- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 13, Issue 106
by Kartthik Raghunathan 23 May '06

23 May '06

Hi Alan, Thanks for your response. Have installed openssl-devel-0.9.7a-33.17 package, do you still think i need some other package to be installed. If so, can i know the package name. Thanks, Kartthik > ------------------------------ > > Message: 6 > Date: Mon, 22 May 2006 14:09:35 -0400 > From: "Alan DeKok" <aland(a)nitros9.org> > Subject: Re: make error message - please help ! > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060522180935.6E9DD16CC1(a)mail.nitros9.org> > > "Kartthik Raghunathan" <kartthikr(a)lycos.com> wrote: > > In file included from eap_peap.h:25, > > from rlm_eap_peap.c:24: > > ../../libeap/eap_tls.h:138: syntax error before "SSL" > > ../../libeap/eap_tls.h:138: warning: no semicolon at end of struct or union > > You don't have the OpenSSL header files installed. > > Alan DeKok. -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

1 0

authentication problems
by simon＠434canada.com 23 May '06

23 May '06

Hi, I am trying to get freeRadius working with PEAP, and am having some issues. When I test the server using NTRadPing (a free utility at http://www.novell.com/coolsolutions/tools/14377.html) I can get properly authenticated, using either of two user accounts I set up in the users file. However, when I try to actually connect (using a laptop running WinXp SP2 with a Intel PRO/Wireless 2915ABG wireless card) I never get fully authenticated. I used the tutorial found at http://tldp.org/HOWTO/html_single/8021X-HOWTO/ to set up all the configuration files. Below is the output from running radiusd in debug mode, including the start up information, and then the results of attempting to connect. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.1.1:1862, id=0, length=131 User-Name = "test-user" NAS-IP-Address = 10.10.1.1 Called-Station-Id = "0014bff3dac8" Calling-Station-Id = "0013ce29c6d7" NAS-Identifier = "0014bff3dac8" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000e01746573742d75736572 Message-Authenticator = 0xaea691f462c399eebe0ccea5abdd016b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test-user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry test-user at line 98 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 10.10.1.1 port 1862 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf590bbb204a16a614cf61d3c73c04467 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.1.1:1864, id=0, length=215 User-Name = "test-user" NAS-IP-Address = 10.10.1.1 Called-Station-Id = "0014bff3dac8" Calling-Station-Id = "0013ce29c6d7" NAS-Identifier = "0014bff3dac8" NAS-Port = 56 Framed-MTU = 1400 State = 0xf590bbb204a16a614cf61d3c73c04467 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005019800000004616030100410100003d0301447369eb92ff2c63e203ef45db95b3a0fdcc5af1ccb4b6a28e9dd88e40a3d78300001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x4ac8301cffc55179342d8b744c786817 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "test-user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry test-user at line 98 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 10.10.1.1 port 1864 EAP-Message = 0x0102040a19c0000006f1160301004a02000046030144736a0490bb7192c45745a721b32c5b68fcc8733f626a18038ae2a93b27c2f2208a76ac974384f6bf8c3dbdae0b2e6ea2371340c4b0a4353a5af39d36f7eeb21c00040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcb312fc37dc40bf679a588a4b66d2e59 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.1.1:1866, id=0, length=141 User-Name = "test-user" NAS-IP-Address = 10.10.1.1 Called-Station-Id = "0014bff3dac8" Calling-Station-Id = "0013ce29c6d7" NAS-Identifier = "0014bff3dac8" NAS-Port = 56 Framed-MTU = 1400 State = 0xcb312fc37dc40bf679a588a4b66d2e59 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200061900 Message-Authenticator = 0x70d6c4332f6449bde6b64dec328f7c14 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "test-user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry test-user at line 98 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 10.10.1.1 port 1866 EAP-Message = 0x010302f71900170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xff0dc76f44ccfd825058d18d81d57758 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.1.1:1868, id=0, length=141 User-Name = "test-user" NAS-IP-Address = 10.10.1.1 Called-Station-Id = "0014bff3dac8" Calling-Station-Id = "0013ce29c6d7" NAS-Identifier = "0014bff3dac8" NAS-Port = 56 Framed-MTU = 1400 State = 0xff0dc76f44ccfd825058d18d81d57758 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0x0345a065f9e26b50b6c8fd34d949efba Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "test-user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry test-user at line 98 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 0 to 10.10.1.1 port 1868 EAP-Message = 0x010400061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4f35e0c331009d44dcad4684f4f9261a Finished request 3 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 44736a04 Cleaning up request 1 ID 0 with timestamp 44736a04 Cleaning up request 2 ID 0 with timestamp 44736a04 Cleaning up request 3 ID 0 with timestamp 44736a04 Nothing to do. Sleeping until we see a request. This just continues over and over. Any help here would be greatly appreciated. Thanks, Simon

2 1

"Open" WPA system
by Mark D. Montgomery II 23 May '06

23 May '06

I posted a while ago about our school trying to setup essentially an open wpa system (anyone can connect with WPA with little or no changes to windows settings). The actual user auth is done later via a hotspot server of some sort. Anyhow, I currently have freeradius set to Auth-Type:=Accept so it should accept any connection. This works fine using radtest, but breaks when trying to do a peap connection. Attached is the log output from a peap attempt. Any suggestions on how to fix the error? Thanks. Mark II mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded DIGEST Module: Instantiated digest (digest) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.109.195:1061, id=0, length=252 Message-Authenticator = 0x41eb703e9f3512dd95d5baa8c95398af Service-Type = Framed-User User-Name = "MONTGOMERY-MARK\\markmontgomery" Framed-MTU = 1488 Called-Station-Id = "00-11-95-BF-EF-1C:DBCWIFI" Calling-Station-Id = "00-14-A5-7C-1A-46" NAS-Identifier = "D-Link Access Point with POE" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02000023014d4f4e54474f4d4552592d4d41524b5c6d61726b6d6f6e74676f6d657279 NAS-IP-Address = 192.168.109.195 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 81 radius_xlat: '' modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall[authorize]: module "digest" returns noop for request 0 rlm_realm: No '@' in User-Name = "MONTGOMERY-MARK\markmontgomery", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: Looking up realm "MONTGOMERY-MARK" for User-Name = "MONTGOMERY-MARK\markmontgomery" rlm_realm: No such realm "MONTGOMERY-MARK" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 35 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 160 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type ACCEPT rad_check_password: Auth-Type = Accept, accepting the user Login OK: [MONTGOMERY-MARK\\markmontgomery] (from client internal-network port 1 cli 00-14-A5-7C-1A-46) Sending Access-Accept of id 0 to 192.168.109.195:1061 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 192.168.109.195:1061, id=0, length=20 Authentication reply packet code 2 sent to a non-proxy reply port from client internal-network:1061 - ID 0 : IGNORED --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 446b74d8 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.109.195:1062, id=0, length=252 Message-Authenticator = 0xcc2effc2183aeadc6a7562d425a30878 Service-Type = Framed-User User-Name = "MONTGOMERY-MARK\\markmontgomery" Framed-MTU = 1488 Called-Station-Id = "00-11-95-BF-EF-1C:DBCWIFI" Calling-Station-Id = "00-14-A5-7C-1A-46" NAS-Identifier = "D-Link Access Point with POE" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02000023014d4f4e54474f4d4552592d4d41524b5c6d61726b6d6f6e74676f6d657279 NAS-IP-Address = 192.168.109.195 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 hints: Matched DEFAULT at 81 radius_xlat: '' modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 modcall[authorize]: module "digest" returns noop for request 1 rlm_realm: No '@' in User-Name = "MONTGOMERY-MARK\markmontgomery", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: Looking up realm "MONTGOMERY-MARK" for User-Name = "MONTGOMERY-MARK\markmontgomery" rlm_realm: No such realm "MONTGOMERY-MARK" modcall[authorize]: module "ntdomain" returns noop for request 1 rlm_eap: EAP packet type response id 0 length 35 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 160 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type ACCEPT rad_check_password: Auth-Type = Accept, accepting the user Login OK: [MONTGOMERY-MARK\\markmontgomery] (from client internal-network port 1 cli 00-14-A5-7C-1A-46) Sending Access-Accept of id 0 to 192.168.109.195:1062 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 192.168.109.195:1062, id=0, length=20 Authentication reply packet code 2 sent to a non-proxy reply port from client internal-network:1062 - ID 0 : IGNORED --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 0 with timestamp 446b74e2 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.109.195:1063, id=0, length=252 Message-Authenticator = 0x7b4d94434e62a332c52855fc18400629 Service-Type = Framed-User User-Name = "MONTGOMERY-MARK\\markmontgomery" Framed-MTU = 1488 Called-Station-Id = "00-11-95-BF-EF-1C:DBCWIFI" Calling-Station-Id = "00-14-A5-7C-1A-46" NAS-Identifier = "D-Link Access Point with POE" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02000023014d4f4e54474f4d4552592d4d41524b5c6d61726b6d6f6e74676f6d657279 NAS-IP-Address = 192.168.109.195 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 hints: Matched DEFAULT at 81 radius_xlat: '' modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 modcall[authorize]: module "digest" returns noop for request 2 rlm_realm: No '@' in User-Name = "MONTGOMERY-MARK\markmontgomery", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_realm: Looking up realm "MONTGOMERY-MARK" for User-Name = "MONTGOMERY-MARK\markmontgomery" rlm_realm: No such realm "MONTGOMERY-MARK" modcall[authorize]: module "ntdomain" returns noop for request 2 rlm_eap: EAP packet type response id 0 length 35 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 160 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type ACCEPT rad_check_password: Auth-Type = Accept, accepting the user Login OK: [MONTGOMERY-MARK\\markmontgomery] (from client internal-network port 1 cli 00-14-A5-7C-1A-46) Sending Access-Accept of id 0 to 192.168.109.195:1063 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 192.168.109.195:1063, id=0, length=20 Authentication reply packet code 2 sent to a non-proxy reply port from client internal-network:1063 - ID 0 : IGNORED --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 0 with timestamp 446b74eb Nothing to do. Sleeping until we see a request.

2 1

Segmentation Fault
by Matteo Lazzarini 23 May '06

23 May '06

help me please.... The cause could be my AP D-Link DWL-900AP+? In the several one tried to you once they are connected to me A single time is successful to connect to me The demands from client Win XP leave corrected with certify to you previously install to you in the client .... Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/radius/etc/1x/cert-srv.pem" tls: certificate_file = "/usr/local/radius/etc/1x/cert-srv.pem" tls: CA_file = "/usr/local/radius/etc/1x/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/radius/etc/1x/dh" tls: random_file = "/usr/local/radius/etc/1x/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded detail detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.5:1206, id=19, length=133 User-Name = "matteo" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-40-05-30-C5-86" Calling-Station-Id = "00-12-F0-64-6D-8A" NAS-Identifier = "DWL-900AP+" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000b016d617474656f Message-Authenticator = 0x967f88da472270a5df15034140e2040c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: '/usr/local/radius/var/log/radius/radacct//auth-detail-20060523' rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct//auth-detail-20060523 modcall[authorize]: module "auth_log" returns ok for request 0 rlm_realm: No '@' in User-Name = "matteo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry matteo at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 19 to 192.168.1.5 port 1206 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5a270abdfa6e2a77ddfe453ad6fc4d54 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.5:1206, id=20, length=220 User-Name = "matteo" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-40-05-30-C5-86" Calling-Station-Id = "00-12-F0-64-6D-8A" NAS-Identifier = "DWL-900AP+" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200500d800000004616030100410100003d030144734f2af0e9b4731fd9c2d0b4e504ca9ecd1d42ac11c913e9e2774b4179862b00001600040005000a000900640062000300060013001200630100 State = 0x5a270abdfa6e2a77ddfe453ad6fc4d54 Message-Authenticator = 0xffd12a5c648cfc7773dbbd30fd0c3f0a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 radius_xlat: '/usr/local/radius/var/log/radius/radacct//auth-detail-20060523' rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct//auth-detail-20060523 modcall[authorize]: module "auth_log" returns ok for request 1 rlm_realm: No '@' in User-Name = "matteo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry matteo at line 216 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04eb], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0051], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 20 to 192.168.1.5 port 1206 EAP-Message = 0x0103040a0dc000000595160301004a0200004603014473330a686dcaad963dba557b286c130ae8a2d9b77b43505615b517a28015cb206097502b68ed30dcc00fa7d886e1a545ac9836c60dad6e34ee5f29b12c64b34e00040016030104eb0b0004e70004e4000239308202353082019ea003020102020105300d06092a864886f70d01010505003040310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a130947727570706f696d69310b3009060355040313024341301e170d3036303532333039303932345a170d3037303532333039303932345a3068310b30090603550406130249543110300e06 EAP-Message = 0x03550408130742657267616d6f31123010060355040a130947727570706f696d69310f300d060355040313067261646975733122302006092a864886f70d01090116137261646975734067727570706f696d692e697430819f300d06092a864886f70d010101050003818d0030818902818100b9ae0ef1716002d6b034f588e8b8b74bd312a355433aec355c9fe01dba647be21a421e811a37a0ec2a9bb214510f02362db1f19b33d0d6cf5f609379ae6dfe962d34bcc76d71f9d2e8ed0bf6f3000f8eaf3d6f9eaacc9f0930f96c86a7cb4ba8cd8c966984ffda1a822207f7c652e63ce05b14f16081e899960095d4efac221d0203010001a317301530 EAP-Message = 0x130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100aa75b2e1c672de7111c6a480c7e63fb0dd6e2763b581e3926abb51775254de94d1f42f3e9c4e73b35f5e6f6d11b76ab024062eb050d433da7249051388c80d0e2622f5d264b1a1da7e4c60a24fceb2310509cff9e61b0583173d79322c834ade2b99f68b4488c56ba88b27e42820306a74fdb6dbf07020c4c2ae90e9ae7da5890002a5308202a13082020aa003020102020900f65e6a6e4582e65e300d06092a864886f70d01010505003040310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a1309 EAP-Message = 0x47727570706f696d69310b3009060355040313024341301e170d3036303532333039303133305a170d3038303532323039303133305a3040310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a130947727570706f696d69310b300906035504031302434130819f300d06092a864886f70d010101050003818d0030818902818100b536489b6093a1ee191c95e2ac498564095e182c86e59a82a276a10a1fe1d60d4a4774370e3a31b6d33c18c64c046877fa8d61a1b08644e891e53c1e38ef28ae219919bb7ba7d4d68e3daded7b81c25ae99c6697fb6dcf0d81238390ba28ad73133dd0f3120cff4c EAP-Message = 0x8782368fd48dd03b12a6847de5340d9035aa1ce1c96f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3889b8bcaefc660f73c84ed14247d0d3 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.5:1206, id=21, length=146 User-Name = "matteo" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-40-05-30-C5-86" Calling-Station-Id = "00-12-F0-64-6D-8A" NAS-Identifier = "DWL-900AP+" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060d00 State = 0x3889b8bcaefc660f73c84ed14247d0d3 Message-Authenticator = 0xd1c04f41b010cf03e62335e3d7009b1d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 radius_xlat: '/usr/local/radius/var/log/radius/radacct//auth-detail-20060523' rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct//auth-detail-20060523 modcall[authorize]: module "auth_log" returns ok for request 2 rlm_realm: No '@' in User-Name = "matteo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry matteo at line 216 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 21 to 192.168.1.5 port 1206 EAP-Message = 0x0104019f0d8000000595e1410203010001a381a230819f301d0603551d0e04160414e3fcd11473961d087743bdfc11c2621c1a49650230700603551d23046930678014e3fcd11473961d087743bdfc11c2621c1a496502a144a4423040310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a130947727570706f696d69310b3009060355040313024341820900f65e6a6e4582e65e300c0603551d13040530030101ff300d06092a864886f70d01010505000381810048be72b06a1043c8891eb2c03156bda58fe068cc6c9e3d0a5cdee92ee5417dc444a241afef677acb4906b9b3bcd22df060f4c040 EAP-Message = 0x79496b09b06ba334af5e487fbddd87bbba5824707f0b1dbf9b68cb1124d2d79f5f0661c727cd2d95756e2172725b529d701e40cc539457567805dc1cd4d0c3cb4f44291b53d3fce1ffac4bc016030100510d000049020102004400423040310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a130947727570706f696d69310b30090603550403130243410e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf018e32e5012deb51093bbbb11bb8f34 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 192.168.1.5:1206, id=22, length=1057 User-Name = "matteo" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-40-05-30-C5-86" Calling-Station-Id = "00-12-F0-64-6D-8A" NAS-Identifier = "DWL-900AP+" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204038f0d800000038516030103550b00024500024200023f3082023b308201a4a003020102020104300d06092a864886f70d01010505003040310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a130947727570706f696d69310b3009060355040313024341301e170d3036303532333039303134395a170d3037303532333039303134395a306e310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a130947727570706f696d69310f300d060355040313066d617474656f3128302606092a864886f70d01090116196d6c617a7a6172696e694063 EAP-Message = 0x72656d612e756e696d692e697430819f300d06092a864886f70d010101050003818d0030818902818100c0493661470a3ca6e9b03253e5961122d87865d8eef1decc61fe4ce1b9b1cbbca4068715290d7503719051add28c6f868716deb07dd07d2472c5e2efd8d19a53e028ae9f9811790e65933fb91dbc77d2378d1b427104f041f24bfa71c33015052530ada0bb655b68f0cc8d3fa3ad38e99bb0dff18524b016abf1f3134f8932d50203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d01010505000381810047151d2a53dd7159cc78884e60f6534471cfd93aacea842acd0e15417cfb79f96c56 EAP-Message = 0x41e5e613e4b50e25fcd2ad850a177bf4abfd4fa808a042439a421a7362cd153ebdd033f462a6883bed08ebae428db26ad2535a8483c68d259bb8d435a67e8e04cf5edd6d74a9c8968d0cd9ce36fa4ac1f8f82c46dcd1d6f725be1b1c2169100000820080816e81dd3de4c19c4f0cc65f235960bb4b139d2a1e63fa0ba5fd2aa7ea810def29bace7abd216dc9508b1e9bc6fffbe243827fe2f23d0413d6b18a4e83f6d18d8a3c90c6da9cbb2267585de5c19fb5289136724d377190a3d15efcee29f73930358afab3240341505572be07bdac1b58813658468dce9295d9c7dbd345a4b25c0f0000820080ac4e6b0ca0e5a7129d1caabc67cb6b24b8d76f EAP-Message = 0xae0cfee930105c775db5b351e6d7732b6f7d190524110211ab922fe155da04edf68295a5998212bea5f38688b2aa7ef3156c3383b352222e725ab54508b751dc21aa3d3eceb01e62d2fcee3eea02fa45e741e2265ae0f007f0ef50810f0f4e9c5a3e621c5baceb2bd2026c3aeb14030100010116030100208563ba073afa9603a9511a7a3cfeb68baffe873b38b39075fe211605188b786f State = 0xf018e32e5012deb51093bbbb11bb8f34 Message-Authenticator = 0x6d1cf151301d9c811944568bccec3380 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 radius_xlat: '/usr/local/radius/var/log/radius/radacct//auth-detail-20060523' rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct//auth-detail-20060523 modcall[authorize]: module "auth_log" returns ok for request 3 rlm_realm: No '@' in User-Name = "matteo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 users: Matched entry matteo at line 216 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0249], Certificate chain-depth=1, error=0 --> User-Name = matteo --> BUF-Name = CA --> subject = /C=IT/ST=Bergamo/O=Gruppoimi/CN=CA --> issuer = /C=IT/ST=Bergamo/O=Gruppoimi/CN=CA --> verify return:1 chain-depth=0, error=0 --> User-Name = matteo --> BUF-Name = matteo --> subject = /C=IT/ST=Bergamo/O=Gruppoimi/CN=matteo/emailAddress=mlazzarini(a)crema.unimi.it --> issuer = /C=IT/ST=Bergamo/O=Gruppoimi/CN=CA --> verify return:1 TLS_accept: SSLv3 read client certificate A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange ./run-radius: line 9: 7283 Segmentation fault

1 0

freeradius and mysql fails
by mailing＠sylph.be 23 May '06

23 May '06

hello, i was wondering what sql tables i need to have. Im trying to setup freeradius with mysql and i cant get out. i've got the following tables: radius (12) * Browse badusers * Browse mtotacct * Browse nas * Browse radacct * Browse radcheck * Browse radgroupcheck * Browse radgroupreply * Browse radpostauth * Browse radreply * Browse totacct * Browse usergroup * Browse userinfo but when i try to logon (asa 5510 test connection to freeradius) it doesnt work with sql i can logon with the test account 'steve' and password 'testing' and i can logon to the cisco ascm. but when i add an user to mysql something goes wrong. first steve: radius_xlat: 'steve' rlm_sql (sql): sql_set_user escaped user --> 'steve' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'steve' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User steve not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'steve' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'steve' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User steve not found in radgroupcheck rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 21 modcall: leaving group authorize (returns ok) for request 21 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 83 to 192.168.6.1 port 1025 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Finished request 21 -------------------sql----------------- rad_recv: Access-Request packet from host 192.168.6.1:1025, id=89, length=110 User-Name = "test1" User-Password = "test1" NAS-IP-Address = 192.168.6.1 NAS-Port-Type = Virtual Calling-Station-Id = "000.000.000.000" Cisco-AVPair = "ip:source-ip=000.000.000.000" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 27 modcall[authorize]: module "preprocess" returns ok for request 27 modcall[authorize]: module "chap" returns noop for request 27 modcall[authorize]: module "mschap" returns noop for request 27 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 27 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 27 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 27 radius_xlat: 'test1' rlm_sql (sql): sql_set_user escaped user --> 'test1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 27 modcall: leaving group authorize (returns ok) for request 27 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 27 modcall[authenticate]: module "unix" returns notfound for request 27 modcall: leaving group authenticate (returns notfound) for request 27 auth: Failed to validate the user. Delaying request 27 for 1 seconds Finished request 27 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 26 ID 88 with timestamp 4472e7cb Sending Access-Reject of id 89 to 192.168.6.1 port 1025 Cleaning up request 27 ID 89 with timestamp 4472e7cb Nothing to do. Sleeping until we see a request. first its 'local' and with sql its 'system', is this ok? when i test the sql statements i get: ==================== Showing rows 0 - 0 (1 total, Query took 0.0004 sec) SQL query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id LIMIT 0 , 30 id UserName Attribute Value op 3 test1 User-Password $1$BnzqweeZ$EJ66Aqwe0/YANJdc8hBC/ := ==================== MySQL returned an empty result set (i.e. zero rows). (Query took 0.0003 sec) SQL query: SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value, radgroupcheck.op FROM radgroupcheck, usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id LIMIT 0 , 30 ==================== Showing rows 0 - 5 (6 total, Query took 0.0004 sec) SQL query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id LIMIT 0 , 30 1 test1 Framed-Protocol PPP = 2 test1 Framed-IP-Address 172.16.3.33 = 3 test1 Framed-IP-Netmask 255.255.255.0 = 4 test1 Framed-MTU 1500 = 5 test1 Framed-Compression Van-Jacobsen-TCP-IP = 6 test1 Service-Type Framed-User = ==================== MySQL returned an empty result set (i.e. zero rows). (Query took 0.0003 sec) SQL query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.op FROM radgroupreply, usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id LIMIT 0 , 30 ==================== i want to know if those results are good, or did i forget something?! the password is encrypted, maybe this is the problem? when i 'check' the password via dialup admin webinterface, it said 'No its wrong' greetings,

2 1

radiusd run time problem
by Abul Monsur Mannan 23 May '06

23 May '06

Dear FR users, I'm new in this field . I need your help. When I execute at root - #radiusd -X the following error message is returned. radiusd.conf[14]: sql: Module instantiation failed. radiusd.conf[1798] Unknown module "sql". radiusd.conf[1727] Failed to parse authorize section. I've done all the steps that stated on Onlamp's webpage. Could you pls help me out and guide me with full linux command? I'm looking for your kind Thank you.

3 6

RE: Re: can't connect to radius server
by simon＠434canada.com 23 May '06

23 May '06

I have tried running tcpdump, and I am getting packets from the client to the server: 09:38:42.376543 IP 10.10.1.1.bpmd > 10.10.1.102.radius: RADIUS, Access Request (1), id: 0x00 length: 131 09:38:42.376543 IP 10.10.1.1.bpmd > 10.10.1.102.radius: RADIUS, Access Request (1), id: 0x00 length: 129 Here is the output I get when I start the server in debug mode: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. When I run nmap on the Radius server, just watching port 1812, I get conflicting results depending on what machine I run nmap on. When I test the port from the client machine, it returns saying the port is filtered, but when I run nmap on the actual server, it returns that the port is closed. Not sure if this is normal or not. Thanks again, Simon >Comments below.... > >--- simon(a)434canada.com wrote: > >> Hi, >> >> I think I have my radius server configured properly >> (I followed the configuration advice in >> http://tldp.org/HOWTO/html_single/8021X-HOWTO/) >> >> I can get it running (using radiusd -X) and see all >> the expected output. > >Please post this output, even if it's just the server >startup info. > >> >> I have also configured my AP to point to the correct >> location, and it is pingable from the radius server. >> > >So, the AP is configured with the RADIUS server's IP, >you have configured your FR "clients.conf" file with >the APs information and the shared secret is correct >on both devices? > >Does your AP have any ping functionality? If so, can >it ping the RADIUS server? Does the AP provide any >logging data indicating it connected to the RADIUS >server? Sounds suspiciously as if the RADIUS box's >firewall settings may be at fault. > >Laker > >> However, when I try to connect, user validation >> always fails. And the radius server (which is in >> debug mode) doesn't show me anything. It's like >> nothing is connecting to it at all. I also tried to >> test it using NTRadPing, and his won't connect >> either. >> >> Any help or suggestions here would be appreciated. I >> am running version 1.1.1 of freeRADIUS. >> >> Thanks, >> >> Simon >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > >__________________________________________________ >Do You Yahoo!? >Tired of spam? Yahoo! Mail has the best spam protection around >http://mail.yahoo.com >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

3 2

Log messages
by raviprakash sunkara 23 May '06

23 May '06

Hi Good Morning. I updated the openser server in US server. When I making a calls from here(India). Its gives the log messages, which are mentioned below and its say " logining Time out ! contact Network Admin ". Its means its not register and server is not responded. ______________________________________________________ (c) 2004 Xten Networks, Inc. All rights reserved. X-Lite release 1105d build stamp 99999 License key: 6FCCC0CC7D9B0017E322142CCDFC1071 Attempting SIP protocol listen on: 192.168.2.55:5060 Attempting SIP protocol listen on: 192.168.2.55:5060 Attempting SIP protocol listen on: 192.168.2.55:5060 Attempting SIP protocol listen on: 192.168.2.55:5060 Attempting SIP protocol listen on: 192.168.2.55:5060 Attempting SIP protocol listen on: 192.168.2.55:5060 Attempting SIP protocol listen on: 192.168.2.55:5060 Attempting SIP protocol listen on: 192.168.2.55:5061 Established SIP protocol listen on: 192.168.2.55:5061 NAT firewall type discovered is forced. SIP: 192.168.2.55:5061 RTP: 192.168.2.55:8000 NAT: 61.17.248.68 PROXY#0: 24.98.157.209:5060 (inbound proxy server) OUTBOUND-PROXY#0: 24.98.157.209:5060 (outbound proxy server) SEND TIME: 1619765420 SEND >> 24.98.157.209:5060 REGISTER sip:24.98.157.209 SIP/2.0 Via: SIP/2.0/UDP 192.168.2.55:5061;rport;branch=z9hG4bK7A9AF049E03A84E1671601A7F2B7900C From: sam <sip:test2@24.98.157.209<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> >;tag=1069014297 To: sam <sip:test2@24.98.157.209<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> > Contact: "sam" <sip:test2@192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> :5061> Call-ID: 61886BDAE211AFF5EF8B8774BD2A59D3(a)24.98.157.209<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> CSeq: 27109 REGISTER Expires: 1800 Max-Forwards: 70 User-Agent: X-Lite release 1105d Content-Length: 0 SEND TIME: 1619766930 SEND >> 24.98.157.209:5060 REGISTER sip:24.98.157.209 SIP/2.0 Via: SIP/2.0/UDP 192.168.2.55:5061;rport;branch=z9hG4bK7A9AF049E03A84E1671601A7F2B7900C From: sam <sip:test2@24.98.157.209<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> >;tag=1069014297 To: sam <sip:test2@24.98.157.209<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> > Contact: "sam" <sip:test2@192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> :5061> Call-ID: 61886BDAE211AFF5EF8B8774BD2A59D3(a)24.98.157.209<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> CSeq: 27109 REGISTER Expires: 1800 Max-Forwards: 70 User-Agent: X-Lite release 1105d Content-Length: 0 SEND TIME: 1619769953 SEND >> 24.98.157.209:5060 REGISTER sip:24.98.157.209 SIP/2.0 Via: SIP/2.0/UDP 192.168.2.55:5061;rport;branch=z9hG4bK7A9AF049E03A84E1671601A7F2B7900C From: sam <sip:test2@24.98.157.209<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> >;tag=1069014297 To: sam <sip:test2@24.98.157.209<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> > Contact: "sam" <sip:test2@192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> :5061> Call-ID: 61886BDAE211AFF5EF8B8774BD2A59D3(a)24.98.157.209<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> CSeq: 27109 REGISTER Expires: 1800 Max-Forwards: 70 User-Agent: X-Lite release 1105d Content-Length: 0 SEND TIME: 1619776003 SEND >> 24.98.157.209:5060 REGISTER sip:24.98.157.209 SIP/2.0 Via: SIP/2.0/UDP 192.168.2.55:5061;rport;branch=z9hG4bK7A9AF049E03A84E1671601A7F2B7900C From: sam <sip:test2@24.98.157.209<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> >;tag=1069014297 To: sam <sip:test2@24.98.157.209<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> > Contact: "sam" <sip:test2@192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> :5061> Call-ID: 61886BDAE211AFF5EF8B8774BD2A59D3(a)24.98.157.209<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=51#Comp…> CSeq: 27109 REGISTER Expires: 1800 Max-Forwards: 70 User-Agent: X-Lite release 1105d Content-Length: 0 ______________________________________________________________ Here, in Local Network working fine with My openser server. What is nat traversal, outbound proxy server , inbound proxy server , is it need in openser and softphone ... Please help me. -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology www.hyperion-tech.com <b>

1 0

help,need radius client
by lee eric 23 May '06

23 May '06

hello all, I used freeradius to config my radius server,and now i need a radius client to communicate with radius server.I search through google and have not any idea,can someone give any suggestions? 3xs eric _________________________________________________________________ 与联机的朋友进行交流，请使用 MSN Messenger: http://messenger.msn.com/cn

3 2

VLAN-mapping by DEFAULT Entry fails
by robiwan＠arcor.de 23 May '06

23 May '06

Dear all, I use a WindowsXP, EAP-Type MD5-challenge as supplicant and a Cisco Catalyst Switch 3750 as authenticator and i want that user hugo will be mapped in VLAN 50 on the switch. This works properly. Every other user should be mapped in VLAN 999, my guest-vlan. I try this with a DEFAULT-entry, but this does not work, the switch does not accept any other user, in my case user nobody is unauthorized for my authenticator. My other configuration files are seen at the end of this text. Thanks in advance... Robert My entire users file: ====================== hugo User-Password == "hugo01" # line 54 Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 50 DEFAULT Auth-Type := Accept # line 69 Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 999 My radiusd output for user nobody, (my authenticator do not accept this): ========================================================================== rad_recv: Access-Request packet from host 10.187.0.15:1645, id=218, length=127 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "nobody" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0203000b016e6f626f6479 Message-Authenticator = 0x48b3cb8e3c0c39e55e33121529f28c7d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "nobody", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 3 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 69 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 218 to 10.187.0.15 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "999" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 218 with timestamp 4472b042 Nothing to do. Sleeping until we see a request. My radiusd output for user hugo (that works, accepted from authenticator): ========================================================================== rad_recv: Access-Request packet from host 10.187.0.15:1645, id=215, length=123 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "hugo" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x02000009016875676f Message-Authenticator = 0xc8b883765bb2789fe6eac6542635ab5c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "hugo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry hugo at line 54 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 215 to 10.187.0.15 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc95b59f55ecae07a3f817b60bfa8f6a5 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=216, length=138 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "hugo" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0xc95b59f55ecae07a3f817b60bfa8f6a5 EAP-Message = 0x020100060304 Message-Authenticator = 0x802ecba91167f7fc5bec047d099a492b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "hugo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry hugo at line 54 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/md5 rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 216 to 10.187.0.15 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x010200160410d9fe422e4ec87bdd6789e712124f70e7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x41f8f0e651189f71392e9acc4206fa15 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=217, length=158 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "hugo" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x41f8f0e651189f71392e9acc4206fa15 EAP-Message = 0x0202001a0410a130883073b273fecdbbd25be5b1e0796875676f Message-Authenticator = 0x59b3fc40c7b1f1430ffd68be05001e7f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "hugo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 26 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry hugo at line 54 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 2 modcall: leaving group authenticate (returns ok) for request 2 Sending Access-Accept of id 217 to 10.187.0.15 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x03020004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "hugo" Finished request 2 Going to the next request Waking up in 6 seconds... My entire eap.conf: ====================== eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } mschapv2 { } } My entire radiusd.conf: ======================== prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = no require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

3 2