- Freeradius-Users - lists.freeradius.org

freeradius and 802.1x troubleshooting
by Vincent Chen 21 Apr '06

21 Apr '06

Hi, all I recently changed my firewall and move my dns server to the same host running freeradius. The 802.1x connection between windows xp and my AP which works perfectly now stop working. How can I troubleshooting this? 802.1x may be secure, but definitely pain in the ass. Here is what I see in radius log. BTW: Hardware, freeradius, certificates are all the same. --- --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.2.5:1024, id=67, length=166 User-Name = "Vincent Chen" NAS-IP-Address = 10.1.2.5 NAS-Identifier = "AWL500" State = 0xf6d7edea4e31a89cdd1e573b8e7f619c EAP-Message = 0x021500500d800000004616030100410100003d030144482d535841e9b32d4e67beba62b2534c19d5a49d7a9f56d591282a9597af8600001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xf6f1d2620cddb7f2b187f79e91dff8dc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 16 rlm_eap: EAP packet type response id 21 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 16 users: Matched entry Vincent Chen at line 19 modcall[authorize]: module "files" returns ok for request 16 modcall: leaving group authorize (returns updated) for request 16 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 16 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0ee9], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 008b], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 16 modcall: leaving group authenticate (returns handled) for request 16 Sending Access-Challenge of id 67 to 10.1.2.5 port 1024 Termination-Action = RADIUS-Request Session-Timeout = 1200 EAP-Message = 0x0116040a0dc000000fcd160301004a02000046030144482d544fab626b96135973511a6d2c7a3ca4375ecf30af715f751166aca50d20338a07507a2423dec32483c2c11d54669ffba33d3f829a3f7f27ea56047a96240004001603010ee90b000ee5000ee20006fa308206f6308204dea003020102020101300d06092a864886f70d0101050500307a310b300906035504061302545731163014060355040a130d416d4a6574204469676974616c310b3009060355040b130249543119301706035504031310416d4a6574204469676974616c204341312b302906092a864886f70d010901161c76696e63656e744069736f6c7574696f6e2e64796e64 EAP-Message = 0x6e732e62697a301e170d3036303330333131313233315a170d3131303330323131313233315a3057310b300906035504061302545731163014060355040a130d416d4a6574204469676974616c310b3009060355040b13024954311730150603550403130e76657264692e686f6d652e6e6574310a3008060355040513013130820122300d06092a864886f70d01010105000382010f003082010a0282010100d8819383482d847fda6b0d13bbc5dc6e6880d3b692076a19b3c1c9487505798e113454d8a8ed2c378c0743029eece31c989826592bafc121c43784d9b835105fdc89cc8e3df125573e76d56c2283e7803f2660a70e095d051ef4e2191c EAP-Message = 0x997d0d69051c1383d82f5abba1a451ca886b0271a7ffd88b63da0b41c3aab3faf6b0a96584924466a11e0e13a19fb6fa7e31ff9f2edd01a7f8298b30152f7af49004860d8dfbf320f593fb1b4634bba64d558a75b851149007c21dbd665f81ee57c414a118b2697acfd5d5418a4e5d9dd7ce6f5356829d20bc0859c53cf9a09a444c278c85bd8a972e05b4e65da8db7ab1ae3c445d902ede58efea886cf0b16a7ec4dd0203010001a38202a8308202a430090603551d130402300030480603551d200441303f300606042a030304300606042a030305302d06042a0303063025302306082b060105050702011617687474703a2f2f736f6d652e75726c EAP-Message = 0x2e6f72672f637073301106096086480186f8420101040403020640300b0603551d0f0404030204f030130603551d25040c300a06082b06010505070301302a06096086480186f842010d041d161b5757572d536572766572206f6620416d4a6574204469676974616c301d0603551d0e04160414a37a030823f727fd625ea3b2e772b37295f8acfc3081ac0603551d230481a43081a180148c3fd1b0c717607c67d8d845ece8741f4ff8ed60a17ea47c307a310b300906035504061302545731163014060355040a130d416d4a6574204469676974616c310b3009060355040b130249543119301706035504031310416d4a6574204469676974616c20 EAP-Message = 0x4341312b302906092a864886f70d010901161c76696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4016d74af2be5576af501ab3faf576f1 Finished request 16 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 10.1.2.5:1024, id=68, length=92 User-Name = "Vincent Chen" NAS-IP-Address = 10.1.2.5 NAS-Identifier = "AWL500" State = 0x4016d74af2be5576af501ab3faf576f1 EAP-Message = 0x021600060d00 Message-Authenticator = 0x5a66fb7be4afdcbc9547bcfb1f6f906e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 17 rlm_eap: EAP packet type response id 22 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 17 users: Matched entry Vincent Chen at line 19 modcall[authorize]: module "files" returns ok for request 17 modcall: leaving group authorize (returns updated) for request 17 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 17 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 17 modcall: leaving group authenticate (returns handled) for request 17 Sending Access-Challenge of id 68 to 10.1.2.5 port 1024 Termination-Action = RADIUS-Request Session-Timeout = 1200 EAP-Message = 0x0117040a0dc000000fcd63656e744069736f6c7574696f6e2e64796e646e732e62697a820900f3bd792c9c40ec4c30270603551d110420301e811c76696e63656e744069736f6c7574696f6e2e64796e646e732e62697a30270603551d120420301e811c76696e63656e744069736f6c7574696f6e2e64796e646e732e62697a304206096086480186f842010404351633687474703a2f2f69736572766963652e64796e646e732e62697a2f6f70656e63612f7075622f63726c2f636163726c2e63726c304206096086480186f842010304351633687474703a2f2f69736572766963652e64796e646e732e62697a2f6f70656e63612f7075622f6372 EAP-Message = 0x6c2f636163726c2e63726c30440603551d1f043d303b3039a037a0358633687474703a2f2f69736572766963652e64796e646e732e62697a2f6f70656e63612f7075622f63726c2f636163726c2e63726c300d06092a864886f70d01010505000382020100a55af54cb3ad70b6d429de93b37b49e161f7975473a3727c1209267f59512eedd04741b77231661d8e45c1479955536ef14648a504ad00252e2d9c8315a60ba9f2604491e965e3c47f00c3355b06d7b6da6cf06ec622b40765f6e6da3390a09ffb5f6dd3cd790cf479b21d504e0be8e135cfeda486dd2febb632a3796f4ae94d949ecb64677b50aa1e754d3158e2738df2fbd94d4837ce6d EAP-Message = 0xb719302a99ad583e26ac0f231ab772db7cbef0a4aecebd056f2d333322d94565217603b022e08043c999eecb9d9543771e4beffc7d0a17fee3706b76dde92da5acf134d8f4795ca72864fc39b71cb9cdf1867bcffca3b195206636ce3e6c714951cbb323cd38e9b876c3668c8a5ba6d3b1201a54bd98d44d77e8e308ddc60a4a8cbebbb87454a31ec031edc09100bf2fc9060950ba6e2da98f8bfbb58ee1a14e89808e773bf6075c0c153ba0a76552957e515a6461fbda579090c57eba1a58d303d40b384fc39b8f7fafd72991a00352d3e0ed144ba679d92117784a18d734530c33d453453908039860106acdb00cfeb8a76b2da25ff0b032e7e9a8b3 EAP-Message = 0x3a57b0787ceb145d8a3a2c82477944d2159d8d3614095e5b618a6e86b69dbac307867c5ffe2e719d90b918260eb685cb3ce1e112a31fa2c234af91fda883b26ad1e60c0d57efc2b2cdc1c129f19e9129a40543fcdd4ee0c9a12b9abfdf46c88aac46ecce3b0ff12d6d3fd20007e2308207de308205c6a003020102020900f3bd792c9c40ec4c300d06092a864886f70d0101050500307a310b300906035504061302545731163014060355040a130d416d4a6574204469676974616c310b3009060355040b130249543119301706035504031310416d4a6574204469676974616c204341312b302906092a864886f70d010901161c76696e63656e7440 EAP-Message = 0x69736f6c7574696f6e2e64796e646e732e62697a301e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf0f9b620b8316abaee0c3ccac9df0bc4 Finished request 17 Going to the next request --- ___________________________________________________ 最新版 Yahoo!奇摩即時通訊 7.0，免費網路電話任你打！ http://messenger.yahoo.com.tw/ ___________________________________________________ 最新版 Yahoo!奇摩即時通訊 7.0，免費網路電話任你打！ http://messenger.yahoo.com.tw/

1 0

callingstationid filter and regexp
by Miguel 20 Apr '06

20 Apr '06

Hi, im trying to configure a check that 1315 username will be allowed to connect only from a particular list of callinstationids, so i added a Calling-Station-Id attribute to the radcheck table, this are my filter's details username: 1315 list of callingstationids: - from 22662100 to 22662199 (this is a pbx) - 22793045 - 22934240 the attribute was entered like this: username: 1315 attribute: Calling-Station-Id Op: ~= Value: ^226621[0-9][0-9]$|^22793045$|^22934240$ But i always get acces denied: Tue Apr 18 15:38:04 2006 : Auth: Login incorrect: [1315/1315] (from client private-network port 0 cli 50322793045) Tue Apr 18 15:38:20 2006 : Info: rlm_sql (sql): No matching entry in the database for request from user [1315] Tue Apr 18 15:38:20 2006 : Auth: Login incorrect: [1315/1315] (from client private-network port 0 cli 50322793045) Tue Apr 18 15:39:09 2006 : Info: rlm_sql (sql): No matching entry in the database for request from user [1315] Tue Apr 18 15:39:09 2006 : Auth: Login incorrect: [1315/1315] (from client private-network port 0 cli 50322793045) Tue Apr 18 15:39:24 2006 : Info: rlm_sql (sql): No matching entry in the database for request from user [1315] Tue Apr 18 15:39:24 2006 : Auth: Login incorrect: [1315/1315] (from client private-network port 0 cli 50322793045) Is my regexp mistyped? or am i using the wrong op? thanks

3 6

Default user in sql
by Antonio Matera 20 Apr '06

20 Apr '06

Hi, I have this user file: TLS1 Cisco-AVPair == "ssid=VLAN3" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 3, Tunnel-Type = VLAN TLS2 Cisco-AVPair == "ssid=cn-test" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2, Tunnel-Type = VLAN peap1 Cisco-AVPair == "ssid=VLAN3", User-Password == "ciao1" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 3, Tunnel-Type = VLAN peap2 Cisco-AVPair == "ssid=cn-test", User-Password := "ciao2" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2, Tunnel-Type = VLAN DEFAULT Auth-Type := Reject TLS1 and TLS2 are used for the EAP-TLS authentication with certificate. I want that TLS1 is authentucate only with the ssid=vlan3 and TLS2 with ssid=cn-test. The same for the users peap1 and peap2 but here I have a peap authentication with user and password. Without the DEFAULT user in the bottom of the user file with auth-type:=reject, if I try to authenticate TLS1 with a bad ssid, my user is authenticated without the attribute, but I don't want that this user is authenticate in this case. With DEFAULT user all works fine and the user is reject. The problem is to set a default user if I want to use the sql database. How can I do it? I need a default user that is matched only if the user that asks the authentication isn't in the sql database. I tried with the DEFAULT user in the sql.conf file but this is different because it is always the first user tested, and in my case I have always a reject authentication. Thanks a lot. Bye Antonio

1 0

Alcatel Dictionary Files
by Anitha Vijayakumar 19 Apr '06

19 Apr '06

Hi, The dictionary files that come with Freeradius for Alcatel is old and incompatible. What is the procedure to submit a new dictionary file ? Thanks and Regards, Anitha

2 1

New CRL, need to killall -HUP radiusd?
by Jason Carr 19 Apr '06

19 Apr '06

Our freeradius server is having a problem with CRL's expiring, however we have a new CRL copying over every 5 minutes. We have a 4 hour expire on our CRL's and I'm wondering if I need to killall -HUP radiusd in order for the new CRL to be picked up. I was looking through the code and it seems like the only thing that the freeradius code does with CRL's is to tell the X509 store to look for the CRL, but that seems about it. When I copy my CRL over I do the following... wget -q http://somesite.com/crl/crlfile.dem -O /tmp/crlfile.dem.new mv /tmp/crlfile.dem.new /home/freeradius/etc/certs/crlfile.dem openssl crl -inform dem -outform pem -in /home/freeradius/etc/certs/crlfile.dem -out /home/freeradius/etc/certs/crlfile.pem c_rehash /home/freeradius/etc/certs/ So, do I need to do something or these CRL's to be updated while radiusd is running? Any other helpful hints would be greatly appreciated.

1 0

Help on specify MAC auth in 'users' file
by Gordon Yuen 19 Apr '06

19 Apr '06

Dear all, I'm new to RADIUS but forced to enable wireless access in a hurry. So far I had made EAP-PEAP work with the following line in 'users' file: john Auth-Type := EAP, User-Password == "hello" Now I want to add a condition based on MAC address, but I find: john Calling-Station-Id == "00AABB00AABB", Auth-Type := EAP, User-Password == "hello" not working. I ran the radiusd in debug mode, and it told the Access-Request packet contain the 'Calling-Station-Id' attribute and the correct value, but at the end it said it cannot validate the user. Any idea!? Thanks, Gordon

3 2

ldap authentication failure
by Abey Thomas 19 Apr '06

19 Apr '06

Hi all, I am facing problems with Ldap and freeradius on RedHat linux AS 4. I can sucessfully authenticate with windows xp machines with freeradius local "users" file and md5 using cisco 2950. Radtest is successful for the ldapusers, but the radius -X shows "rlm_ldap: Attribute "User-Password" is required for authentication. & modcall[authenticate]: module "ldap" returns invalid for request 0" Any help will be appreciated. Thanks I am using the configuration file from the source file. ------------------- [root@localhost ~]# cat /etc/raddb/radiusd.conf prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 0 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no # The program to execute to do concurrency checks. #checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 0 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { ldap { server = "10.10.29.251" #identity = "uid=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com" #identity = "cn=Manager,dc=example,dc=com" #password = password basedn = "ou=people,dc=example,dc=com" #filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile)" start_tls = no tls_mode = no #default_profile = "uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com" #profile_attribute = "radiusProfileDn" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_cache_timeout = 120 ldap_cache_size = 0 ldap_connections_number = 10 #password_header = "{crypt}" password_attribute = userPassword #groupname_attribute = radiusGroupName #groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}}))(objectclass=radiusProfile)" #groupmembership_attribute = radiusGroupName timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no #access_attr_used_for_allow = yes } realm suffix { format = suffix delimiter = "@" } preprocess { huntgroups = ${confdir}/huntgroups #hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users #acctusersfile = ${confdir}/acct_users compat = no #use old style users } # regular detail files detail detail1 { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 dirperm = 0755 } # temp detail file to replicate to accountrad detail detail2 { detailfile= ${radacctdir}/detail-combined detailperm = 0600 dirperm = 0755 locking = yes } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address,Client-IP-Address, NAS-Port-Id" } #radutmp { # filename = ${logdir}/radutmp # perm = 0600 # callerid = "yes" #} #radutmp sradutmp { # filename = ${logdir}/sradutmp # perm = 0644 # callerid = "no" #} #attr_filter { # attrsfile = ${confdir}/attrs #} # The "always" module is here for debugging purposes. Each # instance simply returns the same result, always, without # doing anything. always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } # # The 'expression' module current has no configuration. expr { } } instantiate { expr } authorize { preprocess suffix files ldap } authenticate { authtype LDAP { ldap } } preacct { preprocess suffix files } accounting { acct_unique detail1 detail2 #radutmp #sradutmp } #session { #radutmp #} #post-auth { # Get an address from the IP Pool. #main_pool #} ---------------------------------------- The ldif file dn: uid=ldapuser5,ou=People,dc=example,dc=com uid: ldapuser5 cn: ldapuser5 userPassword: {crypt}$1$1jD47Q.o$o.Aqkoe/Z7au.phSO6ULW1 objectclass: radiusprofile objectClass: account #objectClass: posixAccount objectClass: top objectClass: shadowAccount radiusServiceType: Framed-User radiusFramedProtocol: Ethernet radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None --------------------------------------------------------------------------------------------------------- Ready to process requests. rad_recv: Access-Request packet from host 10.10.29.49:1812, id=61, length=133 NAS-IP-Address = 10.10.29.49 NAS-Port = 50035 NAS-Port-Type = Ethernet User-Name = "ldapuser5" Called-Station-Id = "00-14-69-B1-DE-63" Calling-Station-Id = "00-11-85-81-FE-9F" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200000e016c6461707573657235 Message-Authenticator = 0xa87b5810daf6ae5596070a302b227a3a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "ldapuser5", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched DEFAULT at 153 users: Matched DEFAULT at 157 users: Matched DEFAULT at 175 users: Matched DEFAULT at 204 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for ldapuser5 radius_xlat: '(uid=ldapuser5)' radius_xlat: 'ou=people,dc=example,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.10.29.251:389, authentication 0 rlm_ldap: bind as / to 10.10.29.251:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=example,dc=com, with filter (uid=ldapuser5) rlm_ldap: Added password {crypt}$1$1jD47Q.o$o.Aqkoe/Z7au.phSO6ULW1 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedRouting as Framed-Routing, value None & op=11 rlm_ldap: Adding radiusFramedIPNetmask as Framed-IP-Netmask, value 255.255.255.0 & op=11 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value Ethernet & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: user ldapuser5 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group authtype for request 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: group authtype returns invalid for request 0 auth: Failed to validate the user. Sending Access-Reject of id 61 to 10.10.29.49:1812 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 61 with timestamp 44458f3a Nothing to do. Sleeping until we see a request. Abey Babu Thomas

2 1

Problem in PEAP authentication with SSID check
by Antonio Matera 19 Apr '06

19 Apr '06

Hi, I can't authenticate my client with PEAP when in the user I set the SSID check. My user is the following: cn-test Cisco-AVPair == "ssid=cn-test", User-Password == "ciao" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2, Tunnel-Type = VLAN I tried with User-Password := "ciao" but the result is the same. - If I remove the ssid check the authentication works fine. - If I set Cisco-AVPair := "ssid=cn-test" the user is authenticate with any SSID my PEAP configuration is: peap { default_eap_type = mschapv2 # copy_request_to_tunnel = no # use_tunneled_reply = no # proxy_tunneled_request_as_eap = yes } with my original user I have this log: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 192.168.9.191 IP address [192.168.9.191] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded LDAP ldap: server = "ldap.your.domain" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "" ldap: basedn = "o=My Org,c=UA" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x98f5518 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/usr/local/etc/raddb/certs/masterkeys2/" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/masterkeys2/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/masterkeys2/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/masterkeys2/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = yes Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 192.168.9.191:1812 Listening on accounting 192.168.9.191:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.9.104:1645, id=76, length=158 User-Name = "cn-test" Framed-MTU = 1400 Called-Station-Id = "0012.dacb.8420" Calling-Station-Id = "000c.f135.f1ba" Cisco-AVPair = "ssid=cn-test" Service-Type = Login-User Message-Authenticator = 0x8fd166ec0ccdcd701be9cc0c79a0ac4d EAP-Message = 0x0201000c01636e2d74657374 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "272" NAS-Port = 272 NAS-IP-Address = 192.168.9.104 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cn-test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry cn-test at line 28 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 76 to 192.168.9.104 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" Tunnel-Type:0 = VLAN EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x37da08b2c91b91ad90b809a59bd271da Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.9.104:1645, id=77, length=170 User-Name = "cn-test" Framed-MTU = 1400 Called-Station-Id = "0012.dacb.8420" Calling-Station-Id = "000c.f135.f1ba" Cisco-AVPair = "ssid=cn-test" Service-Type = Login-User Message-Authenticator = 0x8db2e6e490857fafb93e258b95069ce1 EAP-Message = 0x020200060319 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "272" NAS-Port = 272 State = 0x37da08b2c91b91ad90b809a59bd271da NAS-IP-Address = 192.168.9.104 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "cn-test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry cn-test at line 28 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 77 to 192.168.9.104 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" Tunnel-Type:0 = VLAN EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8044c6a44332a0d46773902d9ca7e908 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.9.104:1645, id=78, length=270 User-Name = "cn-test" Framed-MTU = 1400 Called-Station-Id = "0012.dacb.8420" Calling-Station-Id = "000c.f135.f1ba" Cisco-AVPair = "ssid=cn-test" Service-Type = Login-User Message-Authenticator = 0xbbcb1878243f001e9f490554e70a12f9 EAP-Message = 0x0203006a198000000060160301005b0100005703014445fd71234f786eec0f6f26694e59223f5a2d3b5f9805385803325a4a373ec900003000390038003500160013000a00330032002f0066000500040065006400630062006000150012000900140011000800030100 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "272" NAS-Port = 272 State = 0x8044c6a44332a0d46773902d9ca7e908 NAS-IP-Address = 192.168.9.104 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "cn-test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 106 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry cn-test at line 28 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 005b], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0673], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 78 to 192.168.9.104 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" Tunnel-Type:0 = VLAN EAP-Message = 0x0104040a19c0000006d0160301004a0200004603014445fd564aeb2f90f45d61ef2e4c8c028b66789a3058af12abad56a3ac4d6a9520b18000f81d2398e101d0e815c080d219136dcf39ba7eef2ff29c370271a0672900350016030106730b00066f00066c0002bd308202b930820222a003020102020101300d06092a864886f70d0101050500308194310b3009060355040613024954310e300c060355040813054974616c79310f300d060355040713065472656e746f31133011060355040a130a4352454154452d4e455431133011060355040b130a4352454154452d4e4554310d300b06035504031304524f4f54312b302906092a864886f70d EAP-Message = 0x010901161c616e746f6e696f2e6d6174657261406372656174652d6e65742e6974301e170d3036303331353135313230345a170d3037303331353135313230345a308196310b3009060355040613024954310e300c060355040813054974616c79310f300d060355040713065472656e746f31133011060355040a130a4352454154452d4e455431133011060355040b130a4352454154452d4e4554310f300d06035504031306534552564552312b302906092a864886f70d010901161c616e746f6e696f2e6d6174657261406372656174652d6e65742e697430819f300d06092a864886f70d010101050003818d0030818902818100e81d9a2a8804 EAP-Message = 0x4b630c0153075c2a1dc066c99392cc5af660adbbad91ef4eeff866c5f20fa2c5fb7965a3c12b674f90f04985eab710cd97852b1ce3e08f04aa06d4717254338f62a05d6344c311578a02f9fae0aca2aa336ed9121874c86c1124fd4a7f8832b652be20f2c3ad20951e1099300f4d6c27a695aeb757501c36383d0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000381810026e9f99eee1bd9d0a221d725e9dad88ad2b9d1385db136076fda84de1ccfc1e2a5a3fa237fd9c88c4fb98267dd827f96418a007782246380e2c488310eb1df77e5fda4b05143777dcd627fe6f6a948be43e0 EAP-Message = 0x377fa815cd412cb80b442714852fe94cb9aae46c08f2e84cc7092bdf887d069e2ab1fd2cf56c9332b87e83990d670003a9308203a53082030ea003020102020900d6c51af184c17a13300d06092a864886f70d0101050500308194310b3009060355040613024954310e300c060355040813054974616c79310f300d060355040713065472656e746f31133011060355040a130a4352454154452d4e455431133011060355040b130a4352454154452d4e4554310d300b06035504031304524f4f54312b302906092a864886f70d010901161c616e746f6e696f2e6d6174657261406372656174652d6e65742e6974301e170d30363033313531353130 EAP-Message = 0x30305a170d3038303331343135313030305a30819431 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3e18eeacb6c195efc8902a77f9f7e88d Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.9.104:1645, id=79, length=170 User-Name = "cn-test" Framed-MTU = 1400 Called-Station-Id = "0012.dacb.8420" Calling-Station-Id = "000c.f135.f1ba" Cisco-AVPair = "ssid=cn-test" Service-Type = Login-User Message-Authenticator = 0x06f40f67faf08f9403fabaddb6da55a9 EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "272" NAS-Port = 272 State = 0x3e18eeacb6c195efc8902a77f9f7e88d NAS-IP-Address = 192.168.9.104 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "cn-test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry cn-test at line 28 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 79 to 192.168.9.104 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" Tunnel-Type:0 = VLAN EAP-Message = 0x010502d619000b3009060355040613024954310e300c060355040813054974616c79310f300d060355040713065472656e746f31133011060355040a130a4352454154452d4e455431133011060355040b130a4352454154452d4e4554310d300b06035504031304524f4f54312b302906092a864886f70d010901161c616e746f6e696f2e6d6174657261406372656174652d6e65742e697430819f300d06092a864886f70d010101050003818d0030818902818100b9d2e4970beba1cac75125d76679fcede5da675985ae70ca7a7414cca08fa27f7de577e293ad03a5217d3d5c8f48a3d39ed4579e38ac4e7fbf650f80d3b80253683e15948edebf EAP-Message = 0x789e3379e90e8eb5690af994d98cc6d4e702e96db90bbb1bfc642b2ddbdd026812efdcd22664bf27ae6b5cd56737db61cf5b22c2eaa415ce0b0203010001a381fc3081f9301d0603551d0e04160414f877a449a82f70e28ff7d3238ed22fca5f76d7b43081c90603551d230481c13081be8014f877a449a82f70e28ff7d3238ed22fca5f76d7b4a1819aa48197308194310b3009060355040613024954310e300c060355040813054974616c79310f300d060355040713065472656e746f31133011060355040a130a4352454154452d4e455431133011060355040b130a4352454154452d4e4554310d300b06035504031304524f4f54312b30290609 EAP-Message = 0x2a864886f70d010901161c616e746f6e696f2e6d6174657261406372656174652d6e65742e6974820900d6c51af184c17a13300c0603551d13040530030101ff300d06092a864886f70d0101050500038181009afe6349178f51966293fa52eafafe825e9441722f5f86ebb1e995589569640a40f04f3c969ea63173a875d9f055a0b19dc2c463a1c5de3a447dc04f369d5fb56fdff6bca5ef16e785a46f3646e062ac0c7cacc7cbfd163ccbb314bc66e8bbc68ac6d594e47d0cd76d66aec45508952892553bbe957973f8e6c5ac901f86881b16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd7741c3567490b1fffb984dc53d5a68 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.9.104:1645, id=80, length=372 User-Name = "cn-test" Framed-MTU = 1400 Called-Station-Id = "0012.dacb.8420" Calling-Station-Id = "000c.f135.f1ba" Cisco-AVPair = "ssid=cn-test" Service-Type = Login-User Message-Authenticator = 0xf0994c68f7d70fed02e2f659e081117d EAP-Message = 0x020500d01980000000c6160301008610000082008013ce717b6f05b379e5c6c91b127f7dd303bfcc806bbb5a187ba166822089697e8e5d804f0215c2eaab95d018db46ff1242bb7a7f554fb917daacbe29ab7624c553f87cc0fc4205fc2e392fec90c582df70bceddc06989df1c272a2587aaf48383e254286fa2e5c155f3c2acaf8ed74dbc159a8bf333e8968ed7be50326e0b422140301000101160301003056197a86dd1b3207097acac9347ba2f423d8f055addb38c08bdb3c0529ac1b81bbf22b024e307575933d999444354aa9 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "272" NAS-Port = 272 State = 0xbd7741c3567490b1fffb984dc53d5a68 NAS-IP-Address = 192.168.9.104 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "cn-test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 208 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry cn-test at line 28 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 80 to 192.168.9.104 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" Tunnel-Type:0 = VLAN EAP-Message = 0x010600411900140301000101160301003004c192ff3c426fc7d8b003cfd7661fd8d8ebda6bff6213e8b9f1563cfc201494eca607971fc45c1b7b183f6a1d8352d9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x53333b526942ca7f01421e78e3b9d78a Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.9.104:1645, id=81, length=170 User-Name = "cn-test" Framed-MTU = 1400 Called-Station-Id = "0012.dacb.8420" Calling-Station-Id = "000c.f135.f1ba" Cisco-AVPair = "ssid=cn-test" Service-Type = Login-User Message-Authenticator = 0x5edc004a5b772020b133512de56871e0 EAP-Message = 0x020600061900 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "272" NAS-Port = 272 State = 0x53333b526942ca7f01421e78e3b9d78a NAS-IP-Address = 192.168.9.104 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "cn-test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry cn-test at line 28 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 81 to 192.168.9.104 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" Tunnel-Type:0 = VLAN EAP-Message = 0x010700501900170301002059453fd679c215c3def28645e22be49d3fe0d3e6c8c877acca65e906ba9ace311703010020634c550e77f18de57088e622b95d58b25ae8c188ce3caf6bb671cc5a063b3d16 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x69e02909a6e22aa1d48979d0943ac40b Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.9.104:1645, id=82, length=244 User-Name = "cn-test" Framed-MTU = 1400 Called-Station-Id = "0012.dacb.8420" Calling-Station-Id = "000c.f135.f1ba" Cisco-AVPair = "ssid=cn-test" Service-Type = Login-User Message-Authenticator = 0xae4ab4cd22c3974382471e469a842588 EAP-Message = 0x020700501900170301002006d572099134d0e5f0bd80c7782a21e5ba14f9648bac13bbbe58aa4123c1afaa170301002080038f150b6f611704462944afa81f174bead1ecc5aa99c5ba034874f52a9c15 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "272" NAS-Port = 272 State = 0x69e02909a6e22aa1d48979d0943ac40b NAS-IP-Address = 192.168.9.104 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "cn-test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry cn-test at line 28 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - cn-test rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of cn-test PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to cn-test Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "cn-test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 33 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [cn-test/<no User-Password attribute>] (from client cn-radius port 0) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 82 to 192.168.9.104 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" Tunnel-Type:0 = VLAN EAP-Message = 0x0108005019001703010020e4fbd84ce3369c7d2af4655f79717ac52a3c60ea9318f09391f91a6ba729db341703010020822e047e83bab91a70ef94869fc1af81c71577cc762ca670d4e4abba1bc37b8c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb8036cfb325cdeca9124c3a8a4d4e05a Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.9.104:1645, id=83, length=244 User-Name = "cn-test" Framed-MTU = 1400 Called-Station-Id = "0012.dacb.8420" Calling-Station-Id = "000c.f135.f1ba" Cisco-AVPair = "ssid=cn-test" Service-Type = Login-User Message-Authenticator = 0x8ed8a3615899c841e062c2d3eb94c403 EAP-Message = 0x0208005019001703010020a43b25a82006ec2ffed6d934e82a2f3682d451ff559db842f9c26476ec8a09e117030100202f2e8f25e8924b16b0b54638dbf3e63d75e172e5b1c15982a8d9314a8b8183a2 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "272" NAS-Port = 272 State = 0xb8036cfb325cdeca9124c3a8a4d4e05a NAS-IP-Address = 192.168.9.104 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "cn-test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 8 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry cn-test at line 28 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Login incorrect: [cn-test/<no User-Password attribute>] (from client ap-test port 272 cli 000c.f135.f1ba) Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.9.104:1645, id=83, length=244 Sending Access-Reject of id 83 to 192.168.9.104 port 1645 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 76 with timestamp 4445fd56 Cleaning up request 1 ID 77 with timestamp 4445fd56 Cleaning up request 2 ID 78 with timestamp 4445fd56 Cleaning up request 3 ID 79 with timestamp 4445fd56 Cleaning up request 4 ID 80 with timestamp 4445fd56 Cleaning up request 5 ID 81 with timestamp 4445fd56 Cleaning up request 6 ID 82 with timestamp 4445fd56 Cleaning up request 7 ID 83 with timestamp 4445fd56 Nothing to do. Sleeping until we see a request. How can I resolve my problem? Thanks, bye Antonio

3 3

Fwd: Fwd: LDAP+EAP
by foreveruni＠clix.pt 18 Apr '06

18 Apr '06

=?iso-8859-1?q?Jo=E3o_Mamede?= <foreveruni at clix.pt> wrote: > I have seen the output of radiusd -X -A It's in > http://nebioq.ath.cx:85/radiuslog.txt I've made some other tries I don't if > I'm closer or far away from goal. You do not have the Windows Extended Key Usage OID's in the server certificate. See the examples on http://www.freeradius.org/doc/ Alan DeKok. That's xpextensions? I think it's ok now. but I still have not authentication (I have a update in http://nebioq.ath.cx:85/radiuslog.txt ). I have cert-src.pem cert-clt.pem .der (for both) and .p12(for both) with TTLS both freeradius and wpa_supplicant crash now :(. I've read everything in freeradius.org/doc ..couldn't find help

3 2

getting disconected
by debik 18 Apr '06

18 Apr '06

I have problem with my freeradius. I'm getting connected but after 6 minutes Win XP xlient is getting disconected. I have looked in to radius debug and theres no stop message swnt to the client. On the client I haver run ethereal to look for some kind of packet, but i didn't find anything. So what could be the reason ?

3 3