- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 15, Issue 45
by Kun Niu 14 Jul '06

14 Jul '06

But still, you can try as he said.:-( > ------------------------------ > > Message: 4 > Date: Thu, 13 Jul 2006 23:16:35 -0400 > From: Gary.Blydenburgh(a)interactivedata.com > Subject: Re: Crypt-Password Problem > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <OF8C3DA2DE.C826ABAC-ON852571AB.0011AF0E-852571AB.0011FF75(a)interactivedata.com> > > Content-Type: text/plain; charset=US-ASCII > > > > freeradius-users-bounces+gary.blydenburgh=interactivedata.com(a)lists.freeradius.org > wrote on 07/13/2006 11:06:56 PM: > > > Quoting Gary.Blydenburgh(a)interactivedata.com: > > > > > > > > Excuse me if this has been asked before but I am having a hard time > finding > > > it in the archives. I have a script that builds a radius users file > out of > > > a htpasswd file, the password entries are encrypted. This worked great > on > > > a Redhat Enterprise AS 3 server running freeradius-0.9.3. I have since > had > > > to upgrade my linux box (to RHEL 4) and used the version that came with > it, > > > freeradius-1.0.1. Now users can not authenticate. > > > > > > Here is an entry for the user in the USERS file: > > > > > > juser Auth-Type := Local, Crypt-Password == "H25nfgL4rCxBY" > > > Service-Type = Framed-User, > > > Framed-Protocol = PPP, > > > > > > > Here is the problem in your debugging data. > > > > rad_recv: Access-Request packet from host 172.24.0.14:36180, id=72, > > length=46 > > User-Name = "user" > > User-Password = "password" > > > > The password is coming through as User-Password, NOT Crypt-Password. So, > it > > matches nothing in the users file. Furthermore, probably in plain text > not > > encrypted form like you expect. > > > > Chris Carver > > Network Engineer > > > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > First off Chris thank you for responding to me email so quickly. > > Here is a DEBUG from the 0.9.3 server that is still working, using the same > users file, and same client request. Here you see the same User-Password > but further down you see: > rad_check_password: Found Auth-Type Local > auth: type Crypt > Login OK: [d4lane] (from client slpma1nagioswan port 0) > > > FULL DEBUG BELOW: > [root@slpma1ldap01 raddb]# /usr/local/sbin/radiusd -X > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/proxy.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/snmp.conf > Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/usr/local/var" > main: logdir = "/var/log/radius" > main: libdir = "/usr/local/lib" > main: radacctdir = "/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/radius/radius.log" > main: log_auth = yes > main: log_auth_badpass = yes > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > Using deprecated clients file. Support for this will go away soon. > read_config_files: reading realms > Using deprecated realms file. Support for this will go away soon. > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > rlm_eap: Loaded and initialized the type md5 > Module: Instantiated eap (eap) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > Module: Instantiated mschap (mschap) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port-Id" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on IP address *, ports 1645/udp and 1646/udp, with proxy on > 1647/udp. > Ready to process requests. > rad_recv: Access-Request packet from host 172.24.0.14:51838, id=243, > length=46 > User-Name = "user" > User-Password = "password" > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "eap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "d4lane", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > users: Matched d4lane at 7993 > modcall[authorize]: module "files" returns ok for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type Local > auth: type Crypt > Login OK: [d4lane] (from client slpma1nagioswan port 0) > Sending Access-Accept of id 243 to 172.24.0.14:51838 > Service-Type = Framed-User > Framed-Protocol = PPP > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 243 with timestamp 44b70b87 > Nothing to do. Sleeping until we see a request. > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 15, Issue 45 > ************************************************ >

1 0

ntlm_auth - rlm_mschap: No User-Password configured. Cannot create NT-Password.
by Peter de Groot 14 Jul '06

14 Jul '06

Please help ........ I cannot see the problem after a day of reading the lists and googling... hopefully a fresh pair of eyes ???? I am trying to authorize to the network via an ntlm_auth lookup against winbind using PEAP and MS-CHAP v2 etc etc Doing an ntlm_auth on the command line returns success... but on my radius server does not want to authenticate. I am fairly sure I have the certificates ok ?? Samba is joined to the windows domain o.k. I am trying to autheticate against a different domain that than the samba server is joined to.. should be ok ?? [root@curric4182-05 raddb]# ntlm_auth --request-nt-key --domain=admin4182 --username=e2052982 password: NT_STATUS_OK: Success (0x0) [root@curric4182-05 raddb]# . . . . my "stuff" is XP-SP2 Fedora Core 5 Samba 3.0.22-1 Freeradius 1.1.2 Windows 2003 Server AD Cisco Aironet 1100 series . . . Error message is modcall: entering group MS-CHAP for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for e2052982 with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: d6 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=e2052982 --domain=ADMIN4182 --challenge=7801a84637ef5c68 --nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=e2052982 --domain=ADMIN4182 --challenge=7801a84637ef5c68 --nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 . . . radius -X dump follows .... sorry about the length .. trimmed after first error. TIA Peter Peter de Groot Windows Re-Installation Engineer Eastern Goldfields College Ph 08) 90801800 Fax 08) 90801866 Mob 0418915312 http://egshs.wa.edu.au Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/curric4182-05-cert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/curric4182-05-cert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/EGC-cacert.pem" tls: private_key_password = "blah-blahk" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.251.20.20:1645, id=236, length=154 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0xe11606b2cec3600fff69002a34d3c5ce EAP-Message = 0x020200170141444d494e343138325c6532303532393832 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 23 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 236 to 10.251.20.20 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd474c0e53a0b58913df6a8463f681310 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=237, length=229 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0x08066899804ab07de6e77f4699f1aa83 EAP-Message = 0x0203005019800000004616030100410100003d030144b60c0f0ad558b9ba802bc7e5262d89eef41c42b99e1b2586f2674e6c13b4d200001600040005000a000900640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0xd474c0e53a0b58913df6a8463f681310 NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0927], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 237 to 10.251.20.20 port 1645 EAP-Message = 0x0104040a19c000000984160301004a02000046030144b60c6efb4a889fffbb7a1040fa321fed2f98d15922ba81f97720e9bf91222320e869084b36650b68cdb4f4448d3065f4c7e377e45b0a954fb72ee565850327fc00040016030109270b0009230009200004a33082049f30820408a003020102020101300d06092a864886f70d01010505003081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954310c30 EAP-Message = 0x0a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f74406465742e77612e6564752e6175301e170d3036303731333036313435305a170d3037303731333036313435305a3081ba310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954311630140603550403130d637572726963343138322d30353130302e06092a864886f70d0109011621637572726963343138 EAP-Message = 0x322d30352e637572726963343138322e696e7465726e616c30819f300d06092a864886f70d010101050003818d0030818902818100bcf987fa92038c5aa5258da59449a17ec88d0f6e74cd57a6a60d164878cd19cc41114bb9219fc9589b596dfc8bd29dcfad5a07dbb902ed55e4aacabb896bb66fa7e4cd8a91a59a4da8ce7fde59da64a5b41a847ce049a84434f7ff66c82131d483823a6fcc75e87c4bf0ac50afe9ce76fc31c249377e588cf0e8a600873119490203010001a38201c0308201bc30090603551d1304023000301106096086480186f8420101040403020640302b06096086480186f842010d041e161c54696e7943412047656e6572 EAP-Message = 0x61746564204365727469666963617465301d0603551d0e0416041401407fe6428a641a57e2635f01914af69a50b8673081e00603551d230481d83081d58014c4425cf4ef64fc9ccb4fd2bcf3e4d1807424c623a181b1a481ae3081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954310c300a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f7440646574 EAP-Message = 0x2e77612e6564752e617582090093e8cb38c994b33630 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcb5b324f80946972d9dc9a23642def96 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=238, length=155 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0xd2bcd6f014b60cf655218dedefae808e EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0xcb5b324f80946972d9dc9a23642def96 NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 238 to 10.251.20.20 port 1645 EAP-Message = 0x010504061940270603551d120420301e811c70657465722e64652e67726f6f74406465742e77612e6564752e6175302c0603551d11042530238121637572726963343138322d30352e637572726963343138322e696e7465726e616c30160603551d250101ff040c300a06082b06010505070301300d06092a864886f70d0101050500038181000c02343214413546cb4ab2027fd6af5df023ed1ce47222a67e973b312e935480866898ca3c2fe7709e8e7ba889fc55f7738f6ecc80a6bf2821c11a5a479cc2a790415b7566d94bf95f9216f8026f130b5a6f6fe447aab9728363e57b9feb4dbf189615446f7265b702016e117cfc8cb03640cb1f2f0d EAP-Message = 0xb6aa78b4dddd66df23a900047730820473308203dca00302010202090093e8cb38c994b336300d06092a864886f70d01010505003081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954310c300a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f74406465742e77612e6564752e6175301e170d3036303731333036313234395a170d3136303731303036 EAP-Message = 0x313234395a3081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954310c300a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f74406465742e77612e6564752e617530819f300d06092a864886f70d010101050003818d0030818902818100a67e2366b0427ae2c7dab4cef1a303895c9f5ecaecf41dca705e1ae01dc9fa60866dbc7b1727ed2394fb4b02cc EAP-Message = 0x25398c9720c8f8db1e9d1ab70b224e334bc05346153a021b51fd929b073823b12fec849c442b0ca0ccfe0c691f992369d959f24435e04f657ff3ff023ba0adc554dabca8106ea86298892463f0ff3c1be161510203010001a382019b30820197301d0603551d0e04160414c4425cf4ef64fc9ccb4fd2bcf3e4d1807424c6233081e00603551d230481d83081d58014c4425cf4ef64fc9ccb4fd2bcf3e4d1807424c623a181b1a481ae3081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20 EAP-Message = 0x476f6c646669656c647320436f6c6c656765 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf469ad941f526e94ec1351410d1ff22c Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=239, length=155 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0x299168c635a6458965c93d093b864675 EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0xf469ad941f526e94ec1351410d1ff22c NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 239 to 10.251.20.20 port 1645 EAP-Message = 0x0106018a1900310b3009060355040b13024954310c300a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f74406465742e77612e6564752e617582090093e8cb38c994b336300f0603551d130101ff040530030101ff301106096086480186f842010104040302010630090603551d1204023000302b06096086480186f842010d041e161c54696e7943412047656e65726174656420436572746966696361746530270603551d110420301e811c70657465722e64652e67726f6f74406465742e77612e6564752e6175300e0603551d0f0101ff040403020106300d06092a864886f70d0101050500 EAP-Message = 0x03818100798ce3529751d1c0f5255a9ad4e083fe1748a50b633ed1f7cf22e644900e6eba42faae43d7476f486949d0169bda6336338a223b8a529af38c2b4118e933a7ddcda9560b47aaa7ef684b3cd850f961d6f2a75c2fb608dc5dbf49f24f0e6ab33c875ec6df3cccf92177beff8374764aa9d32d59917cbfd0a772295c6165d37bd716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x834ab11b4b0532b9f3d7d32909e2f097 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=240, length=341 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0x11c2e6a099432e32221ecf243b2c342e EAP-Message = 0x020600c01980000000b6160301008610000082008068ea556a9d5bcff59d96209d732af9caba7c63c152206d7199be1a1b8723bde99b893065593eab9245bf98d712fbab31dc2aa5c2263bfa02bac2cbba65fe22b052bda4ce12163f452d40f88a927b37332c1d46081ae1255645b054d1e84761a15b75a1d3d3232a3d022625bed50921834c664db630a1f477ed7e35fa481cf96e1403010001011603010020e0786671da68ad577ac671807db1b1e35e0dd5e202baf00b0a9b9b30399b8200 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0x834ab11b4b0532b9f3d7d32909e2f097 NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 240 to 10.251.20.20 port 1645 EAP-Message = 0x0107003119001403010001011603010020931e9dc13b975a6087224dba25c64077e2ad548c12975f883faa74b60b0bda93 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4f1d96b5b26ae63457b22012f66e7fad Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=241, length=155 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0x032b0a3a7ca860bc528ba8041fcb2485 EAP-Message = 0x020700061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0x4f1d96b5b26ae63457b22012f66e7fad NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 241 to 10.251.20.20 port 1645 EAP-Message = 0x01080020190017030100156d61b9bad1cd18772d3a5bc4d047f8edd052218d92 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8db2c26675d6c8643212f191f157aa61 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=242, length=195 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0xd5a8bdda87761e1572459a716f6d98d8 EAP-Message = 0x0208002e19001703010023141a817d827fa5e32dd020ac8a82e5874da2e7b6a35a0a432fa6f07ecd70ccc98942a7 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0x8db2c26675d6c8643212f191f157aa61 NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 46 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - ADMIN4182\e2052982 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of ADMIN4182\e2052982 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to ADMIN4182\e2052982 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 23 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 242 to 10.251.20.20 port 1645 EAP-Message = 0x01090043190017030100387d28ca432366b4c61627e8742dbb54a2458802449ee7d043cee54f7eb37e93b0955ba755da5aad5b9017551c02f8999c9ea8c49246b6efe7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefa5735fb3f5cab0b3b468b08df9b103 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=243, length=249 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0xd750ebb3d82173907aa54efb998772f0 EAP-Message = 0x0209006419001703010059e30c5f2d9def3e92ee697f3a3368ccf2c1637832a6b78bf9323db95a014d9b5f34bf64f8c9ce48c0f6ba94251fd4c35a8e40ed06e5be206baeef83a40b311e0647348acebbf588ac25b4ee4f2382dc59066fea3516f94cf09f NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0xefa5735fb3f5cab0b3b468b08df9b103 NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 100 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to ADMIN4182\e2052982 PEAP: Adding old state with 5d 21 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 77 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for e2052982 with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: d6 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=e2052982 --domain=ADMIN4182 --challenge=7801a84637ef5c68 --nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=e2052982 --domain=ADMIN4182 --challenge=7801a84637ef5c68 --nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: leaving group MS-CHAP (returns reject) for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: leaving group authenticate (returns reject) for request 7 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 243 to 10.251.20.20 port 1645 EAP-Message = 0x010a00261900170301001b592ffa55de5d78f799afd27bcf5bbeda4180630d0a453e5b1433eb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9fae1d986c18c5f2cdbabbfbfe4796ce Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=244, length=187 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Peter de Groot Windows Re-Installation Engineer Eastern Goldfields College Ph 08) 90801800 Fax 08) 90801866 Mob 0418915312 http://egshs.wa.edu.au

2 1

multiple post-auth sql queries, possible?
by Duane Cox 13 Jul '06

13 Jul '06

Hello List Is there a way to have freeradius 1.1.1 send two or more sql postauth queries? I tried to put together an update statement and an insert statement with a "go" command, but mssql didn't like it because the insert, go, update was all on the same "line" executing the above statement; but broken out on three lines with "go" by itself, works, but I'm not sure if I can do this in freeradius. So is it possible to have freeradius process sql1 and then sql2 in the post-auth section, if so what would be the best way to set this up. here is my current config ... post-auth { sql Post-Auth-Type REJECT { sql } } and then mssql.conf contains one postauth_query Thanks Duane Cox

2 3

rlm_passwd usage
by B Thompson 13 Jul '06

13 Jul '06

Hi We used to list all our fifty thousand usernames individually in the users file, but this made it quite large so following advice on this mailing list I decided to use rlm_passwd instead. This seems to work very well and the file size is much smaller. I have configured my passwd style users file as follows :- passwd york_passwd { filename = /etc/raddb/yorkpasswd format = "*Stripped-User-Name:NT-Password:Crypt-Password" hashsize = 100000 ignorenislike = yes } However, I would now like to restrict access to a particular NAS device to a particular set of users and I am not sure how best to go about this. If these users were still listed in the users file I could do something like this for users allowed access :- user1 NT-Password := "blah", Crypt-Password := "blah" ...and this for disallowed users :- user2 NT-Password := "blah", Crypt-Password := "blah", NAS-Identifier != restrictednas Could anybody suggest a solution using my rlm_passwd setup? Thanks -- Ben Thompson University of York

2 1

removing domain data from user name
by Yedidia Klein 13 Jul '06

13 Jul '06

Hello list, I'm using freeradius server as a radius server that forward the auth to an LDAP server, on a RH enterprise system (freeradius-1.0.1-1.1.RHEL3) I want one of my service providers to authenticate against this radius, After enabling some debug option I found that it sends me the users in the form of user(a)domain.tld, that (of course) my ldap don't know and refuse to auth. Is there a way on freeradius to pass to the ldap server only the left site of the @ sign ? I tried to use "with_ntdomain_hack = yes" in my ldap section on radiusd.conf w/o success. thanks, --Yedidia

3 3

Freerad & routing problem
by Moustapha Ould Maouloud 13 Jul '06

13 Jul '06

Hello, I have in my LAN a Colubris Access Conroller (IP: 192.168.10.81, gw: 192.168.10.1/80.B.C.D) which I authenticate on a freeradius via Internet (IP of freerad server : 63.E.F.G). My server receives : rad_recv: Access-Request packet from host 80.B.C.D:10901, id=64, length=251 Acct-Session-Id = "7592eefb" NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "noven-ac1" Calling-Station-Id = "00-03-52-01-FC-33" Called-Station-Id = "00-03-52-01-FC-33" Framed-IP-Address = 192.168.1.1 User-Password = "novenac1" NAS-Identifier = "noven.Vincennes.0" NAS-IP-Address = 192.168.10.81 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Administrative-User WISPr-Location-Name = "noven.Noven-WiFi" WISPr-Location-ID = "noven2/Noven-WiFi" Message-Authenticator = 0xa4619c3e1b4b1f7f5a877de95f208ab0 Processing the authorize section of radiusd.conf ..... and returns : Sending Access-Accept of id 64 to 80.B.C.D:10901 Framed-Protocol := PPP Service-Type := Framed-User Framed-MTU := 1500 Colubris-AVPair += "transport-page=https://192.168.10.82/Noven/transport.html" Colubris-AVPair += "session-page=https://192.168.10.82/Noven/session.html" ........ My problem is that the response from the radius server does not reach my AC (IP 192.168.10.81) although the answer was indeed turned over to my router (IP : 80.B.C.D) !!! Someone can help me ? Please Thanks; --------------------------------- Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire.

1 0

Segfault when loading a module in rlm_perl?
by Nikola Pavkovic 13 Jul '06

13 Jul '06

Hello all, I'm expiriencing strange behaviour when starting freeradius using rlm_perl. When I include any module (for example DBI) inside my custom AAA script, i get a segfault. (Debian sarge, freeradius 1.1.2). Any hints are very welcome. Thanks a lot. Sincerely, Nikola Pavkovic

2 2

Re:- Authenticating user with FDS
by Hariharan R 13 Jul '06

13 Jul '06

Yes, that method is working fine. Thank you very much for your help. Hariharan R wrote: > Hi all, > > I am using FreeRADIUS1.1.1 with Fedora Directory server as a backend > data store. > > Let us consider the scenario.. > > I have two servers, one is a mail server and another one is a proxy > server. Both servers are configured to use RADIUS+FDS for user > authentication. In FDS i have two organizational unit under root domain. > > For Ex; > ou=mailusers,dc=example,dc=com > ou=proxyusers,dc=example,dc=com > > In the 'raddb/radiusd.conf' file i specified the base domain as > (In LDAP module) > > basedn = "dc=example,dc=com" > > So whenever a client request comes to the RADIUS server it will look > for the username in FDS. > > The problem is, how the RADIUS will identify that whether the request > is comes from the 'mail server' or from the 'proxy server'. Because for > mailserver users i have to look in the "ou=mailusers,dc=example,dc=com" > and for proxy users i have to look in the > "ou=proxyusers,dc=example,dc=com". Try this: /etc/raddb/huntgroups: mail NAS-IP-Address == the.mail.server.ip proxy NAS-IP-Address == the.proxy.server.ip /etc/radiusd.conf: modules { ldap { basedn = "ou=%{Huntgroup-Name},dc=example,dc=com" } } > > How i can change the LDAP basedn according to the request. Use any string expansion you like, as above. --- Regards, Hariharan.R

1 0

DHCP configuration on Free Radius
by Elie Hani 13 Jul '06

13 Jul '06

Hi; I've installed the Free Radius on FC4 OS, I need to know if it's possible to configure DHCP on this server. I want that the dial up users take an IP from a pool, dynamically configured on the Radius server itself. If it's possible, can you tell me the steps, otherwise, can you provide me with a solution? Thanks Elie

2 1

How to use Cisco VoIP specific bulk accounting
by Alberto Cruz 13 Jul '06

13 Jul '06

Hi could anybody give me a tip or clue where could I find information about the requirements to enable the "Cisco VoIP specific bulk accounting" (pgsql-voip)? Does it works with MySQL? Regards Alberto Cruz

1 0