- Freeradius-Users - lists.freeradius.org

RE: PEAP-MSCHAPv2 against AD
by Jonathan De Graeve 25 Sep '06

25 Sep '06

> > > Login incorrect: [IMZ\\jonathan/<no User-Password attribute>] (from > > Do you have: > > realm IMZ { > type = radius > authhost = LOCAL > accthost = LOCAL > } > > In your proxy.conf file? You don't need the realm (I already tried that one and that didn't work)

1 0

PEAP-MSCHAPv2 against AD
by Jonathan De Graeve 25 Sep '06

25 Sep '06

I'm trying todo PEAP-MSCHAPv2 with authentication against an AD Currently I have the following problem: When the domain is in the username the authentication fails, if the domainname isn't in the authentication the authentication succeeds. I'm using the following ntlm_auth line in radiusd.conf: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 --domain=%{mschap:NT-Domain:-IMZ}" The with_ntdomain_hack = yes is enabled in the mschap {} Output from shell: radius1:/etc/freeradius# /usr/bin/ntlm_auth --request-nt-key --username=IMZ\\beheerder --challenge=e456e008c25a9ac7 --nt-response=28e9d997b30267a36af64a4fcb530cd6b08f1141c09bc580 --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 --domain=IMZ Logon failure (0xc000006d) radius1:/etc/freeradius# /usr/bin/ntlm_auth --request-nt-key --username=beheerder --challenge=e456e008c25a9ac7 --nt-response=28e9d997b30267a36af64a4fcb530cd6b08f1141c09bc580 --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 --domain=IMZ NT_KEY: EB23807FB13B1CAB06F4F0BBE5C199D0 Debugging information (with a different user) Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 252 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020800471a0208004231f622919de18b1fdab0ca9902b9729d49000000000000000013 37f654a247b82ba252becd3320cdd94974567666fa081800494d5a5c6a6f6e617468616e PEAP: Setting User-Name to IMZ\jonathan PEAP: Adding old state with 8f f9 PEAP: Sending tunneled request EAP-Message = 0x020800471a0208004231f622919de18b1fdab0ca9902b9729d49000000000000000013 37f654a247b82ba252becd3320cdd94974567666fa081800494d5a5c6a6f6e617468616e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "IMZ\\jonathan" State = 0x8ff913e6997d7ca8d6a9b4832ff5c931 NAS-IP-Address = 194.8.52.161 Connect-Info = "CONNECT 802.11" Called-Station-Id = "000fb5df0524" Calling-Station-Id = "004096ab4eed" NAS-Identifier = "ap" NAS-Port-Type = Wireless-802.11 NAS-Port = 4 NAS-Port-Id = "4" Framed-MTU = 1400 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 252 modcall[authorize]: module "preprocess" returns ok for request 252 modcall[authorize]: module "attr_filter" returns noop for request 252 modcall[authorize]: module "chap" returns noop for request 252 modcall[authorize]: module "mschap" returns noop for request 252 modcall[authorize]: module "digest" returns noop for request 252 rlm_realm: No '@' in User-Name = "IMZ\jonathan", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 252 rlm_eap: EAP packet type response id 8 length 71 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 252 modcall[authorize]: module "files" returns notfound for request 252 radius_xlat: 'IMZ\\jonathan' rlm_sql (sql): sql_set_user escaped user --> 'IMZ\\jonathan' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'IMZ=5C=5C=5C=5Cjonathan' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User IMZ\\jonathan not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'IMZ=5C=5C=5C=5Cjonathan' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'IMZ=5C=5C=5C=5Cjonathan' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User IMZ\\jonathan not found in radgroupcheck rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 252 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "validfromlogin" returns noop for request 252 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "validfromcreation" returns noop for request 252 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "uploadlimit" returns noop for request 252 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "volumelimit" returns noop for request 252 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "prepaidcounter" returns noop for request 252 modcall: leaving group authorize (returns updated) for request 252 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 252 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 252 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for jonathan with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 05 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=IMZ\\jonathan --challenge=d13cab581e1c3097 --nt-response=1337f654a247b82ba252becd3320cdd94974567666fa0818 --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 --domain=IMZ' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=IMZ\\jonathan --challenge=d13cab581e1c3097 --nt-response=1337f654a247b82ba252becd3320cdd94974567666fa0818 --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 --domain=IMZ Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 252 modcall: leaving group MS-CHAP (returns reject) for request 252 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 252 modcall: leaving group authenticate (returns reject) for request 252 auth: Failed to validate the user. Login incorrect: [IMZ\\jonathan/<no User-Password attribute>] (from client localhost port 4 cli 004096ab4eed) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x8978750 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE Anyone out there who nows how to solve this problem? PS I'm running freeradius 1.1.3 Thx in advance, J. -- Jonathan De Graeve Network/System Engineer Imelda vzw Informatica Dienst +32 15/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite ---------

2 1

RE: PEAP-MSCHAPv2 against AD
by Garber, Neal 25 Sep '06

25 Sep '06

> Login incorrect: [IMZ\\jonathan/<no User-Password attribute>] (from Do you have: realm IMZ { type = radius authhost = LOCAL accthost = LOCAL } In your proxy.conf file?

1 0

RE: PEAP-MSCHAPv2 against AD
by Jonathan De Graeve 25 Sep '06

25 Sep '06

Never mind, found the solutions as: ntlm_auth --username=%{mschap:User-Name} --foobar J. -- Jonathan De Graeve Network/System Engineer Imelda vzw Informatica Dienst +32 15/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.degraeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.degraeve=imelda.be(a)lists.freeradius.org] Namens Jonathan > De Graeve > Verzonden: maandag 25 september 2006 17:34 > Aan: FreeRadius users mailing list > Onderwerp: PEAP-MSCHAPv2 against AD > > I'm trying todo PEAP-MSCHAPv2 with authentication against an AD > > Currently I have the following problem: > > When the domain is in the username the authentication fails, if the > domainname isn't in the authentication the authentication succeeds. I'm > using the following ntlm_auth line in radiusd.conf: > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --username=%{Stripped-User-Name:-%{User-Name:-None}} > --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00} > --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 > --domain=%{mschap:NT-Domain:-IMZ}" > > The with_ntdomain_hack = yes is enabled in the mschap {} > > Output from shell: > radius1:/etc/freeradius# /usr/bin/ntlm_auth --request-nt-key > --username=IMZ\\beheerder --challenge=e456e008c25a9ac7 > --nt-response=28e9d997b30267a36af64a4fcb530cd6b08f1141c09bc580 > --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 > --domain=IMZ > Logon failure (0xc000006d) > radius1:/etc/freeradius# /usr/bin/ntlm_auth --request-nt-key > --username=beheerder --challenge=e456e008c25a9ac7 > --nt-response=28e9d997b30267a36af64a4fcb530cd6b08f1141c09bc580 > --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 > --domain=IMZ > NT_KEY: EB23807FB13B1CAB06F4F0BBE5C199D0 > > > Debugging information (with a different user) > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 252 > rlm_eap: Request found, released from the list > rlm_eap: EAP/peap > rlm_eap: processing type peap > rlm_eap_peap: Authenticate > rlm_eap_tls: processing TLS > eaptls_verify returned 7 > rlm_eap_tls: Done initial handshake > eaptls_process returned 7 > rlm_eap_peap: EAPTLS_OK > rlm_eap_peap: Session established. Decoding tunneled attributes. > rlm_eap_peap: EAP type mschapv2 > rlm_eap_peap: Tunneled data is valid. > PEAP: Got tunneled EAP-Message > EAP-Message = > 0x020800471a0208004231f622919de18b1fdab0ca9902b9729d49000000000000000013 > 37f654a247b82ba252becd3320cdd94974567666fa081800494d5a5c6a6f6e617468616e > PEAP: Setting User-Name to IMZ\jonathan > PEAP: Adding old state with 8f f9 > PEAP: Sending tunneled request > EAP-Message = > 0x020800471a0208004231f622919de18b1fdab0ca9902b9729d49000000000000000013 > 37f654a247b82ba252becd3320cdd94974567666fa081800494d5a5c6a6f6e617468616e > FreeRADIUS-Proxied-To = 127.0.0.1 > User-Name = "IMZ\\jonathan" > State = 0x8ff913e6997d7ca8d6a9b4832ff5c931 > NAS-IP-Address = 194.8.52.161 > Connect-Info = "CONNECT 802.11" > Called-Station-Id = "000fb5df0524" > Calling-Station-Id = "004096ab4eed" > NAS-Identifier = "ap" > NAS-Port-Type = Wireless-802.11 > NAS-Port = 4 > NAS-Port-Id = "4" > Framed-MTU = 1400 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 252 > modcall[authorize]: module "preprocess" returns ok for request 252 > modcall[authorize]: module "attr_filter" returns noop for request 252 > modcall[authorize]: module "chap" returns noop for request 252 > modcall[authorize]: module "mschap" returns noop for request 252 > modcall[authorize]: module "digest" returns noop for request 252 > rlm_realm: No '@' in User-Name = "IMZ\jonathan", looking up realm > NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 252 > rlm_eap: EAP packet type response id 8 length 71 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 252 > modcall[authorize]: module "files" returns notfound for request 252 > radius_xlat: 'IMZ\\jonathan' > rlm_sql (sql): sql_set_user escaped user --> 'IMZ\\jonathan' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM > radcheck WHERE Username = 'IMZ=5C=5C=5C=5Cjonathan' > ORDER BY id' > rlm_sql (sql): Reserving sql socket id: 3 > rlm_sql (sql): User IMZ\\jonathan not found in radcheck > radius_xlat: 'SELECT > radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou > pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE > usergroup.Username = 'IMZ=5C=5C=5C=5Cjonathan' AND usergroup.GroupName = > radgroupcheck.GroupName ORDER BY radgroupcheck.id' > radius_xlat: 'SELECT > radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou > preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE > usergroup.Username = 'IMZ=5C=5C=5C=5Cjonathan' AND usergroup.GroupName = > radgroupreply.GroupName ORDER BY radgroupreply.id' > rlm_sql (sql): User IMZ\\jonathan not found in radgroupcheck > rlm_sql (sql): Released sql socket id: 3 > rlm_sql (sql): User not found > modcall[authorize]: module "sql" returns notfound for request 252 > rlm_sqlcounter: Entering module authorize code > rlm_sqlcounter: Could not find Check item value pair > modcall[authorize]: module "validfromlogin" returns noop for request > 252 > rlm_sqlcounter: Entering module authorize code > rlm_sqlcounter: Could not find Check item value pair > modcall[authorize]: module "validfromcreation" returns noop for > request 252 > rlm_sqlcounter: Entering module authorize code > rlm_sqlcounter: Could not find Check item value pair > modcall[authorize]: module "uploadlimit" returns noop for request 252 > rlm_sqlcounter: Entering module authorize code > rlm_sqlcounter: Could not find Check item value pair > modcall[authorize]: module "volumelimit" returns noop for request 252 > rlm_sqlcounter: Entering module authorize code > rlm_sqlcounter: Could not find Check item value pair > modcall[authorize]: module "prepaidcounter" returns noop for request > 252 > modcall: leaving group authorize (returns updated) for request 252 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 252 > rlm_eap: Request found, released from the list > rlm_eap: EAP/mschapv2 > rlm_eap: processing type mschapv2 > Processing the authenticate section of radiusd.conf > modcall: entering group MS-CHAP for request 252 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: No User-Password configured. Cannot create NT-Password. > rlm_mschap: Told to do MS-CHAPv2 for jonathan with NT-Password > radius_xlat: Running registered xlat function of module mschap for > string 'Challenge' > mschap2: 05 > radius_xlat: Running registered xlat function of module mschap for > string 'NT-Response' > radius_xlat: Running registered xlat function of module mschap for > string 'NT-Domain' > radius_xlat: '/usr/bin/ntlm_auth --request-nt-key > --username=IMZ\\jonathan --challenge=d13cab581e1c3097 > --nt-response=1337f654a247b82ba252becd3320cdd94974567666fa0818 > --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 > --domain=IMZ' > Exec-Program: /usr/bin/ntlm_auth --request-nt-key > --username=IMZ\\jonathan --challenge=d13cab581e1c3097 > --nt-response=1337f654a247b82ba252becd3320cdd94974567666fa0818 > --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 > --domain=IMZ > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > rlm_mschap: FAILED: MS-CHAP2-Response is incorrect > modcall[authenticate]: module "mschap" returns reject for request 252 > modcall: leaving group MS-CHAP (returns reject) for request 252 > rlm_eap: Freeing handler > modcall[authenticate]: module "eap" returns reject for request 252 > modcall: leaving group authenticate (returns reject) for request 252 > auth: Failed to validate the user. > Login incorrect: [IMZ\\jonathan/<no User-Password attribute>] (from > client localhost port 4 cli 004096ab4eed) > PEAP: Got tunneled reply RADIUS code 3 > MS-CHAP-Error = "\010E=691 R=1" > EAP-Message = 0x04080004 > Message-Authenticator = 0x00000000000000000000000000000000 > PEAP: Processing from tunneled session code 0x8978750 3 > MS-CHAP-Error = "\010E=691 R=1" > EAP-Message = 0x04080004 > Message-Authenticator = 0x00000000000000000000000000000000 > PEAP: Tunneled authentication was rejected. > rlm_eap_peap: FAILURE > > Anyone out there who nows how to solve this problem? > > PS I'm running freeradius 1.1.3 > > Thx in advance, > > > J. > > -- > Jonathan De Graeve > Network/System Engineer > Imelda vzw > Informatica Dienst > +32 15/50.52.98 > jonathan.de.graeve(a)imelda.be > > --------- > Always read the manual for the correct way to do things because the > number of incorrect ways to do things is almost infinite > --------- > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

need help with error
by Mike May 25 Sep '06

25 Sep '06

I have noticed in my log's this error and do not know what it means, or where to look to start fixing it.. thanks in advance Mike rlm_eap_tls: Length Included Mon Sep 25 08:58:16 2006 : Error: TLS_accept:error in SSLv3 read client cert ificate A Mon Sep 25 08:58:16 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon Sep 25 08:58:16 2006 : Info: rlm_eap_tls: Length Included Mon Sep 25 08:58:16 2006 : Info: (other): SSL negotiation finished successfu lly

3 2

Segfault with EAP-PEAP/MSCHAPv2
by Paul A Roberts 25 Sep '06

25 Sep '06

I'm having a problem trying to use FreeBSD 6.1 with FreeRADIUS. I'd like to use PEAP/MSCHAPV2 but it keeps crashing. I stopped using FreeRADIUS a long time ago because it wasn't very stable on my Redhat 8.0. I thought I'd give it another try (new system, OS, and peap instead of EAP-TLS) and basically the same thing! Argh! When I try to authenticate with radiusd -xx running I get: TLS_accept: before/accept initialization TLS_accept: SSLv3 read client hello A TLS_accept: SSLv3 write server hello A Segmentation fault (core dumped) Every time I try to authenticate FreeRADIUS crashes at that spot. FreeRADIUS Version 1.1.2 is what's running. Any ideas? I've been trying to get this working for so long it's getting very frustrating...especially when the Cisco ACS is practically just point...click...and works for peap. I've reviewed dozens of online howtos on this but the seg fault has got me stumped. I can authenticate with the NTradping Windows utility using MS-CHAP just fine without crashing it. Thanks for any assistance.

2 1

Freeradius + OpenLDAP - user password problem
by Stuckzor 25 Sep '06

25 Sep '06

Hello, as you can see, i must be pretty desperate to register somewhere so i can ask for help. Anyway, the situation is: i recently set up a freeradius server with openldap for auth., everything seemed to work great (radtest returns access-accept ), until i tried to login via notebook and Linksys router (with dd-wrt firmware). Linksys is properly configured, i believe. On laptop i have chosen WPA 2 security using ms-chap, and when i try to connect, access-request packet doesn't contain attribute user-password! I am really stuck here, have no idea what to do so any help would be really apprechiated. If you need additional info i will be glad to asisst (e.g. post debug output or something). -- View this message in context: http://www.nabble.com/Freeradius-%2B-OpenLDAP---user-password-problem-tf201… Sent from the FreeRadius - User forum at Nabble.com.

9 47

Peap+TTLs and Ldap
by Francisco Castanheiro 24 Sep '06

24 Sep '06

Hello, i'm using freeradius to do the auth on a wireless network. My users are in a Ldap directory that have both NT-Password and UserPassword, i use ldap to auth linux users and samba+ldap to auth windows users. I have PEAP and ttls set up in my config and some test users with clear password in the users file, plus the ldap users. I have no problems with ttls auth, both with ldap and "local" test users, but i can't say the same about peap. When i try to use peap to auth a "local" user it goes fine, but when the user is a ldap one it just fails. I have the map between ldap and radius attributes setup. I think that my ldap NT hashes are correct because i can use them to auth my windows users with samba, but the only thing that i can see that differs from both the scenarios that i described is that ttls uses the "userpassword" attr and PEAP uses the NT-Password attr. And i know that peap works when the password is clear, because it works with the "local" test users. Could some bad config do this behavior? Or could it be some problem with my version of freeradius and my NT hashes? I'm out of ideas. If my config or logs help i can post them. Thanks for any help. Regards --- Francisco Castanheiro Departamento de Informática Faculdade de Ciências e Tecnologia - UNL E-mail: fdsc(a)di.fct.unl.pt

1 1

EAP-PEAP, SSL, Segmentation Fault
by Nick Larsen 24 Sep '06

24 Sep '06

Hi, Does anyone know what may be happening here? I'm trying to get PEAP logins working from a wireless access point, and on every login attempt (whether correct or incorrect username or password in all combinations) FreeRADIUS Seg Faults. I'm using the default certificates that come with FreeRADIUS (1.1.3), and have also tried generating and self signing SSL certificates via openssl. I'm testing the server on out local network, but the server will be publically accessable once up and ready. (also, what should the commonName be set as for the certificate, or does this not matter?) `uname -a` output FreeBSD finc.01online.co.nz 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Thu Nov 3 09:36:13 UTC 2005 root@x64.samsco.home:/usr/obj/usr/src/sys/GENERIC i386 Here is the output from `radiusd -XA` till the end of the login (my guess is the SSL side of things isn't working): Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addre ss, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/de tail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.1.196:1040, id=0, length=196 Message-Authenticator = 0x8559d2fd6863050916c31324405391c1 Service-Type = Framed-User User-Name = "blah" Framed-MTU = 1488 Called-Station-Id = "00-80-48-36-54-81:compex-wpe54ag" Calling-Station-Id = "00-09-2D-0E-5F-3B" NAS-Identifier = "ZeroOne Baby WiFi" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000901626c6168 NAS-IP-Address = 10.10.1.196 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "blah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 10.10.1.196 port 1040 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100160410f390bcd28d5a39f5f449cc5d8130669a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x95c0077ace87ab4b3f1230df0a5d5696 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.1.196:1040, id=1, length=211 Message-Authenticator = 0xa7cfb526bf546834ba5d3b0c56e8fdb5 Service-Type = Framed-User User-Name = "blah" Framed-MTU = 1488 State = 0x95c0077ace87ab4b3f1230df0a5d5696 Called-Station-Id = "00-80-48-36-54-81:compex-wpe54ag" Calling-Station-Id = "00-09-2D-0E-5F-3B" NAS-Identifier = "ZeroOne Baby WiFi" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020100060319 NAS-IP-Address = 10.10.1.196 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "blah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 10.10.1.196 port 1040 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0999987376b43477d4152a6a4a954f9e Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.1.196:1040, id=2, length=279 Message-Authenticator = 0xf88c4e5d9853cc6b3bfa78463aa89b85 Service-Type = Framed-User User-Name = "blah" Framed-MTU = 1488 State = 0x0999987376b43477d4152a6a4a954f9e Called-Station-Id = "00-80-48-36-54-81:compex-wpe54ag" Calling-Station-Id = "00-09-2D-0E-5F-3B" NAS-Identifier = "ZeroOne Baby WiFi" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0202004a198000000040160301003b01000037030105b84d77af64a7 f566d3091571f0bf326453ac38c63e22c5ece6ba62e008f4b400001000040005000a000900640062 000300060100 NAS-IP-Address = 10.10.1.196 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "blah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 74 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization TLS_accept: SSLv3 read client hello A TLS_accept: SSLv3 write server hello A Segmentation fault: 11 (core dumped) I've been trying to figure out the problem for weeks, so any replies/info would be greatly appreciated, -- Regards, Nick Larsen Wellington NEW ZEALAND

1 0

WPA+freeradius problem?
by Giuseppina Venezia 24 Sep '06

24 Sep '06

Hi, i'm trying to use freeradius+chillispot (in proxy mode)+ wpa. When i try to connect with a client, autentication fails. This is the log, if you need my config, please tell me. Thanks in advance. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=mydomain,dc=it" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "PASSWORD" ldap: basedn = "ou=mydepartment,dc=mydomain,dc=it" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "userPassword" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusGroupName mapped to RADIUS Ldap-Group rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id rlm_ldap: LDAP radiusMaxBandwidthDown mapped to RADIUS WISPr-Bandwidth-Max-Down rlm_ldap: LDAP radiusMaxBandwidthUp mapped to RADIUS WISPr-Bandwidth-Max-Up rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8143b98 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded checkval checkval: item-name = "Calling-Station-Id" checkval: check-name = "Calling-Station-Id" checkval: data-type = "string" checkval: notfound-reject = yes rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiated checkval (checkval) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded IPPOOL ippool: session-db = "/usr/local/etc/raddb/db.ippool" ippool: ip-index = "/usr/local/etc/raddb/db.ipindex" ippool: range-start = 192.168.182.129 IP address [192.168.182.129] ippool: range-stop = 192.168.182.254 IP address [192.168.182.254] ippool: netmask = 255.255.255.0 IP address [255.255.255.0] ippool: cache-size = 800 ippool: override = no ippool: maximum-timeout = 0 Module: Instantiated ippool (main_pool) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=125 User-Name = "prof1" EAP-Message = 0x0200000a0170726f6631 Message-Authenticator = 0xe1ea70d586e9404dfe60cf2d2688d2e2 Calling-Station-Id = "00-11-24-94-D4-DA" Called-Station-Id = "00-50-BF-E3-E8-2A" NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-IP-Address = 0.0.0.0 NAS-Identifier = "localhost" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "prof1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 154 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mydepartment,dc=mydomain,dc=it' radius_xlat: '(uid=prof1)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mydomain,dc=it/PASSWORD to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=mydepartment,dc=mydomain,dc=it, with filter (uid=prof1) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmydepartment\2cdc\3dmydomain\2cdc\3dit))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmydepartment\2cdc\3dmydomain\2cdc\3dit)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mydepartment,dc=mydomain,dc=it, with filter (&(cn=professor)(|(&(objectClass=GroupOfNames)(member=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmydepartment\2cdc\3dmydomain\2cdc\3dit))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmydepartment\2cdc\3dmydomain\2cdc\3dit)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Maurizio Costanzo,ou=faculty,ou=dspsa,ou=mydepartment,dc=mydomain,dc=it, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group professor rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 176 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for prof1 radius_xlat: '(uid=prof1)' radius_xlat: 'ou=mydepartment,dc=mydomain,dc=it' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mydepartment,dc=mydomain,dc=it, with filter (uid=prof1) rlm_ldap: checking if remote access for prof1 is allowed by userPassword rlm_ldap: Added password a in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusGroupName as Ldap-Group, value professor & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-05-5D-25-12-5B & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-02-C7-8F-A0-16 & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-0B-6B-4A-22-E8 & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-17-F2-44-11-C2 & op=21 rlm_ldap: Adding userPassword as User-Password, value a & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user prof1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-11-24-94-D4-DA rlm_checkval: Value Name: Calling-Station-Id, Value: 00-05-5D-25-12-5B rlm_checkval: Value Name: Calling-Station-Id, Value: 00-02-C7-8F-A0-16 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-0B-6B-4A-22-E8 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-17-F2-44-11-C2 modcall[authorize]: module "checkval" returns reject for request 0 modcall: leaving group authorize (returns reject) for request 0 Invalid user (rlm_checkval: This Calling-Station-Id is not allowed for the user): [prof1/<no User-Password attribute>] (from client localhost port 2 cli 00-11-24-94-D4-DA) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=125 Sending Access-Reject of id 0 to 127.0.0.1 port 1025 --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 450125f0 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:1025, id=1, length=125 User-Name = "prof1" EAP-Message = 0x0200000a0170726f6631 Message-Authenticator = 0xe1a97d3a12b9bb211b325e1e7349be14 Calling-Station-Id = "00-11-24-94-D4-DA" Called-Station-Id = "00-50-BF-E3-E8-2A" NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-IP-Address = 0.0.0.0 NAS-Identifier = "localhost" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "prof1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 154 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mydepartment,dc=mydomain,dc=it' radius_xlat: '(uid=prof1)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mydepartment,dc=mydomain,dc=it, with filter (uid=prof1) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmydepartment\2cdc\3dmydomain\2cdc\3dit))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmydepartment\2cdc\3dmydomain\2cdc\3dit)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mydepartment,dc=mydomain,dc=it, with filter (&(cn=professor)(|(&(objectClass=GroupOfNames)(member=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmydepartment\2cdc\3dmydomain\2cdc\3dit))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmydepartment\2cdc\3dmydomain\2cdc\3dit)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Maurizio Costanzo,ou=faculty,ou=dspsa,ou=mydepartment,dc=mydomain,dc=it, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group professor rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 176 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for prof1 radius_xlat: '(uid=prof1)' radius_xlat: 'ou=mydepartment,dc=mydomain,dc=it' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mydepartment,dc=mydomain,dc=it, with filter (uid=prof1) rlm_ldap: checking if remote access for prof1 is allowed by userPassword rlm_ldap: Added password a in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusGroupName as Ldap-Group, value professor & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-05-5D-25-12-5B & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-02-C7-8F-A0-16 & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-0B-6B-4A-22-E8 & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-17-F2-44-11-C2 & op=21 rlm_ldap: Adding userPassword as User-Password, value a & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user prof1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-11-24-94-D4-DA rlm_checkval: Value Name: Calling-Station-Id, Value: 00-05-5D-25-12-5B rlm_checkval: Value Name: Calling-Station-Id, Value: 00-02-C7-8F-A0-16 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-0B-6B-4A-22-E8 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-17-F2-44-11-C2 modcall[authorize]: module "checkval" returns reject for request 1 modcall: leaving group authorize (returns reject) for request 1 Invalid user (rlm_checkval: This Calling-Station-Id is not allowed for the user): [prof1/<no User-Password attribute>] (from client localhost port 2 cli 00-11-24-94-D4-DA) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=1, length=125 Sending Access-Reject of id 1 to 127.0.0.1 port 1025 --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 1 with timestamp 4501260d Nothing to do. Sleeping until we see a request.

2 2