- Freeradius-Users - lists.freeradius.org

strange crash with freeradius 1.1.2 on startup
by Guillaume Rousse 20 Aug '07

20 Aug '07

Hello. I'm a mandriva package maintainer, and I'm trying to solve a strange issue with our freeradius package. On mandriva 2007.1, the server crashes immediatly after forking (SIGPIPE error), whereas it works OK with -x debug flag. The same package, built on mandriva 2007.0, works OK also. You have a bug report available at http://qa.mandriva.com/show_bug.cgi?id=32597, with traces of both cases. I initially thought of some kind of bogus autoconf detection of build environment, due to the lack of commands such as setsid in wrong trace, and tghe use of conditional builds directives in the code. However, comparating autoconf.h in both build tree doesn't show any sensible hint (in particular, HAVE_SETSID is set even for the non-working case, whereas it doesn't appear in the trace). Comparing build commandes neither (only difference being -mpentiumpro versus -mgeneric gcc flag). Using ldd on radiusd binary doesn't show any sensible difference neither. Freeradius 1.1.6 and 1.1.7 work perfectly on current mandriva development version, however, I'd prefer to fix the issue on stable release without changing version if possible. Any hint welcome. -- Guillaume Rousse Moyens Informatiques - INRIA Futurs Tel: 01 69 35 69 62

3 12

Chap-password to User-password
by Carl aniams 20 Aug '07

20 Aug '07

Hi all I installed freeradius 1.1.6 with mysql for storing users login. i created some users through dialup admin page and had their password stored in User-password attribute.(i checked in the database select from radcheck) when i fire up radius in debug i notice that there is a CHAP challenge and the password is in a CHAP-password format rejecting then access with message auth: local auth: user supplied password does not match local user-password when in my radiusd.conf authorize section i uncomment chap i have auth: type CHAP rlm_chap:login attempt by username with CHAP password rlm_chap: using clear text password 'mypass' for user username authentication rlm_chap: passxord check failed I would like to stop the put my password in User-password rather than CHAP-password, but don't know how it should be done. please a help -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

2 1

Big Problem with peap-mschapv2+freeradius 1.1.7
by Christian Frank 20 Aug '07

20 Aug '07

Hi, I have a big problem with my radius setup. I want to authenticate my users with peap+mschapv2. The radius backend is an ldap server. I have this setup working with Freeradius 1.0.1 on Redhat 4 ES. But after upgrading to 1.1.7 this setup does not work anymore. I configured my radius/eap/client config file the same way like the old file was. I additionally tried to start the new radius with the old config files with the same effect, it does not work. Here is my setup: Freeradius 1.1.7 OPenldap (newest version) Clients: Windows Xp Sp 2 WPA Supplicant, Juniper Odyysee Client, Cisco Secure Services Client In my ldap i have following attributes: cn,uid, description, UserPassword, If i look at the logfiles, i can see that the ldap authorization seems to work. It seems that something goes wrong with the authentication. But i cant find the reason :-( ... Here is the logfile output of radiusd -X: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/freeradius/etc/raddb/proxy.conf Config: including file: /usr/local/freeradius/etc/raddb/clients.conf Config: including file: /usr/local/freeradius/etc/raddb/snmp.conf Config: including file: /usr/local/freeradius/etc/raddb/eap.conf Config: including file: /usr/local/freeradius/etc/raddb/sql.conf main: prefix = "/usr/local/freeradius" main: localstatedir = "/usr/local/freeradius/var" main: logdir = "/usr/local/freeradius/var/log/radius" main: libdir = "/usr/local/freeradius/lib" main: radacctdir = "/usr/local/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/freeradius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/freeradius/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/freeradius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/freeradius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/certs/wcsserver.key" tls: certificate_file = "/usr/local/certs/wcsserver.pem" tls: CA_file = "/usr/local/certs/root.pem" tls: private_key_password = "wcs" tls: dh_file = "/usr/local/freeradius/etc/raddb/certs/dh" tls: random_file = "/usr/local/freeradius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/freeradius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/freeradius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/freeradius/etc/raddb/users" files: acctusersfile = "/usr/local/freeradius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/freeradius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded LDAP ldap: server = "150.150.40.241" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=rsel,dc=com" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "secret" ldap: basedn = "dc=rsel,dc=com" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "uid" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/freeradius/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /usr/local/freeradius/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x9979d68 Module: Instantiated ldap (ldap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/freeradius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 150.150.40.141:32769, id=107, length=150 User-Name = "cfra" Calling-Station-Id = "00-0D-F0-1E-DE-BF" Called-Station-Id = "00-0B-85-91-89-B0:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400090163667261 Message-Authenticator = 0x4d1154f01781893214d80dc924c4cdb8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cfra", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 4 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for cfra radius_xlat: '(uid=cfra)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 150.150.40.241:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=rsel,dc=com/secret to 150.150.40.241:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: checking if remote access for cfra is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 107 to 150.150.40.141 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010500061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68eb865ee357444579d56ef8dd18b568 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 150.150.40.141:32769, id=108, length=239 User-Name = "cfra" Calling-Station-Id = "00-0D-F0-1E-DE-BF" Called-Station-Id = "00-0B-85-91-89-B0:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0205005019800000004616030100410100003d030146bb0481120e954898fc6765c741badb30fa41d1af048bb118f6dd383aeea06600001600040005000a000900640062000300060013001200630100 State = 0x68eb865ee357444579d56ef8dd18b568 Message-Authenticator = 0x2a025ab7d5abf0ac510f213d9016805d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "cfra", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 5 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for cfra radius_xlat: '(uid=cfra)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: checking if remote access for cfra is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04e9], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 108 to 150.150.40.141 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0106040a19c000000546160301004a02000046030146bb04823834ea970dc6dc2ef5bec117c325fedde71c1240ea63dfd128d8096520e3d954c547d2a4c0e0bcdffdd83ba7f747963e13375345a09eab86e6787d70f000040016030104e90b0004e50004e200027430820270308201d9a003020102020101300d06092a864886f70d0101050500306d3110300e060355040313075253454c204341310b3009060355040b13024954310b3009060355040b13024954310d300b060355040a13045253454c3111300f060355040713084c616e64736875743110300e0603550408130742617661726961310b3009060355040613024445301e170d303730 EAP-Message = 0x3830363030303030305a170d3038303830363233353935395a301f311d301b060355040313147763732e7273656c2e72656e657361732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100bfdca3c73f9d3442ee1d8fd3edb90bc20a935415000efe8003eca3cea0168658ccf33924df3648aa81744a9d15f69ceece4373e1b25d294f93b93cb98371cb9cfd159a917c2e099b8954d9751626ba4a0fe8972b9459538ff3894d078253dec1e445d976ad05207e6d4d2da68d1343e6db85fe7f64bab0f83a8dca8afd1d26370203010001a36e306c30160603551d250101ff040c300a06082b060105050703013052060355 EAP-Message = 0x1d1f044b30493047a045a0438641687474703a2f2f70633430333335313a383038302f736572766c65742f636f6d2e66756e6b2e6f6463612e7365727665722e736572766c6574732e47657443524c300d06092a864886f70d0101050500038181001ed004b5c41754dc2c5cfaaac2217d6a90aca3b5aaf7a27461102d4acdfe2905836a9baed7c6aaa41914893be6cfad54589fa57b359a491097b6d60fe8b2a090e68a2adc4f2654875d9585a9759eefa924cf421c29f71e08a4eeb5ad5d23da6bdd9b5a9bac4549edd8004c553ca9a19c948c0a895f0622141645d18dfea4427800026830820264308201cda003020102020100300d06092a864886 EAP-Message = 0xf70d0101050500306d3110300e060355040313075253454c204341310b3009060355040b13024954310b3009060355040b13024954310d300b060355040a13045253454c3111300f060355040713084c616e64736875743110300e0603550408130742617661726961310b3009060355040613024445301e170d3037303830363030303030305a170d3137303830363233353935395a306d3110300e060355040313075253454c204341310b3009060355040b13024954310b3009060355040b13024954310d300b060355040a13045253454c3111300f060355040713084c616e64736875743110300e0603550408130742617661726961310b300906 EAP-Message = 0x035504061302444530819d300d06092a864886f70d01 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7faa5cbebe7ecf725bf86d55d240bbe8 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 150.150.40.141:32769, id=109, length=165 User-Name = "cfra" Calling-Station-Id = "00-0D-F0-1E-DE-BF" Called-Station-Id = "00-0B-85-91-89-B0:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600061900 State = 0x7faa5cbebe7ecf725bf86d55d240bbe8 Message-Authenticator = 0xe15ed9d6d6a23fbc6b6b571b22ea97da Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "cfra", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for cfra radius_xlat: '(uid=cfra)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: checking if remote access for cfra is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 109 to 150.150.40.141 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0107014c19000101050003818b0030818702818100b74f716b56b2464b8bd640955a1ffb274335f05646eddff3f93dcd47520eb764f5bd05d510275861f30e7e727c4b0ccc10797b1ed07bf9e98d88ba4d91ef041e0fc5a7f755b4b375d196170ab1a47c38a75e8d44bf09e20fe0e86994fe89060820e9f5fd284dc1551d48aa64951dbed7410548aeac1824ac5ddbdf629c946be5020111a316301430120603551d130101ff040830060101ff020100300d06092a864886f70d0101050500038181005649f966db9fe97da32747c5cc3af6cf15fde8f9c0db98db3aae700e3e74d1cc0fd07969def57f876d864aa05a01a5ef961487081ad57e4b18e7 EAP-Message = 0xd3a445ed9de2c9f4e79376f2991b4796ecf3ecb27786443b7e99b9e24b27756c03d9123a93a1eb8c091b796e6ce73f66a9700a71f24f7874de816052c4bc1f25b05235abf93c16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x23155c0d1d93ad5dbc16ec39a8d2c3b9 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 150.150.40.141:32769, id=110, length=351 User-Name = "cfra" Calling-Station-Id = "00-0D-F0-1E-DE-BF" Called-Station-Id = "00-0B-85-91-89-B0:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700c01980000000b61603010086100000820080495fd3d574ec2239838b12e8424f7be6f1c2ec76d01f8a1e98f29dfab39473b098c9ff3cf88c3c8bc70998c01deb0c23178b4eb276583ef49ab2674a59df2d72f001f5085ec1a47cbddbf2b9e2fa8dc0f69337f0ad559106dfa4274f5938f819812e5054614fc378fa02204aa694b064b1a87d3e7c4f969af871e6a11d10fe1a14030100010116030100201934f29bfc4143780f9d8a064a905b28d39133a3ce5ba7cf8c71cff46fa43caf State = 0x23155c0d1d93ad5dbc16ec39a8d2c3b9 Message-Authenticator = 0x393a942966cf2b7c324ddd4dd16dec0d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "cfra", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 7 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for cfra radius_xlat: '(uid=cfra)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: checking if remote access for cfra is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 110 to 150.150.40.141 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010800311900140301000101160301002082da3d461e5ae1bf666a365a53d76857c9ff00417315c05c661163e3c961f9dd Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f6e7b9f5ef8c1f052063c8070722eb5 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 150.150.40.141:32769, id=111, length=165 User-Name = "cfra" Calling-Station-Id = "00-0D-F0-1E-DE-BF" Called-Station-Id = "00-0B-85-91-89-B0:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800061900 State = 0x3f6e7b9f5ef8c1f052063c8070722eb5 Message-Authenticator = 0xe57181a04355eb33e37ba9aca6cd8514 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "cfra", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 8 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for cfra radius_xlat: '(uid=cfra)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: checking if remote access for cfra is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 111 to 150.150.40.141 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x01090020190017030100156e23c73668274ce98de77cea4b16a1ac74a092de4e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xad83e1fbd1b19043a005f2c19aeef040 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 150.150.40.141:32769, id=112, length=191 User-Name = "cfra" Calling-Station-Id = "00-0D-F0-1E-DE-BF" Called-Station-Id = "00-0B-85-91-89-B0:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02090020190017030100152026241d2abf412ed21c7e07fec512665f40ff40c9 State = 0xad83e1fbd1b19043a005f2c19aeef040 Message-Authenticator = 0xa865b16188d69faf0368c5f653c609a2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "cfra", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 9 length 32 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for cfra radius_xlat: '(uid=cfra)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: checking if remote access for cfra is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Process1ing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - cfra rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of cfra PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to cfra Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "cfra", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 9 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for cfra radius_xlat: '(uid=cfra)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: checking if remote access for cfra is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 112 to 150.150.40.141 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010a00351900170301002aff32a30b0e247564738de0340239c09df40a8bc617850bc63caa463b8ed880c9dc10bdccdacd8e5a3f08 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4892210e53e8fe174260c82262478541 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 150.150.40.141:32769, id=113, length=245 User-Name = "cfra" Calling-Station-Id = "00-0D-F0-1E-DE-BF" Called-Station-Id = "00-0B-85-91-89-B0:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020a00561900170301004bd1add2fef5102e65f6ff8f7a230b9eb0720cfe38fe6a7cdd411f085025c7d4ef8b22504381b79e2235c204df4517fbe4c63e48a840ea6dcce4a245a3505e36162e4e9c468ec874ce80befb State = 0x4892210e53e8fe174260c82262478541 Message-Authenticator = 0x0c8912dbebdfc69e7bc99568217feaac Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "cfra", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 10 length 86 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for cfra radius_xlat: '(uid=cfra)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: checking if remote access for cfra is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to cfra PEAP: Adding old state with 07 60 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "cfra", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 10 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for cfra radius_xlat: '(uid=cfra)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: checking if remote access for cfra is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for cfra with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 113 to 150.150.40.141 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010b00261900170301001b227f4f0044ed450b943d764372f9aeaaf71c46a3058b6d5c1868d3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd997668a26711f7f503add1a238036b5 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 150.150.40.141:32769, id=114, length=197 User-Name = "cfra" Calling-Station-Id = "00-0D-F0-1E-DE-BF" Called-Station-Id = "00-0B-85-91-89-B0:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020b00261900170301001b9a93dc0f7a25b95069f4c7e40e2cbbc67b017273477fe23f6cdecb State = 0xd997668a26711f7f503add1a238036b5 Message-Authenticator = 0x732ff4feed977f31e020b461f7c174bb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "cfra", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 11 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for cfra radius_xlat: '(uid=cfra)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: checking if remote access for cfra is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 7 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 114 to 150.150.40.141 port 32769 EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 Thanks for your help, Christian **************************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited. E-mail messages are not necessarily secure. Renesas does not accept responsibility for any changes made to this message after it was sent. Please note that this email message has been swept by Renesas for the presence of computer viruses. Renesas Semiconductor Europe (Landshut) GmbH Jenaer Strasse 1, 84034 Landshut Tel.: +49-(0)871-684-0, Fax: +49-(0)871-684-150 www.rsel.renesas.com GESCHAEFTSFUEHRER: Dipl.-Ing. YOSHIHARU KAKUI GESCHAEFTSFUEHRER: Dipl.-Phys. STEFAN SAUER Registergericht Landshut HRB 1464 Ust-ldNr.: DE 128953054 Steuer-Nr.: 132/136/30347 HypoVereinsbank, Landshut, Kto.-Nr. 3704 700 (BLZ 743 200 73) Mizuho Corporate Bank (Germany) AG, Frankfurt, Kto.-Nr. 200 733 (BLZ 503 308 00) ****************************************************************************

5 5

sqlcounter test
by zahra bahar 20 Aug '07

20 Aug '07

Hi, I am testing freeradius with :radclient. I use sqlcounter module for monthly and add max-monthly-session in users file. then I send this tests: radclient -f filename localhost auth testing123 radclient -f filename localhost acct testing123 : with acct-status-type=start after "max-monthly-seesion" second : radclient -f filename localhost acct testing123 :with acct-status-type=stop now I think this user hasn't any acct, I send another radclient auth test and waiting to receive access-reject, but it accepts. what is wrong? does sqlcounter have problem? --------------------------------- Fussy? Opinionated? Impossible to please? Perfect. Join Yahoo!'s user panel and lay it on us.

1 0

FreeRADIUS question
by Douglas Lane 20 Aug '07

20 Aug '07

Hi All, I have a little project for a small ISP that I would like to execute, however, am just wondering about the infrastructure. Currently, the core radius server is hosted in a secure datacenter that has ample bandwidth available. Now the issue I have is the "cells" where the Cisco Concentrators are have slow links to the core radius server (these would be around 64 - 512kb). Now I know that radius packets are small, however, the other issue is these links will be used for internet access aswell. Currently each router controlling the cell links have a VPN link over the internet to the core radius server. Now steps have been taken to enable QoS on these links so the VPN traffic gets highest priority, however, what I wanna ask is the following: I'd like to "cache" the usernames and password (effectively radcheck and radgroupcheck) on each cell network (each cell has a local RADIUS server that proxies the realm to the core radius server). This way, avoiding the possibility that the link may be to slow to auth the user and hence cause a timeout, as well as in case the VPN link itself is down. The other question I'd like to get your opinion on is I'd like to have accounting local to the cell's RADIUS server (for lookups from the Cisco), but also have a way to replicate the accounting data to the core-radius server. I've looked at use MySQL replication, but i feel its not sufficient for my requirements. Perhaps I'm wrong? Obviously, for this particular situation, I'd like to only "cache" the radcheck and radgroupcheck information for valid accounts in the that cell. I don't really want to have every cell's users part of the the other cell's. Obviously the idea is if the local RADIUS can't auth the use on itself, it must peer to the next available RADIUS server (core radius). Hope I've been as descriptive as possible. I appreciate the help. Thanks Doug

2 3

how to logout user
by wow lala 20 Aug '07

20 Aug '07

hi , any one can tell me , how to logout user??? i use freeradius to my radius server ,i`m testing 802.1x and user login success with username & pw from wireless ap but after user reboot laptop , then the laptop will login again automatic , so , i hope someone to tell me how to logout user after login

4 7

Problem with freeradius 2.0 pre1 and realms
by Christian Frank 20 Aug '07

20 Aug '07

Hi Guys, I'm trying to use freeradius with peap+mschapv2+ldap+realms. If i don't use realms, everything works fine. But the problem is that i need to stripp of the domain part of the username, cause windows sends TEST\cfra . But i have only cfra in my ldap . So i di the follwing: radius.conf: realm ntdomain { format = prefix delimiter = "\\" } and enabled ntdomain under authorisation . My proxy.conf: realm test { type = radius authhost = LOCAL accthost = LOCAL } But when i want to login, it does not work. Seems like the domain is stripped of correctly for authorisation, but not for authentication. But what could be wrong ? Here is the output of radius: Config: including file: ../etc/raddb//radiusd.conf Config: including file: /usr/local/freeradius2/etc/raddb/proxy.conf Config: including file: /usr/local/freeradius2/etc/raddb/clients.conf Config: including file: /usr/local/freeradius2/etc/raddb/snmp.conf Config: including file: /usr/local/freeradius2/etc/raddb/eap.conf Config: including file: /usr/local/freeradius2/etc/raddb/sql.conf Config: including file: /usr/local/freeradius2/etc/raddb/sql/mysql-dialup.conf FreeRADIUS Version 2.0.0-pre1, for host i686-pc-linux-gnu, built on Aug 16 2007 at 13:45:55 Starting - reading configuration files ... read_config_files: reading dictionary main { prefix = "/usr/local/freeradius2" localstatedir = "/usr/local/freeradius2/var" logdir = "/usr/local/freeradius2/var/log/radius" libdir = "/usr/local/freeradius2/lib" radacctdir = "/usr/local/freeradius2/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no log_stripped_names = no log_file = "/usr/local/freeradius2/var/log/radius/radius.log" log_auth = no log_auth_badpass = no log_auth_goodpass = no pidfile = "/usr/local/freeradius2/var/run/radiusd/radiusd.pid" user = "radiusd" group = "radiusd" checkrad = "/usr/local/freeradius2/sbin/checkrad" debug_level = 0 proxy_requests = yes log { syslog_facility = "daemon" } proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } home_server localhost { ipaddr = 127.0.0.1 IP address [127.0.0.1] port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } server_pool my_auth_failover { type = my_auth_failover home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { ldflag = fail_over } realm test { ldflag = fail_over } port = 1812 listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } client 127.0.0.1 { secret = "testing123" shortname = "localhost" nastype = "other" } client 150.150.40.0/16 { secret = "ciscotest1" shortname = "private-network-1" nastype = "cisco" } radiusd: entering modules setup radiusd: Library search path is /usr/local/freeradius2/lib instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } rlm_exec: wait=yes but no output defined. Did you mean output=none? Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } modules { Module: Instantiating section authenticate Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/freeradius2/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } eap: Linked to sub-module rlm_eap_md5 eap: Instantiating eap-md5 eap: Linked to sub-module rlm_eap_leap eap: Instantiating eap-leap eap: Linked to sub-module rlm_eap_gtc eap: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } eap: Linked to sub-module rlm_eap_tls eap: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/certs/wcsserver.key" certificate_file = "/usr/local/certs/wcsserver.pem" CA_file = "/usr/local/certs/root.pem" private_key_password = "wcs" dh_file = "/usr/local/freeradius2/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/freeradius2/etc/raddb/certs/bootstrap" } rlm_eap_tls: Loading the certificate file as a chain eap: Linked to sub-module rlm_eap_ttls eap: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } eap: Linked to sub-module rlm_eap_peap eap: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } eap: Linked to sub-module rlm_eap_mschapv2 eap: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Instantiating section authorize Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/freeradius2/etc/raddb/huntgroups" hints = "/usr/local/freeradius2/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Instantiating ntdomain realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/freeradius2/etc/raddb/users" acctusersfile = "/usr/local/freeradius2/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/freeradius2/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "150.150.40.241" port = 389 password = "secret" identity = "cn=Manager,dc=rsel,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=rsel,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" password_attribute = "userPassword" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/usr/local/freeradius2/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /usr/local/freeradius2/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x9be8488 Module: Instantiating section preacct Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Instantiating section accounting Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/freeradius2/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/freeradius2/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/freeradius2/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Instantiating section session Module: Instantiating section post-proxy Module: Instantiating section post-auth Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/freeradius2/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } Initializing the thread pool... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Nothing to do. Sleeping until we see a request. Processing the authorize section of radiusd.conf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop rlm_eap: EAP packet type response id 13 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(uid=anonymous)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 150.150.40.241:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=rsel,dc=com/secret to 150.150.40.241:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop +- group authorize returns updated rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled +- group authenticate returns handled Finished request 0 state 5 Going to the next request Processing the authorize section of radiusd.conf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop rlm_eap: EAP packet type response id 14 length 82 rlm_eap: Continuing tunnel setup. ++[eap] returns ok +- group authorize returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0043], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04e9], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled +- group authenticate returns handled Finished request 1 state 5 Going to the next request rad_recv: Access-Request packet from host 150.150.40.141 port 32769, id=235, length=160 User-Name = "anonymous" Calling-Station-Id = "00-0C-F1-10-95-48" Called-Station-Id = "00-0B-85-82-C3-60:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020d000e01616e6f6e796d6f7573 Message-Authenticator = 0x237df9d6a5ccc4b8a6e7e241372567f7 Sending Access-Challenge of id 235 to 150.150.40.141 port 32769 EAP-Message = 0x010e00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7e04413c4ac3982e863e3bc1d40fc3cc rad_recv: Access-Request packet from host 150.150.40.141 port 32769, id=236, length=246 User-Name = "anonymous" Calling-Station-Id = "00-0C-F1-10-95-48" Called-Station-Id = "00-0B-85-82-C3-60:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020e005219800000004816030100430100003f030146c57f9e6adfd54e836ecd7108b2d9b0e8b32885ce5fb7dc236fd9502c507a1a00001800390038003300320016001300660035002f000a000500040100 State = 0x7e04413c4ac3982e863e3bc1d40fc3cc Message-Authenticator = 0x1ee566e14988e1656634a8bda1a23970 Sending Access-Challenge of id 236 to 150.150.40.141 port 32769 EAP-Message = 0x010f040a19c0000006d8160301004a02000046030146c580d914781e0631885babfd323f744e073c1a0d762fa5edd6dfe2690fbb9320d843d45cd88fecc5cb4b2c1256cc25c4d4e442e804158b8ec4485fc9bfeb53c000390016030104e90b0004e50004e200027430820270308201d9a003020102020101300d06092a864886f70d0101050500306d3110300e060355040313075253454c204341310b3009060355040b13024954310b3009060355040b13024954310d300b060355040a13045253454c3111300f060355040713084c616e64736875743110300e0603550408130742617661726961310b3009060355040613024445301e170d303730 EAP-Message = 0x3830363030303030305a170d3038303830363233353935395a301f311d301b060355040313147763732e7273656c2e72656e657361732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100bfdca3c73f9d3442ee1d8fd3edb90bc20a935415000efe8003eca3cea0168658ccf33924df3648aa81744a9d15f69ceece4373e1b25d294f93b93cb98371cb9cfd159a917c2e099b8954d9751626ba4a0fe8972b9459538ff3894d078253dec1e445d976ad05207e6d4d2da68d1343e6db85fe7f64bab0f83a8dca8afd1d26370203010001a36e306c30160603551d250101ff040c300a06082b060105050703013052060355 EAP-Message = 0x1d1f044b30493047a045a0438641687474703a2f2f70633430333335313a383038302f736572766c65742f636f6d2e66756e6b2e6f6463612e7365727665722e736572766c6574732e47657443524c300d06092a864886f70d0101050500038181001ed004b5c41754dc2c5cfaaac2217d6a90aca3b5aaf7a27461102d4acdfe2905836a9baed7c6aaa41914893be6cfad54589fa57b359a491097b6d60fe8b2a090e68a2adc4f2654875d9585a9759eefa924cf421c29f71e08a4eeb5ad5d23da6bdd9b5a9bac4549edd8004c553ca9a19c948c0a895f0622141645d18dfea4427800026830820264308201cda003020102020100300d06092a864886 EAP-Message = 0xf70d0101050500306d3110300e060355040313075253454c204341310b3009060355040b13024954310b3009060355040b13024954310d300b060355040a13045253454c3111300f060355040713084c616e64736875743110300e0603550408130742617661726961310b3009060355040613024445301e170d3037303830363030303030305a170d3137303830363233353935395a306d3110300e060355040313075253454c204341310b3009060355040b13024954310b3009060355040b13024954310d300b060355040a13045253454c3111300f060355040713084c616e64736875743110300e0603550408130742617661726961310b300906 EAP-Message = 0x035504061302444530819d300d06092a864886f70d01 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67538f85548078f113fef01af0d2efc4 rad_recv: Access-Request packet from host 150.150.40.141 port 32769, id=237, length=170 User-Name = "anonymous" Calling-Station-Id = "00-0C-F1-10-95-48" Called-Station-Id = "00-0B-85-82-C3-60:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020f00061900 State Processing the authorize section of radiusd.conf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop rlm_eap: EAP packet type response id 15 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok +- group authorize returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled +- group authenticate returns handled Finished request 2 state 5 Going to the next request Processing the authorize section of radiusd.conf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop rlm_eap: EAP packet type response id 16 length 208 rlm_eap: Continuing tunnel setup. ++[eap] returns ok +- group authorize returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled +- group authenticate returns handled Finished request 3 state 5 Going to the next request Processing the authorize section of radiusd.conf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop rlm_eap: EAP packet type response id 17 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok +- group authorize returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled +- group authenticate returns handled Finished request 4 state 5 Going to the next request = 0x67538f85548078f113fef01af0d2efc4 Message-Authenticator = 0x31cbc446aeb5a95d6e907b59aad4f27a Sending Access-Challenge of id 237 to 150.150.40.141 port 32769 EAP-Message = 0x011002de19000101050003818b0030818702818100b74f716b56b2464b8bd640955a1ffb274335f05646eddff3f93dcd47520eb764f5bd05d510275861f30e7e727c4b0ccc10797b1ed07bf9e98d88ba4d91ef041e0fc5a7f755b4b375d196170ab1a47c38a75e8d44bf09e20fe0e86994fe89060820e9f5fd284dc1551d48aa64951dbed7410548aeac1824ac5ddbdf629c946be5020111a316301430120603551d130101ff040830060101ff020100300d06092a864886f70d0101050500038181005649f966db9fe97da32747c5cc3af6cf15fde8f9c0db98db3aae700e3e74d1cc0fd07969def57f876d864aa05a01a5ef961487081ad57e4b18e7 EAP-Message = 0xd3a445ed9de2c9f4e79376f2991b4796ecf3ecb27786443b7e99b9e24b27756c03d9123a93a1eb8c091b796e6ce73f66a9700a71f24f7874de816052c4bc1f25b05235abf93c160301018d0c0001890080c7fdf4f2281a88444fb04733e293131bce140e28f08bb104facc9f16bbb0e3a1fc291776b898ec3e41884668163bc9a4f9feb445807c5b473a6c6714446d020935e87a0949c7863829e465c0ff1969384880e68b7f5add98429755464e76d4e239adb1de9dc8c4a376d1b61111dc0309c4e8b1abe76b3449ce313020d34216cb00010200800ea1768aedf982acd3dad43f3b5f6c440327d9656d82e0c0440e87bcc3f690741044f4d196bf4c EAP-Message = 0x9687da51560b696339059923f15ebc123fb1008fef0d5d0cb67832e5b51ac8e616d2ba10f34f980525ed587e8da3d42205a72964f12c96bd41c3b586ed93d12108699a5bb86e97b803c67d97225053d6f2f38084cf0f9e7a3e0080a1d348ca67045ab0ceebd35497c5e0a51795a534e4e902a06880f7bbbd288e5f0f502e36d5cfb50863f71253bd6ebc9e8d9208a54b1996cac92fba67886e98750a7867145a5706e41706baa75b32205aaa1f0916d5b519d525e9bcfd0bd447a01db9ebdcb0f821cbc1cbfe1f7facc3aea50cc2ccf5c93a588d69400ba2522f7d16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd613929d0835375b51b0bad22b0859c8 rad_recv: Access-Request packet from host 150.150.40.141 port 32769, id=238, length=372 User-Name = "anonymous" Calling-Station-Id = "00-0C-F1-10-95-48" Called-Station-Id = "00-0B-85-82-C3-60:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021000d01980000000c6160301008610000082008039724b2d404ca74c3b10364d9cfdb3ae6aad2a2be4250d2bc8af99abec7f0123bbf1868d547d29217c1bb0029a4abbde00940c54686a852e8d76033992c36a886c95302c16ddce802ab4956d578ad648e7b5923aa7ce88a0199db9245531b02b2c1c31bbc3fcc37b461c5e2eebae2fc44235a4723e35d2d86e7feffb26e778111403010001011603010030d16158a87ab639360df086b3c2dff39bd1ce72bbb875734f1d0b485ef8a3fd4b645cccc8c0bb284a561374ec26304714 State = 0xd613929d0835375b51b0bad22b0859c8 Message-Authenticator = 0x0f8218941c2ce5d17ecdee9dcc4b2762 Sending Access-Challenge of id 238 to 150.150.40.141 port 32769 EAP-Message = 0x011100411900140301000101160301003088c0c27a6f51fb7527c91b1b5303922637f4cc60fedecadd80965391e8dba99bf9841f8d0eb24d9371259333eaa767cf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cafbd9fc9bad1cc56e6e3b7680d946f rad_recv: Access-Request packet from host 150.150.40.141 port 32769, id=239, length=170 User-Name = "anonymous" Calling-Station-Id = "00-0C-F1-10-95-48" Called-Station-Id = "00-0B-85-82-C3-60:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021100061900 State = 0x3cafbd9fc9bad1cc56e6e3b7680d946f Message-Authenticator = 0x7e13c9b8d0b8083b90ef4f55195383ec Sending Access-Challenge of id 239 to 150.150.40.141 port 32769 EAP-Message = 0x0112002b19001703010020a9fce9f01fd333b6acd4e84c383b77d3c463b6847adf1ab77354f677ce6fe62e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0eca445faa2dd2b4a2e9097a7d976000 rad_recv: Access-Request packet from host 150.150.40.141 port 32769, id=240, length=207 User-Name = "anonymous" Calling-Station-Id = "00-0C-F1-10-95-48" Called-Station-Id = "00-0B-85-82-C3-60:RSEL" NAS-Port = 29 NAS-IP-Address = 150.150.40.141 NAS-Identifier = "RSEL-WLC" Airespac Processing the authorize section of radiusd.conf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop rlm_eap: EAP packet type response id 18 length 43 rlm_eap: Continuing tunnel setup. ++[eap] returns ok +- group authorize returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - test\cfra rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of test\cfra PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to test\cfra Processing the authorize section of radiusd.conf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "test\cfra", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: Looking up realm "test" for User-Name = "test\cfra" rlm_realm: Found realm "test" rlm_realm: Adding Stripped-User-Name = "cfra" rlm_realm: Proxying request from user cfra to realm test rlm_realm: Adding Realm = "test" rlm_realm: Authentication realm is LOCAL. ++[ntdomain] returns noop rlm_eap: EAP packet type response id 18 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for cfra radius_xlat: '(uid=cfra)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: Added User-Password = cisco12 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop +- group authorize returns updated rad_check_password: Found Auth-Type EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "EAP" Processing the authenticate section of radiusd.conf +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled +- group authenticate returns handled PEAP: Got tunneled Access-Challenge ++[eap] returns handled +- group authenticate returns handled Finished request 5 state 5 Going to the next request Processing the authorize section of radiusd.conf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop rlm_eap: EAP packet type response id 19 length 91 rlm_eap: Continuing tunnel setup. ++[eap] returns ok +- group authorize returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to test\cfra PEAP: Adding old state with 13 1f Processing the authorize section of radiusd.conf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "test\cfra", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: Looking up realm "test" for User-Name = "test\cfra" rlm_realm: Found realm "test" rlm_realm: Adding Stripped-User-Name = "cfra" rlm_realm: Proxying request from user cfra to realm test rlm_realm: Adding Realm = "test" rlm_realm: Authentication realm is LOCAL. ++[ntdomain] returns noop rlm_eap: EAP packet type response id 19 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for cfra radius_xlat: '(uid=cfra)' radius_xlat: 'dc=rsel,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: Added User-Password = cisco12 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop +- group authorize returns updated rad_check_password: Found Auth-Type EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "EAP" Processing the authenticate section of radiusd.conf +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf +- entering group MS-CHAP rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack? rlm_mschap: Told to do MS-CHAPv2 for test\cfra with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject +- group MS-CHAP returns reject rlm_eap: Freeing handler ++[eap] returns reject +- group authenticate returns reject auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled +- group authenticate returns handled Finished request 6 state 5 Going to the next request Processing the authorize section of radiusd.conf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop rlm_eap: EAP packet type response id 20 length 43 rlm_eap: Continuing tunnel setup. ++[eap] returns ok +- group authorize returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid +- group authenticate returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject Processing the post-auth section of radiusd.conf +- entering group REJECT radius_xlat: 'anonymous' attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated +- group REJECT returns updated Delaying reject of request 7 for 1 seconds Going to the next request Sending delayed reject for request 7 Waking up in 3 seconds... Cleaning up request 0 ID 235 with timestamp +26 Waking up in 1 seconds... Cleaning up request 7 ID 242 with timestamp +26 Nothing to do. Sleeping until we see a request. Would be nice if someone could give me some hints. Thanks, Christian **************************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited. E-mail messages are not necessarily secure. Renesas does not accept responsibility for any changes made to this message after it was sent. Please note that this email message has been swept by Renesas for the presence of computer viruses. Renesas Semiconductor Europe (Landshut) GmbH Jenaer Strasse 1, 84034 Landshut Tel.: +49-(0)871-684-0, Fax: +49-(0)871-684-150 www.rsel.renesas.com GESCHAEFTSFUEHRER: Dipl.-Ing. YOSHIHARU KAKUI GESCHAEFTSFUEHRER: Dipl.-Phys. STEFAN SAUER Registergericht Landshut HRB 1464 Ust-ldNr.: DE 128953054 Steuer-Nr.: 132/136/30347 HypoVereinsbank, Landshut, Kto.-Nr. 3704 700 (BLZ 743 200 73) Mizuho Corporate Bank (Germany) AG, Frankfurt, Kto.-Nr. 200 733 (BLZ 503 308 00) ****************************************************************************

2 2

chap password reject
by Carl aniams 19 Aug '07

19 Aug '07

Hi am using a fedora core 6 platform with freeradius 1.1.6 and mysql for storing users login.with the when i start radiusd in debug mode i have chap reject my password with the message: processing the authenticate section of radiusd.conf modcall:entering groupa chap for request 0 rlm_chap: login attempt by aniams with CHAP password rlm_chap: using clear text password carl for user aniams authentication rlm_chap: password check failed i've tried many options including reading faq but nothing yet.Attached is my radiusd.conf can somebody give a help? thanks -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

1 0

RE: Ipsec EAP_TLS
by Josh Howlett 19 Aug '07

19 Aug '07

> Does the current implementation of free radius provides > capability that these keys can be securely transfererred to > the VPN gateway ? No. josh.

2 1

freeradius + mysql + pptpd help me please
by hyunok 19 Aug '07

19 Aug '07

Fedora cor 5 freeradius-1.1.7.tar.gz ==> rpmbuild -bb Redhat\freeradius.spec radiusd.conf ==> option sql enable options.pptpd plugin radius.so radius-config-file /usr/local/etc/radiusclient/radiusclient.conf plugin radattr.so mysql use raidius; mysql> select * from usergroup; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | testuser | pptpd | 1 | +----------+-----------+----------+ 1 row in set (0.00 sec) mysql> select * from radcheck; +----+----------+---------------+----+------------------------------------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+------------------------------------+ | 2 | testuser | User-Password | := | $1$GhlXfa4L$4MU8.SGVhavIVwTtWOWRV1 | +----+----------+---------------+----+------------------------------------+ 1 row in set (0.00 sec) radiusd -xx ............. Thread spawned new child 1. Total threads in pool: 1 Thread spawned new child 2. Total threads in pool: 2 Thread spawned new child 3. Total threads in pool: 3 Thread spawned new child 4. Total threads in pool: 4 Thread spawned new child 5. Total threads in pool: 5 Thread pool initialized Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Thread 1 waiting to be assigned a request Thread 2 waiting to be assigned a request Thread 3 waiting to be assigned a request Thread 4 waiting to be assigned a request Thread 5 waiting to be assigned a request rad_recv: Access-Request packet from host 127.0.0.1:32772, id=237, length=69 Thread 1 got semaphore --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 5/0/5 Thread 1 handling request 0, (1 handled so far) Service-Type = Framed-User Framed-Protocol = PPP User-Name = "testuser" Calling-Station-Id = "123.xx.xx.xx" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry DEFAULT at line 184 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,r adgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Userna me = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck .id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,r adgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Userna me = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply .id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "unix" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request

1 0