- Freeradius-Users - lists.freeradius.org

FreeRADIUS 1.1.1 Segmentation fault on Fedora 4
by Nikolas Thoman 09 May '06

09 May '06

I am running FreeRADIUS 1.1.1 on a Fedora Core 4 server (kernel 2.6.11-1.1369_FC4smp) to authenticate using EAP-SIM. After ~400 successful auths at 20 requests/second the radiusd service encounters a segmentation fault. The output of the gdb dump is as follows: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1208572224 (LWP 9805)] 0x0072ec33 in _int_malloc () from /lib/libc.so.6 (gdb) bt #0 0x0072ec33 in _int_malloc () from /lib/libc.so.6 #1 0x00730792 in malloc () from /lib/libc.so.6 #2 0x005007e4 in eap_compose (handler=0x8fb8220) at eap.c:395 #3 0x004ffa94 in eap_authenticate (instance=0x8f8e4b8, request=0x8fbe648) at rlm_eap.c:341 #4 0x08053009 in modcall () #5 0x0805351d in modcall () #6 0x0805312d in modcall () #7 0x080525ba in find_module_instance () #8 0x0804c532 in rad_check_password () #9 0x0804cb03 in rad_authenticate () #10 0x08054c0a in rad_respond () #11 0x08056287 in main () (gdb) I have another FreeRADIUS 1.0.3 server running on a Red Hat 9 server (kernel 2.4.20-8) that has had no problems running this kind of traffic. Any help in diagnosing the reason why I'm encountering a fault in malloc would be much appreciated. Thanks, Nik

4 17

Limit connection
by charlonet 09 May '06

09 May '06

Hi, I have small problem concern with my radius server(freeradius). I cannot how make to limit the connection of the various accounts ? exple: user1: 2 simultaneous connections user2: 1 connection simultaneous Cordially ---------------------------------------------------------------------- Le Pingouin Noir -- Charlonet -- Fixe : 20 32 68 91 / 20 32 07 57 GSM : +225 08 00 74 80 ICQ : 323076595 skype : charlonet yahoomessenger : charlonet MSN : charlonet_gates(a)hotmail.com Adresse Postale : 06 BP 1217 Abidjan 06 Côte d'Ivoire Vous avez reçu gratuitement donnez gratuitement (Mt 10,8) ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com

2 1

users connected blocked
by Nicola Iotti 09 May '06

09 May '06

Hi all....sorry for HTML content but it's not my PC...... We are using freeradius 1.0.5 just as proxy to do a realm based messages redirection... we have the problem that sometimes the radius client doesn't send stop message and users remain connected.It is a big problem because if one user blocked tries to connect again, the main server rejects connection because in its database the user is already connected. Is it possible to use Acct-Interim-Attribute to solve this problem.. I mean: is it possible to do that when freeradius doesn't receive anymore Interim-Update messages for one connection, it sends to main server a stop message for that connection ? Or is there another way to force connection ends message to main server after a fixed time or when freeradius doesn't receive anymore Interim-Update message even if freeradius doesn't receive stop message from client?(remember that all the database are on the main server only..) Thank you Ing. Nicola Iotti Network Manager mailto: nicola.iotti(a)guglielmo.biz Guglielmo S.r.l. Sede legale: Via Martiri di Minozzo, 12 Sede operativa: Via Sante Vincenzi , 2 / D 42100 Reggio Emilia ITALIA Tel.: +39-0522 - 40 63 67 Fax: +39-0522 - 54 08 16 Cell: +39-320 61 90 072 internet website: http://www.guglielmo.biz mailto:info@guglielmo.biz

2 1

Help in Freeradius and openser
by raviprakash sunkara 09 May '06

09 May '06

Hi to all, I tried to insert the users for testing the server, but small error arrived. That is . a) radiusd.conf[1840] unknown Auth-Type "digest" in authenticate section. b) radclient: Failed to send packet for ID 162: Unknown attribute "NAS-IP-Address" c) radtest test test 192.168.2.55 1812 radiustest Sending Access-Request of id 215 to 192.168.2.55 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 Re-sending Access-Request of id 215 to 192.168.2.55 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 Please help me in a,b and c issues. what are these issues. Please help me -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology www.hyperion-tech.com

2 1

problems with machine authetication
by wekz 09 May '06

09 May '06

Hello everybody, last week I was working out a freeradius 1.1.1 + ldap with domain authentication. I got it running with the help of Phil Mayers with this configuration: authorize { preprocess ntdomain # other modules } realm MYDOMAIN { type = radius authhost = LOCAL accthost = LOCAL strip } But it didn't work till I enable ntdomain_hack in the mschap module: with_ntdomain_hack = yes The truth is I don't understand it at all. Here's my thinking: When someone is trying to authenticate and he belongs to a domain, in the request packet windows sends a string like: MYDOMAIN\\username In the authorization part, using the realm ntdomain, the server can strip the User-Name and use only username so it can find it in ldap. But when it comes to the authorization module it fails. Here's part of the log: Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) ............... rad_recv: Access-Request packet from host 192.168.51.162:1024, id=50, length=279 Acct-Session-Id = "2a6bb0b4-00000017" NAS-Port = 8 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1496 Framed-IP-Address = 255.255.255.254 User-Name = "MYDOMAIN\\prueba_freeradius" Calling-Station-Id = "00-04-23-8D-4B-0E" Service-Type = Framed-User EAP-Message = 0x02b1006c190017030100610d895f029ebe43af255559638cf1e7e9d0639a11e7d7dfec4a794bee5fbee0a2bf64947cd8a99ad354fa03d6a0913904068c58dd975f8a122a929bc477b2af67b8907c9a4c6a2765188e878ca77f07e45a5329a20fd473989289fdfe3c23eb646b State = 0x908673323bd5eac7e882e906e316049f Colubris-AVPair = "ssid=aamm" Message-Authenticator = 0x8e2b19ea1dfd0d6f0f5b4c895f619818 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 14 modcall[authorize]: module "preprocess" returns ok for request 14 rlm_realm: Looking up realm "MYDOMAIN" for User-Name = "MYDOMAIN\prueba_freeradius" rlm_realm: Found realm "MYDOMAIN" rlm_realm: Adding Stripped-User-Name = "prueba_freeradius" rlm_realm: Proxying request from user prueba_freeradius to realm MYDOMAIN rlm_realm: Adding Realm = "MYDOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 14 radius_xlat: '/usr/local/radius_regex/var/log/radius/radacct/192.168.51.162/auth-detail-20060509' rlm_detail: /usr/local/radius_regex/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius_regex/var/log/radius/radacct/192.168.51.162/auth-detail-20060509 modcall[authorize]: module "auth_log" returns ok for request 14 modcall[authorize]: module "chap" returns noop for request 14 modcall[authorize]: module "mschap" returns noop for request 14 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 14 rlm_eap: EAP packet type response id 177 length 108 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 14 rlm_ldap: - authorize rlm_ldap: performing user authorization for prueba_freeradius radius_xlat: '(uid=prueba_freeradius)' radius_xlat: 'ou=Central,dc=bcn,dc=es' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Central,dc=bcn,dc=es, with filter (uid=prueba_freeradius) rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value xxx & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user prueba_freeradius authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 14 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 14 modcall: leaving group authorize (returns updated) for request 14 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x02b100551a02b1005031d780cac8a727745249e57389beb21e6800000000000000004a4d93fb40b1108062905326a78ff4081fea67b75e569815004d59444f4d41494e5c7072756562615f66726565726164697573 PEAP: Setting User-Name to MYDOMAIN\prueba_freeradius PEAP: Adding old state with dc 47 PEAP: Sending tunneled request EAP-Message = 0x02b100551a02b1005031d780cac8a727745249e57389beb21e6800000000000000004a4d93fb40b1108062905326a78ff4081fea67b75e569815004d59444f4d41494e5c7072756562615f66726565726164697573 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "MYDOMAIN\\prueba_freeradius" State = 0xdc47453244df028b4a9c81ff38a17be9 Acct-Session-Id = "2a6bb0b4-00000017" NAS-Port = 8 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1496 Framed-IP-Address = 255.255.255.254 Calling-Station-Id = "00-04-23-8D-4B-0E" Service-Type = Framed-User Colubris-AVPair = "ssid=aamm" NAS-IP-Address = 192.168.51.162 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 14 modcall[authorize]: module "preprocess" returns ok for request 14 rlm_realm: Looking up realm "MYDOMAIN" for User-Name = "MYDOMAIN\prueba_freeradius" rlm_realm: Found realm "MYDOMAIN" rlm_realm: Adding Stripped-User-Name = "prueba_freeradius" rlm_realm: Proxying request from user prueba_freeradius to realm MYDOMAIN rlm_realm: Adding Realm = "MYDOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 14 radius_xlat: '/usr/local/radius_regex/var/log/radius/radacct/127.0.0.1/auth-detail-20060509' rlm_detail: /usr/local/radius_regex/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius_regex/var/log/radius/radacct/127.0.0.1/auth-detail-20060509 modcall[authorize]: module "auth_log" returns ok for request 14 modcall[authorize]: module "chap" returns noop for request 14 modcall[authorize]: module "mschap" returns noop for request 14 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 14 rlm_eap: EAP packet type response id 177 length 85 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 14 rlm_ldap: - authorize rlm_ldap: performing user authorization for prueba_freeradius radius_xlat: '(uid=prueba_freeradius)' radius_xlat: 'ou=Central,dc=bcn,dc=es' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Central,dc=bcn,dc=es, with filter (uid=prueba_freeradius) rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value xxx & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user prueba_freeradius authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 14 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 14 modcall: leaving group authorize (returns updated) for request 14 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 14 rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack? rlm_mschap: Told to do MS-CHAPv2 for MYDOMAIN\prueba_freeradius with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 14 modcall: leaving group MS-CHAP (returns reject) for request 14 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 14 modcall: leaving group authenticate (returns reject) for request 14 auth: Failed to validate the user. Login incorrect: [prueba_freeradius/<no User-Password attribute>] (from client localhost port 8 cli 00-04-23-8D-4B-0E) PEAP: Got tunneled reply RADIUS code 3 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-CHAP-Error = "\261E=691 R=1" EAP-Message = 0x04b10004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x8153428 3 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-CHAP-Error = "\261E=691 R=1" EAP-Message = 0x04b10004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 14 modcall: leaving group authenticate (returns handled) for request 14 Sending Access-Challenge of id 50 to 192.168.51.162 port 1024 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x01b200261900170301001b6c9a8c161b62aec589f4a4f92e58f4c76ec7ae250761970d9213c7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa18cd510394250c8136571f619e429e0 Finished request 14 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.51.162:1024, id=36, length=209 Acct-Session-Id = "2a6bb0b4-00000017" NAS-Port = 8 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1496 Framed-IP-Address = 255.255.255.254 User-Name = "MYDOMAIN\\prueba_freeradius" Calling-Station-Id = "00-04-23-8D-4B-0E" Service-Type = Framed-User EAP-Message = 0x02b200261900170301001bd89d386a7c80dcf210c271671421915148555085d02e7c2a34149e State = 0xa18cd510394250c8136571f619e429e0 Colubris-AVPair = "ssid=aamm" Message-Authenticator = 0xacf972ea063d9318ee2b2dad1613cc3c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 rlm_realm: Looking up realm "MYDOMAIN" for User-Name = "MYDOMAIN\prueba_freeradius" rlm_realm: Found realm "MYDOMAIN" rlm_realm: Adding Stripped-User-Name = "prueba_freeradius" rlm_realm: Proxying request from user prueba_freeradius to realm MYDOMAIN rlm_realm: Adding Realm = "MYDOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 15 radius_xlat: '/usr/local/radius_regex/var/log/radius/radacct/192.168.51.162/auth-detail-20060509' rlm_detail: /usr/local/radius_regex/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius_regex/var/log/radius/radacct/192.168.51.162/auth-detail-20060509 modcall[authorize]: module "auth_log" returns ok for request 15 modcall[authorize]: module "chap" returns noop for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 15 rlm_eap: EAP packet type response id 178 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 15 rlm_ldap: - authorize rlm_ldap: performing user authorization for prueba_freeradius radius_xlat: '(uid=prueba_freeradius)' radius_xlat: 'ou=Central,dc=bcn,dc=es' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Central,dc=bcn,dc=es, with filter (uid=prueba_freeradius) rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value xxx & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user prueba_freeradius authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 15 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 15 modcall: leaving group authorize (returns updated) for request 15 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 15 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 15 modcall: leaving group authenticate (returns invalid) for request 15 auth: Failed to validate the user. Login incorrect: [prueba_freeradius/<no User-Password attribute>] (from client ap port 8 cli 00-04-23-8D-4B-0E) Delaying request 15 for 1 seconds Finished request 15 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 36 to 192.168.51.162 port 1024 After reading the comments of with_ntdomain_hack, what i get is this: The first time windows sends the id, the User-Name = MYDOMAIN\\username, but when he response the access-challenge the User-Name = username. I wonder why the server expects MYDOMAIN\\username. After the realm the server will only see User-Name = username in ldap-authorization. And as windows sends for replying the challenge only username, I thought this second time realm was not going to be aplicable. So I think I don't understand this operation. And as I don't understand it I can't work out a new configuration like: freeradius 1.1.1 + ldap + machine authentication. User-Name = host/username I have tried it making a new realm with this configuration radiusd.conf realm hostdm { format = prefix delimiter = "/" ignore_default = no ignore_null = no } authorize { preprocess hostdm # other modules } proxy.conf: realm host { type = radius authhost = LOCAL accthost = LOCAL strip } But I got me into the same situation as with ntdomain + with_ntdomain_hack=no. Then I try with the hints file: DEFAULT User-Name =~ "^([^/]+)/([^/]+)" User-Name := `%{2}` But the same. So I don't know what to do. Is there another feature like with_ntdomain_hack for this ? I could put some logs if needed. If there is something unintelligible please tell me, because my english is terrible, as you can notice. Thanks.

1 0

freeradius port to windows
by jasonatx0001 09 May '06

09 May '06

Anyone know of a Windows port of freeradius ? -- View this message in context: http://www.nabble.com/freeradius-port-to-windows-t1578157.html#a4284227 Sent from the FreeRadius - User forum at Nabble.com.

3 3

Time connection
by ludovic cailleau 09 May '06

09 May '06

I would like to authorize connection to users according to a clock time (8:00 AM to 4:00 PM) . Is what Freeradius manages that and so yes how then I to set up it? --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici.

2 1

db_mysql.sql(Thanks)
by Monsur Mannan 09 May '06

09 May '06

Hello Alan Thank you very much for your help. I found the file named - mysql.sql Thank U again. _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar - get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

1 0

Re: VLAN Mapping with MS-CHAP
by robiwan＠arcor.de 09 May '06

09 May '06

> Dear all, > I try to put my Windows-XP-Clients in different VLANs on my Cisco Catalyst 3750 Switch, depending on their Account. > And i use two differnt authentication methods: MD5-Challange and MS-CHAP. > > User hugo should be mapped in VLAN 50 and authenticated via MD5-Challange > User roka at Domain WINLAB should be mapped in VLAN 40 and authenticated via MS-CHAP > > Now both authentication works (thanks to all again) but i have difficulties to map user roka in his right VLAN. > > Here is my users file: > -----------------------snip------------------------ > > hugo User-Password == "hugo01" > Tunnel-Type = VLAN, > Tunnel-Medium-Type = 6, > Tunnel-Private-Group-ID = 50 > > roka Auth-Type := MS-CHAP > Tunnel-Type = VLAN, > Tunnel-Medium-Type = 6, > Tunnel-Private-Group-ID = 40 > ---------------------snap-------------------------- Do NOT set Auth-Type. If your server is properly configured, it is not needed and can cause problems. In this case, it should not be causing the problem. Just to check - that's the ENTIRE users file, yes? robiwan: Now, here is my complete users: ---------------------start users --------------------------- hugo User-Password == "hugo01" Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 50 roka Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 40 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP --------------------------end users----------------------------------- > > > Here is the output of my radiusd with user hugo > The Cisco-Switch map user hugo in VLAN 50: > > Login OK: [hugo/<no User-Password attribute>] (from client M4DEMRCO0000015 port 50103 cli 00-0B-5D-84-AE-CA) > Sending Access-Accept of id 210 to 10.187.0.15 port 1645 > Tunnel-Type:0 = VLAN > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Private-Group-Id:0 = "50" > EAP-Message = 0x03010004 > Message-Authenticator = 0x00000000000000000000000000000000 > User-Name = "hugo" > Finished request 1 > Going to the next request > > > Here is the output with user roka > The Cisco-Switch map user roka in VLAN 1, and NOT in VLAN 40, i miss the Tunnel informations: > > Login OK: [WINLAB\\roka/<no User-Password attribute>] (from client M4DEMRCO0000015 port 50103 cli 00-0B-AA-84-AE-CA) > Sending Access-Accept of id 220 to 10.187.0.15 port 1645 > Framed-IP-Address = 255.255.255.254 > Framed-MTU = 576 > Service-Type = Framed-User > MS-MPPE-Recv-Key = 0x70235fcdc1bc208578d0a26edb3c6d0b09f7cb712d4e9b66e7b2bea5b159c4f2 > MS-MPPE-Send-Key = 0x6208fd4f8c1d2cd07a5e4597c98707dc70c94f29898eb0672e4572808efbd13d > EAP-Message = 0x03090004 > Message-Authenticator = 0x00000000000000000000000000000000 > User-Name = "WINLAB\\roka" > Finished request 9 > Going to the next request This is not helpful. Send the full debugging output prior to this, so we can see what modules matched. If you're going to trim, start from the point the radius server is idling, not the very last packet. robiwan: Okay, here is the complete output from my radiusd, when user roka do a request: sorry, it's huge rad_recv: Access-Request packet from host 10.187.0.15:1645, id=231, length=137 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x020000100157494e4c41425c726f6b61 Message-Authenticator = 0x58539e67c56f220589cf69d3485c493d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 231 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0101001604104d9b1cdfa7099813e534e513b97cf690 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1d76bae29fbc0e19159eaa3f74334d79 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=232, length=145 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1d76bae29fbc0e19159eaa3f74334d79 EAP-Message = 0x020100060319 Message-Authenticator = 0xf909eb3892cf65a9bc743a0df26a1969 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 232 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7403336ead41e5a0c556b56a35cb7d33 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=233, length=251 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x7403336ead41e5a0c556b56a35cb7d33 EAP-Message = 0x0202007019800000006616030100610100005d0301445ed95d77c35c3390cfe1215b5c4e1e8e9e656d274731adb4b7f90657cbd13b2095b1a12797a7ea814e2acdc0f092c6d3be7983fa1a806039dea5576694e804ca001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xe1546f42b5e72f886fe40c3175d5f42b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 112 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 233 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103040a19c0000006f1160301004a020000460301445eda018a3e232a765524a6e5794ea3af3409d9e3dcee73a95b41b8c452b4f72069073717e251c570a42ab27ce7128641cec168d48fac0cdae9434b00cc7bb06200040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x23e1da47b9d2ad5d9a992e53e51b0f88 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=234, length=145 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x23e1da47b9d2ad5d9a992e53e51b0f88 EAP-Message = 0x020300061900 Message-Authenticator = 0x993d1a0b0a680cde949eeeeb5366b376 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 234 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010402f71900170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd0b2de9f6247bc1a377ab09601b6622 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=235, length=331 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0xcd0b2de9f6247bc1a377ab09601b6622 EAP-Message = 0x020400c01980000000b6160301008610000082008054fa1df090a84370a298993600e34cf8af13808befff697746cb3100c83a481758189f961b7e391de8cdfe48ef0f66f45c29019de52b662aac1738fed79487efab399df4c231b1a680c8c745180c6187d738aeead3a84e22bd38e15b0487befddce9b383e84f0bd6bcb51226f258d4ceb214853d622a16ff1316df2740767e9814030100010116030100200765266a26b02174d0fbf43fdce14c70a7e27c39c9ef851116dfc350e922d9fa Message-Authenticator = 0x2c4f1683c21b9c8465c622867b6b424f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 235 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x01050031190014030100010116030100204d6ac14fd758207216d3d41e01832f4ac6183a076fbe4efd160f4a41a35b22cf Message-Authenticator = 0x00000000000000000000000000000000 State = 0xddcdd8f2cca99b985d18ca87d2b88cec Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=236, length=145 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0xddcdd8f2cca99b985d18ca87d2b88cec EAP-Message = 0x020500061900 Message-Authenticator = 0x53e1a745d44793df57b5d50d1c052863 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 236 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0106002019001703010015a9944ae4d3056456288bb99631ee9e954ab45638e8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x24ba89d55cd3575e21c74e389b97be66 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=237, length=178 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x24ba89d55cd3575e21c74e389b97be66 EAP-Message = 0x020600271900170301001ca47c7847287cdeb393c6bf70b5f6af519019eef05e83f8e5003b8efc Message-Authenticator = 0x7b8091e9347c683bf40f234e7573fb4a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 39 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - WINLAB\roka rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of WINLAB\roka PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to WINLAB\roka Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall[authorize]: module "files" returns notfound for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 237 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0107003c19001703010031fd510c2ebf47b3a59fa1aab6adad8b98bb1a27fde1f9b25b4bafef2db23581fcbc4905146ff16fb84d542486a6876d4788 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x576a439ed6f27a43441fcea96241dcdd Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=238, length=232 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x576a439ed6f27a43441fcea96241dcdd EAP-Message = 0x0207005d19001703010052543c8cda2e4d4b809a7ef500fced9a32c8475105b33591b7793d47c9038cd9d5ebaee45ce7ab4b48e9ce1429870fe0f0709833f807ed3b178c16ca85748e3425a59631a4fa19cb8a6e0e41ad7bbcc8042500 Message-Authenticator = 0x603bc333fad2a5b42b41856c81000ccc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 93 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to WINLAB\roka PEAP: Adding old state with 05 ce Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 70 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall[authorize]: module "files" returns notfound for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for roka with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: ed radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --domain=winlab --request-nt-key --username=roka --challenge=35f97f5f894fdd88 --nt-response=4f19e399acdcdaec236c88b715ba0429aad7d843e4ed9e45' Exec-Program: /usr/bin/ntlm_auth --domain=winlab --request-nt-key --username=roka --challenge=35f97f5f894fdd88 --nt-response=4f19e399acdcdaec236c88b715ba0429aad7d843e4ed9e45 Exec-Program output: NT_KEY: 2F6C7B1EA51DEE8E0E47A627D4E5DEA5 Exec-Program-Wait: plaintext: NT_KEY: 2F6C7B1EA51DEE8E0E47A627D4E5DEA5 Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 7 modcall: leaving group MS-CHAP (returns ok) for request 7 MSCHAP Success modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 238 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0108004a1900170301003f14015567cad71a1b0c4fb4c3130bde7dfa157cb9c3917e440185650393f07e3c85f3cc7b9206df9f48d67727fb5dc0d424d26c244884598f80ec4d79717050 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f776c18d763a3b13fec28371a580368 Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=239, length=168 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3f776c18d763a3b13fec28371a580368 EAP-Message = 0x0208001d1900170301001286cf00cd681fe2c866ceaa4dd4685616ebf2 Message-Authenticator = 0x9401ce83f45cba5524631482575c4e50 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 8 length 29 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to WINLAB\roka PEAP: Adding old state with 1c 3f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 8 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 modcall[authorize]: module "files" returns notfound for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Login OK: [WINLAB\\roka/<no User-Password attribute>] (from client localhost port 0) PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS modcall[authenticate]: module "eap" returns handled for request 8 modcall: leaving group authenticate (returns handled) for request 8 Sending Access-Challenge of id 239 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010900261900170301001b5d719231c99f383ef56f29dbd88ccdcee4619d327702c0a3fdcd0a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x86881135a8c0cf1a0a5e4673d0a3c80f Finished request 8 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=240, length=177 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x86881135a8c0cf1a0a5e4673d0a3c80f EAP-Message = 0x020900261900170301001b10ced5dc970678de199f84026e0da62c8d8aafcaef18cd827120f3 Message-Authenticator = 0x7299f75e3c756461e2af68b680bfdfba Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 9 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: leaving group authenticate (returns ok) for request 9 Login OK: [WINLAB\\roka/<no User-Password attribute>] (from client M4DEMRCO0000015 port 50103 cli 00-0B-5D-84-AE-CA) Sending Access-Accept of id 240 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-MPPE-Recv-Key = 0xf40ac6877b951361d702e2278e23578e330487ae798b71b65d12bb92ee68ae08 MS-MPPE-Send-Key = 0xbd3ba39fcf4ac785ca88eb041c7329af1a87a23b1c30d61f4fede979f078e442 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "WINLAB\\roka" Finished request 9 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 231 with timestamp 445eda01 Cleaning up request 1 ID 232 with timestamp 445eda01 Cleaning up request 2 ID 233 with timestamp 445eda01 Cleaning up request 3 ID 234 with timestamp 445eda01 Cleaning up request 4 ID 235 with timestamp 445eda01 Cleaning up request 5 ID 236 with timestamp 445eda01 Cleaning up request 6 ID 237 with timestamp 445eda01 Cleaning up request 7 ID 238 with timestamp 445eda01 Cleaning up request 8 ID 239 with timestamp 445eda01 Cleaning up request 9 ID 240 with timestamp 445eda01 Nothing to do. Sleeping until we see a request. In all probability, your problem is that you're using PEAP rather than just MS-CHAP, and the tunnel attributes are being set on the inner MS-CHAP reply, but not being copied to the outer EAP reply. Make sure you have this in eap.conf: eap { # rest of config, then peap { # rest of config, then use_tunneled_reply = yes } } You may also need: eap { # rest of config, then peap { # rest of config, then copy_request_to_tunnel = yes use_tunneled_reply = yes } } robiwan: Here is my eap.conf, the peap-section: peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no } unfortunately it doesn't work. User roka is still in VLAN 1 and not in VLAN 40 ...if you want to match on other attributes in the request than username at a later date. > > > So, any ideas what to do, that for user roka my radiusd also say to my Switch the Tunnel things: > > Tunnel-Type:0 = VLAN > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Private-Group-Id:0 = "40" > That's expected and normal. See RFC 2868. The number is a tag, as you can specify multiple tunnel-* attribute set. The tag groups them together, and FreeRadius sets it to zero for the common case of one set. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

2 2

Special characters in users file
by sumi thra 09 May '06

09 May '06

Hi All, Can we use special characters like $, {, [, ( in the users file?? I have defined some vendor specific attribute in users file. When i escape with \ still im not able to start the server. Whether the freeradius does not allow these characters ?? or we can accept those characters by specifying in different way?? Any help in the earliest will be of great help. Awaiting for your reply. :-) Thanks Sumi

2 11