d0f040403020520301d0603551d0e041604147cde7fa24cc353fd6960e65a3032174128 EAP-Message = 0x53be953081800603551d2304793077801454852f14a64fd6f543904418130793652dc75602a15ca45a3058310b3009060355040613025553312730250603550403131e596153542044656661756c7420434120286c696e75782d726164697573293120301e06092a864886f70d0109011611706f73746d617374657240424f4345534a820100301c0603551d11041530138111706f73746d617374657240424f4345534a301c0603551d12041530138111706f73746d617374657240424f4345534a300d06092a864886f70d0101050500038201010020e81b2771a689bdbb40d18b648d27d02487fd296248b236e14032c709de93e51db86571aca075 EAP-Message = 0xd1dd93938f9ee2c2627cc1b960a61dac711a7cc08d0f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf695fd32f8c07a90b4cd463f7b5ab0df Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 172.18.184.107:1562, id=180, length=153 NAS-IP-Address = 172.18.184.107 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "auser" Calling-Station-Id = "00197e1c4ec5" Called-Station-Id = "00186ed1f900" NAS-Identifier = "Admin Conference Rooms AP" State = 0xf695fd32f8c07a90b4cd463f7b5ab0df EAP-Message = 0x020300061900 Message-Authenticator = 0xdad1e4ce7888045be6a2dc4c60e19454 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 radius_xlat: '/var/log/radius/radacct/172.18.184.107/auth-detail-20071022' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.184.107/auth-detail-20071022 modcall[authorize]: module "auth_log" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "auser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall[authorize]: module "files" returns notfound for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for auser radius_xlat: '(cn=auser)' radius_xlat: 'ou=TechSupport,ou=JeffS,o=Jeff' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=TechSupport,ou=JeffS,o=Jeff, with filter (cn=auser) rlm_ldap: checking if remote access for auser is allowed by wirelessAccess rlm_ldap: Error reading Universal Password.Return Code = -16049 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user auser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 180 to 172.18.184.107:1562 EAP-Message = 0x01040406194064bce47716fbbc21dbbb0139e49161ad230f9c764866452276f9e678debc8dd5cb27d93d9bf16629deed632f11ef02ee80e94d347912079410566b60df170ddb31d848db7bdee1968b7cead352a9f9a7377ff437d33e97c42b91dbdd32a07214b3ee5e736664d128518e65b73325b90e6f855bf09dd2b2cca706a0a563d8663d727a7d1afb98b1a9a202c14f75d5e2f881bf7dd21f74fae5d49b68547cd72c5d670aa06539ec9f1e839b0facf84d242dd50b36e6cb5c4ddf6c0dc9eaaf5e6e16a2afd10004723082046e30820356a003020102020100300d06092a864886f70d01010505003058310b3009060355040613025553312730 EAP-Message = 0x250603550403131e596153542044656661756c7420434120286c696e75782d726164697573293120301e06092a864886f70d0109011611706f73746d617374657240424f4345534a301e170d3037303530383132323633355a170d3137303530353132323633355a3058310b3009060355040613025553312730250603550403131e596153542044656661756c7420434120286c696e75782d726164697573293120301e06092a864886f70d0109011611706f73746d617374657240424f4345534a30820122300d06092a864886f70d01010105000382010f003082010a0282010100b69396aeaedaa831c4b1db5188b461db8d3cdaa19dbb1dde692f EAP-Message = 0x50091cc6b48f2fcb8919f5efe8453fa0af3cb896eb6a6db6a45bcffe450ccd6dd48322e91bc0cfbb7c0a9495c7ab737388d5762e2d8ef4d8b3c55549c910eb722b4eb672c3bf590630ee529c0469c3a045809c78721b73aa8143bcddaecbc8ee244db121396360931b9c26e8c6466ea8c355907371efbf276e8cb4e6b558838dd840fe9b33369c021213d039a993d2f7d6584559970d62d82724e13c480308442edfb5ddb4a6ebd6eb3a4ad73783079673ce434e723e2944ebceb0d6caa9410f5489f711dddc02488746d1371a424f32658215f7d0f028bd7e089c391253d2dc264effefef430203010001a38201413082013d300f0603551d130101ff EAP-Message = 0x040530030101ff302c06096086480186f842010d041f161d596153542047656e657261746564204341204365727469666963617465301106096086480186f8420101040403020106300b0603551d0f040403020106301d0603551d0e0416041454852f14a64fd6f543904418130793652dc756023081800603551d2304793077801454852f14a64fd6f543904418130793652dc75602a15ca45a3058310b3009060355040613025553312730250603550403131e596153542044656661756c7420434120286c696e75782d726164697573293120301e06092a864886f70d0109011611706f73746d617374657240424f4345534a820100301c0603551d EAP-Message = 0x11041530138111706f73746d617374657240 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf00af82340e99f284ebd6265a6bdfa9a Finished request 2 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 172.18.184.107:1563, id=181, length=153 NAS-IP-Address = 172.18.184.107 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "auser" Calling-Station-Id = "00197e1c4ec5" Called-Station-Id = "00186ed1f900" NAS-Identifier = "Admin Conference Rooms AP" State = 0xf00af82340e99f284ebd6265a6bdfa9a EAP-Message = 0x020400061900 Message-Authenticator = 0x3e63ae1291fa872d75f4a43530068c9a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 radius_xlat: '/var/log/radius/radacct/172.18.184.107/auth-detail-20071022' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.184.107/auth-detail-20071022 modcall[authorize]: module "auth_log" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "auser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 modcall[authorize]: module "files" returns notfound for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for auser radius_xlat: '(cn=auser)' radius_xlat: 'ou=TechSupport,ou=JeffS,o=Jeff' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=TechSupport,ou=JeffS,o=Jeff, with filter (cn=auser) rlm_ldap: checking if remote access for auser is allowed by wirelessAccess rlm_ldap: Error reading Universal Password.Return Code = -16049 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user auser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 181 to 172.18.184.107:1563 EAP-Message = 0x010501471900424f4345534a301c0603551d12041530138111706f73746d617374657240424f4345534a300d06092a864886f70d01010505000382010100b49fa23ad1f88fa18723a3c9a4d271870747bcf25a9cd168f7561144ff7a24e2ea8acb896ff54167343926928371f0dd383deeea0600cf739a12dff70a5a7f31081a17a9a59fc5674f08ce7e744923cf5e2fd5f6340dd0e6bca67247d7ef9888dbdc44d34f59327e48131d5868dc8178a34f304c224c571d76470292460f892792276bfaafec5142a10f06a9073ebc2fff9ad2728e2fbb03a38f757842edb32dd0d6e2a7cbbe7305846de1c3c53e6ae0e54b6393f7cad98ec3f8c78a1311c3 EAP-Message = 0x1dabc901aa0867858841367588bb746d3fd63b97cafac05f5cf5deea3394de79c383da10d45a0237709ce1e66e397bf5d40f48c282b65fcadb490a23dd1e27677e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x55bd7662ec9f690990d6ac5d9a99c704 Finished request 3 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 172.18.184.107:1564, id=182, length=469 NAS-IP-Address = 172.18.184.107 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "auser" Calling-Station-Id = "00197e1c4ec5" Called-Station-Id = "00186ed1f900" NAS-Identifier = "Admin Conference Rooms AP" State = 0x55bd7662ec9f690990d6ac5d9a99c704 EAP-Message = 0x0205014019800000013616030101061000010201008af180f579d3a1e9cf59b7e55b42d658adf478bae0aa879ce238e459e5a626bf77c7a9fefa7858f5ada701d820f6c3d5117ede320123021493075805810066aa88bbad8287d6c53bfb9f9ff6fb2425967d7153aeb271e129c5a53eb54d8d274b333ce976ff37d891b33d3b7c2602855e3052a93bbfe33eeeb80f05332865524519427d9c3f68e19efb297fb83dff04d5de5de1781b440d2e188becfef9691252731d959ada9620b17d091ab7e29fe346c9cea6d8dd5784ffb05ccc0396d54bf5553c16382ea14f636a40b74c29c3d0c0c0d31ce4c3de8f49cfb340c690b00d9ddf4cf365d9827d42 EAP-Message = 0xfa987e090f5bd5d7c6f2d7e206678070977f29f9c38db4c21403010001011603010020991d9ceaa5d20ebea3054aedb8016ec675c7c319ec41d6b1f1082ce6d3f53d98 Message-Authenticator = 0x1e6d6412ab1fbd11bcc3d9c39231ae67 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 radius_xlat: '/var/log/radius/radacct/172.18.184.107/auth-detail-20071022' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.184.107/auth-detail-20071022 modcall[authorize]: module "auth_log" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "auser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall[authorize]: module "files" returns notfound for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for auser radius_xlat: '(cn=auser)' radius_xlat: 'ou=TechSupport,ou=JeffS,o=Jeff' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=TechSupport,ou=JeffS,o=Jeff, with filter (cn=auser) rlm_ldap: checking if remote access for auser is allowed by wirelessAccess rlm_ldap: Error reading Universal Password.Return Code = -16049 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user auser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 182 to 172.18.184.107:1564 EAP-Message = 0x0106003119001403010001011603010020b514d083074fb85348c095e4d2b856a9a92f5d1223ba5b724770d9fc696d3758 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x044441eeeecd19313f1862f1493a9322 Finished request 4 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 172.18.184.107:1565, id=183, length=153 NAS-IP-Address = 172.18.184.107 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "auser" Calling-Station-Id = "00197e1c4ec5" Called-Station-Id = "00186ed1f900" NAS-Identifier = "Admin Conference Rooms AP" State = 0x044441eeeecd19313f1862f1493a9322 EAP-Message = 0x020600061900 Message-Authenticator = 0x1be438426b0ce5d14dc234457f2e9fd8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 radius_xlat: '/var/log/radius/radacct/172.18.184.107/auth-detail-20071022' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.184.107/auth-detail-20071022 modcall[authorize]: module "auth_log" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "auser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall[authorize]: module "files" returns notfound for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for auser radius_xlat: '(cn=auser)' radius_xlat: 'ou=TechSupport,ou=JeffS,o=Jeff' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=TechSupport,ou=JeffS,o=Jeff, with filter (cn=auser) rlm_ldap: checking if remote access for auser is allowed by wirelessAccess rlm_ldap: Error reading Universal Password.Return Code = -16049 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user auser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 183 to 172.18.184.107:1565 EAP-Message = 0x0107002019001703010015480e17eb4fd17ad86bb7a97e6c742132c8715cacb6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0d09e170938d776b6472278d6b0890b3 Finished request 5 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 172.18.184.107:1566, id=184, length=183 NAS-IP-Address = 172.18.184.107 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "auser" Calling-Station-Id = "00197e1c4ec5" Called-Station-Id = "00186ed1f900" NAS-Identifier = "Admin Conference Rooms AP" State = 0x0d09e170938d776b6472278d6b0890b3 EAP-Message = 0x0207002419001703010019167ccd21be98eeaf8133dd80280eca76cbe78da49dc30b711d Message-Authenticator = 0x8bef795fbb4a89671c981442245278ee Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/var/log/radius/radacct/172.18.184.107/auth-detail-20071022' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.184.107/auth-detail-20071022 modcall[authorize]: module "auth_log" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "auser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 36 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall[authorize]: module "files" returns notfound for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for auser radius_xlat: '(cn=auser)' radius_xlat: 'ou=TechSupport,ou=JeffS,o=Jeff' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=TechSupport,ou=JeffS,o=Jeff, with filter (cn=auser) rlm_ldap: checking if remote access for auser is allowed by wirelessAccess rlm_ldap: Error reading Universal Password.Return Code = -16049 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user auser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - auser rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of auser PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to auser Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20071022' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20071022 modcall[authorize]: module "auth_log" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "auser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall[authorize]: module "files" returns notfound for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for auser radius_xlat: '(cn=auser)' radius_xlat: 'ou=TechSupport,ou=JeffS,o=Jeff' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=TechSupport,ou=JeffS,o=Jeff, with filter (cn=auser) rlm_ldap: checking if remote access for auser is allowed by wirelessAccess rlm_ldap: Error reading Universal Password.Return Code = -16049 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user auser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 184 to 172.18.184.107:1566 EAP-Message = 0x010800391900170301002ebb2aee051b50b9d7f407795e9504667e6288d97f036aaafb5e5b05778dda04b91c0fdc350f9145e5175138ac94cb Message-Authenticator = 0x00000000000000000000000000000000 State = 0xceaf55949f9829204e8347d7ab4f977f Finished request 6 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 172.18.184.107:1567, id=185, length=237 NAS-IP-Address = 172.18.184.107 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "auser" Calling-Station-Id = "00197e1c4ec5" Called-Station-Id = "00186ed1f900" NAS-Identifier = "Admin Conference Rooms AP" State = 0xceaf55949f9829204e8347d7ab4f977f EAP-Message = 0x0208005a1900170301004f36dc7dcdc9d421c52e4da48220bfc29c1d4e541f7f6205073e3d1367b28d6bded448e8b524d16e9f402b45eff1b140111f548033c47a42eb791d7c37c0098650b04da16065af574a27bcd438314c3c Message-Authenticator = 0x0b31643b2836fd5790f333d5a9d95f84 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 radius_xlat: '/var/log/radius/radacct/172.18.184.107/auth-detail-20071022' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.184.107/auth-detail-20071022 modcall[authorize]: module "auth_log" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "auser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 8 length 90 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall[authorize]: module "files" returns notfound for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for auser radius_xlat: '(cn=auser)' radius_xlat: 'ou=TechSupport,ou=JeffS,o=Jeff' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=TechSupport,ou=JeffS,o=Jeff, with filter (cn=auser) rlm_ldap: checking if remote access for auser is allowed by wirelessAccess rlm_ldap: Error reading Universal Password.Return Code = -16049 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user auser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to auser PEAP: Adding old state with 91 83 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20071022' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20071022 modcall[authorize]: module "auth_log" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "auser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 8 length 67 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall[authorize]: module "files" returns notfound for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for auser radius_xlat: '(cn=auser)' radius_xlat: 'ou=TechSupport,ou=JeffS,o=Jeff' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=TechSupport,ou=JeffS,o=Jeff, with filter (cn=auser) rlm_ldap: checking if remote access for auser is allowed by wirelessAccess rlm_ldap: Error reading Universal Password.Return Code = -16049 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user auser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for auser with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: group Auth-Type returns reject for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. Login incorrect: [auser/<no User-Password attribute>] (from client localhost port 0) Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 7 modcall[post-auth]: module "ldap" returns noop for request 7 modcall: group Post-Auth-Type returns noop for request 7 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 185 to 172.18.184.107:1567 EAP-Message = 0x010900261900170301001be4b9d6e00ad0df41f2a810a5b901527ee45ef7e158448827bf5076 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb64969dafcaabf39204b4438f97b1629 Finished request 7 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 172.18.184.107:1568, id=186, length=185 NAS-IP-Address = 172.18.184.107 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "auser" Calling-Station-Id = "00197e1c4ec5" Called-Station-Id = "00186ed1f900" NAS-Identifier = "Admin Conference Rooms AP" State = 0xb64969dafcaabf39204b4438f97b1629 EAP-Message = 0x020900261900170301001b1ba37ceec20d1d88dd5913cb84f468381acfa9f8b922915e60c073 Message-Authenticator = 0x783b3c3df11f953a609f3e8ca023b8b7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 radius_xlat: '/var/log/radius/radacct/172.18.184.107/auth-detail-20071022' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.184.107/auth-detail-20071022 modcall[authorize]: module "auth_log" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "auser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 9 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 modcall[authorize]: module "files" returns notfound for request 8 rlm_ldap: - authorize rlm_ldap: performing user authorization for auser radius_xlat: '(cn=auser)' radius_xlat: 'ou=TechSupport,ou=JeffS,o=Jeff' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=TechSupport,ou=JeffS,o=Jeff, with filter (cn=auser) rlm_ldap: checking if remote access for auser is allowed by wirelessAccess rlm_ldap: Error reading Universal Password.Return Code = -16049 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user auser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: group authenticate returns invalid for request 8 auth: Failed to validate the user. Login incorrect: [auser/<no User-Password attribute>] (from client wpasecuredwap1 port 1 cli 00197e1c4ec5) Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 8 modcall[post-auth]: module "ldap" returns noop for request 8 modcall: group Post-Auth-Type returns noop for request 8 Delaying request 8 for 1 seconds Finished request 8 Going to the next request Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 178 with timestamp 471ccf28 Sending Access-Reject of id 186 to 172.18.184.107:1568 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1 seconds... --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. -- View this message in context: http://www.nabble.com/Please-help-with-my-EAP-config---PEAP-MSCHAP-tf467718… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Ip pool lease migration
by Francesco Cristofori 24 Oct '07

24 Oct '07

Hi all, I have two FR instances up with only one (let's call it radA, the other radB) actually serving IP addresses from several ip pools. Is it a good idea to use rlm_ippool_tool to extract leases from radA and then inserting them in radB with rlm_ippool_tool -n ? I think it would be better to use sql_ippool (having only one centralized ip pool cache), but now it's not a viable solution to me. Suggestions are always welcome. :-) Thanks in advance, Francesco.

2 1

Adding attributes
by Vinh T. Nguyen 23 Oct '07

23 Oct '07

Hi, How do I add cisco attributes to a user or a group of users? For single user example, user bob has "permit ip any x", user john has "permit ip any y", user kevin has "permit ip any z". For group users example, users of group 1 have "permit ip any x", and users of group 2 have "permit ip any y". So that users can authenticate from any ip to these two servers. Thanks in advance for your reply. I am using freeRadius 1.1.7 on Linux Radhat ES 4.0 Vinh __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

aaa accounting command
by Dominique Demore 23 Oct '07

23 Oct '07

Hi folks, Is there any method of keeping track of the commands issued by a user with Radius. Under the aaa option, there is "aaa accounting command <blah>" but for some reason, I'm not seeing the accounting information stored in the radacct information. I know a few years ago, this was an issue, but I'm not sure if it has been resolved. Does anyone have an alternative to accomplish this if it's not possible with Radius. Thanks. -- Dominique

3 2

Proposed Freeradius - Kerberos authentication
by David Pullman 23 Oct '07

23 Oct '07

We have a new requirement to provide wireless access to our network with an authenticated connection. The wireless access/connection is controlled by a Cisco 4402 controller. The clients that will connect are Windows XP, Mac OSX, and Linux OS laptops. We have all of the systems on the wired network currently logging in to either to a Windows AD domain (XP) or to a MIT Kerberos realm (Linux and OSX). The user password is synchronized on these two authentication sources. I've been reading the FAQs, the man pages, and going over mailing list archives, and also the info at deployingradius.com. I thought I should start by checking that I'm heading in the right direction before trying building stuff. I'm proposing that we use Freeradius to authenticate the connections to the wireless APs using the MIT Kerberos server. If this is possible, would it be done using EAP-TTLS from the clients, and the Auth-Type would need to be defaulted to Kerberos so that the rlm_krb5 module would be used? I'm basing this on the Protocols page in conjunction with a thread from earlier in October about EAP-TTLS and Kerberos. Thanks very much. --David Pullman

2 1