- Freeradius-Users - lists.freeradius.org

help in setting up PEAP in freeRADIUS with winXp supplicant
by Apangshu Saha 11 Jun '07

11 Jun '07

Dear All, I am a newbee in freeRADIUS and unable to setting up PEAP in freeRADIUS with winXp supplicant.On the client side it always show attempting to authenticate.I am getting the following lines at the last of the log file of freeRADIUS.Help me to sort out the problem please. **************************log file************************* modcall[authorize]: module "files" returns ok for request 4 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x0105002019001703010015c37ca76db66f6a97fcfcf85e65a7e03d3e70fcf43d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5142c99b4f3e278d5f71af41f06e1e96 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=180 User-Name = "administrator" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0x5142c99b4f3e278d5f71af41f06e1e96 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500291900170301001e103d6d5ce7a04c446824e451f6b169ff53a8f48d18f614092295e6e1cdb6 Message-Authenticator = 0x45a325b094cfed83fdb2aad638a9fb12 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 41 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 users: Matched entry administrator at line 215 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - administrator rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of administrator PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to administrator Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 18 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 users: Matched entry administrator at line 215 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: No such EAP type mschapv2 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x010600261900170301001b91727baee5568c72883984a71242056b8f336171f797c3646a85de Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1654be07c4122f438449a5f35981dd27 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=177 User-Name = "administrator" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0x1654be07c4122f438449a5f35981dd27 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600261900170301001bdbac43bc04a3b2686dc05fc44cdb0a3922e36e0156ea45c11c188e Message-Authenticator = 0x0150585836af2d8127b88cf51a3efbfd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 users: Matched entry administrator at line 215 modcall[authorize]: module "files" returns ok for request 6 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 6 modcall: leaving group authenticate (returns invalid) for request 6 auth: Failed to validate the user. Delaying request 6 for 1 seconds Finished request 6 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 6 ID 0 with timestamp 466d3f35 Nothing to do. Sleeping until we see a request. ***********************log file************************************* please help. with regards... apangshu

2 1

freeradius eap-ttls pap ldap
by emmcosta 11 Jun '07

11 Jun '07

Hi everyone, I have a problem with my configuration, authorize is ok but authentication fail.I use freeradius 1.1.6 e openldap 2.2.13 and use windows xp for client with securew2. My access-point is Cisco aironet 1100. My radiusd.conf: .......... ldap { server = "localhost" identity = "cn=root,dc=teste,dc=pt" password = secret basedn = "dc=teste,dc=pt" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" start_tls = no access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 set_auth_type = no } .............. authorize { preprocess ldap pap } authenticate{ Auth-Type PAP { pap } Auth-Type LDAP { ldap } eap } My eap.conf: eap{ default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = yes md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. certificate_file = ${raddbdir}/certs/cert-srv.pem # Trusted Root CA list CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random } ttls { default_eap_type = gtc use_tunneled_reply = yes } } The log: ............ rlm_ldap: - authorize rlm_ldap: performing user authorization for user_test radius_xlat: '(uid=user_test)' radius_xlat: 'dc=teste,dc=pt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=teste,dc=pt, with filter (uid=user_test) Waking up in 1 seconds... Threads: total/active/spare threads = 5/1/4 rlm_ldap: checking if remote access for user_test is allowed by uid rlm_ldap: Added password {CRYPT}HkDWb49nxN4Zo in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value {CRYPT}HkDWb49nxN4Zo & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user gilberto authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 rlm_pap: No clear-text password in the request. Not performing PAP. modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns ok) for request 2 auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [user_test/<no User-Password attribute>] (from client 192.168.1.69 port 371 cli 0040.96a2.24f3) Delaying request 2 for 1 seconds Finished request 2 Going to the next request Thread 3 waiting to be assigned a request --- Walking the entire request list --- Waking up in 1 seconds... Threads: total/active/spare threads = 5/0/5 --- Walking the entire request list --- Sending Access-Reject of id 121 to 192.168.1.69 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 121 with timestamp 4669d1cd Nothing to do. Sleeping until we see a request. Anyone can help-me. Best regards -- /emmc

4 5

POD and HP Products.
by Arran Cudbard-Bell 11 Jun '07

11 Jun '07

Hi, Trying to find out whether any HP products support PoD (Packet of Disconnect). I've got a HP2626 ProCurve switch and one of the new HP 530 WAPs (released last august). Tried using radclient with the example in the wiki, but I don't get any response back from the switch or the WAP. According to the RFC (rfc3576) even if the packet of disconnect does not have the correct attributes , the NAS should send back a PoD NAK with the appropriate error code. The lack of Disconnect NAK suggests that HP devices don't support PoD, but I just wanted to check to see if anybody has had any experience with this. Seems strange that their enterprise products don't support something as basic as this, specially when the RFC was published in 2003. *sigh* Whats even more stupid is that you can disconnect users using the ssh interface on the switches using, # conf *# aaa port-access authenticator <port range> reauthenticate* .

2 2

I will be out of the office from Wednesday May 30 until Monday
by along 11 Jun '07

11 Jun '07

I will be out of the office from Wednesday May 30 until Monday June 4. Please use my cell number if you require immediate assistance. You may also call the main office number (716) 893-4984 to speak with someone else. I will receive your e-mail during this period and will try to get back to you as soon as possible. Thank You. Andrew Long

3 5

EAP-TLS problem
by shantanu choudhary 11 Jun '07

11 Jun '07

hello all, earlier i was having problem of segmentation fault for wpa supplicant, that i have resolved(at least i think so, it was because i was not using xauth module of ath card). but now i am having a problem of validating CA, i am not able to validate server certificate. i am sending u my wpa_supplicant result i hope u can help me out. EAP-TLS: Requesting private key passphrase CTRL-REQ-PASSPHRASE-0:Private key passphrase needed for SSID ATH183 CTRL_IFACE monitor send - hexdump(len=21): 2f 74 6d 70 2f 77 70 61 5f 63 74 72 6c 5f 37 30 39 36 2d 31 00 EAP: Failed to initialize EAP method: vendor 0 method 13 (TLS) CTRL_IFACE monitor send - hexdump(len=21): 2f 74 6d 70 2f 77 70 61 5f 63 74 72 6c 5f 37 30 39 36 2d 31 00 EAP: Pending PIN/passphrase request - skip Nak EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=6): 53 54 41 54 55 53 STATUS ioctl[SIOCGIFADDR]: Cannot assign requested address RX ctrl_iface - hexdump_ascii(len=13): 4c 49 53 54 5f 4e 45 54 57 4f 52 4b 53 LIST_NETWORKS RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING EAPOL: startWhen --> 0 RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=30): [REMOVED] CTRL_IFACE: field=PASSPHRASE id=0 CTRL_IFACE: value - hexdump_ascii(len=8): [REMOVED] EAPOL: received control response (user input) notification - retrying pending EAP Request EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=1 method=13 vendor=0 vendorMethod=0 EAP: EAP entering state GET_METHOD EAP: Initialize selected EAP method: vendor 0 method 13 (TLS) TLS: Trusted root certificate(s) loaded TLS - SSL error: error:0B07C065:x509 certificate routines:X509_STORE_add_cert:cert already in hash table OpenSSL: tls_connection_client_cert - SSL_use_certificate_file (DER) failed error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: pending error: error:140C800D:SSL routines:SSL_use_certificate_file:ASN1 lib OpenSSL: SSL_use_certificate_file (PEM) --> OK OpenSSL: tls_connection_private_key - SSL_use_PrivateKey_File (DER) failed error:0D094065:asn1 encoding routines:d2i_ASN1_SET:bad class OpenSSL: pending error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: pending error: error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib OpenSSL: pending error: error:140CB00D:SSL routines:SSL_use_PrivateKey_file:ASN1 lib OpenSSL: SSL_use_PrivateKey_File (PEM) --> OK SSL: Private key loaded successfully CTRL-EVENT-EAP-METHOD EAP vendor 0 method 13 (TLS) selected CTRL_IFACE monitor send - hexdump(len=21): 2f 74 6d 70 2f 77 70 61 5f 63 74 72 6c 5f 37 30 39 36 2d 31 00 EAP: EAP entering state METHOD SSL: Received packet(len=6) - Flags 0x20 EAP-TLS: Start SSL: SSL_connect - want more data SSL: 101 bytes pending from ssl_out SSL: 101 bytes left to be sent out (of total 101 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=111): 01 00 00 6b 02 01 00 6b 0d 00 16 03 01 00 60 01 00 00 5c 03 01 46 6d 06 4b cc 4f b2 ae eb 76 1c 1a ab 4f 82 ee 2f bd fd 8e 83 a6 c6 cd da 79 43 cb b4 07 97 13 00 00 34 00 39 00 38 00 35 00 16 00 13 00 0a 00 33 00 32 00 2f 00 66 00 05 00 04 00 63 00 62 00 61 00 15 00 12 00 09 00 65 00 64 00 60 00 14 00 11 00 08 00 06 00 03 02 01 00 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:03:7f:09:60:7e RX EAPOL - hexdump(len=1038): 01 00 04 0a 01 02 04 0a 0d c0 00 00 07 9e 16 03 01 00 4a 02 00 00 46 03 01 46 6d 03 13 c3 0c 81 a0 fe 19 5b 81 0d fd af 94 0e 8c 1d 58 53 16 d8 50 c1 56 81 a8 f0 5f 9b 79 20 1e 0e 1c b8 b7 1d d9 94 7b 65 46 61 7a 9c 22 74 cd 58 6c 80 b9 86 75 a0 21 a5 a4 bf a7 7c 3d b4 00 35 00 16 03 01 06 94 0b 00 06 90 00 06 8d 00 02 cd 30 82 02 c9 30 82 02 32 a0 03 02 01 02 02 01 02 30 0d 06 09 2a 86 48 86 f7 0d 01 01 04 05 00 30 81 9f 31 0b 30 09 06 03 55 04 06 13 02 43 41 31 11 30 0f 06 03 55 04 08 13 08 50 72 6f 76 69 6e 63 65 31 12 30 10 06 03 55 04 07 13 09 53 6f 6d 65 20 43 69 74 79 31 15 30 13 06 03 55 04 0a 13 0c 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 31 12 30 10 06 03 55 04 0b 13 09 6c 6f 63 61 6c 68 6f 73 74 31 1b 30 19 06 03 55 04 03 13 12 43 6c 69 65 6e 74 20 63 65 72 74 69 66 69 63 61 74 65 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 63 6c 69 65 6e 74 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 30 1e 17 0d 30 34 30 31 32 35 31 33 32 36 31 30 5a 17 0d 30 35 30 31 32 34 31 33 32 36 31 30 5a 30 81 9b 31 0b 30 09 06 03 55 04 06 13 02 43 41 31 11 30 0f 06 03 55 04 08 13 08 50 72 6f 76 69 6e 63 65 31 12 30 10 06 03 55 04 07 13 09 53 6f 6d 65 20 43 69 74 79 31 15 30 13 06 03 55 04 0a 13 0c 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 31 12 30 10 06 03 55 04 0b 13 09 6c 6f 63 61 6c 68 6f 73 74 31 19 30 17 06 03 55 04 03 13 10 52 6f 6f 74 20 63 65 72 74 69 66 69 63 61 74 65 31 1f 30 1d 06 09 2a 86 48 86 f7 0d 01 09 01 16 10 72 6f 6f 74 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 da c5 25 42 2b fe db 08 26 29 a2 cb a4 4b 34 49 c9 0d 0a b4 62 fb 72 c8 43 4a 78 20 98 86 3d 7e b7 d7 e7 00 28 c2 b7 ad 55 5a 51 cc 75 6c f4 fa 1d 70 91 61 5a b4 50 d5 28 95 53 ae 66 16 af f0 14 a5 50 85 d6 b8 fb 4a ee 98 63 8e 42 61 75 cd d3 6c 66 5c 63 cd a1 77 d3 49 20 eb 30 58 5e dc 87 73 99 9c 29 80 f8 1a d4 63 8b bb ea 1c 82 d0 54 02 3d b7 ef 24 a3 ec 1c 3f 62 41 a9 03 d7 f3 02 03 01 00 01 a3 17 30 15 30 13 06 03 55 1d 25 04 0c 30 0a 06 08 2b 06 01 05 05 07 03 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 04 05 00 03 81 81 00 7a 2d 92 1b 1c f1 3b f2 98 2a 91 78 ec 9e de 6d 88 ed c1 78 a2 e8 bd 40 a0 a0 6f b6 f0 76 99 57 88 4c d7 08 45 37 08 34 96 fd 18 41 65 29 3f 58 3c 8e 82 40 eb 68 e0 42 c9 4b 15 75 2e 4c 07 e8 0d 09 77 9a fa 3d d5 5c 24 fa 54 ac 29 2d 77 20 5d 1c 24 77 ed 30 d5 9f 57 ca f9 bd 21 ff 2a 8d 16 cc 09 11 c5 0e 4f 29 57 63 fc b6 0e fa 3c 3d 2d 0e 43 85 0f 6e 6f be 28 49 02 f6 e8 35 03 65 00 03 ba 30 82 03 b6 30 82 03 1f a0 03 02 01 02 02 01 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 04 05 00 30 81 9f 31 0b 30 09 06 03 55 04 06 13 02 43 41 31 11 30 0f 06 03 55 04 08 13 08 50 72 6f 76 69 6e 63 65 31 12 30 10 06 03 55 04 07 13 09 53 6f 6d 65 20 43 69 74 79 31 15 30 13 06 03 55 04 0a 13 0c 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 31 12 30 10 06 03 55 04 0b 13 09 6c 6f 63 61 6c 68 6f 73 74 31 1b 30 19 06 03 55 04 03 13 12 43 6c 69 65 6e 74 20 63 65 72 74 69 66 69 63 61 74 65 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 63 6c 69 65 6e 74 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 30 1e 17 0d 30 34 30 31 32 35 31 33 32 36 30 37 5a EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=2 method=13 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=1034) - Flags 0xc0 SSL: TLS Message Length: 1950 SSL: Need 926 bytes more input data SSL: Building ACK EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=10): 01 00 00 06 02 02 00 06 0d 00 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:03:7f:09:60:7e RX EAPOL - hexdump(len=940): 01 00 03 a8 01 03 03 a8 0d 80 00 00 07 9e 17 0d 30 36 30 31 32 34 31 33 32 36 30 37 5a 30 81 9f 31 0b 30 09 06 03 55 04 06 13 02 43 41 31 11 30 0f 06 03 55 04 08 13 08 50 72 6f 76 69 6e 63 65 31 12 30 10 06 03 55 04 07 13 09 53 6f 6d 65 20 43 69 74 79 31 15 30 13 06 03 55 04 0a 13 0c 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 31 12 30 10 06 03 55 04 0b 13 09 6c 6f 63 61 6c 68 6f 73 74 31 1b 30 19 06 03 55 04 03 13 12 43 6c 69 65 6e 74 20 63 65 72 74 69 66 69 63 61 74 65 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 63 6c 69 65 6e 74 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 d4 c5 b1 97 24 f1 64 ac f1 ff b1 89 db 1c 8f bf f4 f1 43 96 ea 7c b1 e9 0f 78 d6 94 51 72 53 77 89 5d fe 52 cc b9 9b 41 e8 0d de b5 8b 12 7a 94 3f 4f 58 cb c5 62 87 81 92 fb dc 6f ec e9 f8 71 e7 c1 30 d3 5c f5 18 88 17 e9 b1 33 24 9e dd 2a 1c 75 d3 10 43 ae 87 55 3c ec 7a 77 ef 26 aa 7d 74 28 1d b9 b7 7e 17 c6 44 6c 5d d9 b1 88 b4 32 50 ca 02 29 96 37 22 a1 23 a7 26 b0 0b 40 27 fd 02 03 01 00 01 a3 81 ff 30 81 fc 30 1d 06 03 55 1d 0e 04 16 04 14 68 d3 6d 3e 1e e7 bc 9d 5a 05 70 21 c3 63 da 13 65 d1 ad e3 30 81 cc 06 03 55 1d 23 04 81 c4 30 81 c1 80 14 68 d3 6d 3e 1e e7 bc 9d 5a 05 70 21 c3 63 da 13 65 d1 ad e3 a1 81 a5 a4 81 a2 30 81 9f 31 0b 30 09 06 03 55 04 06 13 02 43 41 31 11 30 0f 06 03 55 04 08 13 08 50 72 6f 76 69 6e 63 65 31 12 30 10 06 03 55 04 07 13 09 53 6f 6d 65 20 43 69 74 79 31 15 30 13 06 03 55 04 0a 13 0c 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 31 12 30 10 06 03 55 04 0b 13 09 6c 6f 63 61 6c 68 6f 73 74 31 1b 30 19 06 03 55 04 03 13 12 43 6c 69 65 6e 74 20 63 65 72 74 69 66 69 63 61 74 65 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 63 6c 69 65 6e 74 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 82 01 00 30 0c 06 03 55 1d 13 04 05 30 03 01 01 ff 30 0d 06 09 2a 86 48 86 f7 0d 01 01 04 05 00 03 81 81 00 33 c0 0b 66 b1 e5 79 ef 73 a0 67 98 25 2d ab 8d 5e 55 11 fc 00 fd 27 6d 80 d1 2f 83 47 77 c6 74 3f dc 27 43 fc a1 50 77 04 e4 bc 09 79 e4 f6 0a c3 ad 9e e8 3e 6f 34 73 69 22 9d 1f 77 22 9b a2 e9 82 35 9d a5 63 02 4a 00 16 3d ba 6d 6c 98 6c 0b ad 28 af 85 13 2f f8 f0 d7 65 01 bf 1b 7c 2d ff 65 8c e1 e6 2c 01 99 7b 6e 64 e3 e8 d4 37 33 54 ce 99 12 84 76 51 53 90 63 b8 5b bc 54 85 c5 16 03 01 00 b1 0d 00 00 a9 02 01 02 00 a4 00 a2 30 81 9f 31 0b 30 09 06 03 55 04 06 13 02 43 41 31 11 30 0f 06 03 55 04 08 13 08 50 72 6f 76 69 6e 63 65 31 12 30 10 06 03 55 04 07 13 09 53 6f 6d 65 20 43 69 74 79 31 15 30 13 06 03 55 04 0a 13 0c 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 31 12 30 10 06 03 55 04 0b 13 09 6c 6f 63 61 6c 68 6f 73 74 31 1b 30 19 06 03 55 04 03 13 12 43 6c 69 65 6e 74 20 63 65 72 74 69 66 69 63 61 74 65 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 63 6c 69 65 6e 74 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 0e 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=3 method=13 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=936) - Flags 0x80 SSL: TLS Message Length: 1950 TLS: Certificate verification failed, error 19 (self signed certificate in certificate chain) depth 1 for '/C=CA/ST=Province/L=Some City/O=Organization/OU=localhost/CN=Client certificate/emailAddress=client(a)example.com' OpenSSL: tls_connection_handshake - SSL_connect error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed SSL: 7 bytes pending from ssl_out SSL: Failed - tls_out available to report error SSL: 7 bytes left to be sent out (of total 7 bytes) EAP-TLS: TLS processing failed EAP: method process -> ignore=FALSE methodState=DONE decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=17): 01 00 00 0d 02 03 00 0d 0d 00 15 03 01 00 02 02 30 EAPOL: SUPP_BE entering state RECEIVE regards shantanu Did you know? You can CHAT without downloading messenger. Click here http://in.messenger.yahoo.com/webmessengerpromo.php

1 0

Installing freeradius on hosted directory : can't create /usr/local/sbin
by Leodom 11 Jun '07

11 Jun '07

Hello ! I am trying to install freeradius on an hosted Linux space I have rented, I do have a dedicated IP, and shell access. Following install procedure, I stumbled on the make install command : [~/public_html/freeradius-1.1.6]# make install /home/lvkinfon/public_html/freeradius-1.1.6/install-sh -c -d -m 755 /usr/local/sbin mkdir: cannot create directory `/usr/local/sbin': Permission denied make: *** [install] Error 1 I am quite new to Linux, and so it would be great if someone could give me an hint on what I should do to solve this and be able to install freeradius... thanks for anyone who have some help -- View this message in context: http://www.nabble.com/Installing-freeradius-on-hosted-directory-%3A-can%27t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

unexpected radius packets
by Andrew Long 11 Jun '07

11 Jun '07

NAS are Colubris cn3200; they are periodically logging events like the following: warning iprulesmgr Received unexpected RADIUS packet (id='56') from RADIUS Server (ip-address='65.xxx.xxx.x',port='1812') I have run a capture on the interface (server) and see that the packet with this id is an access-reject(3) in response to a request. Can someone help me with debugging why the NAS is logging this as unexpected? It is recording the reject prior to the unexpected event. From the capture I see that there was only 1 packet (id56) returned. I am pretty unfamiliar with reading captures, but I do have the saved files if more info is needed. Regards, Andrew

6 9

radius server stops with error "segmentation fault"
by ravi sawant 11 Jun '07

11 Jun '07

Dear All, I have freeradius installed in RHEL4 with mysql database server. When I had basic configuration of radiusd.conf, the server was working fine. But when I made some changes in radiusd.conf file for checking user's data & time limit with sqlcounter & sqldatacounter, the server stops with error "segmentation fault" . Please help me in this regard. Thanks & Regards, Ravin

1 0

pairfind() with VSAs
by hwang＠i-fone.net 10 Jun '07

10 Jun '07

I'm trying to write my own module and come into some problems. I'm trying to access request attributes using pairfind() as mentioned in the Wiki. I can get normal attributes without problem but having problem with VSAs. I tried to access some Cisco VSAs like h323-conf-id, h323-call-origin by using something like PW_H323_CONF_ID, CISCO_H323_CONF_ID, H323_CONF_ID but compiler told me those are "undeclared". How do I access those VSAs? Thanks. C.C. Hwang

2 1

Re : debug messages on dialupadmin interface
by Eshun Benjamin 10 Jun '07

10 Jun '07

Is it normal? No. You have to turn off debug mode from your dial-up admin config ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Carl aniams <aniamss(a)gmail.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Vendredi, 8 Juin 2007, 17h25mn 24s Objet : debug messages on dialupadmin interface I finished installing my freeradius 1.1.6 vers, and the dialup admin interface is configured with mysql server V4.1.11. Everything is up, yet when i insert a user and ask for his statistics it displays the stats though but before i have a full page of debug messages. So it is for whatever page i open there are debug messages that visibly shouldn't appear(i think). Is it normal? -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0