- Freeradius-Users - lists.freeradius.org

Radius authentication problems
by sizo nsibande 25 May '07

25 May '07

Goodmorow We are having a problem testing the authentication process on our radius box, please do not flame me, I am just trying to find out if any of you guys have ever maybe come across any such issue. Thanks in advance. <snip> May 24 14:09:52 allan snmpd[2435]: netsnmp_assert index == tmp failed if-mib/data_access/interface.c:467 _access_interface_entry_save_name() May 24 14:10:05 allan pppd[5714]: LCP: timeout sending Config-Requests May 24 14:10:05 allan pppd[5714]: Connection terminated. May 24 14:10:05 allan pppd[5714]: Modem hangup May 24 14:10:09 allan pppoe[5715]: Timeout waiting for PADS packets May 24 14:10:09 allan pppd[5714]: Exit. May 24 14:10:09 allan adsl-connect: ADSL connection lost; attempting re-connection. May 24 14:10:14 allan pppd[5788]: pppd 2.4.4 started by root, uid 0 May 24 14:10:14 allan pppd[5788]: Using interface ppp0 May 24 14:10:14 allan pppd[5788]: Connect: ppp0 <--> /dev/pts/6 May 24 14:10:22 allan snmpd[2435]: netsnmp_assert index == tmp failed if-mib/data_access/interface.c:467 _access_interface_entry_save_name() May 24 14:10:30 allan ntpd[2484]: sendto(212.244.104.2) (fd=23): Network is unreachable May 24 14:10:45 allan pppd[5788]: LCP: timeout sending Config-Requests May 24 14:10:45 allan pppd[5788]: Connection terminated. May 24 14:10:45 allan pppd[5788]: Modem hangup May 24 14:10:49 allan pppoe[5789]: Timeout waiting for PADS packets May 24 14:10:49 allan pppd[5788]: Exit. Sent at 14:26 on Thursday <snip> -- Communication is not just eglish grammaer and literature, but a well established database between people that have come to know each other!

2 1

dictionary handling
by Wolfgang Rosenauer 25 May '07

25 May '07

Hi, since I just begun to use freeradius in production I found some strangeness. The default configuration is to include all dictionaries but I wonder how they are evaluated? I have a Cisco NAS which sends (at least I think) VSA records and so I configured the Cisco VSA hack. For accounting reasons I'm interested in Cisco-PreSession-Time which is 198. In the detail log I found X-Ascend-PreSession-Time instead of Cisco-PreSession-Time though. If I grep through the dictionaries I found: dictionary.alvarion:ATTRIBUTE Alvariaon-VSA-198 198 string dictionary.aptis:ATTRIBUTE CVX-PreSession-Time 198 integer dictionary.ascend:ATTRIBUTE Ascend-PreSession-Time 198 integer dictionary.ascend:ATTRIBUTE X-Ascend-PreSession-Time 198 integer dictionary.cisco:ATTRIBUTE Cisco-PreSession-Time 198 integer dictionary.epygi:ATTRIBUTE Epygi-OutRTP_PacketSize 198 integer dictionary.lucent:ATTRIBUTE Lucent-PreSession-Time 198 integer So I find it strange that freeradius logs X-Ascend-PreSession-Time at all since it's not the first match and not the last one. In addition I wonder if it makes sense that dictionary.ascend has two definitions for 198. I was under the impression that the correct dictionary would be chosen by the vendor ID (9 in case of Cisco). So any idea why freeradius logs Ascend attributes then? Thanks, Wolfgang

2 1

freeradius as a middleware between multiple ldap/ADS-servers and CMS
by baeus＠web.de 25 May '07

25 May '07

Hello, I have got a very general question. I have got a moodle-CMS in the internet. For single-sign-in I made a ldap-authentification between our ADS in school and moodle. So every teacher and student can log into moodle with his windows-domain-password. Now other schools are also interested in single-sign-in to our moodle. Unfortunately only one ldap-connecting is accepted by moodle at one time. So I'm looking for a middleware. On one side the middleware has to handle multiple ldap/ADS-servers and on the other side the middleware has to talk to moodle with one host-address, one port and one shared key. Will radius be my friend? The radius-connector does exist in moodle. Stefan

2 1

Re: Very critical: Memory leak in freeradius-1.1.6
by nikitha george 25 May '07

25 May '07

On 5/23/07, nikitha george <nikitha.george(a)gmail.com> wrote: > > Please find the valgrind output below. It shows so much memory is still > reachable. > I guess we are not cleaning up the all the expired cached session at > regular interval. > > > ==21844== 7,456 bytes in 29 blocks are still reachable in loss record 33 > of 44 > ==21844== at 0x48054FB: realloc (vg_replace_malloc.c:306) > ==21844== by 0x351D54: (within /lib/libcrypto.so.0.9.8b) > ==21844== by 0x352486: CRYPTO_realloc (in /lib/libcrypto.so.0.9.8b) > ==21844== by 0x3A4776: lh_insert (in /lib/libcrypto.so.0.9.8b) > ==21844== by 0x355527: OBJ_NAME_add (in /lib/libcrypto.so.0.9.8b) > ==21844== by 0x3AC41C: EVP_add_digest (in /lib/libcrypto.so.0.9.8b) > ==21844== by 0x486EF91: SSL_library_init (in /lib/libssl.so.0.9.8b) > ==21844== by 0x4BAAE03: eaptls_attach (rlm_eap_tls.c:287) > ==21844== by 0x4B95230: eaptype_load (eap.c:122) > ==21844== by 0x4B93D1B: eap_instantiate (rlm_eap.c:145) > ==21844== by 0xCCBE: find_module_instance (modules.c:358) > ==21844== by 0xDCBD: do_compile_modsingle (modcall.c:1005) > ==21844== > ==21844== > ==21844== 10,692 bytes in 33 blocks are still reachable in loss record 34 > of 44 > ==21844== at 0x4805400: malloc (vg_replace_malloc.c:149) > ==21844== by 0x4830106: pairmake (valuepair.c:1049) > ==21844== by 0x4830A58: pairread (valuepair.c:1244) > ==21844== by 0x4830C15: userparse (valuepair.c:1296) > ==21844== by 0x9BAB: pairlist_read (files.c:200) > ==21844== by 0x4BBB5FF: preprocess_instantiate (rlm_preprocess.c:493) > ==21844== by 0xCCBE: find_module_instance (modules.c:358) > ==21844== by 0xDCBD: do_compile_modsingle (modcall.c:1005) > ==21844== by 0xD34C: setup_modules (modules.c:580) > ==21844== by 0x10A35: main (radiusd.c:965) > ==21844== > ==21844== > ==21844== 13,325 bytes in 21 blocks are still reachable in loss record 35 > of 44 > ==21844== at 0x480473F: calloc (vg_replace_malloc.c:279) > ==21844== by 0x4FE8F57A: _dl_new_object (in /lib/ld-2.5.so) > ==21844== by 0x4FE8B0E0: _dl_map_object_from_fd (in /lib/ld-2.5.so) > ==21844== by 0x4FE8D403: _dl_map_object (in /lib/ld-2.5.so) > ==21844== by 0x4FE96668: dl_open_worker (in /lib/ld-2.5.so) > ==21844== by 0x4FE92C05: _dl_catch_error (in /lib/ld-2.5.so) > ==21844== by 0x4FE96191: _dl_open (in /lib/ld-2.5.so) > ==21844== by 0x419BCD0C: dlopen_doit (in /lib/libdl-2.5.so) > ==21844== by 0x4FE92C05: _dl_catch_error (in /lib/ld-2.5.so) > ==21844== by 0x419BD38B: _dlerror_run (in /lib/libdl-2.5.so) > ==21844== by 0x419BCC43: dlopen@@GLIBC_2.1 (in /lib/libdl-2.5.so) > ==21844== by 0x48392A9: sys_dl_open (ltdl.c:958) > ==21844== > ==21844== > ==21844== 15,808 bytes in 670 blocks are still reachable in loss record 36 > of 44 > ==21844== at 0x4805400: malloc (vg_replace_malloc.c:149) > ==21844== by 0x418C001F: strdup (in /lib/libc-2.5.so) > ==21844== by 0x79D7: cf_section_read (conffile.c:207) > ==21844== by 0x8094: conf_read (conffile.c:917) > ==21844== by 0xB55D: read_radius_conf_file (mainconfig.c:1264) > ==21844== by 0xB6A5: read_mainconfig (mainconfig.c:1309) > ==21844== by 0x109F2: main (radiusd.c:941) > ==21844== > ==21844== > ==21844== 26,768 bytes in 336 blocks are still reachable in loss record 37 > of 44 > ==21844== at 0x4805400: malloc (vg_replace_malloc.c:149) > ==21844== by 0x4B944E1: eap_compose (eap.c:395) > ==21844== by 0x4B93AC8: eap_authenticate (rlm_eap.c:341) > ==21844== by 0xE3C7: modcall (modcall.c:236) > ==21844== by 0xEA6B: call_one (modcall.c:269) > ==21844== by 0xE5B9: modcall (modcall.c:324) > ==21844== by 0xC63D: indexed_modcall (modules.c:469) > ==21844== by 0x5213: rad_check_password (auth.c:380) > ==21844== by 0x579A: rad_authenticate (auth.c:675) > ==21844== by 0xFC66: rad_respond (radiusd.c:1675) > ==21844== by 0x116B1: main (radiusd.c:1440) > ==21844== > ==21844== > ==21844== 49,152 bytes in 4 blocks are still reachable in loss record 38 > of 44 > ==21844== at 0x4805400: malloc (vg_replace_malloc.c:149) > ==21844== by 0x4825B3F: lrad_hash_table_insert (hash.c:375) > ==21844== by 0x4822AAF: dict_addattr (dict.c:478) > ==21844== by 0x482316B: my_dict_init (dict.c:744) > ==21844== by 0x4822F71: my_dict_init (dict.c:1050) > ==21844== by 0x4822F71: my_dict_init (dict.c:1050) > ==21844== by 0x4823DC5: dict_init (dict.c:1258) > ==21844== by 0xB5AF: read_radius_conf_file (mainconfig.c:1276) > ==21844== by 0xB6A5: read_mainconfig (mainconfig.c:1309) > ==21844== by 0x109F2: main (radiusd.c:941) > ==21844== > ==21844== > ==21844== 64,892 bytes in 1,704 blocks are still reachable in loss record > 39 of 44 > ==21844== at 0x4805400: malloc (vg_replace_malloc.c:149) > ==21844== by 0x153DC: rad_malloc (util.c:308) > ==21844== by 0x79AE: cf_section_read (conffile.c:203) > ==21844== by 0x8094: conf_read (conffile.c:917) > ==21844== by 0xB55D: read_radius_conf_file (mainconfig.c:1264) > ==21844== by 0xB6A5: read_mainconfig (mainconfig.c:1309) > ==21844== by 0x109F2: main (radiusd.c:941) > ==21844== > ==21844== > ==21844== 136,877 bytes in 5,331 blocks are still reachable in loss record > 40 of 44 > ==21844== at 0x4805400: malloc (vg_replace_malloc.c:149) > ==21844== by 0x4822662: dict_addvalue (dict.c:542) > ==21844== by 0x482322E: my_dict_init (dict.c:783) > ==21844== by 0x4822F71: my_dict_init (dict.c:1050) > ==21844== by 0x4822F71: my_dict_init (dict.c:1050) > ==21844== by 0x4823DC5: dict_init (dict.c:1258) > ==21844== by 0xB5AF: read_radius_conf_file (mainconfig.c:1276) > ==21844== by 0xB6A5: read_mainconfig (mainconfig.c:1309) > ==21844== by 0x109F2: main (radiusd.c:941) > ==21844== > ==21844== > ==21844== 200,340 bytes in 3,339 blocks are still reachable in loss record > 41 of 44 > ==21844== at 0x4805400: malloc (vg_replace_malloc.c:149) > ==21844== by 0x4822A43: dict_addattr (dict.c:463) > ==21844== by 0x482316B: my_dict_init (dict.c:744) > ==21844== by 0x4822F71: my_dict_init (dict.c:1050) > ==21844== by 0x4822F71: my_dict_init (dict.c:1050) > ==21844== by 0x4823DC5: dict_init (dict.c:1258) > ==21844== by 0xB5AF: read_radius_conf_file (mainconfig.c:1276) > ==21844== by 0xB6A5: read_mainconfig (mainconfig.c:1309) > ==21844== by 0x109F2: main (radiusd.c:941) > ==21844== > ==21844== > ==21844== 276,096 bytes in 17,256 blocks are still reachable in loss > record 42 of 44 > ==21844== at 0x4805400: malloc (vg_replace_malloc.c:149) > ==21844== by 0x4825A61: lrad_hash_table_insert (hash.c:417) > ==21844== by 0x4822AAF: dict_addattr (dict.c:478) > ==21844== by 0x482316B: my_dict_init (dict.c:744) > ==21844== by 0x4822F71: my_dict_init (dict.c:1050) > ==21844== by 0x4822F71: my_dict_init (dict.c:1050) > ==21844== by 0x4823DC5: dict_init (dict.c:1258) > ==21844== by 0xB5AF: read_radius_conf_file (mainconfig.c:1276) > ==21844== by 0xB6A5: read_mainconfig (mainconfig.c:1309) > ==21844== by 0x109F2: main (radiusd.c:941) > ==21844== > ==21844== > ==21844== 1,569,535 bytes in 3,525 blocks are still reachable in loss > record 43 of 44 > ==21844== at 0x4805400: malloc (vg_replace_malloc.c:149) > ==21844== by 0x351D1D: (within /lib/libcrypto.so.0.9.8b) > ==21844== by 0x35239E: CRYPTO_malloc (in /lib/libcrypto.so.0.9.8b) > ==21844== by 0x3A4867: lh_new (in /lib/libcrypto.so.0.9.8b) > ==21844== by 0x35548A: OBJ_NAME_init (in /lib/libcrypto.so.0.9.8b) > ==21844== by 0x355564: OBJ_NAME_add (in /lib/libcrypto.so.0.9.8b) > ==21844== by 0x3AC4D7: EVP_add_cipher (in /lib/libcrypto.so.0.9.8b) > ==21844== by 0x486EE95: SSL_library_init (in /lib/libssl.so.0.9.8b) > ==21844== by 0x4BAAE03: eaptls_attach (rlm_eap_tls.c:287) > ==21844== by 0x4B95230: eaptype_load (eap.c:122) > ==21844== by 0x4B93D1B: eap_instantiate (rlm_eap.c:145) > ==21844== by 0xCCBE: find_module_instance (modules.c:358) > ==21844== > ==21844== > ==21844== 3,557,736 bytes in 54 blocks are still reachable in loss record > 44 of 44 > ==21844== at 0x4805400: malloc (vg_replace_malloc.c:149) > ==21844== by 0x4B9D4EC: eaptls_new_session (tls.c:49) > ==21844== by 0x4BAA7A3: eaptls_initiate (rlm_eap_tls.c:594) > ==21844== by 0x4B94C51: eaptype_call (eap.c:150) > ==21844== by 0x4B94F1E: eaptype_select (eap.c:260) > ==21844== by 0x4B9391E: eap_authenticate (rlm_eap.c:261) > ==21844== by 0xE3C7: modcall (modcall.c:236) > ==21844== by 0xEA6B: call_one (modcall.c:269) > ==21844== by 0xE5B9: modcall (modcall.c:324) > ==21844== by 0xC63D: indexed_modcall (modules.c:469) > ==21844== by 0x5213: rad_check_password (auth.c:380) > ==21844== by 0x579A: rad_authenticate (auth.c:675) > ==21844== > ==21844== LEAK SUMMARY: > ==21844== definitely lost: 289 bytes in 20 blocks. > ==21844== possibly lost: 0 bytes in 0 blocks. > ==21844== still reachable: 5,960,026 bytes in 33,842 blocks. > ==21844== suppressed: 0 bytes in 0 blocks. > > Please let me know if you could get any fix for this.. > > Thanks a lot for any help, > -- Nikitha > > > > > > > On 5/21/07, nikitha george <nikitha.george(a)gmail.com> wrote: > > > > OS: GNU/Linux-2.6.18-1.2798.fc6 > > > > machine : i686 > > hardware-platform: i386 > > gcc -- 4.1.1 > > glib -- 2.12.13 > > > > Number of requests per second: > > I am trying to connect 16 clients at the roaming rate of 1 second. The > > average > > time per request complete is (250ms) so atmost 4 requests per second. > > Once the roaming > > is started none of the requests are getting completed. During this > > condition > > the memory usage increase rapidly at the rate of 5 to 10MB till 160MB. > > > > radiusd.conf file: default one comes with freeradius-1.1.6 > > > > > > > > ... > > [Message clipped]

2 1

Freeradius and rlm_mysql with encrypted PWD's
by Rascher, Markus 25 May '07

25 May '07

Hi All, In Prev. Threads i read about the same Problem i have now. But i never found an answer which solves my problem. My question is: what kind of Password-encryption is supported in the mysql-DB used by the Freeradius-Server to authenticate Users. Cleartext-PWD's are working fine. Sql-Encryption for the PWD's works fine too. (I used the encrypt() command of mysql to create the encrypted Passwords for the radcheck-Table). Does MD5 or sha1 work too? I tried to get md5 working but get stucked... Can anyone send me a howto or link to one? I can send my configuration if u need. Thanks for your help

3 3

log_badlogins problem
by satish patel 25 May '07

25 May '07

Dear all I have some problem with dailup admin i got this error when i run log_badlogin script suse:/usr/local/dialup_admin/bin # perl -w log_badlogins /var/log/radius/radius.log /usr/local/dialup_admin/conf/admin.conf Name "main::force" used only once: possible typo at log_badlogins line 105. Use of uninitialized value in string eq at log_badlogins line 43, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 44, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 45, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 46, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 47, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 48, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 49, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 50, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 51, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 52, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 53, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 54, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 55, <CONF> line 43. Use of uninitialized value in string eq at log_badlogins line 43, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 44, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 45, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 46, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 47, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 48, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 49, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 50, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 51, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 52, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 53, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 54, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 55, <CONF> line 60. Use of uninitialized value in string eq at log_badlogins line 43, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 44, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 45, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 46, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 47, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 48, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 49, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 50, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 51, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 52, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 53, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 54, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 55, <CONF> line 65. Use of uninitialized value in string eq at log_badlogins line 43, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 44, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 45, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 46, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 47, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 48, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 49, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 50, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 51, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 52, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 53, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 54, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 55, <CONF> line 145. Use of uninitialized value in string eq at log_badlogins line 43, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 44, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 45, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 46, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 47, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 48, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 49, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 50, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 51, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 52, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 53, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 54, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 55, <CONF> line 147. Use of uninitialized value in string eq at log_badlogins line 43, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 44, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 45, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 46, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 47, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 48, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 49, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 50, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 51, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 52, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 53, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 54, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 55, <CONF> line 149. Use of uninitialized value in string eq at log_badlogins line 43, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 44, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 45, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 46, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 47, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 48, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 49, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 50, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 51, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 52, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 53, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 54, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 55, <CONF> line 211. Use of uninitialized value in string eq at log_badlogins line 43, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 44, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 45, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 46, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 47, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 48, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 49, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 50, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 51, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 52, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 53, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 54, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 55, <CONF> line 212. Use of uninitialized value in string eq at log_badlogins line 43, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 44, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 45, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 46, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 47, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 48, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 49, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 50, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 51, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 52, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 53, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 54, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 55, <CONF> line 261. Use of uninitialized value in string eq at log_badlogins line 43, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 44, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 45, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 46, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 47, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 48, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 49, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 50, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 51, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 52, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 53, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 54, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 55, <CONF> line 262. Use of uninitialized value in string eq at log_badlogins line 43, <CONF> line 292. Use of uninitialized value in string eq at log_badlogins line 44, <CONF> line 292. Use of uninitialized value in string eq at log_badlogins line 45, <CONF> line 292. Use of uninitialized value in string eq at log_badlogins line 46, <CONF> line 292. Use of uninitialized value in string eq at log_badlogins line 47, <CONF> line 292. Use of uninitialized value in string eq at log_badlogins line 48, <CONF> line 292. Use of uninitialized value in string eq at log_badlogins line 49, <CONF> line 292. Use of uninitialized value in string eq at log_badlogins line 50, <CONF> line 292. Use of uninitialized value in string eq at log_badlogins line 51, <CONF> line 292. Use of uninitialized value in string eq at log_badlogins line 52, <CONF> line 292. Use of uninitialized value in string eq at log_badlogins line 53, <CONF> line 292. Use of uninitialized value in string eq at log_badlogins line 54, <CONF> line 292. Use of uninitialized value in string eq at log_badlogins line 55, <CONF> line 292. Use of uninitialized value in unpack at log_badlogins line 82, <CLIENTS> line 27. Use of uninitialized value in concatenation (.) or string at log_badlogins line 83, <CLIENTS> line 27. Use of uninitialized value in concatenation (.) or string at log_badlogins line 83, <CLIENTS> line 27. Use of uninitialized value in concatenation (.) or string at log_badlogins line 83, <CLIENTS> line 27. Use of uninitialized value in concatenation (.) or string at log_badlogins line 83, <CLIENTS> line 27. Use of uninitialized value in unpack at log_badlogins line 82, <CLIENTS> line 101. Use of uninitialized value in concatenation (.) or string at log_badlogins line 83, <CLIENTS> line 101. Use of uninitialized value in concatenation (.) or string at log_badlogins line 83, <CLIENTS> line 101. Use of uninitialized value in concatenation (.) or string at log_badlogins line 83, <CLIENTS> line 101. Use of uninitialized value in concatenation (.) or string at log_badlogins line 83, <CLIENTS> line 101. Use of uninitialized value in string ne at log_badlogins line 106. $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Download prohibited? No problem! CHAT from any browser, without download.

1 0

Re: Freeradius-Users Digest, Vol 25, Issue 117
by t.drollinger＠i-motion.de 25 May '07

25 May '07

Ich bin am 25. Mai nicht im Haus und kann Ihre Nachricht erst am Dienstag den 29. Mai bearbeiten. In dringenden Fällen wenden Sie sich bitte an Herrn René Böhm (E-Mail: r.boehm(a)i-motion.de) Mit freundlichen Grüßen Tobias Drollinger

1 0

Cannot get EAP/TLS working
by prajakta choudhari 25 May '07

25 May '07

Hi all: My setup is a linksys router enabled with radius authentication and client connecting to it. I get the following messages and it just gets stuck on it. Can somebody help in understanding the problem. I am pasting it. Thank You Prajakta [root@localhost sbin]# ./radiusd -X -A \Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/home/praju/freeradius-1.1.3/scripts/gen/cert-srv.pem" tls: certificate_file = "/home/praju/freeradius-1.1.3/scripts/gen/cert-srv.pem" tls: CA_file = "/home/praju/freeradius-1.1.3/scripts/gen/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/radius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.6.15:2054, id=0, length=129 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000d01636572742d636c74 Message-Authenticator = 0xbc296283d7c2c9e175f632885f6daf64 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry cert-clt at line 96 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.6.15 port 2054 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6939bd070a48824264cfda1489dd8a39 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2054, id=0, length=214 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0x6939bd070a48824264cfda1489dd8a39 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100500d800000004616030100410100003d03014657213cba157c3cc8684804f2f50e4eb2a2b826c45db0e7db4af93d2ddf746200001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x1db59a11338973b8145b8cc59e4cce36 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry cert-clt at line 96 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 05f8], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 008c], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 192.168.6.15 port 2054 EAP-Message = 0x0102040a0dc0000006dd160301004a0200004603014656724e5658c1acd1dd20531f78b5edaa151a850c1659a42b7e7f7615b7cbbb206f8cc0e4ac8f19e18a7004ce143923d77c53e86b5f3e9b94f77cbd249c4f4efd00040016030105f80b0005f40005f10002923082028e308201f7a003020102020102300d06092a864886f70d0101050500307b310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340 EAP-Message = 0x636461632e696e301e170d3037303532313130323232365a170d3038303532303130323232365a308185310b300906035504061302494e311430120603550408130b6d61686172617368747261310d300b060355040713047075656e310d300b060355040a130443444143310d300b060355040b13044e4953473111300f06035504031308636572742d7372763120301e06092a864886f70d01090116117072616a616b74616340636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100ba96be1dae6471ce9089953b952d0baaa9535e3f64589ca05794e54a6989b54e5f9c414b0dc0dddcf8e4feb2adea6ddf86 EAP-Message = 0x5a98928047c0e820ce8e55723717a4e67841de9d724c3e554f8bea06cfbf66210633a0708a2c28006588c520488b3ae9319666bd8d691ac90ea7e6205024cac75f1a9db146d4cbc9e7e7585a5e76690203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100134f1f412d627f76a94946ceaaa42b36e5511ea5bb5a0b07c51c85189a61daf753aeb4c7316d0938f0c7773319344ad6c2ca2d14443d15a7e2c25849aac0b4ed1dcb2b299d0660d5bab0ecad14d656d751e536cce27050c77b1bc4302adbd100bc523313ce355a1227db12d22f26c21f71d70ea89907216a5a4a068f8a EAP-Message = 0x20983600035930820355308202bea003020102020900fd08e181edb41830300d06092a864886f70d0101050500307b310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e301e170d3037303532313130323130355a170d3039303532303130323130355a307b310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b0603 EAP-Message = 0x55040a130443444143310d300b060355040b13044e49 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x07aa3969910d4945cc7fc5dbae49ea7a Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2054, id=0, length=140 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0x07aa3969910d4945cc7fc5dbae49ea7a NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060d00 Message-Authenticator = 0x05d7c1ecdee567d780d5e08bc551fd9d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry cert-clt at line 96 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 192.168.6.15 port 2054 EAP-Message = 0x010302e70d80000006dd5347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100d4e249a959b945e0a701b23d1fcb5c72665cc9f37941b5c5e4f548db63a0f73fd7713456d14872bfaa793708153f26a8bdae729fc605d4d88bacf454e140215d6445b8e2a9f63c979dccefc27587ee04de044a465ddf6394297de61d6e4a4f01755fd2afab982e36dcc82b13fc3147b63c30de3d12309dbd8a9b180b6d390a8f0203010001a381e03081dd301d0603551d0e0416041488b0879e4157f3021edced4b EAP-Message = 0xda7beef0053f56713081ad0603551d230481a53081a2801488b0879e4157f3021edced4bda7beef0053f5671a17fa47d307b310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e820900fd08e181edb41830300c0603551d13040530030101ff300d06092a864886f70d0101050500038181007ca56158c183dd67b75efb7b5bf4de3a06886b378cd8e68345d0f4c6d4dfa08415a9cc1c EAP-Message = 0x7a6081551f38d4b1a5650cc7fbcd736ff064da2f408f6a060b688cb79551abafb6ad796d9b0ff935c69a9d7e96a3394e3c0e6cab05a17125d92c39753bd054724e827153d79b42fba5a503cf710835e99a1c4fbcd9467d902e6834fb160301008c0d000084020102007f007d307b310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf5fe1a53de2bf3ebbe4959a8f81c5198 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2054, id=0, length=1140 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0xf5fe1a53de2bf3ebbe4959a8f81c5198 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020303e80d80000003de16030103ae0b00029e00029b00029830820294308201fda003020102020101300d06092a864886f70d0101050500308181310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e301e170d3037303532333131343335375a170d3038303532323131343335375a308184310b300906035504061302494e311430120603550408130b4d6168617261 EAP-Message = 0x7368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e4953473111300f06035504031308636572742d636c743120301e06092a864886f70d01090116117072616a616b74616340636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100bca99f739541ff5508930cdac4b928611acf16bbc153a5fd10ddd735468d3f8a633566a1c059b807aacfbf5d112d1abfaa5e4834245f04cc818e20442306909c3f16b0b4ae404493281ed2509083a6465704eec6036e6566270dffea047e9207ac7681f2ca70164aa0a2a014d96a439112b3f7877cfa1297a306 EAP-Message = 0x262e3f6ced850203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010105050003818100b87aad1c3e9ccbc82a753b013bf5f4e76328950b473b8bc42f6826b19af18a4d9a2352498d613fc64155f828a3d94999c3903a305a55f46198b6ecc49b4c3f9b80c9da6af5e052da06fd47803b95d9d9c39adeed6d5a85d7d6aa2c3a284d58e99dc977eafa40a511f27938a4618262dc5f9816eefc1b9c4173f1094ec0011a1310000082008072c0fd0840915b216318c89bed05fd65aefc23ae96f4650a921fd74de49407ff214893640de85e358774d2898ece03aa8dacec05cec6c103c44fdf6967c7e713 EAP-Message = 0x96a825aa06c40d163b4e7a66b14fbd069d7ac2362b88e818298c0866bf5f572180d8c0891b5b17e238cdc9b32a0d9c9d7599ef3e8838f1c2a508919caba899e00f00008200806eb651194fae382d0d33e905d27b9fb88b3e9a2615801b101f90ddc3e6fe0d47eb739aa62baa271a65f8cefc938b09f115b14dd47862255f85072e00f8ad70d4f309c7b07962e6b73677ebae339574900be61f8dda1e04de4989d58f7f42bad3fb0e57452b2dc9fd1faf12385beafa83f4e3072aaf5e71335e6dda7131b07c6614030100010116030100209eb4b1b7820184e9b7d6d01f77ccdfb90a0b3d324aea40ab5496e430a707cc7a Message-Authenticator = 0xd088bb2c45c82c971315caa4f9a8fea7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry cert-clt at line 96 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 02a2], Certificate --> verify error:num=20:unable to get local issuer certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 0 to 192.168.6.15 port 2054 EAP-Message = 0x010400110d800000000715030100020230 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1d9ff9291ff6d9f906a5ce9b4358b893 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2054, id=0, length=140 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0x1d9ff9291ff6d9f906a5ce9b4358b893 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400060d00 Message-Authenticator = 0x7743b76f7f07ee00d9b9a3c812ad2f24 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry cert-clt at line 96 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack alert eaptls_verify returned 4 eaptls_process returned 4 rlm_eap: Handler failed in EAP/tls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 4 modcall: leaving group authenticate (returns invalid) for request 4 auth: Failed to validate the user. Delaying request 4 for 1 seconds Finished request 4 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.6.15 port 2054 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 4 ID 0 with timestamp 4656724e Nothing to do. Sleeping until we see a request. Download prohibited? No problem! To chat from any browser without download, Click Here: http://in.messenger.yahoo.com/webmessengerpromo.php

1 0

Freeradius and MS ActiveDirectory
by Ouahiba MACHANI 25 May '07

25 May '07

Hi, Is there any plug-in for Freeradius, that allow to interface with an Active Directory and authenticate users?? if not, is it possible to developpe such a plug-in ? and what are the requiremenet? could this plug-in be a PAM module ? thanks.

3 2

peap in users file?
by Matt Ashfield 24 May '07

24 May '07

Hi I'm trying to do PEAP authentication against a user listed in my users file instead of an AD or LDAP. I'm just doing this initially for some proof of concept stuff. I'm wondering how I need to set up the user in the users file? Currently my entry looks like: "testuser" User-Password == "abc.123", Tunnel-Private-Group-Id=staff But when I run in debug mode I'm getting the following, which indicates to me perhaps I'm not setting the password correctly: modcall: entering group MS-CHAP for request 7 Thu May 24 15:56:47 2007 : Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 7 Thu May 24 15:56:47 2007 : Debug: rlm_mschap: No User-Password configured. Cannot create LM-Password. Thu May 24 15:56:47 2007 : Debug: rlm_mschap: No User-Password configured. Cannot create NT-Password. Thu May 24 15:56:47 2007 : Debug: rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password Thu May 24 15:56:47 2007 : Debug: rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. Thu May 24 15:56:47 2007 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Thu May 24 15:56:47 2007 : Debug: modsingle[authenticate]: returned from mschap (rlm_mschap) for request 7 Thu May 24 15:56:47 2007 : Debug: modcall[authenticate]: module "mschap" returns reject for request 7 Thu May 24 15:56:47 2007 : Debug: modcall: leaving group MS-CHAP (returns reject) for request 7 Thu May 24 15:56:47 2007 : Debug: rlm_eap: Freeing handler Thu May 24 15:56:47 2007 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 7 Thu May 24 15:56:47 2007 : Debug: modcall[authenticate]: module "eap" returns reject for request 7 Thu May 24 15:56:47 2007 : Debug: modcall: leaving group authenticate (returns reject) for request 7 Thu May 24 15:56:47 2007 : Debug: auth: Failed to validate the user. Any advice is appreciated. Matt mda(a)unb.ca

2 1