- Freeradius-Users - lists.freeradius.org

Re: free radius 1.1.6 -eap-tls authentication
by anoop_c＠sifycorp.com 11 May '07

11 May '07

>>>>> The FAQ, README, INSTALL, etc. all say to run the server in debugging mode to see what\'s going on. >>>>> Dear all I run the radius server in debug mode and the output is as follows. I didn;t get any clue for the problem. [root@anoop raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = \"/usr/local\" main: localstatedir = \"/usr/local/var\" main: logdir = \"/usr/local/var/log/radius\" main: libdir = \"/usr/local/lib\" main: radacctdir = \"/usr/local/var/log/radius/radacct\" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = \"/usr/local/var/log/radius/radius.log\" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = \"/usr/local/var/run/radiusd/radiusd.pid\" main: user = \"(null)\" main: group = \"(null)\" main: usercollide = no main: lower_user = \"no\" main: lower_pass = \"no\" main: nospace_user = \"no\" main: nospace_pass = \"no\" main: checkrad = \"/usr/local/sbin/checkrad\" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = \"(null)\" mschap: ntlm_auth = \"(null)\" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = \"tls\" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = \"(null)\" tls: pem_file_type = yes tls: private_key_file = \"/etc/raddb/certs/07xwifi.pem\" tls: certificate_file = \"/etc/raddb/certs/07xwifi.pem\" tls: CA_file = \"/etc/raddb/certs/root.pem\" tls: private_key_password = \"password\" tls: dh_file = \"/etc/raddb/certs/dh\" tls: random_file = \"/etc/raddb/certs/random\" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = \"(null)\" tls: cipher_list = \"(null)\" tls: check_cert_issuer = \"(null)\" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = \"tls\" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = \"/etc/raddb/huntgroups\" preprocess: hints = \"/etc/raddb/hints\" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = \"/etc/raddb/users\" files: acctusersfile = \"/etc/raddb/acct_users\" files: preproxy_usersfile = \"/etc/raddb/preproxy_users\" files: compat = \"no\" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = \"User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port\" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = \"suffix\" realm: delimiter = \"@\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = \"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d\" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = \"(null)\" unix: shadow = \"(null)\" unix: group = \"(null)\" unix: radwtmp = \"/usr/local/var/log/radius/radwtmp\" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = \"/usr/local/var/log/radius/radutmp\" radutmp: username = \"%{User-Name}\" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.50:1031, id=0, length=197 Message-Authenticator = 0xc7b1d7b5ec22e8aeb3d3c2a37c3b3a57 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x0200000c01616e6f6f703037 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module \"preprocess\" returns ok for request 0 modcall[authorize]: module \"mschap\" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module \"files\" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module \"eap\" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.0.50 port 1031 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x002d8b408269eb13be9fe51557152e71 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1031, id=2, length=197 Message-Authenticator = 0xd4ad8d1460fc72220a6f4977f5267e73 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x0202000c01616e6f6f703037 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module \"preprocess\" returns ok for request 1 modcall[authorize]: module \"mschap\" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 1 users: Matched entry DEFAULT at line 153 modcall[authorize]: module \"files\" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module \"eap\" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 2 to 192.168.0.50 port 1031 EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x317c46c3f86f28005a91c1f1980ab3ab Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1031, id=3, length=283 Message-Authenticator = 0x701e18b26592377cb69381a32d9b7549 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x317c46c3f86f28005a91c1f1980ab3ab Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020300500d800000004616030100410100003d0301464433995ca90757d734f0075c780c8f33eb9fdc362a96a9a3eee9d37cb4c71700001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module \"preprocess\" returns ok for request 2 modcall[authorize]: module \"mschap\" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 2 users: Matched entry DEFAULT at line 153 modcall[authorize]: module \"files\" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04bf], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004c], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 3 to 192.168.0.50 port 1031 EAP-Message = 0x0104040a0dc000000564160301004a0200004603014644339a2a93e1117f8dc62c68b0c2051f4cb05aa4ee8bf4060d2e103cad32312021dad64d5e809b5721688753c3fa8c1a57936fe7e37a42293229abde363dc93100040016030104bf0b0004bb0004b800022c3082022830820191a003020102020101300d06092a864886f70d0101040500303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603550403130730377877696669301e170d3037303131323135333533305a170d3038303131323135333533305a3060310b300906035504061302494e310b3009060355040813 EAP-Message = 0x02544e310d300b060355040a1304536966793110300e06035504031307303778776966693123302106092a864886f70d0109011614616e6f6f705f634073696679636f72702e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d2bbbe35bc8a47709632284aff484695385e69c3522f63da46834f9586a420bda380889693fa77fedd9ed4290e6f9ff4436721775294fc65a38fea098f18975b34b5063de27220e18a07d433cbb6e19aeb3f84b012f7c20071dd280457a932634bbe50f438cc2ee6f4d65fa395a10bdecc4bf9087979ec45af000940e186ed290203010001a317301530130603551d25040c300a06082b EAP-Message = 0x06010505070301300d06092a864886f70d0101040500038181000afea7f2a8a9cffe60baa8f779353c523457f8237faeff81ba5f2c22664c70b6b2fb58c8967ca4a4c847b80e1d5a6cc4558ffa1d161614f374d8b5efd565aa66045b192b3ac3da82c81c4a99fc10cfe473f9ac258ef99b16cbd335004677694a05addae48c6a9dcdb26b86ddb56c635266c33c7de7586543532692e5220d30b100028630820282308201eba003020102020100300d06092a864886f70d0101040500303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603550403130730377877696669301e170d EAP-Message = 0x3037303131323135333435305a170d3038303131323135333435305a303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e060355040313073037787769666930819f300d06092a864886f70d010101050003818d0030818902818100ba8b07a479bb6ce9adf2d8bc6ac9cf214506dfc039cb10c3b4d27d1bbc082caff0bb77424819728977f04b32e231a3c4755a65823b366f1a604f15ce6c499883ab7d2757a5a2c07a11e75b7a00d6c55a8fb7443b202a25a3cdaad39579b2d8f4c09c974056f0c8666fff754d574836fcaf105200fcd5df5158e2b387310c4ed90203010001a381 EAP-Message = 0x95308192301d0603551d0e041604149eda6f69065423 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x19754bedc30572111832212fcc84191e Finished request 2 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1031, id=4, length=209 Message-Authenticator = 0xcb2030e901c7f1526ddac51af57e4dba Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x19754bedc30572111832212fcc84191e Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020400060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module \"preprocess\" returns ok for request 3 modcall[authorize]: module \"mschap\" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 3 users: Matched entry DEFAULT at line 153 modcall[authorize]: module \"files\" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 4 to 192.168.0.50 port 1031 EAP-Message = 0x0105016e0d80000005647ec1c9e4d07a608e0e6dcd730f30630603551d23045c305a80149eda6f690654237ec1c9e4d07a608e0e6dcd730fa13fa43d303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603550403130730377877696669820100300c0603551d13040530030101ff300d06092a864886f70d0101040500038181006b514f008b6a77757fc73ddbe9d54e4ea925a1ab9ce80ad7895d6d19661d8b8558d0e359876aac023aa52d4273e00407b9b588b30dbc35c5911bc89d2d99677e0ec8dea17fece35d0b4dfab8775ba73eaeb0a0998bcdf1437cff0a1031f6a5b1 EAP-Message = 0x7e8bcdc01e2e964cb256f49d947eea2cfd42989aef397fa438be294fa3dc7a3d160301004c0d000044020102003f003d303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e06035504031307303778776966690e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdc59784c151c5f91316f8ad08591688c Finished request 3 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1031, id=5, length=209 Message-Authenticator = 0x25ded394258af7d7d4a0822acf32fbf7 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0xdc59784c151c5f91316f8ad08591688c Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020500060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module \"preprocess\" returns ok for request 4 modcall[authorize]: module \"mschap\" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 4 users: Matched entry DEFAULT at line 153 modcall[authorize]: module \"files\" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 5 to 192.168.0.50 port 1031 EAP-Message = 0x0106000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfc4dda99d8ba977e9954c938dac93595 Finished request 4 Going to the next request Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 46443398 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 2 with timestamp 4644339a Cleaning up request 2 ID 3 with timestamp 4644339a Cleaning up request 3 ID 4 with timestamp 4644339a Cleaning up request 4 ID 5 with timestamp 4644339a Nothing to do. Sleeping until we see a request. Anoop

4 3

1.1.6: PAP and MySQL-stored NT-Password don't work
by Stefan Winter 11 May '07

11 May '07

Hi, I try to get rid of cleartext passwords stored in a MySQL db, and replace them by NT hashes. I set up a test environment and first tried with an entry in users: swinter NT-Password := "...", Auth-Type := Accept which worked okay. Storing the same password in MySQL did NOT work, with a quite spurious error, see below: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:52635, id=148, length=59 User-Name = "swinter" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 1234 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "swinter", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 radius_xlat: 'swinter' rlm_sql (sql): sql_set_user escaped user --> 'swinter' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'swinter' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'swinter' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'swinter' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'swinter' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 rlm_pap: Normalizing NT-Password from hex encoding modcall[authorize]: module "pap" returns updated for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 1 rlm_pap: login attempt with password test rlm_pap: Using NT encryption. radius_xlat: Running registered xlat function of module mschap for string 'NT-Hash test' rlm_mschap: Unknown expansion string "NT-Hash test" radius_xlat: '' rlm_pap: mschap xlat failed rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 1 modcall: leaving group PAP (returns reject) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Especially the lines radius_xlat: Running registered xlat function of module mschap for string 'NT-Hash test' rlm_mschap: Unknown expansion string "NT-Hash test" radius_xlat: '' rlm_pap: mschap xlat failed appear suspicious ("test" is the password"). Maybe there's some xlat escaping wrong? The configuration in use is almost as shipped, only added sql config. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

4 9

POD not work with radclient
by satish patel 11 May '07

11 May '07

Dear guys I am comming with new problem now i have enable POD packet of disconnet on cisco router and now i m trying to disconnect user with radclient command but i got this output [root@radius ~]# cat packet.txt Acct-Session-Id=0000C476 User-Name=mlpm607 X-Ascend-Session-Svr-Key=396830D9 NAS-IP-Address=192.168.1.1 [root@radius ~]# cat packet.txt | radclient -x 192.168.1.1:1700 disconnect tulip786 Sending Disconnect-Request of id 115 to 192.168.1.1 port 1700 Acct-Session-Id = "0000C476" User-Name = "mlpm607" X-Ascend-Session-Svr-Key = "396830D9" NAS-IP-Address = 192.168.1.1 rad_recv: Disconnect-NAK packet from host 192.168.1.1:1700, id=115, length=41 Reply-Message = "No Matching Session" why user not disconnect from NAS but user still login on NAS ????? $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

4 4

Center for Internet Security - Call for Participation for FreeRADIUS Benchmark
by Dave Shackleford 11 May '07

11 May '07

***Thanks to moderators for allowing this post - it's for a good cause!*** Hi folks, I'd like to introduce myself. My name is Dave Shackleford, and I represent the Center for Internet Security. Some of you may know of us, and some of you may not. CIS is a non-profit that coordinates teams of volunteers who collaborate to create benchmark guides for securing systems. Many of you may have used some of the CIS tools to score your systems against the benchmarks at one time or another, and thousands of people download the benchmarks and scoring tools every month. We are actively seeking IT and security professionals to participate in the benchmark development process. We are also looking for anyone experienced in Java and/or XML programming to assist with our newest scoring tool development (contact me off-list). We are about to begin the consensus process for a FreeRADIUS security benchmark. Time commitments are minimal, all you need to do is go and sign up on the mailing list and provide some input to the group on the benchmark draft when it's released. We always have a team leader who puts together the initial draft, pulling from a variety of sources; this is then sent to the mailing list for review and comment. After a consensus is reached, we publish it. We also list participants' names on our "Honor Roll" page at http://www.cisecurity.org/honor_roll.html. Our benchmarks are gaining a lot of attention right now. We are mentioned specifically in the PCI DSS (section 2.2), we are working with NIST to develop tools and content, and a lot more. If you would like to participate, please visit the site and sign up. We won't send you any unsolicited email, just the list postings for benchmark development. Also, please feel free to sign up for anything not mentioned below, we will be working on all of the benchmarks over the course of the next year or so. There are also lots of opportunities to earn CPE credits for participation. If you have any questions, please reply to me off-list (dshackleford at cisecurity dot org). Thanks for your help! -Dave 1. FreeRADIUS Benchmark (OpenLDAP will also be discussed here) MAILING LIST: http://lists.cisecurity.org/mailman/listinfo/access-controls Also the Virtualization Benchmark (may interest some) MAILING LIST: http://lists.cisecurity.org/mailman/listinfo/vm-security-benchmark Note: This list will benefit from varied backgrounds and skill sets.

2 1

Re: free radius 1.1.6 -eap-tls authentication
by anoop_c＠sifycorp.com 11 May '07

11 May '07

Dear all Thanks for the information.I am not able to do successful authentication still. These are my configurations I have copied my root.pem and server.pem to /etc/raddb/certs directory 1.My eap.conf file is like this eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no ## EAP-TLS tls { private_key_password = password private_key_file = /etc/raddb/certs/07xwifi.pem certificate_file = /etc/raddb/certs/07xwifi.pem CA_file = /etc/raddb/certs/root.pem dh_file = /etc/raddb/certs/dh random_file = /etc/raddb/certs/random fragment_size = 1024 include_length = yes } peap { default_eap_type = tls } } 2 radiusd.conf (only authorize and authentication section) nstantiate { } authorize { preprocess mschap eap files } # Authentication. authenticate { Auth-Type MS-CHAP { mschap } eap } 3 I havn;t modified users file since its eap-tls authentication Giude me any modification required further for eap-tls certificate based authentication. Regards Anoop > That the server is working as expected. > > Alan DeKok. > TLS_accept: Need to read more data: SSLv3 read client certificate A > In SSL Handshake Phase > In SSL Accept mode > eaptls_process returned 13 > > > eaptls_verify returned 1 > eaptls_process returned 13 > > What is these debug messages indicate... > > Anoop

2 1

free radius 1.1.6 -eap-tls authentication
by anoop_c＠sifycorp.com 11 May '07

11 May '07

Hi list While doing eap-tls authentication i am getting the following debug message.Anybody please clarify. TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 eaptls_verify returned 1 eaptls_process returned 13 What is these debug messages indicate... Anoop

2 1

LDAP/RACF authentication issue
by Marc Giuliani 10 May '07

10 May '07

Hello, I am VERY new to radius and need some guidance...I have read the configuration instructions and have searched the freeradius mail archives to no avail... We are trying to set up Oracle to use radius/ldap and racf for the authentication. Oracle (10g on Solaris) --> Radius (on Solaris) --> LDAP (on Z/os) --> RACF (authenticate and pass back to Oracle ok or not ok to connect). Radius is installed and I have followed the instructions provided by IBM to set up RACF/LDAP and Radius in the document http://www.redbooks.ibm.com/abstracts/sg246482.html chapter 9. However when I run radtest I cannot get a successful return. Also a log file is not being generated on the logdir and I have confirmed by adding a foo file manually that the id does have permission to write to the log directory....I have tried many variations of the radius.conf....Any ideas or guidance would be very appreciated. Here is the output when running radiusd -X: /opt/local/etc/raddb>radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/local/etc/raddb/clients.conf Config: including file: /opt/local/etc/raddb/snmp.conf Config: including file: /opt/local/etc/raddb/eap.conf main: prefix = "/opt/local" main: localstatedir = "/opt/local/var" main: logdir = "/opt/local/var/log/radius" main: libdir = "/opt/local/lib" main: radacctdir = "/opt/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/opt/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/opt/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/opt/local/etc/raddb/huntgroups" preprocess: hints = "/opt/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/opt/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = yes realm: ignore_null = yes Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/opt/local/etc/raddb/users" files: acctusersfile = "/opt/local/etc/raddb/acct_users" files: preproxy_usersfile = "/opt/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/opt/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/opt/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.71.175.19:36661, id=228, length=59 User-Name = "NBCTST1" User-Password = "testpwd" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/opt/local/var/log/radius/radacct/10.71.175.19/auth-detail-20070510' rlm_detail: /opt/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /opt/local/var/log/radius/radacct/10.71.175.19/auth-detail-20070510 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "NBCTST1", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect: [NBCTST1/testpwd] (from client denord01 port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 228 to 10.71.175.19 port 36661 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 228 with timestamp 46433e16 Nothing to do. Sleeping until we see a request.

1 0

Problems with PEAP
by pippo metallaro 10 May '07

10 May '07

hi, i use freeradius with eap -peap and MySQL...but the freeradius don't send an access-accept at the end of authentication ...the server send an access-challenge,i don't know what's the problem... i'use a hp 2650 switch client,and a win xp supplicant, this is the the result of the debug mode.. Wed May 9 17:51:58 2007 : Info: Starting - reading configuration files ... Wed May 9 17:51:58 2007 : Debug: reread_config: reading radiusd.conf Wed May 9 17:51:58 2007 : Debug: Config: including file: /etc/freeradius/proxy.conf Wed May 9 17:51:58 2007 : Debug: Config: including file: /etc/freeradius/clients.conf Wed May 9 17:51:58 2007 : Debug: Config: including file: /etc/freeradius/snmp.conf Wed May 9 17:51:58 2007 : Debug: Config: including file: /etc/freeradius/eap.conf Wed May 9 17:51:58 2007 : Debug: Config: including file: /etc/freeradius/sql.conf Wed May 9 17:51:58 2007 : Debug: main: prefix = "/usr" Wed May 9 17:51:58 2007 : Debug: main: localstatedir = "/var" Wed May 9 17:51:58 2007 : Debug: main: logdir = "/var/log/freeradius" Wed May 9 17:51:58 2007 : Debug: main: libdir = "/usr/lib/freeradius" Wed May 9 17:51:58 2007 : Debug: main: radacctdir = "/var/log/freeradius/radacct" Wed May 9 17:51:58 2007 : Debug: main: hostname_lookups = no Wed May 9 17:51:58 2007 : Debug: main: max_request_time = 30 Wed May 9 17:51:58 2007 : Debug: main: cleanup_delay = 5 Wed May 9 17:51:58 2007 : Debug: main: max_requests = 1024 Wed May 9 17:51:58 2007 : Debug: main: delete_blocked_requests = 0 Wed May 9 17:51:58 2007 : Debug: main: port = 0 Wed May 9 17:51:58 2007 : Debug: main: allow_core_dumps = no Wed May 9 17:51:58 2007 : Debug: main: log_stripped_names = no Wed May 9 17:51:58 2007 : Debug: main: log_file = "/var/log/freeradius/radius.log" Wed May 9 17:51:58 2007 : Debug: main: log_auth = no Wed May 9 17:51:58 2007 : Debug: main: log_auth_badpass = no Wed May 9 17:51:58 2007 : Debug: main: log_auth_goodpass = no Wed May 9 17:51:58 2007 : Debug: main: pidfile = "/var/run/freeradius/freeradius.pid" Wed May 9 17:51:58 2007 : Debug: main: bind_address = 192.168.0.1 IP address [192.168.0.1] Wed May 9 17:51:58 2007 : Debug: main: user = "freerad" Wed May 9 17:51:58 2007 : Debug: main: group = "freerad" Wed May 9 17:51:58 2007 : Debug: main: usercollide = no Wed May 9 17:51:58 2007 : Debug: main: lower_user = "no" Wed May 9 17:51:58 2007 : Debug: main: lower_pass = "no" Wed May 9 17:51:58 2007 : Debug: main: nospace_user = "no" Wed May 9 17:51:58 2007 : Debug: main: nospace_pass = "no" Wed May 9 17:51:58 2007 : Debug: main: checkrad = "/usr/sbin/checkrad" Wed May 9 17:51:58 2007 : Debug: main: proxy_requests = yes Wed May 9 17:51:58 2007 : Debug: proxy: retry_delay = 5 Wed May 9 17:51:58 2007 : Debug: proxy: retry_count = 3 Wed May 9 17:51:58 2007 : Debug: proxy: synchronous = no Wed May 9 17:51:58 2007 : Debug: proxy: default_fallback = yes Wed May 9 17:51:58 2007 : Debug: proxy: dead_time = 120 Wed May 9 17:51:58 2007 : Debug: proxy: post_proxy_authorize = no Wed May 9 17:51:58 2007 : Debug: proxy: wake_all_if_all_dead = no Wed May 9 17:51:58 2007 : Debug: security: max_attributes = 200 Wed May 9 17:51:58 2007 : Debug: security: reject_delay = 1 Wed May 9 17:51:58 2007 : Debug: security: status_server = no Wed May 9 17:51:58 2007 : Debug: main: debug_level = 0 Wed May 9 17:51:58 2007 : Debug: read_config_files: reading dictionary Wed May 9 17:51:58 2007 : Debug: read_config_files: reading naslist Wed May 9 17:51:58 2007 : Info: Using deprecated naslist file. Support for this will go away soon. Wed May 9 17:51:58 2007 : Debug: read_config_files: reading clients Wed May 9 17:51:58 2007 : Debug: read_config_files: reading realms Wed May 9 17:51:58 2007 : Debug: radiusd: entering modules setup Wed May 9 17:51:58 2007 : Debug: Module: Library search path is /usr/lib/freeradius Wed May 9 17:51:58 2007 : Debug: Module: Loaded exec Wed May 9 17:51:58 2007 : Debug: exec: wait = yes Wed May 9 17:51:58 2007 : Debug: exec: program = "(null)" Wed May 9 17:51:58 2007 : Debug: exec: input_pairs = "request" Wed May 9 17:51:58 2007 : Debug: exec: output_pairs = "(null)" Wed May 9 17:51:58 2007 : Debug: exec: packet_type = "(null)" Wed May 9 17:51:58 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed May 9 17:51:58 2007 : Debug: Module: Instantiated exec (exec) Wed May 9 17:51:58 2007 : Debug: Module: Loaded expr Wed May 9 17:51:58 2007 : Debug: Module: Instantiated expr (expr) Wed May 9 17:51:58 2007 : Debug: Module: Loaded PAP Wed May 9 17:51:58 2007 : Debug: pap: encryption_scheme = "crypt" Wed May 9 17:51:58 2007 : Debug: Module: Instantiated pap (pap) Wed May 9 17:51:58 2007 : Debug: Module: Loaded CHAP Wed May 9 17:51:58 2007 : Debug: Module: Instantiated chap (chap) Wed May 9 17:51:58 2007 : Debug: Module: Loaded MS-CHAP Wed May 9 17:51:58 2007 : Debug: mschap: use_mppe = yes Wed May 9 17:51:58 2007 : Debug: mschap: require_encryption = yes Wed May 9 17:51:58 2007 : Debug: mschap: require_strong = yes Wed May 9 17:51:58 2007 : Debug: mschap: with_ntdomain_hack = no Wed May 9 17:51:58 2007 : Debug: mschap: passwd = "(null)" Wed May 9 17:51:58 2007 : Debug: mschap: ntlm_auth = "(null)" Wed May 9 17:51:58 2007 : Debug: Module: Instantiated mschap (mschap) Wed May 9 17:51:58 2007 : Debug: Module: Loaded eap Wed May 9 17:51:58 2007 : Debug: eap: default_eap_type = "peap" Wed May 9 17:51:58 2007 : Debug: eap: timer_expire = 60 Wed May 9 17:51:58 2007 : Debug: eap: ignore_unknown_eap_types = no Wed May 9 17:51:58 2007 : Debug: eap: cisco_accounting_username_bug = no Wed May 9 17:51:58 2007 : Debug: rlm_eap: Loaded and initialized type md5 Wed May 9 17:51:58 2007 : Debug: rlm_eap: Loaded and initialized type leap Wed May 9 17:51:58 2007 : Debug: tls: rsa_key_exchange = no Wed May 9 17:51:58 2007 : Debug: tls: dh_key_exchange = yes Wed May 9 17:51:58 2007 : Debug: tls: rsa_key_length = 512 Wed May 9 17:51:58 2007 : Debug: tls: dh_key_length = 512 Wed May 9 17:51:58 2007 : Debug: tls: verify_depth = 0 Wed May 9 17:51:58 2007 : Debug: tls: CA_path = "(null)" Wed May 9 17:51:58 2007 : Debug: tls: pem_file_type = yes Wed May 9 17:51:58 2007 : Debug: tls: private_key_file = "/etc/freeradius/certs/cert-srv.pem" Wed May 9 17:51:58 2007 : Debug: tls: certificate_file = "/etc/freeradius/certs/cert-srv.pem" Wed May 9 17:51:58 2007 : Debug: tls: CA_file = "/etc/freeradius/certs/demoCA/cacert.pem" Wed May 9 17:51:58 2007 : Debug: tls: private_key_password = "whatever" Wed May 9 17:51:58 2007 : Debug: tls: dh_file = "/etc/freeradius/certs/dh" Wed May 9 17:51:58 2007 : Debug: tls: random_file = "/etc/freeradius/certs/random" Wed May 9 17:51:58 2007 : Debug: tls: fragment_size = 1024 Wed May 9 17:51:58 2007 : Debug: tls: include_length = yes Wed May 9 17:51:58 2007 : Debug: tls: check_crl = no Wed May 9 17:51:58 2007 : Debug: tls: check_cert_cn = "(null)" Wed May 9 17:51:58 2007 : Debug: tls: cipher_list = "(null)" Wed May 9 17:51:58 2007 : Debug: tls: check_cert_issuer = "(null)" Wed May 9 17:51:58 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed May 9 17:51:58 2007 : Debug: rlm_eap: Loaded and initialized type tls Wed May 9 17:51:58 2007 : Debug: peap: default_eap_type = "mschapv2" Wed May 9 17:51:58 2007 : Debug: peap: copy_request_to_tunnel = no Wed May 9 17:51:58 2007 : Debug: peap: use_tunneled_reply = yes Wed May 9 17:51:58 2007 : Debug: peap: proxy_tunneled_request_as_eap = yes Wed May 9 17:51:58 2007 : Debug: rlm_eap: Loaded and initialized type peap Wed May 9 17:51:58 2007 : Debug: mschapv2: with_ntdomain_hack = no Wed May 9 17:51:58 2007 : Debug: rlm_eap: Loaded and initialized type mschapv2 Wed May 9 17:51:58 2007 : Debug: Module: Instantiated eap (eap) Wed May 9 17:51:58 2007 : Debug: Module: Loaded preprocess Wed May 9 17:51:58 2007 : Debug: preprocess: huntgroups = "/etc/freeradius/huntgroups" Wed May 9 17:51:58 2007 : Debug: preprocess: hints = "/etc/freeradius/hints" Wed May 9 17:51:58 2007 : Debug: preprocess: with_ascend_hack = no Wed May 9 17:51:58 2007 : Debug: preprocess: ascend_channels_per_line = 23 Wed May 9 17:51:58 2007 : Debug: preprocess: with_ntdomain_hack = no Wed May 9 17:51:58 2007 : Debug: preprocess: with_specialix_jetstream_hack = no Wed May 9 17:51:58 2007 : Debug: preprocess: with_cisco_vsa_hack = no Wed May 9 17:51:58 2007 : Debug: preprocess: with_alvarion_vsa_hack = no Wed May 9 17:51:58 2007 : Debug: Module: Instantiated preprocess (preprocess) Wed May 9 17:51:58 2007 : Debug: Module: Loaded realm Wed May 9 17:51:58 2007 : Debug: realm: format = "suffix" Wed May 9 17:51:58 2007 : Debug: realm: delimiter = "@" Wed May 9 17:51:58 2007 : Debug: realm: ignore_default = no Wed May 9 17:51:58 2007 : Debug: realm: ignore_null = no Wed May 9 17:51:58 2007 : Debug: Module: Instantiated realm (suffix) Wed May 9 17:51:58 2007 : Debug: Module: Loaded SQL Wed May 9 17:51:58 2007 : Debug: sql: driver = "rlm_sql_mysql" Wed May 9 17:51:58 2007 : Debug: sql: server = "localhost" Wed May 9 17:51:58 2007 : Debug: sql: port = "" Wed May 9 17:51:58 2007 : Debug: sql: login = "radius" Wed May 9 17:51:58 2007 : Debug: sql: password = "cisonline" Wed May 9 17:51:58 2007 : Debug: sql: radius_db = "radius" Wed May 9 17:51:58 2007 : Debug: sql: nas_table = "nas" Wed May 9 17:51:58 2007 : Debug: sql: sqltrace = no Wed May 9 17:51:58 2007 : Debug: sql: sqltracefile = "/var/log/freeradius/sqltrace.sql" Wed May 9 17:51:58 2007 : Debug: sql: readclients = no Wed May 9 17:51:58 2007 : Debug: sql: deletestalesessions = yes Wed May 9 17:51:58 2007 : Debug: sql: num_sql_socks = 5 Wed May 9 17:51:58 2007 : Debug: sql: sql_user_name = "%{User-Name}" Wed May 9 17:51:58 2007 : Debug: sql: default_user_profile = "" Wed May 9 17:51:58 2007 : Debug: sql: query_on_not_found = no Wed May 9 17:51:58 2007 : Debug: sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" Wed May 9 17:51:58 2007 : Debug: sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" Wed May 9 17:51:58 2007 : Debug: sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" Wed May 9 17:51:58 2007 : Debug: sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" Wed May 9 17:51:58 2007 : Debug: sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" Wed May 9 17:51:58 2007 : Debug: sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" Wed May 9 17:51:58 2007 : Debug: sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" Wed May 9 17:51:58 2007 : Debug: sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" Wed May 9 17:51:58 2007 : Debug: sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" Wed May 9 17:51:58 2007 : Debug: sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" Wed May 9 17:51:58 2007 : Debug: sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" Wed May 9 17:51:58 2007 : Debug: sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" Wed May 9 17:51:58 2007 : Debug: sql: connect_failure_retry_delay = 60 Wed May 9 17:51:58 2007 : Debug: sql: simul_count_query = "" Wed May 9 17:51:58 2007 : Debug: sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" Wed May 9 17:51:58 2007 : Debug: sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" Wed May 9 17:51:58 2007 : Debug: sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Wed May 9 17:51:58 2007 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed May 9 17:51:58 2007 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): starting 0 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Wed May 9 17:51:58 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): Connected new DB handle, #0 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): starting 1 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Wed May 9 17:51:58 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): Connected new DB handle, #1 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): starting 2 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Wed May 9 17:51:58 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): Connected new DB handle, #2 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): starting 3 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Wed May 9 17:51:58 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): Connected new DB handle, #3 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): starting 4 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Wed May 9 17:51:58 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed May 9 17:51:58 2007 : Debug: rlm_sql (sql): Connected new DB handle, #4 Wed May 9 17:51:58 2007 : Debug: Module: Instantiated sql (sql) Wed May 9 17:51:58 2007 : Debug: Module: Loaded Acct-Unique-Session-Id Wed May 9 17:51:58 2007 : Debug: acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Wed May 9 17:51:58 2007 : Debug: Module: Instantiated acct_unique (acct_unique) Wed May 9 17:51:58 2007 : Debug: Module: Loaded detail Wed May 9 17:51:58 2007 : Debug: detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Wed May 9 17:51:58 2007 : Debug: detail: detailperm = 384 Wed May 9 17:51:58 2007 : Debug: detail: dirperm = 493 Wed May 9 17:51:58 2007 : Debug: detail: locking = no Wed May 9 17:51:58 2007 : Debug: Module: Instantiated detail (detail) Wed May 9 17:51:58 2007 : Debug: Module: Loaded System Wed May 9 17:51:58 2007 : Debug: unix: cache = no Wed May 9 17:51:58 2007 : Debug: unix: passwd = "(null)" Wed May 9 17:51:58 2007 : Debug: unix: shadow = "/etc/shadow" Wed May 9 17:51:58 2007 : Debug: unix: group = "(null)" Wed May 9 17:51:58 2007 : Debug: unix: radwtmp = "/var/log/freeradius/radwtmp" Wed May 9 17:51:58 2007 : Debug: unix: usegroup = no Wed May 9 17:51:58 2007 : Debug: unix: cache_reload = 600 Wed May 9 17:51:58 2007 : Debug: Module: Instantiated unix (unix) Wed May 9 17:51:58 2007 : Debug: Module: Loaded radutmp Wed May 9 17:51:58 2007 : Debug: radutmp: filename = "/var/log/freeradius/radutmp" Wed May 9 17:51:58 2007 : Debug: radutmp: username = "%{User-Name}" Wed May 9 17:51:58 2007 : Debug: radutmp: case_sensitive = yes Wed May 9 17:51:58 2007 : Debug: radutmp: check_with_nas = yes Wed May 9 17:51:58 2007 : Debug: radutmp: perm = 384 Wed May 9 17:51:58 2007 : Debug: radutmp: callerid = yes Wed May 9 17:51:58 2007 : Debug: Module: Instantiated radutmp (radutmp) Wed May 9 17:51:58 2007 : Debug: Listening on authentication 192.168.0.1:1812 Wed May 9 17:51:58 2007 : Debug: Listening on accounting 192.168.0.1:1813 Wed May 9 17:51:58 2007 : Info: Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.254:1039, id=71, length=201 Framed-MTU = 1480 NAS-IP-Address = 172.17.1.10 NAS-Identifier = "CIS2650" User-Name = "david" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 39 NAS-Port-Type = Ethernet NAS-Port-Id = "39" Called-Station-Id = "00-19-bb-6a-2d-80" Calling-Station-Id = "00-11-25-d6-ab-1a" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3" EAP-Message = 0x0201000c0170726174657369 Message-Authenticator = 0x0bce6099ad4417ee86a75d1549a6b2f2 Wed May 9 17:54:37 2007 : Debug: Processing the authorize section of radiusd.conf Wed May 9 17:54:37 2007 : Debug: modcall: entering group authorize for request 0 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Wed May 9 17:54:37 2007 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Wed May 9 17:54:37 2007 : Debug: modcall[authorize]: module "chap" returns noop for request 0 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Wed May 9 17:54:37 2007 : Debug: modcall[authorize]: module "mschap" returns noop for request 0 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Wed May 9 17:54:37 2007 : Debug: rlm_realm: No '@' in User-Name = "david", looking up realm NULL Wed May 9 17:54:37 2007 : Debug: rlm_realm: No such realm "NULL" Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Wed May 9 17:54:37 2007 : Debug: modcall[authorize]: module "suffix" returns noop for request 0 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Wed May 9 17:54:37 2007 : Debug: rlm_eap: EAP packet type response id 1 length 12 Wed May 9 17:54:37 2007 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Wed May 9 17:54:37 2007 : Debug: modcall[authorize]: module "eap" returns updated for request 0 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 0 Wed May 9 17:54:37 2007 : Debug: radius_xlat: 'david' Wed May 9 17:54:37 2007 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'david' Wed May 9 17:54:37 2007 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'david' ORDER BY id' Wed May 9 17:54:37 2007 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Wed May 9 17:54:37 2007 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'david' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Wed May 9 17:54:37 2007 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'david' ORDER BY id' Wed May 9 17:54:37 2007 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'david' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Wed May 9 17:54:37 2007 : Debug: rlm_sql (sql): Released sql socket id: 4 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 0 Wed May 9 17:54:37 2007 : Debug: modcall[authorize]: module "sql" returns ok for request 0 Wed May 9 17:54:37 2007 : Debug: modcall: leaving group authorize (returns updated) for request 0 Wed May 9 17:54:37 2007 : Debug: rad_check_password: Found Auth-Type EAP Wed May 9 17:54:37 2007 : Debug: auth: type "EAP" Wed May 9 17:54:37 2007 : Debug: Processing the authenticate section of radiusd.conf Wed May 9 17:54:37 2007 : Debug: modcall: entering group authenticate for request 0 Wed May 9 17:54:37 2007 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 0 Wed May 9 17:54:37 2007 : Debug: rlm_eap: EAP Identity Wed May 9 17:54:37 2007 : Debug: rlm_eap: processing type tls Wed May 9 17:54:37 2007 : Debug: rlm_eap_tls: Initiate Wed May 9 17:54:37 2007 : Debug: rlm_eap_tls: Start returned 1 Wed May 9 17:54:37 2007 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 0 Wed May 9 17:54:37 2007 : Debug: modcall[authenticate]: module "eap" returns handled for request 0 Wed May 9 17:54:37 2007 : Debug: modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 71 to 192.168.0.254 port 1039 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1d29dc63e3727a27017d56d212ebbe51 Wed May 9 17:54:37 2007 : Debug: Finished request 0 Wed May 9 17:54:37 2007 : Debug: Going to the next request Wed May 9 17:54:37 2007 : Debug: --- Walking the entire request list --- Wed May 9 17:54:37 2007 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.254:1039, id=72, length=287 Framed-MTU = 1480 NAS-IP-Address = 172.17.1.10 NAS-Identifier = "CIS2650" User-Name = "david" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 39 NAS-Port-Type = Ethernet NAS-Port-Id = "39" Called-Station-Id = "00-19-bb-6a-2d-80" Calling-Station-Id = "00-11-25-d6-ab-1a" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3" State = 0x1d29dc63e3727a27017d56d212ebbe51 EAP-Message = 0x0202005019800000004616030100410100003d03014641eeacad5de1cf91cb82312b724ce969405f00152ecb9fe36317d9e794505500001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x848b664f7ebf5d0c45b92e1ea6dcbf29 Wed May 9 17:54:37 2007 : Debug: Processing the authorize section of radiusd.conf Wed May 9 17:54:37 2007 : Debug: modcall: entering group authorize for request 1 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Wed May 9 17:54:37 2007 : Debug: modcall[authorize]: module "preprocess" returns ok for request 1 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 1 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 1 Wed May 9 17:54:37 2007 : Debug: modcall[authorize]: module "chap" returns noop for request 1 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 1 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 1 Wed May 9 17:54:37 2007 : Debug: modcall[authorize]: module "mschap" returns noop for request 1 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 1 Wed May 9 17:54:37 2007 : Debug: rlm_realm: No '@' in User-Name = "david", looking up realm NULL Wed May 9 17:54:37 2007 : Debug: rlm_realm: No such realm "NULL" Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Wed May 9 17:54:37 2007 : Debug: modcall[authorize]: module "suffix" returns noop for request 1 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1 Wed May 9 17:54:37 2007 : Debug: rlm_eap: EAP packet type response id 2 length 80 Wed May 9 17:54:37 2007 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1 Wed May 9 17:54:37 2007 : Debug: modcall[authorize]: module "eap" returns updated for request 1 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 1 Wed May 9 17:54:37 2007 : Debug: radius_xlat: 'david' Wed May 9 17:54:37 2007 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'david' Wed May 9 17:54:37 2007 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'david' ORDER BY id' Wed May 9 17:54:37 2007 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Wed May 9 17:54:37 2007 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'david' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Wed May 9 17:54:37 2007 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'david' ORDER BY id' Wed May 9 17:54:37 2007 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'david' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Wed May 9 17:54:37 2007 : Debug: rlm_sql (sql): Released sql socket id: 3 Wed May 9 17:54:37 2007 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 1 Wed May 9 17:54:37 2007 : Debug: modcall[authorize]: module "sql" returns ok for request 1 Wed May 9 17:54:37 2007 : Debug: modcall: leaving group authorize (returns updated) for request 1 Wed May 9 17:54:37 2007 : Debug: rad_check_password: Found Auth-Type EAP Wed May 9 17:54:37 2007 : Debug: auth: type "EAP" Wed May 9 17:54:37 2007 : Debug: Processing the authenticate section of radiusd.conf Wed May 9 17:54:37 2007 : Debug: modcall: entering group authenticate for request 1 Wed May 9 17:54:37 2007 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 1 Wed May 9 17:54:37 2007 : Debug: rlm_eap: Request found, released from the list Wed May 9 17:54:37 2007 : Debug: rlm_eap: EAP/peap Wed May 9 17:54:37 2007 : Debug: rlm_eap: processing type peap Wed May 9 17:54:37 2007 : Debug: rlm_eap_peap: Authenticate Wed May 9 17:54:37 2007 : Debug: rlm_eap_tls: processing TLS Wed May 9 17:54:37 2007 : Debug: rlm_eap_tls: Length Included Wed May 9 17:54:37 2007 : Debug: eaptls_verify returned 11 Wed May 9 17:54:37 2007 : Debug: (other): before/accept initialization Wed May 9 17:54:37 2007 : Debug: TLS_accept: before/accept initialization Wed May 9 17:54:37 2007 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello Wed May 9 17:54:37 2007 : Debug: TLS_accept: SSLv3 read client hello A Wed May 9 17:54:37 2007 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello Wed May 9 17:54:37 2007 : Debug: TLS_accept: SSLv3 write server hello A Wed May 9 17:54:37 2007 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0346], Certificate Wed May 9 17:54:37 2007 : Debug: TLS_accept: SSLv3 write certificate A Wed May 9 17:54:37 2007 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Wed May 9 17:54:37 2007 : Debug: TLS_accept: SSLv3 write server done A Wed May 9 17:54:37 2007 : Debug: TLS_accept: SSLv3 flush data Wed May 9 17:54:37 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed May 9 17:54:37 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed May 9 17:54:37 2007 : Debug: In SSL Handshake Phase Wed May 9 17:54:37 2007 : Debug: In SSL Accept mode Wed May 9 17:54:37 2007 : Debug: eaptls_process returned 13 Wed May 9 17:54:37 2007 : Debug: rlm_eap_peap: EAPTLS_HANDLED Wed May 9 17:54:37 2007 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 1 Wed May 9 17:54:37 2007 : Debug: modcall[authenticate]: module "eap" returns handled for request 1 Wed May 9 17:54:37 2007 : Debug: modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 72 to 192.168.0.254 port 1039 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x010303a91900160301004a0200004603014641eebd4b0257f30568312508ce9d844da2ab8cdbc40e8bbfc011c7854f405e20d80a80e573f163f60573e9abfe1cf11719e3ebf6f8aa6607cac262017cc3521f00040016030103460b00034200033f00033c3082033830820220a003020102020102300d06092a864886f70d01010505003053310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c7464310c300a06035504031303636973301e170d3037303530333038303232355a170d3038303530323038303232355a3053310b30 EAP-Message = 0x09060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c7464310c300a0603550403130363697330820122300d06092a864886f70d01010105000382010f003082010a0282010100be1f23b9bf021191c28df0d121a868f37aa0ed8650dfd3525c9bfd9782dd4528e7f670981ee608eb3c3b01334cff4532b4b59b3b132e71abdf2634bf00fc7234404f255291e3888816de19ea9c80b283a52d0f8cace67230d172f7ddcea6e0bd6793924b5d1c98c7cb80ea60f9a9b97757bf90420dcd25ddb79a500f4ef79f59dd0ae5b81fb6522f8d042a31 EAP-Message = 0x6d2f0720a8dc00f73ad27bc737294cac8eeb7c914a7afa577c1532e34712f752a7a77e65e45350cf88a9d366f4d9bcc9ff4bb7611938a20f8534655fbfe0d205ef65eb408c91e3b1988d19144227aa8081ddcc94854619e0daadc64e0460d18ccaff05ac3163c3ca681aff1fcb62bab71a771a230203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000382010100339dc8986a5c60e942fcf5e76230fde8b3e75d73a8fc182512262617ec74b358d20452512e25bfc44d594cfaa100674207adb9f267d369ff7d5a6deb558b7cbd538aa5ccd4b44030be51acde4dc3ac940ec4c37335f277 EAP-Message = 0x5246554e7c031fd501578b605daa683c51c0d38c12b48f088b2360a2bd6f4ae8edaf53617335befcb7e3eafe8c99e6adcd944b9e6da0a21acb056763d11b6e32a53d6bb3bb93d6dbfb8cc373f07f6efb2e9cf38ced2b04a43af28a00432d3bd936276b26a0f66540af127ed392a6cd83b89626ddcad0c090af2f239e05127baf8df9659dba0f0280415a9a6569c23dcbc22f3c2a2922826f56e5b1bd90f2a4c979ac2e52efb019932e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc5018df96803d9ee44a6047b590c6057 Wed May 9 17:54:37 2007 : Debug: Finished request 1 Wed May 9 17:54:37 2007 : Debug: Going to the next request Wed May 9 17:54:37 2007 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.254:1039, id=73, length=213 Framed-MTU = 1480 NAS-IP-Address = 172.17.1.10 NAS-Identifier = "CIS2650" User-Name = "david" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 39 NAS-Port-Type = Ethernet NAS-Port-Id = "39" Called-Station-Id = "00-19-bb-6a-2d-80" Calling-Station-Id = "00-11-25-d6-ab-1a" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3" State = 0xc5018df96803d9ee44a6047b590c6057 EAP-Message = 0x020300061900 Message-Authenticator = 0x1ada415bcaa4a23684361400292abc59 Wed May 9 17:54:38 2007 : Debug: Processing the authorize section of radiusd.conf Wed May 9 17:54:38 2007 : Debug: modcall: entering group authorize for request 2 Wed May 9 17:54:38 2007 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 2 Wed May 9 17:54:38 2007 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 2 Wed May 9 17:54:38 2007 : Debug: modcall[authorize]: module "preprocess" returns ok for request 2 Wed May 9 17:54:38 2007 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 2 Wed May 9 17:54:38 2007 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 2 Wed May 9 17:54:38 2007 : Debug: modcall[authorize]: module "chap" returns noop for request 2 Wed May 9 17:54:38 2007 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 2 Wed May 9 17:54:38 2007 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 2 Wed May 9 17:54:38 2007 : Debug: modcall[authorize]: module "mschap" returns noop for request 2 Wed May 9 17:54:38 2007 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 2 Wed May 9 17:54:38 2007 : Debug: rlm_realm: No '@' in User-Name = "david", looking up realm NULL Wed May 9 17:54:38 2007 : Debug: rlm_realm: No such realm "NULL" Wed May 9 17:54:38 2007 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 2 Wed May 9 17:54:38 2007 : Debug: modcall[authorize]: module "suffix" returns noop for request 2 Wed May 9 17:54:38 2007 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 2 Wed May 9 17:54:38 2007 : Debug: rlm_eap: EAP packet type response id 3 length 6 Wed May 9 17:54:38 2007 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed May 9 17:54:38 2007 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 2 Wed May 9 17:54:38 2007 : Debug: modcall[authorize]: module "eap" returns updated for request 2 Wed May 9 17:54:38 2007 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 2 Wed May 9 17:54:38 2007 : Debug: radius_xlat: 'david' Wed May 9 17:54:38 2007 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'david' Wed May 9 17:54:38 2007 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'david' ORDER BY id' Wed May 9 17:54:38 2007 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Wed May 9 17:54:38 2007 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'david' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Wed May 9 17:54:38 2007 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'david' ORDER BY id' Wed May 9 17:54:38 2007 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'david' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Wed May 9 17:54:38 2007 : Debug: rlm_sql (sql): Released sql socket id: 2 Wed May 9 17:54:38 2007 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 2 Wed May 9 17:54:38 2007 : Debug: modcall[authorize]: module "sql" returns ok for request 2 Wed May 9 17:54:38 2007 : Debug: modcall: leaving group authorize (returns updated) for request 2 Wed May 9 17:54:38 2007 : Debug: rad_check_password: Found Auth-Type EAP Wed May 9 17:54:38 2007 : Debug: auth: type "EAP" Wed May 9 17:54:38 2007 : Debug: Processing the authenticate section of radiusd.conf Wed May 9 17:54:38 2007 : Debug: modcall: entering group authenticate for request 2 Wed May 9 17:54:38 2007 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 2 Wed May 9 17:54:38 2007 : Debug: rlm_eap: Request found, released from the list Wed May 9 17:54:38 2007 : Debug: rlm_eap: EAP/peap Wed May 9 17:54:38 2007 : Debug: rlm_eap: processing type peap Wed May 9 17:54:38 2007 : Debug: rlm_eap_peap: Authenticate Wed May 9 17:54:38 2007 : Debug: rlm_eap_tls: processing TLS Wed May 9 17:54:38 2007 : Debug: rlm_eap_tls: Received EAP-TLS ACK message Wed May 9 17:54:38 2007 : Debug: rlm_eap_tls: ack handshake fragment handler Wed May 9 17:54:38 2007 : Debug: eaptls_verify returned 1 Wed May 9 17:54:38 2007 : Debug: eaptls_process returned 13 Wed May 9 17:54:38 2007 : Debug: rlm_eap_peap: EAPTLS_HANDLED Wed May 9 17:54:38 2007 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 2 Wed May 9 17:54:38 2007 : Debug: modcall[authenticate]: module "eap" returns handled for request 2 Wed May 9 17:54:38 2007 : Debug: modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 73 to 192.168.0.254 port 1039 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x010400061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe7a8882c93b992e5d2c3b9eab695e62a Wed May 9 17:54:38 2007 : Debug: Finished request 2 Wed May 9 17:54:38 2007 : Debug: Going to the next request Wed May 9 17:54:38 2007 : Debug: --- Walking the entire request list --- Wed May 9 17:54:38 2007 : Debug: Waking up in 5 seconds... Wed May 9 17:54:43 2007 : Debug: --- Walking the entire request list --- Wed May 9 17:54:43 2007 : Debug: Cleaning up request 0 ID 71 with timestamp 4641eebd Wed May 9 17:54:43 2007 : Debug: Cleaning up request 1 ID 72 with timestamp 4641eebd Wed May 9 17:54:43 2007 : Debug: Waking up in 1 seconds... Wed May 9 17:54:44 2007 : Debug: --- Walking the entire request list --- Wed May 9 17:54:44 2007 : Debug: Cleaning up request 2 ID 73 with timestamp 4641eebe Wed May 9 17:54:44 2007 : Debug: Nothing to do. Sleeping until we see a request. david _________________________________________________________________ Personalizza la tua casella di posta con Windows Live Hotmail! http://imagine-windowslive.com/hotmail/default.aspx?locale=it#5

3 2

execute more than one sql query
by Amr el-Saeed 10 May '07

10 May '07

Dear All, I need to execute two queries using radius in sql.conf. i tried to put two queries like this : in the file i have accounting_update_query_alt = "query_1" i made it accounting_update_query_alt = "query_1 ; query_2" but i got an error from MySql concerning the second section '; query_2' how can i do it ?? Thanks Amr el-Saeed

1 0

Re: eap-tls authentication with free radius 1.1.6
by anoop_c＠sifycorp.com 10 May '07

10 May '07

Hi all I am trying to do eap-tls authentication with 1.1.6.My xp client is saying attempting to authenticate. So in the output i got when i tried to connect in debug mode is Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = \\\"/usr/local\\\" main: localstatedir = \\\"/usr/local/var\\\" main: logdir = \\\"/usr/local/var/log/radius\\\" main: libdir = \\\"/usr/local/lib\\\" main: radacctdir = \\\"/usr/local/var/log/radius/radacct\\\" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = \\\"/usr/local/var/log/radius/radius.log\\\" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = \\\"/usr/local/var/run/radiusd/radiusd.pid\\\" main: user = \\\"(null)\\\" main: group = \\\"(null)\\\" main: usercollide = no main: lower_user = \\\"no\\\" main: lower_pass = \\\"no\\\" main: nospace_user = \\\"no\\\" main: nospace_pass = \\\"no\\\" main: checkrad = \\\"/usr/local/sbin/checkrad\\\" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = \\\"(null)\\\" exec: input_pairs = \\\"request\\\" exec: output_pairs = \\\"(null)\\\" exec: packet_type = \\\"(null)\\\" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = \\\"(null)\\\" unix: shadow = \\\"(null)\\\" unix: group = \\\"(null)\\\" unix: radwtmp = \\\"/usr/local/var/log/radius/radwtmp\\\" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = \\\"tls\\\" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = \\\"(null)\\\" tls: pem_file_type = yes tls: private_key_file = \\\"/etc/1x/07xwifi.pem\\\" tls: certificate_file = \\\"/etc/1x/07xwifi.pem\\\" tls: CA_file = \\\"/etc/1x/root.pem\\\" tls: private_key_password = \\\"password\\\" tls: dh_file = \\\"/etc/1x/DH\\\" tls: random_file = \\\"/etc/1x/random\\\" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = \\\"(null)\\\" tls: cipher_list = \\\"(null)\\\" tls: check_cert_issuer = \\\"(null)\\\" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = \\\"/etc/raddb/huntgroups\\\" preprocess: hints = \\\"/etc/raddb/hints\\\" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = \\\"suffix\\\" realm: delimiter = \\\"@\\\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = \\\"/etc/raddb/users\\\" files: acctusersfile = \\\"/etc/raddb/acct_users\\\" files: preproxy_usersfile = \\\"/etc/raddb/preproxy_users\\\" files: compat = \\\"no\\\" Module: Instantiated files (files) Module: Loaded PAP pap: encryption_scheme = \\\"crypt\\\" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = \\\"User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addre ss, NAS-Port\\\" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = \\\"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/de tail-%Y%m%d\\\" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = \\\"/usr/local/var/log/radius/radutmp\\\" radutmp: username = \\\"%{User-Name}\\\" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.50:1026, id=0, length=197 Message-Authenticator = 0x58682b62b2334fb6e661df414bc30e61 Service-Type = Framed-User User-Name = \\\"anoop07\\\" Framed-MTU = 1488 Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\" Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\" NAS-Identifier = \\\"D-Link Access Point\\\" NAS-Port-Type = Wireless-802.11 Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\" EAP-Message = 0x0200000c01616e6f6f703037 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \\\"STA port # 1\\\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module \\\"preprocess\\\" returns ok for request 0 rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm NULL rlm_realm: No such realm \\\"NULL\\\" modcall[authorize]: module \\\"suffix\\\" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation modcall[authorize]: module \\\"eap\\\" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \\\"files\\\" returns ok for request 0 rlm_pap: WARNING! No \\\"known good\\\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \\\"pap\\\" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type \\\"EAP\\\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module \\\"eap\\\" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.0.50 port 1026 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf149907fc590a6e39f01cbbd9619107b Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1026, id=1, length=299 Message-Authenticator = 0x4fd5a9fe11d848f8f7a1324997be4a8e Service-Type = Framed-User User-Name = \\\"anoop07\\\" Framed-MTU = 1488 State = 0xf149907fc590a6e39f01cbbd9619107b Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\" Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\" NAS-Identifier = \\\"D-Link Access Point\\\" NAS-Port-Type = Wireless-802.11 Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\" EAP-Message = 0x020100600d800000005616030100510100004d03014642cb0590f008 20866efd284d568c69cde48b6530bced71bd7a674a2a46e36e103102d6b9e079cbcf0242e2192803 fe40001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \\\"STA port # 1\\\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module \\\"preprocess\\\" returns ok for request 1 rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm NULL rlm_realm: No such realm \\\"NULL\\\" modcall[authorize]: module \\\"suffix\\\" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 96 rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation modcall[authorize]: module \\\"eap\\\" returns updated for request 1 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \\\"files\\\" returns ok for request 1 rlm_pap: WARNING! No \\\"known good\\\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \\\"pap\\\" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type \\\"EAP\\\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0051], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04bf], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004c], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module \\\"eap\\\" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 192.168.0.50 port 1026 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0102040a0dc000000564160301004a0200004603014642cb066051eb 4f14285a58bcd1249829d97ad27f846524d57f7a25b0a3981720143a0cfecdd12ac8ec78c09d87f3 05ba498dcfe95c07b2b76e9b8510cfc644fd00040016030104bf0b0004bb0004b800022c30820228 30820191a003020102020101300d06092a864886f70d0101040500303b310b300906035504061302 494e310b300906035504081302544e310d300b060355040a1304536966793110300e060355040313 0730377877696669301e170d3037303131323135333533305a170d3038303131323135333533305a 3060310b300906035504061302494e310b3009060355040813 EAP-Message = 0x02544e310d300b060355040a1304536966793110300e060355040313 07303778776966693123302106092a864886f70d0109011614616e6f6f705f634073696679636f72 702e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d2bbbe35bc8a 47709632284aff484695385e69c3522f63da46834f9586a420bda380889693fa77fedd9ed4290e6f 9ff4436721775294fc65a38fea098f18975b34b5063de27220e18a07d433cbb6e19aeb3f84b012f7 c20071dd280457a932634bbe50f438cc2ee6f4d65fa395a10bdecc4bf9087979ec45af000940e186 ed290203010001a317301530130603551d25040c300a06082b EAP-Message = 0x06010505070301300d06092a864886f70d0101040500038181000afe a7f2a8a9cffe60baa8f779353c523457f8237faeff81ba5f2c22664c70b6b2fb58c8967ca4a4c847 b80e1d5a6cc4558ffa1d161614f374d8b5efd565aa66045b192b3ac3da82c81c4a99fc10cfe473f9 ac258ef99b16cbd335004677694a05addae48c6a9dcdb26b86ddb56c635266c33c7de75865435326 92e5220d30b100028630820282308201eba003020102020100300d06092a864886f70d0101040500 303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453 6966793110300e0603550403130730377877696669301e170d EAP-Message = 0x3037303131323135333435305a170d3038303131323135333435305a 303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453 6966793110300e060355040313073037787769666930819f300d06092a864886f70d010101050003 818d0030818902818100ba8b07a479bb6ce9adf2d8bc6ac9cf214506dfc039cb10c3b4d27d1bbc08 2caff0bb77424819728977f04b32e231a3c4755a65823b366f1a604f15ce6c499883ab7d2757a5a2 c07a11e75b7a00d6c55a8fb7443b202a25a3cdaad39579b2d8f4c09c974056f0c8666fff754d5748 36fcaf105200fcd5df5158e2b387310c4ed90203010001a381 EAP-Message = 0x95308192301d0603551d0e041604149eda6f69065423 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2fdcf333629491d0e1c1ee647458de64 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1026, id=2, length=209 Message-Authenticator = 0x4ad9312009d92ce8a0efb591a5179928 Service-Type = Framed-User User-Name = \\\"anoop07\\\" Framed-MTU = 1488 State = 0x2fdcf333629491d0e1c1ee647458de64 Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\" Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\" NAS-Identifier = \\\"D-Link Access Point\\\" NAS-Port-Type = Wireless-802.11 Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\" EAP-Message = 0x020200060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \\\"STA port # 1\\\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module \\\"preprocess\\\" returns ok for request 2 rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm NULL rlm_realm: No such realm \\\"NULL\\\" modcall[authorize]: module \\\"suffix\\\" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation modcall[authorize]: module \\\"eap\\\" returns updated for request 2 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \\\"files\\\" returns ok for request 2 rlm_pap: WARNING! No \\\"known good\\\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \\\"pap\\\" returns noop for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type \\\"EAP\\\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \\\"eap\\\" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 2 to 192.168.0.50 port 1026 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103016e0d80000005647ec1c9e4d07a608e0e6dcd730f3063060355 1d23045c305a80149eda6f690654237ec1c9e4d07a608e0e6dcd730fa13fa43d303b310b30090603 5504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e06 03550403130730377877696669820100300c0603551d13040530030101ff300d06092a864886f70d 0101040500038181006b514f008b6a77757fc73ddbe9d54e4ea925a1ab9ce80ad7895d6d19661d8b 8558d0e359876aac023aa52d4273e00407b9b588b30dbc35c5911bc89d2d99677e0ec8dea17fece3 5d0b4dfab8775ba73eaeb0a0998bcdf1437cff0a1031f6a5b1 EAP-Message = 0x7e8bcdc01e2e964cb256f49d947eea2cfd42989aef397fa438be294f a3dc7a3d160301004c0d000044020102003f003d303b310b300906035504061302494e310b300906 035504081302544e310d300b060355040a1304536966793110300e06035504031307303778776966 690e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8312be86097e0bba014e67facd670e26 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1026, id=3, length=209 Message-Authenticator = 0xd1d028ef0c35ada1104dae076b233114 Service-Type = Framed-User User-Name = \\\"anoop07\\\" Framed-MTU = 1488 State = 0x8312be86097e0bba014e67facd670e26 Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\" Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\" NAS-Identifier = \\\"D-Link Access Point\\\" NAS-Port-Type = Wireless-802.11 Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\" EAP-Message = 0x020300060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \\\"STA port # 1\\\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module \\\"preprocess\\\" returns ok for request 3 rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm NULL rlm_realm: No such realm \\\"NULL\\\" modcall[authorize]: module \\\"suffix\\\" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation modcall[authorize]: module \\\"eap\\\" returns updated for request 3 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \\\"files\\\" returns ok for request 3 rlm_pap: WARNING! No \\\"known good\\\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \\\"pap\\\" returns noop for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type \\\"EAP\\\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \\\"eap\\\" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 3 to 192.168.0.50 port 1026 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0104000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc08d54ac02795c8e31c2f7865a609bd5 Finished request 3 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 4642cb06 Cleaning up request 1 ID 1 with timestamp 4642cb06 Cleaning up request 2 ID 2 with timestamp 4642cb06 Cleaning up request 3 ID 3 with timestamp 4642cb06 Nothing to do. Sleeping until we see a request. [root@anoop raddb]# Regards Anoop essage: 3 Date: Thu, 10 May 2007 11:45:42 +0200 From: inverse <inverse(a)ngi.it> Subject: Re: eap-tls authentication with free radius 1.1.5 To: \"FreeRadius users mailing list\" <freeradius-users(a)lists.freeradius.org> Message-ID: <32deb3e30705100245t4c9ff9cay66d7c99ea0e34a44(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed On 5/10/07, anoop_c(a)sifycorp.com <anoop_c(a)sifycorp.com> wrote: anoop, please fix your quoting. Configurations are not interchangeable between the snapshot tree, 1.1.5 and 1.1.6

1 0