- Freeradius-Users - lists.freeradius.org

Win XP with 802.1x PEAP (EAP-MSCHAP V2)
by Marc Charbonneau 25 Apr '07

25 Apr '07

Gentlemen, I could use your help. I have a number of wireless devices that use FreeRADIUS to authenticate back to eDirectory with success while using Cisco's supplicant. The Cisco ADU (Aironet Desktop Utility) is configured with 802.1x PEAP (EAP-MSCHAP V2). For various reasons, I really need to make it work with the Microsoft supplicant. The Cisco docs indicate that it is possible to disable the use of their ADU to configure the WLAN card and use the Microsoft Wireless Configuration Manager in Windows XP. I would like to keep the same 802.1x authentication type, PEAP (EAP-MSCHAP V2). I have followed Cisco's detailed docs on this change of configuration and I am not getting any success. RADIUSD log is below. I have spent too much time on this issue, can someone please point me in the right direction. Thanks much, Marc *-----------------------------------------------------RADIUSD LOG*----------------------------------------------------- rad_recv: Access-Request packet from host 192.168.242.4:32768, id=222, length=184 User-Name = "UOHI-40628" Calling-Station-Id = "00-40-96-B1-43-BB" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x0209000f01554f48492d3430363238 Message-Authenticator = 0x8881c69556fbec1f966ab6b8081d75ec Processing the authorize section of radiusd.conf modcall: entering group authorize for request 38 modcall[authorize]: module "preprocess" returns ok for request 38 modcall[authorize]: module "chap" returns noop for request 38 modcall[authorize]: module "mschap" returns noop for request 38 rlm_realm: No '@' in User-Name = "UOHI-40628", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 38 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40628 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40628))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40628)) rlm_ldap: checking if remote access for UOHI-40628 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40628 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 38 rlm_eap: EAP packet type response id 9 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 38 modcall: group authorize returns updated for request 38 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 38 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 38 modcall: group authenticate returns handled for request 38 Sending Access-Challenge of id 222 to 192.168.242.4:32768 EAP-Message = 0x010a00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4dda1f635e420966fc8dbbcc69dda607 Finished request 38 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=223, length=267 User-Name = "UOHI-40628" Calling-Station-Id = "00-40-96-B1-43-BB" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x020a005019800000004616030100410100003d0301462f5a5fd08496fa6f73faf534b5d9dfc37bd2c6669a9574fa88e6335c8ad88a00001600040005000a000900640062000300060013001200630100 State = 0x4dda1f635e420966fc8dbbcc69dda607 Message-Authenticator = 0x9018d1e50a6f18bc6b57d69c25671a00 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 39 modcall[authorize]: module "preprocess" returns ok for request 39 modcall[authorize]: module "chap" returns noop for request 39 modcall[authorize]: module "mschap" returns noop for request 39 rlm_realm: No '@' in User-Name = "UOHI-40628", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 39 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40628 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40628))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40628)) rlm_ldap: checking if remote access for UOHI-40628 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40628 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 39 rlm_eap: EAP packet type response id 10 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 39 modcall: group authorize returns updated for request 39 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 39 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 098e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 39 modcall: group authenticate returns handled for request 39 Sending Access-Challenge of id 223 to 192.168.242.4:32768 EAP-Message = 0x010b040a19c0000009eb160301004a020000460301462eb1d736542a8a4df2f4f3a5844ef939143c291aee6778ea4f87a6236ebf88207d4d3e0a6f3cce6751337b109c3c125ed04ea100b962d594018546de179773b4000400160301098e0b00098a0009870004e5308204e1308203c9a003020102020102300d06092a864886f70d01010505003072310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761312d302b060355040a1324556e6976657273697479206f66204f747461776120486561727420496e737469747574653111300f060355040313086f6869736c657331301e EAP-Message = 0x170d3036313031303137343732365a170d3037313031303137343732365a3081a6310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761312d302b060355040a1324556e6976657273697479206f66204f747461776120486561727420496e737469747574653120301e060355040313176f6869736c6573312e6f747461776168656172742e63613123302106092a864886f70d010901161461646d696e406f747461776168656172742e636130820122300d06092a864886f70d01010105000382010f003082010a0282010100bd9e19cc9f7510ee7a3170729413a3724cdf9b4355 EAP-Message = 0x500a711649144df5caee883e099d4229e52a023ee71fbad5fa7c91cd8374529160801c6323e357e3a313610c4ed3266e7d305015f0686e4cab8e2839099d7a36f5412774232e115fdbbace6238601a88ec0eb12134da278895a504f479bfeee87aa2ac9c50a9e387ae89fdfb6b6b0dc01abe0ea4f77b2a3e606b60c9c6be6d8b688ab34989c93f27240c43ba7b4e0ae8f42ad6b179411de526fcafe7fc75f257fdb551ec16d23876010e4cb5c0ea83c37be6ddaca2c455ab7b89ded92786d7cd1cb4bcf851f78845a4bd923293b50c86d8ac54f316ac3cd9917aadc265881e2b5ae30a1220d0798d2944930203010001a382014b308201473009060355 EAP-Message = 0x1d1304023000303006096086480186f842010d04231621596153542047656e65726174656420536572766572204365727469666963617465301106096086480186f8420101040403020640300b0603551d0f040403020520301d0603551d0e0416041470bf34961e35fdf4aaf4dcaee9a7e137e2652ec030819c0603551d2304819430819180144998ca048e04b60db2fb700a2b3716b300fcb779a176a4743072310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761312d302b060355040a1324556e6976657273697479206f66204f747461776120486561727420496e73746974 EAP-Message = 0x7574653111300f060355040313086f6869736c657331 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0d45f794c16d885a70ce95b2f9482a78 Finished request 39 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=224, length=193 User-Name = "UOHI-40628" Calling-Station-Id = "00-40-96-B1-43-BB" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x020b00061900 State = 0x0d45f794c16d885a70ce95b2f9482a78 Message-Authenticator = 0x52561bab2e8c9afa9b6d07292146a53b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 40 modcall[authorize]: module "preprocess" returns ok for request 40 modcall[authorize]: module "chap" returns noop for request 40 modcall[authorize]: module "mschap" returns noop for request 40 rlm_realm: No '@' in User-Name = "UOHI-40628", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 40 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40628 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40628))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40628)) rlm_ldap: checking if remote access for UOHI-40628 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40628 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 40 rlm_eap: EAP packet type response id 11 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 40 modcall: group authorize returns updated for request 40 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 40 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 40 modcall: group authenticate returns handled for request 40 Sending Access-Challenge of id 224 to 192.168.242.4:32768 EAP-Message = 0x010c04061940820100301f0603551d1104183016811461646d696e406f747461776168656172742e636130090603551d1204023000300d06092a864886f70d01010505000382010100b2eb4b296d4d38a8f0eca582b092107e24976a83c5b6068922d3348769521e0a4b57f3e843d50c851db4ad541f6342beea24a6467e73a53fae3be20573bf824b87ce49a1dc946dfc2ecb2579136eff8464c5d5f4266cc9dbde9ad6766007960ed23c7a47cd05ddea1bbfcf494af0af491e273729a6f52aa172d7e7ba09741280098d4ce25d2c951733bf9a56647a247040d11781025175e1da1cc5b546e8deb8c71bbc52e521e0b38006447eee72c4d6c31192b2 EAP-Message = 0x47b9ef622eb5c5162e8f13fb856bf31e447f2a3ca9f32b77eb99ab60fad53474c452a8749d06fcce810f7855c5340edeb4b5f77ce880e780565c0b60fd3d2f60ca91b2ba676191090fc7e5f400049c3082049830820380a003020102020100300d06092a864886f70d01010505003072310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761312d302b060355040a1324556e6976657273697479206f66204f747461776120486561727420496e737469747574653111300f060355040313086f6869736c657331301e170d3036313030323139313331335a170d3136303932393139 EAP-Message = 0x313331335a3072310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761312d302b060355040a1324556e6976657273697479206f66204f747461776120486561727420496e737469747574653111300f060355040313086f6869736c65733130820122300d06092a864886f70d01010105000382010f003082010a0282010100e050a5f7f6204276dce3df6c20ddc3cf195f382301b3c374408ce528cd5ef3d4931ccaa304b9105b09377d3cf3b3489665496581c1c2b4b95ae785fe925f203eb266ac65e1d9a463cde7f7befe5f843d5cff41b4cea891cf8918cfd0634d2806e31a4f EAP-Message = 0x7b2d4e8dd26cae6b4ba5418df21a65073208af5afe60ff565d0616a37493a1cfc94899ccd85fed161653736d0addd1a4e267112f08f81506243ab63f9700a5529e22967dac11a2b8ffa1f3239f784ecc5299d8c31d6d159386aceb39b32f29d6cb784249f234baab3b1845e418bd2df18b71f801d80787f17fddfed27494885eda51d2c05e29a5ad33330920cdd040d13e2c54c432d29667a3ef2f9c4d0203010001a382013730820133300f0603551d130101ff040530030101ff302c06096086480186f842010d041f161d596153542047656e657261746564204341204365727469666963617465301106096086480186f842010104040302010630 EAP-Message = 0x0b0603551d0f040403020106301d0603551d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa69c23be214cea213ab71772ec162e3e Finished request 40 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=225, length=193 User-Name = "UOHI-40628" Calling-Station-Id = "00-40-96-B1-43-BB" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x020c00061900 State = 0xa69c23be214cea213ab71772ec162e3e Message-Authenticator = 0xaa8de108a0eecfcde92e4c62ed858be4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 41 modcall[authorize]: module "preprocess" returns ok for request 41 modcall[authorize]: module "chap" returns noop for request 41 modcall[authorize]: module "mschap" returns noop for request 41 rlm_realm: No '@' in User-Name = "UOHI-40628", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 41 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40628 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40628))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40628)) rlm_ldap: checking if remote access for UOHI-40628 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40628 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 41 rlm_eap: EAP packet type response id 12 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 41 modcall: group authorize returns updated for request 41 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 41 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 41 modcall: group authenticate returns handled for request 41 Sending Access-Challenge of id 225 to 192.168.242.4:32768 EAP-Message = 0x010d01f119000e041604144998ca048e04b60db2fb700a2b3716b300fcb77930819c0603551d2304819430819180144998ca048e04b60db2fb700a2b3716b300fcb779a176a4743072310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761312d302b060355040a1324556e6976657273697479206f66204f747461776120486561727420496e737469747574653111300f060355040313086f6869736c65733182010030090603551d110402300030090603551d1204023000300d06092a864886f70d010105050003820101009a6086c121e9b175d4b9c5e9406243685a58250199 EAP-Message = 0x513347d581ba358ed6c64ac14e2782da6d6e9b40df6221c2d25e1eb785004c49bb4bb8c8889c417db67e00082324108726a295dd3121c67ddd83d7453726ce22abd2887e7ab93f829566a259347004b581a21e96db42ee57c3f29ede27882370daf38a45c331dd3c7f37a3d8c3740dd5e3ff107bd9b50dd2a9c3f18b550962f9ce5d4dda747c13b135a888f7db26648c436102b4393b7ec907d1cfaa04fac70f244c677442ea413bddd490cf144e38604f9bacbe91b9b7eb23ecf768048d71d23976d9899db5267d4f6f0ea00897c1642c3a4f70d8e21f2f04285554faa174ce6971cc6986e7c87f56ce2016030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x66033bb93efe19bc2d9927ae35020a1c Finished request 41 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=226, length=509 User-Name = "UOHI-40628" Calling-Station-Id = "00-40-96-B1-43-BB" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x020d0140198000000136160301010610000102010086e0f9ad658ba724bdd476c7d85b8546179334b45eb22fbbdd454326aa5ac1d00e73314dd9f1d1062acb9cb6a7a52017d219aed52f301eecdd6cc9ecaa430687a8506d5133313796465869536c861713fc98b50c7e4fc4e2e049bae00a01c919f33a9992fdb17c6c01efcb6ecb9fdfa076a46cc353164b53da2794ed7629cfc550488076a11513bdb0ce38361b61159bf5c62a93c6f322ff0d7f10c11b42c76be143fa2d7ce697b917df9948758e41f0fde6fefc636a5174b0f7fed1133e911cad334551be4fed1a9e8a2ea891d53f2bb5480c36ab18f17e454edb9b363dca569106885aefc2f07b EAP-Message = 0x54693c4cc6fc46d497033ae13a2bd4232717955983f96bab1403010001011603010020855695767ea53d5e8315327a5db64cf94eecbd1e8dc21c668149e5249ab54709 State = 0x66033bb93efe19bc2d9927ae35020a1c Message-Authenticator = 0x780254fe75985fe63ca23fedb0cb7bbb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 42 modcall[authorize]: module "preprocess" returns ok for request 42 modcall[authorize]: module "chap" returns noop for request 42 modcall[authorize]: module "mschap" returns noop for request 42 rlm_realm: No '@' in User-Name = "UOHI-40628", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 42 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40628 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40628))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40628)) rlm_ldap: checking if remote access for UOHI-40628 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40628 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 42 rlm_eap: EAP packet type response id 13 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 42 modcall: group authorize returns updated for request 42 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 42 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 42 modcall: group authenticate returns handled for request 42 Sending Access-Challenge of id 226 to 192.168.242.4:32768 EAP-Message = 0x010e0031190014030100010116030100204c6f7e2f074eaf9fff787a15e29a6d0d4cca30295d1d5f9fde2ca041aa17f6b6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7b3a5e790f37b4700e491742dbc7cf95 Finished request 42 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=227, length=220 User-Name = "UOHI-40628" Calling-Station-Id = "00-40-96-B1-43-BB" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x020e00211980000000171503010012aab9a07fd9c55ae9bc2a0bd0e1128b5157f7 State = 0x7b3a5e790f37b4700e491742dbc7cf95 Message-Authenticator = 0xa502333e39b077923bc35b03b4aaec26 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 43 modcall[authorize]: module "preprocess" returns ok for request 43 modcall[authorize]: module "chap" returns noop for request 43 modcall[authorize]: module "mschap" returns noop for request 43 rlm_realm: No '@' in User-Name = "UOHI-40628", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 43 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40628 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40628))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40628)) rlm_ldap: checking if remote access for UOHI-40628 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40628 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 43 rlm_eap: EAP packet type response id 14 length 33 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 43 modcall: group authorize returns updated for request 43 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 43 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 43 modcall: group authenticate returns invalid for request 43 auth: Failed to validate the user. Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 43 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: eDirectory account policy check failed. rlm_ldap: NDS error: failed authentication (-669) rlm_ldap: ldap_release_conn: Release Id: 0 modcall[post-auth]: module "ldap" returns reject for request 43 modcall: group Post-Auth-Type returns reject for request 43 Delaying request 43 for 1 seconds Finished request 43 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=227, length=220 Sending Access-Reject of id 227 to 192.168.242.4:32768 EAP-Message = 0x040e0004 Message-Authenticator = 0x00000000000000000000000000000000 Reply-Message = "NDS error: failed authentication (-669)" --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 38 ID 222 with timestamp 462eb1d7 Cleaning up request 39 ID 223 with timestamp 462eb1d7 Cleaning up request 40 ID 224 with timestamp 462eb1d7 Cleaning up request 41 ID 225 with timestamp 462eb1d7 Cleaning up request 42 ID 226 with timestamp 462eb1d7 Cleaning up request 43 ID 227 with timestamp 462eb1d7 Nothing to do. Sleeping until we see a request.

2 1

radtest and Message-Authenticator
by Norbert Wegener 25 Apr '07

25 Apr '07

When I send radtest 000000000009 000000000009 brm 1812 secret xx 10.10.20.138 to a freeradiusserver, I get an access accept. Sending the same radtest command line to an IAS, that should proxy that request to a freeradiusserver, the IAS complains about a missing Message-Authenticator. What do I have to do to get a Message-Authenticator in such a radtest request? Thanks Norbert Wegener

2 1

Huntgroups/preprocess issue 1.1.6
by Craig Huckabee 25 Apr '07

25 Apr '07

If this is already a known issue, forgive me - I did not find anything in the archives or bug database that appeared relevant. I'm trying to upgrade from FreeRADIUS 1.1.2 to 1.1.6 - building from source on Debian Linux (sarge). The build goes without a hitch, but when running the new version and using the existing configuration files I get the following (relevant output from 'radiusd -X'): ... Module: Loaded preprocess preprocess: huntgroups = "/s/freeradius-1.1/etc/raddb/huntgroups" preprocess: hints = "/s/freeradius-1.1/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no /s/freeradius-1.1/etc/raddb/huntgroups[30]: Parse error (check) for entry snt-console: Unknown value 1-22 for attribute NAS-Port rlm_preprocess: Error reading /s/freeradius-1.1/etc/raddb/huntgroups radiusd.conf[249]: preprocess: Module instantiation failed. radiusd.conf[341] Unknown module "preprocess". radiusd.conf[340] Failed to parse authorize section. The section in the huntgroups file it is choking on is this: snt-console NAS-IP-Address == aaa.bbb.ccc.ddd, NAS-Port == 1-22 If I comment that line out, it also chokes on this entry with a slightly different error ( "=" expected): nci-console NAS-IP-Address == aaa.bbb.ccc.ddd, NAS-Port == 1,25-32 So - did the syntax for huntgroups change or is this a real bug ? This config works fine with 1.1.2 - I have not tried any of the versions between 1.1.2 and 1.1.6 to narrow down the issue. I can send the full debug output if needed but I didn't want to clobber the list unnecessarily. Thanks, Craig

3 4

Accept users by NAS-IP-Address
by Svend Eriksen 25 Apr '07

25 Apr '07

Hi, I'm running version 1.1.6 against a Postgres database. In the radcheck table I check the password and sets Expiration for the users. In the nas table I have listed all the NAS that the users can connect through, and this seems to work fine. I also want the users to be member of a group, where the group gives access to some of the NAS. If I set 'NAS-IP-Address == ip_of_a_nas' in the radgroupcheck, the user can only connect through that NAS. The problem occurs when I want a group to contain several NAS. How can I make freeradius accept the login if the NAS-IP-Address from the user, is one of several listed in a group that a user is member of? reg Svend

2 1

MultiFactor authentication with FreeRadius
by Ouahiba MACHANI 25 Apr '07

25 Apr '07

Hi, I need to extend FreeRadius to allow Mmulti-Factor Authentication. I should extend it to support OTP authentication in addition to static password authentication. Did anyone manage to do it ? and how ? Thanks. Ouahiba.

1 0

EAP MD5 with Accounting
by Tan hanyin 25 Apr '07

25 Apr '07

Hi All, I was wondering if I were to perform authentication using EAP MD5, does it accommodate for Accounting in FreeRADIUS? Many Thanks. _________________________________________________________________ Check it out! Windows Live Spaces is here! http://spaces.live.com/?mkt=en-my Its easy to create your own personal Web site.

3 4

Non-ascii usernames
by Alexander V. Klepikov 25 Apr '07

25 Apr '07

Hello, All! How do I make FreeRadius work correct with non-ascii usernames? With best regards, Alexander V. Klepikov. E-mail: klepikov_a(a)up.ua

2 4

pam_radius: mutiple bad logins hitting radius server
by J S 25 Apr '07

25 Apr '07

I'm running pam_radius 1.3.16 on Solaris 10 using a Cisco ACS backend that authenticates to an MS AD server. I'm running into an issue where a user will fail a single login attempt (one username/password challenge with a bad password) and the ACS will record 3 attempts from the client (the Solaris 10 server). after a single attempt (or a valid login with a local password) the 3 fails bollixes up the AD login attempts and locks the user out. Am I missing a compile option to only attempt a single RADIUS login per authentication or do I possible have pam.conf misconfigured. I use sshd-kbdint and sshd-password with the same results. Otherwise the system works well. # pam_radius_auth configuration file. Copy to: /etc/raddb/server # # For proper security, this file SHOULD have permissions 0600, # that is readable by root, and NO ONE else. If anyone other than # root can read this file, then they can spoof responses from the server! # # There are 3 fields per line in this file. There may be multiple # lines. Blank lines or lines beginning with '#' are treated as # comments, and are ignored. The fields are: # # server[:port] secret [timeout] # # the port name or number is optional. The default port name is # "radius", and is looked up from /etc/services The timeout field is # optional. The default timeout is 3 seconds. # # If multiple RADIUS server lines exist, they are tried in order. The # first server to return success or failure causes the module to return # success or failure. Only if a server fails to response is it skipped, # and the next server in turn is used. # # The timeout field controls how many seconds the module waits before # deciding that the server has failed to respond. # # server[:port] shared_secret timeout (s) #127.0.0.1 secret 1 #other-server other-secret 3 localhost secret 3 10.0.0.10:2048 XXXXXXXX 3 # # having localhost in your radius configuration is a Good Thing. # # See the INSTALL file for pam.conf hints. bash-3.00# cat /etc/pam.conf # #ident "@(#)pam.conf 1.28 04/04/21 SMI" # # Copyright 2004 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # # PAM configuration # # Unless explicitly defined, all services use the modules # defined in the "other" section. # # Modules are defined with relative pathnames, i.e., they are # relative to /usr/lib/security/$ISA. Absolute path names, as # present in this file in previous releases are still acceptable. # # Authentication management # # login service (explicit because of pam_dial_auth) # login auth sufficient /usr/lib/security/pam_radius_auth.so.1 debug login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_unix_auth.so.1 login auth required pam_dial_auth.so.1 # telnet auth sufficient /usr/lib/security/pam_radius_auth.so.1 debug #telnet auth required /usr/lib/security/pam_unix.so.1 # # rlogin service (explicit because of pam_rhost_auth) # rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth required pam_unix_cred.so.1 rlogin auth required pam_unix_auth.so.1 # # Kerberized rlogin service # krlogin auth required pam_unix_cred.so.1 krlogin auth binding pam_krb5.so.1 krlogin auth required pam_unix_auth.so.1 # # rsh service (explicit because of pam_rhost_auth, # and pam_unix_auth for meaningful pam_setcred) # rsh auth sufficient pam_rhosts_auth.so.1 rsh auth required pam_unix_cred.so.1 # # Kerberized rsh service # krsh auth required pam_unix_cred.so.1 krsh auth binding pam_krb5.so.1 krsh auth required pam_unix_auth.so.1 # # Kerberized telnet service # ktelnet auth required pam_unix_cred.so.1 ktelnet auth binding pam_krb5.so.1 ktelnet auth required pam_unix_auth.so.1 # # PPP service (explicit because of pam_dial_auth) # ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth required pam_unix_cred.so.1 ppp auth required pam_unix_auth.so.1 ppp auth required pam_dial_auth.so.1 # # Default definitions for Authentication management # Used when service name is not explicitly mentioned for authentication # other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth required pam_unix_cred.so.1 other auth required pam_unix_auth.so.1 # # passwd command (explicit because of a different authentication module) # passwd auth required pam_passwd_auth.so.1 # # cron service (explicit because of non-usage of pam_roles.so.1) # cron account required pam_unix_account.so.1 # # Default definition for Account management # Used when service name is not explicitly mentioned for account management # other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 # # Default definition for Session management # Used when service name is not explicitly mentioned for session management # other session required pam_unix_session.so.1 # # Default definition for Password management # Used when service name is not explicitly mentioned for password management # other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 # # Support for Kerberos V5 authentication and example configurations can # be found in the pam_krb5(5) man page under the "EXAMPLES" section. # # sshd access # either local or radius login will work sshd-kbdint auth requisite pam_authtok_get.so.1 sshd-kbdint auth required pam_dhkeys.so.1 sshd-kbdint auth required pam_unix_cred.so.1 sshd-kbdint auth required pam_unix_auth.so.1 sshd-kbdint auth required pam_dial_auth.so.1 sshd-kbdint auth sufficient pam_radius_auth.so.1 debug

2 3

Re : RES: Re: RES: Re: PEAP/EAP-TLS with client and server certificate
by Eshun Benjamin 25 Apr '07

25 Apr '07

Use this: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no # Supported EAP-types # EAP-TLS tls { private_key_password = xxxxxxxxxxxxxxxxx private_key_file = ${raddbdir}/certs/freeradius_key.pem certificate_file = ${raddbdir}/certs/freeradius_cert.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } peap { default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no } #tls { #private_key_password = xxxxxxxxxxxxxxxxxxxxx #private_key_file = ${raddbdir}/certs/freeradius_key.pem #certificate_file = ${raddbdir}/certs/freeradius_cert.pem #CA_file = ${raddbdir}/certs/demoCA/cacert.pem #dh_file = ${raddbdir}/certs/dh #random_file = ${raddbdir}/certs/random #fragment_size = 1024 #include_length = yes #} mschapv2 { } } ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Marcelo Augusto Rodrigues Pimentel <marcelo.pimentel(a)cgu.gov.br> À : freeradius-users(a)lists.freeradius.org Envoyé le : Mardi, 24 Avril 2007, 20h36mn 17s Objet : RES: Re: RES: Re: PEAP/EAP-TLS with client and server certificate Marcelo Augusto Rodrigues Pimentel wrote: > OK. But I?m trying to use peap to make an encrypted tunnel validating the server certificate and then I want to authenticate the clients whith EAP-TLS using client/server certificate. The TLS tunnel is working fine, but the second part of EAP-TLS authentication not. > What second part of EAP-TLS? The server supports authenticating via client certificates, and nothing else. I said two parts, because those parts of my configuration uses TLS: The first part is making the encrypt tunnel using PEAP --> Only validates server certificate to create the tunnel. The second part is the authenticathion inner the tunnel with EAP-TLS --> Mutual validation of client and server certificate. This configuration is like Geroge Ou said below: ... PEAP-EAP-TLS is an improved version of the original EAP-TLS protocol that goes further to encrypt client digital certificate information. Both PEAP-EAP-TLS and EAP-TLS have the same server and client side digital certificate requirements. ... Reference: Wireless LAN security guide --> Level 3: Medium to large Enterprise WLAN security" http://www.lanarchitect.net/Articles/Wireless/SecurityRating/ Thank´s ! > So .... in the peap section in the eap.conf, what I?ve to configure for default eap type? Is tls ? > No. You can leave it alone. It's fine. > If I configure tls, I?ve to create a tls section in the peap section or the tls section of the eap.conf is enough. I?ve attached my eap.conf file. > If you want to use just TLS, you don't need the PEAP section. If you want to use PEAP, you need the TLS section. The comments in the "eap.conf" file explain this. "Mensagem protegida por sigilo profissional. Sua utilização indevida sujeita o infrator às penas da lei. Não sendo seu destinatário, por favor, elimine-a e informe o equívoco ao emitente." "This e-mail message and any attachment are intended exclusively for the named addressee. They may contain confidential information which may also be protected by professional secrecy. Unless you are the named addressee (or authorised to receive for the addressee) you may not copy or use this message or any attachment or disclose the contents to anyone else. If this e-mail was sent to you by mistake please notify the sender immediately and delete this e-mail." - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

More on double free or corruption errors
by ken 25 Apr '07

25 Apr '07

I strongly suspect its a Fedora problem, not a Freeradius problem. (Or else I made a boo-boo configuring the OS) Alan DeKok replied to matthew zeier: > Let me clear: I cannot reproduce this problem here. > No one else has > seen the same problem. May or may not be relevant, but I've got two supposedly identical Fedora 6 machines, one gets a similar error, the other doesn't!. Both upgraded with yum to current level, followed by manual install and configure of Freeradius 1.1.5 - I cut and pasted the commands from one machine to the other and I FTPed the files including ones I modified. (And the one it works on is the SECOND one I installed, so its not a failure to copy correctly!) I think there must be some difference in my /usr/local/lib/libltdl.so.3.1.4 - they are slightly different sizes. I have no idea why, I used the same commands to install both systems. I will compare them. Just in case it means anything to anyone I attach the command output, but as I said my guess is its a Fedora problem [root@ficus raddb]# radiusd -v radiusd: FreeRADIUS Version 1.1.5, for host i686-pc-linux-gnu, built on Mar 9 2007 at 13:16:16 Copyright (C) 2000-2006 The FreeRADIUS server project. [root@ficus raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 --More--*** glibc detected *** radiusd: double free or corruption (fasttop): 0x81029498 *** ======= Backtrace: ========= /lib/libc.so.6[0x24b09d] /lib/libc.so.6(cfree+0x90)[0x24e6f0] /usr/local/lib/libltdl.so.3[0x14151b] /usr/local/lib/libltdl.so.3(lt_dlopenext+0xbe)[0x141eae] radiusd(find_module_instance+0x317)[0x8000cbb7] radiusd(setup_modules+0x1d8)[0x8000d168] radiusd(main+0x45c)[0x8001079c] /lib/libc.so.6(__libc_start_main+0xdc)[0x1faf2c] radiusd[0x80004771] ======= Memory map: ======== 00110000-00123000 r-xp 00000000 fd:00 13959203 /lib/libpthread-2.5.so 00123000-00124000 r-xp 00012000 fd:00 13959203 /lib/libpthread-2.5.so 00124000-00125000 rwxp 00013000 fd:00 13959203 /lib/libpthread-2.5.so 00125000-00127000 rwxp 00125000 00:00 0 00127000-0013c000 r-xp 00000000 fd:00 13087333 /usr/local/lib/libradius-1.1.5.so 0013c000-0013d000 rwxp 00014000 fd:00 13087333 /usr/local/lib/libradius-1.1.5.so 0013d000-0013e000 rwxp 0013d000 00:00 0 0013e000-00143000 r-xp 00000000 fd:00 13086902 /usr/local/lib/libltdl.so.3.1.4 00143000-00144000 rwxp 00004000 fd:00 13086902 /usr/local/lib/libltdl.so.3.1.4 00144000-0014b000 r-xp 00000000 fd:00 13087742 /usr/lib/libkrb5support.so.0.1 0014b000-0014c000 rwxp 00006000 fd:00 13087742 /usr/lib/libkrb5support.so.0.1 0014e000-0014f000 r-xp 0014e000 00:00 0 [vdso] 0014f000-00161000 r-xp 00000000 fd:00 13082790 /usr/lib/libz.so.1.2.3 00161000-00162000 rwxp 00011000 fd:00 13082790 /usr/lib/libz.so.1.2.3 00162000-0016b000 r-xp 00000000 fd:00 13959208 /lib/libnss_files-2.5.so 0016b000-0016c000 r-xp 00008000 fd:00 13959208 /lib/libnss_files-2.5.so 0016c000-0016d000 rwxp 00009000 fd:00 13959208 /lib/libnss_files-2.5.so 0016d000-00171000 r-xp 00000000 fd:00 13959206 /lib/libnss_dns-2.5.so 00171000-00172000 r-xp 00003000 fd:00 13959206 /lib/libnss_dns-2.5.so 00172000-00173000 rwxp 00004000 fd:00 13959206 /lib/libnss_dns-2.5.so 00173000-0017e000 r-xp 00000000 fd:00 13959199 /lib/libgcc_s-4.1.1-20070105.so.1 0017e000-0017f000 rwxp 0000a000 fd:00 13959199 /lib/libgcc_s-4.1.1-20070105.so.1 001a0000-001e1000 r-xp 00000000 fd:00 13959361 /lib/libssl.so.0.9.8b 001e1000-001e5000 rwxp 00040000 fd:00 13959361 /lib/libssl.so.0.9.8b 001e5000-0031c000 r-xp 00000000 fd:00 13959186 /lib/libc-2.5.so 0031c000-0031e000 r-xp 00137000 fd:00 13959186 /lib/libc-2.5.so 0031e000-0031f000 rwxp 00139000 fd:00 13959186 /lib/libc-2.5.so 0031f000-00322000 rwxp 0031f000 00:00 0 00322000-003a8000 r-xp 00000000 fd:00 13100407 /usr/lib/libkrb5.so.3.2 003a8000-003aa000 rwxp 00086000 fd:00 13100407 /usr/lib/libkrb5.so.3.2 00474000-0048d000 r-xp 00000000 fd:00 13959170 /lib/ld-2.5.so 0048d000-0048e000 r-xp 00018000 fd:00 13959170 /lib/ld-2.5.so 0048e000-0048f000 rwxp 00019000 fd:00 13959170 /lib/ld-2.5.so 00710000-0082c000 r-xp 00000000 fd:00 13959247 /lib/libcrypto.so.0.9.8b 0082c000-0083e000 rwxp 0011c000 fd:00 13959247 /lib/libcrypto.so.0.9.8b 0083e000-00842000 rwxp 0083e000 00:00 0 008ec000-00911000 r-xp 00000000 fd:00 13100406 /usr/lib/libk5crypto.so.3.0 00911000-00912000 rwxp 00025000 fd:00 13100406 /usr/lib/libk5crypto.so.3.0 00a47000-00a56000 r-xp 00000000 fd:00 13959217 /lib/libresolv-2.5.so 00a56000-00a57000 r-xp 0000e000 fd:00 13959217 /lib/libresolv-2.5.so 00a57000-00a58000 rwxp 0000f000 fd:00 13959217 /lib/libresolv-2.5.so 00a58000-00a5a000 rwxp 00a58000 00:00 0 00c7a000-00ca4000 r-xp 00000000 fd:00 13100408 /usr/lib/libgssapi_krb5.so.2.2 00ca4000-00ca5000 rwxp 00029000 fd:00 13100408 /usr/lib/libgssapi_krb5.so.2.2 00cf1000-00cf3000 r-xp 00000000 fd:00 13099224 /usr/local/lib/rlm_exec-1.1.5.so 00cf3000-00cf4000 rwxp 00001000 fd:00 13099224 /usr/local/lib/rlm_exec-1.1.5.so 00d1b000-00d2e000 r-xp 00000000 fd:00 13959209 /lib/libnsl-2.5.so 00d2e000-00d2f000 r-xp 00012000 fd:00 13959209 /lib/libnsl-2.5.so 00d2f000-00d30000 rwxp 00013000 fd:00 13959209 /lib/libnsl-2.5.so 00d30000-00d32000 rwxp 00d30000 00:00 0 00de4000-00de6000 r-xp 00000000 fd:00 13959245 /lib/libcom_err.so.2.1 00de6000-00de7000 rwxp 00001000 fd:00 13959245 /lib/libcom_err.so.2.1 00e98000-00e9a000 r-xp 00000000 fd:00 13959193 /lib/libdl-2.5.so 00e9a000-00e9b000 r-xp 00001000 fd:00 13959193 /lib/libdl-2.5.so 00e9b000-00e9c000 rwxp 00002000 fd:00 13959193 /lib/libdl-2.5.so 00e9c000-00ea1000 r-xp 00000000 fd:00 13959219 /lib/libcrypt-2.5.so 00ea1000-00ea2000 r-xp 00004000 fd:00 13959219 /lib/libcrypt-2.5.so 00ea2000-00ea3000 rwxp 00005000 fd:00 13959219 /lib/libcrypt-2.5.so 00ea3000-00eca000 rwxp 00ea3000 00:00 0 80000000-8001d000 r-xp 00000000 fd:00 13100199 /usr/local/sbin/radiusd 8001d000-8001e000 rw-p 0001d000 fd:00 13100199 /usr/local/sbin/radiusd 8001e000-8001f000 rw-p 8001e000 00:00 0 80f4e000-81035000 rw-p 80f4e000 00:00 0 b7e00000-b7e21000 rw-p b7e00000 00:00 0 b7e21000-b7f00000 ---p b7e21000 00:00 0 b7fbe000-b7fc2000 rw-p b7fbe000 00:00 0 b7fd0000-b7fd2000 rw-p b7fd0000 00:00 0 bf81b000-bf84c000 rw-p bf81b000 00:00 0 [stack]

2 1