- Freeradius-Users - lists.freeradius.org

Two factor authentication
by alfonso.lazaro＠eresmas.com 28 Mar '06

28 Mar '06

hi i am trying to configure freeradius to authenticate wireless users. i would like to use a two-factor authentication. - all pcs that want to connect to the wireless network need a certificate signed by CA - users must authenticate with their user/pass active directory i am not sure how to do it rasdius.conf authorize { eap } authenticate { Auth-Type MS-CHAP { mschap } } eap.conf tls { private_key_password = password private_key_file = /cert/cert-srv.pem CA_file = /CA/ca-cert.pem dh_file= /dev/urandom } best regards alfonso

3 3

Re:Ignoring resquest from unkown client
by yao guoxian 28 Mar '06

28 Mar '06

to Alex M: >If u are using MySQL you need to set, radiusd.config >to read NAS table im MuSQL (look et the end of the config file, I >think it's a last line) and then add your NAS clients to NAS table im >db Thanks for your advice. Will you please explain and describe the detail to me ? I searched through the radiusd.conf and couldn't locate the entry for nas. And my NAS table in 'freeradius' database looks like the following: mysql> select * from nas; +----+------------------------+---------------+---------+----------+---------------+-----------------+------------------+ | id | nasname |shortname | type | ports | secret | community | description | +-----+-----------------------+---------------+---------+----------+---------------+-----------------+-------------------+ | 1 | 202.117.15.164 | liv1 | other | NULL | testing123 | NULL | RADIUS Client

1 0

RE: Different user attributes based on NAS-IP-Address?AlsoSuffixwildcards available?
by John Mylchreest 28 Mar '06

28 Mar '06

How would they work in this case? -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Jonathan De Graeve Sent: 27 March 2006 19:28 To: FreeRadius users mailing list Subject: RE: Different user attributes based on NAS-IP-Address?AlsoSuffixwildcards available? Uh, huntgroups? J. > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens John > Mylchreest > Verzonden: maandag 27 maart 2006 15:00 > Aan: FreeRadius users mailing list > Onderwerp: RE: Different user attributes based on NAS-IP-Address? > AlsoSuffixwildcards available? > > Funnily enough, I asked the very same thing recently. We do it quite > crudely at the moment, but it works. > > We add an nshortname field to radreply/anything else necessary, and in > sql.conf we link it to the user reply. Ie: > > Something like this would work: > > authorize_reply_query = "SELECT radreply.id,UserName,Attribute,Value,Op > FROM radreply, nas WHERE Username = '%{SQL-User-Name}' AND nas.ipaddr = > %{Client-IP-Address}' AND (radreply.nshortname = nas.shortname OR > radreply.nshortname is NULL) ORDER BY id" > > If you find any cleaner solution using the default schema, I would LOVE to > hear about it, since that's the problem/task I'm currently facing. > > -----Original Message----- > From: freeradius-users- > bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius- > users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org] On Behalf Of > Andy Coates > Sent: 27 March 2006 13:35 > To: freeradius-users(a)lists.freeradius.org > Subject: Different user attributes based on NAS-IP-Address? Also > Suffixwildcards available? > > > Hey, > > Is this even possible? > > The basic problem is that I have 2 devices that will use the same > username. > For example, one device handles dialup, one handles DSL. I'd like the > user > to have the same username, and depending on the NAS sending the request > the > correct IP/Netmask would be returned. > > I've setup huntgroups for the NAS, and can match them in various setups in > the users file - but this only seems like it would work for group based > attributes (i.e. common fields). Returning unique fields for each user > based on the NAS-IP-Address doesn't seem possible? > > That aside, does anyone know if its possible to use wildcards with Suffix > when stripping usernames? I've tried "@*" or "@*.domain.com" and it > doesn't > seem to match :( > > Thanks in advance, > Andy. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > Communications on or through ioko's computer systems may be monitored or > recorded to secure effective system operation and for other lawful > purposes. > > Unless otherwise agreed expressly in writing, this communication is to be > treated as confidential and the information in it may not be used or > disclosed except for the purpose for which it has been sent. If you have > reason to believe that you are not the intended recipient of this > communication, please contact the sender immediately. No employee is > authorised to conclude any binding agreement on behalf of ioko with > another party by e-mail without prior express written confirmation. > > ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0

RE: Version 1.1.1 stops responding
by King, Michael 28 Mar '06

28 Mar '06

Just for some reference (Trying to find commonalities): What OS/Distro are you? I'm Debian testing release How did you Install? (Prebuilt binary / created local package and install / install from source) I created a local Debian package, and installed it. What modules did you enable? PEAP, TTLS, and TLS What is your authentication source? Using ntlm_auth against Active Directory 2003 What is your supplicant? 98% Windows XP built in supplicant. The rest are Linux / Mac clients. I wonder if this has something to do with this bug that got squashed.... 2006.03.20 v1.0.5, and v1.1.0 - A validation issue exists with the EAP-MSCHAPv2 module in all versions from 1.0.0 (where the module first appeared) to 1.1.0. Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 client state machine to potentially convince the server to bypass authentication checks. This bypassing could also result in the server crashing. We recommend that administrators upgrade immediately. > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Stefan Winter > Sent: Monday, March 27, 2006 1:49 AM > To: FreeRadius users mailing list > Subject: Re: Version 1.1.1 stops responding > > > Mine seg faulted as well.. > > Here's the last few lines of the freeradius -X -A > > > modcall: entering group authenticate for request 1002 > > rlm_eap: Request found, released from the list > > rlm_eap: EAP/peap > > rlm_eap: processing type peap > > rlm_eap_peap: Authenticate > > rlm_eap_tls: processing TLS > > rlm_eap_tls: Length Included > > eaptls_verify returned 11 > > Interesting. This morning I encountered again that radiusd > was claiming to be still listening on its ports, but didn't > process anything any more. As other logs showed, someone > logged into an Access Point via TTLS at 8:22 and at 8:25 the > Nagios Monitoring system marked the RADIUS Server as > critical. Scan interval for Nagios is every three minutes. So > it could very well be that FreeRADIUS stopped processing > packets when it tried to do TTLS. Sounds similar to your > case, just that it didn't segfault. Note that we usually use > TTLS it several times a day, and FreeRADIUS shows this > behaviour only sporadically. > I now reverted to 1.1.0 in the hope that it's better there. > The way it is now is... disturbing. > > Greetings, > > Stefan Winter > > -- > Stefan WINTER > > Stiftung RESTENA - Réseau Téléinformatique de l'Education > Nationale et de la Recherche Ingenieur Forschung & Entwicklung > > 6, rue Richard Coudenhove-Kalergi > L-1359 Luxembourg > E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 > http://www.restena.lu Fax: +352 422473 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

RE: How Getting accounting informations ?
by Vincent MARGUERIE 28 Mar '06

28 Mar '06

Hi, I've always got the same problem with accounting informations...sorry to query you one more time !! But I've made a new test with radclient and I have this log (maybe it will be helpfull) > echo "User-Password = tata, User-Name = tata, Accounting-Status-Type = Start" | radclient -x -d /usr/local/etc/raddb/ radius:1813 acct whatever rad_recv: Accounting-Request packet from host 192.168.0.1:32768, id=218, length=44 User-Password = "\256\032\246\027\310$!\305\313UBc\306." User-Name = "tata" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 7 modcall[preacct]: module "preprocess" returns noop for request 7 rlm_realm: No '@' in User-Name = "tata", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 7 modcall: leaving group preacct (returns noop) for request 7 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 7 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.0.1/detail-20060328' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.0.1/detail-20060328 modcall[accounting]: module "detail" returns ok for request 7 rlm_unix: no Accounting-Status-Type attribute in request. modcall[accounting]: module "unix" returns noop for request 7 rlm_radutmp: No Accounting-Status-Type record. modcall[accounting]: module "radutmp" returns noop for request 7 radius_xlat: '*packet has no accounting status type*. [user 'tata', nas '192.168.0.1']' rlm_sql (sql) in sql_accounting: packet has no accounting status type. [user 'tata', nas '192.168.0.1'] modcall[accounting]: module "sql" returns invalid for request 7 modcall: leaving group accounting (returns invalid) for request 7 Finished request 7 Going to the next request --- Walking the entire request list --- Cleaning up request 7 ID 218 with timestamp 44289161 Nothing to do. Sleeping until we see a request. What does "*packet has no accounting status type*" means ? Is it the reason for accounting doesn't work ? I fell lost...please help :-) ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- For the auth section....there's no problem (see the following lines) > echo "User-Password = tata, User-Name = tata, Accounting-Status-Type = Start" | radclient -x -d /usr/local/etc/raddb/ radius:1812 auth whatever rad_recv: Access-Request packet from host 192.168.0.1:32768, id=215, length=44 User-Password = "tata" User-Name = "tata" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.0.1/auth-detail-20060328' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.0.1/auth-detail-20060328 modcall[authorize]: module "auth_log" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "tata", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 4 radius_xlat: 'tata' rlm_sql (sql): sql_set_user escaped user --> 'tata' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'tata' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'tata' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tata' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tata' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'tata' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'tata' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tata' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tata' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 4 modcall: leaving group authorize (returns ok) for request 4 auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 4 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.0.1/reply-detail-20060328' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.0.1/reply-detail-20060328 modcall[post-auth]: module "reply_log" returns ok for request 4 rlm_sql (sql): Processing sql_postauth radius_xlat: 'tata' rlm_sql (sql): sql_set_user escaped user --> 'tata' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'tata', 'tata', 'Access-Accept', NOW())' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'tata', 'tata', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: INSERT into radpostauth (id, user, pass, reply, date) values ('', 'tata', 'tata', 'Access-Accept', NOW()) rlm_sql (sql): Released sql socket id: 0 modcall[post-auth]: module "sql" returns ok for request 4 rlm_sql_log (sql_log): Processing sql_log_postauth radius_xlat: 'INSERT INTO radpostauth ?? (user, pass, reply, date) VALUES ?? ('tata', 'tata', ?? 'Access-Accept', '2006-03-28 03:22:25');' radius_xlat: '/usr/local/var/log/radius/radacct/sql-relay' modcall[post-auth]: module "sql_log" returns ok for request 4 modcall: leaving group post-auth (returns ok) for request 4 Sending Access-Accept of id 215 to 192.168.0.1 port 32768 Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 215 with timestamp 44288fd1 Nothing to do. Sleeping until we see a request. Regards, Vincent

1 1

rlm_eap_tls sometimes fails to read files after HUP
by Ben Thompson 27 Mar '06

27 Mar '06

Hi I have just upgraded to FreeRADIUS 1.1.1 after previously using the 1.0.1 RedHat package. At first startup it works fine but sometimes when the server receives a HUP signal (we do this every 15 mins) to re-read the config files I am getting the following errors :- Wed Mar 22 16:48:45 2006 : Info: Reloading configuration files. Wed Mar 22 16:48:47 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Mar 22 16:48:47 2006 : Error: rlm_eap_tls: Error reading certificate file Wed Mar 22 16:48:47 2006 : Error: rlm_eap: Failed to initialize type tls Wed Mar 22 16:48:47 2006 : Error: radiusd.conf[9]: eap: Module instantiation failed. Wed Mar 22 16:48:47 2006 : Error: radiusd.conf[1719] Unknown module "eap". Wed Mar 22 16:48:47 2006 : Error: radiusd.conf[1666] Failed to parse authenticate section. At this point I have to restart. As I said this only happens sometimes, at other times it is successful and I just get this :- Wed Mar 22 16:47:36 2006 : Info: Reloading configuration files. Wed Mar 22 16:47:36 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Mar 22 16:47:37 2006 : Info: Ready to process requests. Could someone advise how to go about debugging this problem? Thanks Ben Thompson

3 5

RE: Still having issue with radtest
by Atkins, Dwane P 27 Mar '06

27 Mar '06

I apologize for not using proper terms since this is new to me, I tend to associate to something I do know. 1.) Since I attempting to use the sql database for authentication purpose, would it be best if I made sure that radius@localhost (my username I chose) be in the users file and also be granted privileges on the sql database (I chose to call it radius as well) 2.) When doing the radtest, would the proper syntax be radtest radius radiustest localhost 1645 baseball (with baseball being the shared secret also entered into the clients.conf file) or should there be quotes around the shared secret. My apologies for calling it a preshare key. This is an IPSec term that I have used for a few years. 3.) I have read documentation. I have bought the O'Reilly Book and read it. I have reinstalled my server and all to no avail. I appreciate the help you all give, but I am stuck. I am sure I overlooked the issue, but at this point, I cannot see it. Thanks again. Dwane ________________________________ From: Atkins, Dwane P Sent: Sat 3/25/2006 11:34 AM To: freeradius-users(a)lists.freeradius.org Subject: Still having issue with radtest A couple questions I have not asked about this issue? Do both the user@localhost and localhost need access to the Sql database. I am at a loss as to why everytime I run this process, it tells me that I have an invalid preshare key. Do they preshare keys need to be in quotes. If I have a user called radius with a password of radiustest and my localhost preshare is BASEBALL, then would my syntax be, radtest radius radiustest localhost 1645 BASEBALL ? Or woudl I need to put quotes around the alpha characters. I cannot move on until I get this resolved obviously and I am not sure where to try. I can get issues resolved with the SQL portion, but to get it to see the local host, I am at a loss. If anyone can think of anything else I can possibly try, please let me know. If not, I appreciate all your efforts. Dwane

3 2

RE: Different user attributes based on NAS-IP-Address? AlsoSuffixwildcards available?
by Jonathan De Graeve 27 Mar '06

27 Mar '06

Uh, huntgroups? J. > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens John > Mylchreest > Verzonden: maandag 27 maart 2006 15:00 > Aan: FreeRadius users mailing list > Onderwerp: RE: Different user attributes based on NAS-IP-Address? > AlsoSuffixwildcards available? > > Funnily enough, I asked the very same thing recently. We do it quite > crudely at the moment, but it works. > > We add an nshortname field to radreply/anything else necessary, and in > sql.conf we link it to the user reply. Ie: > > Something like this would work: > > authorize_reply_query = "SELECT radreply.id,UserName,Attribute,Value,Op > FROM radreply, nas WHERE Username = '%{SQL-User-Name}' AND nas.ipaddr = > %{Client-IP-Address}' AND (radreply.nshortname = nas.shortname OR > radreply.nshortname is NULL) ORDER BY id" > > If you find any cleaner solution using the default schema, I would LOVE to > hear about it, since that's the problem/task I'm currently facing. > > -----Original Message----- > From: freeradius-users- > bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius- > users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org] On Behalf Of > Andy Coates > Sent: 27 March 2006 13:35 > To: freeradius-users(a)lists.freeradius.org > Subject: Different user attributes based on NAS-IP-Address? Also > Suffixwildcards available? > > > Hey, > > Is this even possible? > > The basic problem is that I have 2 devices that will use the same > username. > For example, one device handles dialup, one handles DSL. I'd like the > user > to have the same username, and depending on the NAS sending the request > the > correct IP/Netmask would be returned. > > I've setup huntgroups for the NAS, and can match them in various setups in > the users file - but this only seems like it would work for group based > attributes (i.e. common fields). Returning unique fields for each user > based on the NAS-IP-Address doesn't seem possible? > > That aside, does anyone know if its possible to use wildcards with Suffix > when stripping usernames? I've tried "@*" or "@*.domain.com" and it > doesn't > seem to match :( > > Thanks in advance, > Andy. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > Communications on or through ioko's computer systems may be monitored or > recorded to secure effective system operation and for other lawful > purposes. > > Unless otherwise agreed expressly in writing, this communication is to be > treated as confidential and the information in it may not be used or > disclosed except for the purpose for which it has been sent. If you have > reason to believe that you are not the intended recipient of this > communication, please contact the sender immediately. No employee is > authorised to conclude any binding agreement on behalf of ioko with > another party by e-mail without prior express written confirmation. > > ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Different user attributes based on NAS-IP-Address? Also Suffix wildcards available?
by Andy Coates 27 Mar '06

27 Mar '06

Hey, Is this even possible? The basic problem is that I have 2 devices that will use the same username. For example, one device handles dialup, one handles DSL. I'd like the user to have the same username, and depending on the NAS sending the request the correct IP/Netmask would be returned. I've setup huntgroups for the NAS, and can match them in various setups in the users file - but this only seems like it would work for group based attributes (i.e. common fields). Returning unique fields for each user based on the NAS-IP-Address doesn't seem possible? That aside, does anyone know if its possible to use wildcards with Suffix when stripping usernames? I've tried "@*" or "@*.domain.com" and it doesn't seem to match :( Thanks in advance, Andy.

2 1

RE: Version 1.1.1 stops responding
by King, Michael 27 Mar '06

27 Mar '06

Mine seg faulted as well.. (This time I didn't overwrite the log) rad2:/home/mking# /usr/sbin/freeradius -X -A >crash.log Segmentation fault rad2:/home/mking# I don't believe running /usr/sbin/freeradius -X -A is capturing anything useful. Is there something else I can do? Here's the last few lines of the freeradius -X -A rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.0.1.32/auth-detail-20060324 modcall[authorize]: module "auth_log" returns ok for request 1002 modcall[authorize]: module "chap" returns noop for request 1002 modcall[authorize]: module "mschap" returns noop for request 1002 rlm_realm: No '@' in User-Name = "BSC\ddelutis", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1002 rlm_eap: EAP packet type response id 28 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1002 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 1002 modcall: leaving group authorize (returns updated) for request 1002 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1002 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11

3 2