- Freeradius-Users - lists.freeradius.org

RE: Radius server health monitor :
by Devaraj Hattibelegal Patil 07 Mar '06

07 Mar '06

Can I get any idea on writing our own new open code? I mean I am looking for new small really light wait application which does monitoring and uses the best method (either snmp ping or Server status message or some radius API). Regards, Devah -----Original Message----- From: freeradius-users-bounces+devaraj=airvana.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+devaraj=airvana.com@lists.freeradius.or g] On Behalf Of Peter Nixon Sent: Tuesday, March 07, 2006 4:50 AM To: FreeRadius users mailing list Subject: Re: Radius server health monitor : On Mon 06 Mar 2006 15:11, Devaraj Hattibelegal Patil wrote: > Radius server health monitor: I was looking from best way monitor the > health of the Radius server. Can some body suggest the best possible > way? > Thanks in advance Nagios, OpenNMS (Which I use) and many other NMS systems have radius monitoring plugins that work just fine. They can also monitor your backend auth and accounting stores for you (LDAP and SQL for example) -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

1 0

mysql 4.1.0 can not run normally in Freeradius 1.0.5
by yao guoxian 07 Mar '06

07 Mar '06

Freeradius works well through authenticating users throught "files" option. In order to authenticate users throng "sql" , I have installed mysql 4.1.0 on the machine which has the Redhat 9 operation system. I followed the suggestion : mysql -uroot -prootpass radius < db_mysql.sql and made changes to radiusd.conf like below: authorise { preprocess chap mschap #counter #attr_filter #eap suffix sql #files #etc_smbpasswd } authenticate { authtype PAP { pap } authtype CHAP { chap } authtype MS-CHAP{ mschap } #pam #unix #authtype LDAP { # ldap #} } preacct { preprocess suffix #files } accounting { acct_unique detail #counter unix sql radutmp #sradutmp } session { radutmp } However when I input : radiusd -X, only got the following errors: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "rootpass" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = no sql: sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Could not link driver rlm_sql_mysql: file not found rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. Any suggestons?

2 1

Problem with EAP/TLS authentication
by Guillaume 07 Mar '06

07 Mar '06

hi, i am in trouble in the configuration of my radius server, eap/tls and wifi clients, i dont know where is the error, if its in my conf or if its in my certificates... I run the freeradius version 1.0.4. When Wifi client running winXP sp2 try to connect the radius, i have this following error after (i think) a succesfull authentication: rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 #error is here >> rlm_eap_tls: Received unexpected tunneled data after successful handshake. rlm_eap: Handler failed in EAP/tls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 9 modcall: group authenticate returns invalid for request 9 auth: Failed to validate the user. Do you have any idea why it doesnt work? If i use the radtest command with a fake user, it works... Thanks for your help :) --------------- here is my eap.conf: eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = yes tls { private_key_password = eripasse private_key_file = /etc/pki/ERITEST/private/ERITEST.srv.mail_key.pem certificate_file = /etc/pki/ERITEST/private/ERITEST.srv.mail_cert.pem CA_file = /etc/pki/ERITEST/eritestCA.pem random_file = /etc/pki/tls/random.rand fragment_size = 1024 } } -------------------------- and my users file "user" Auth-Type := EAP "test" Auth-Type := Local, User-Password =="test"

3 3

Radius server health monitor :
by Devaraj Hattibelegal Patil 06 Mar '06

06 Mar '06

Radius server health monitor: I was looking from best way monitor the health of the Radius server. Can some body suggest the best possible way? Thanks in advance

2 1

CRL not working....
by Robert Myers 06 Mar '06

06 Mar '06

I'm having some odd troubles here with the check_crl = yes I've added what I think is the appropriate config file directives, I must be missing something. Here is the debug output, any help would be much appreciated -Bob rad_recv: Access-Request packet from host 192.168.2.169:1038, id=37, length=208 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x0206000f01726d796572732d636d64 Message-Authenticator = 0xab51b4a66e5e063bf6ecb0244e478fd6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 5 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 37 to 192.168.2.169:1038 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010700060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x011fcb927c106af30a76bf45e031e026 Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=38, length=291 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0x011fcb927c106af30a76bf45e031e026 EAP-Message = 0x020700500d800000004616030100410100003d0301440cb2749bc2a634cef7356a18a591bab4181aa08ad97702e92c360a5bca7cc900001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x8cd00e8b1b35684ba2b8b81c14861bb9 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 6 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns notfound for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0562], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0073], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 38 to 192.168.2.169:1038 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x0108040a0dc00000062e160301004a020000460301440ca6c9ce32946be1ccac53123187db21cf3feaece1f5da6209b1d150132d6f20427a2b648e04281c7433674b6bff47834d3b252cae63361527f5124a08cb76a300040016030105620b00055e00055b00024730820243308201aca003020102020900b02d53f88c901429300d06092a864886f70d01010405003062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d301e170d303630313331 EAP-Message = 0x3139313831355a170d3037303133313139313831355a3065310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310f300d0603550403130673657276657230819f300d06092a864886f70d010101050003818d0030818902818100d7ecba2856c6c8427536a5100cec4b7ceed9af3e7e9f82ae8a444b0b744724ea3e99b165c59746b2900bbc6218b604a9309322295643f8d168f5d55a9e7e1be81950ab022acf750d5063120b7b56ed8f594a6e89e523e2027ace19e452fe414710f6ed EAP-Message = 0xd0d79cea027e94e35d0f6095fd04db8416c4f11f63bcf02d41d7293e450203010001300d06092a864886f70d010104050003818100a617555e7ca5a90a7e0eef057c96eb6d9dc5b8439ebbb52b7f7925dc68237c529e763580949c851755df0ac76b1451724b866e6bae7945fb64faeb88499084398dc9e7c0cbc31bd8489f27467d683448fb5787eb2b9c66d964232552a46d74c524273ccd6d3a7be29c0439b8f2c20bc96ab16755437270a2b9f647eb9806856a00030e3082030a30820273a003020102020900b02d53f88c901427300d06092a864886f70d01010405003062310b3009060355040613025553311530130603550408130c50656e6e EAP-Message = 0x73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d301e170d3036303133313139313733375a170d3038303133313139313733375a3062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d30819f300d06092a864886f70d010101050003818d0030818902818100cd464aa3398c84bd31985dea600f28cd60f7bced7e6c EAP-Message = 0x749306ff79145fb5e00628fc5908338f312aaf008a99 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa06c77f4cfd37fb9f16ced52ebdc6686 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=39, length=217 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xa06c77f4cfd37fb9f16ced52ebdc6686 EAP-Message = 0x020800060d00 Message-Authenticator = 0x2716dcc5794b1beffe21cf96c356e943 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 8 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 7 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns notfound for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 39 to 192.168.2.169:1038 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010902380d800000062e01c770ef206700cbd397b8f4627e086d6b2872b23e467fff195f007451bcb1547b66ca23a46ec638978c904ca8a942b73928be83ef91154e6c22817461d944f6ed41f7bfd17bc1ba8b6a6295eba1d63549d5dbd30203010001a381c73081c4301d0603551d0e041604147084def1ae8ce1a8344e404cfe763700473b65f43081940603551d2304818c30818980147084def1ae8ce1a8344e404cfe763700473b65f4a166a4643062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009 EAP-Message = 0x060355040b13024954310c300a0603550403130352504d820900b02d53f88c901427300c0603551d13040530030101ff300d06092a864886f70d010104050003818100a4448cd34e1dd346ee6638304d4b8f2e9ee6d8b3fc85c68d71f80b9b74cc549332042dbec402dcf84655c2478cd9ec086c4df0ae8ace50992085005e76fd10b9f7a237984a196d7614437ee9e97e7e621e6b2a07d67d0384e0485960257f2074644699b9ec065cc673a7b05622013abb3beb77d0cd2d1624e7676922eaa6e82f16030100730d00006b020102006600643062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e696131133011 EAP-Message = 0x0603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfc10b5f87ea497dbce8d66694199924f Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=40, length=1387 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xfc10b5f87ea497dbce8d66694199924f EAP-Message = 0x020904900d800000048616030104560b0003460003430003403082033c308202a5a003020102020900b02d53f88c90142c300d06092a864886f70d01010405003062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d301e170d3036303330363231303532345a170d3036303630343231303532345a3069310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a4861727269736275 EAP-Message = 0x7267310c300a060355040a13034d5349310b3009060355040b13024954311330110603550403130a726d796572732d636d6430819f300d06092a864886f70d010101050003818d0030818902818100daf05c6716f9346a5b14322363d56e9e47bce702e316f9961f06beaf89e571b6c81d7ec957bb4103ef28898be6cac14dacfb6d71265134cf9193dc08ce5e05b71d0074daca80665453493ef750381e94f8033f3212e94f7cf24e6ae34537edaf3c3b0a9e09a40cb7fec19c32d0753bfab5d6424acb1e8bb0b7a7bb453d00905d0203010001a381f23081ef30090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c EAP-Message = 0x2047656e657261746564204365727469666963617465301d0603551d0e04160414139d43580e4b595bf65001b9fb711d3a5cf04bc93081940603551d2304818c30818980147084def1ae8ce1a8344e404cfe763700473b65f4a166a4643062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d820900b02d53f88c901427300d06092a864886f70d010104050003818100289d684fa9f9e1df1757e61a0396237d891de9780a69d3db969d0c901ac8 EAP-Message = 0x36722ca531e05c52e116121dd0afabf1d8994b669084140b94c15c9ce05104a021bbfb5e79ede88ceaf592b3366df0d50eafe8bcf4ceaeddf284d3801de3eea9fab5cbe1b539784a825da253facb813e15b36a3eebd68da4add2ab48a7085c799886100000820080c72a0e26751c13b01c91545ff716fe9f16ff0328cfa0eb8822edd6c870b2fe6303e12c642f31edf017cf6cb49d6078b7b69809374f39ea5591144a0e97f882d7f99ea9eb8a3bc2e77f48dd0a9bac62857c51d7221ab13d9261dbe12240f3d9b8547242b4746e7500af619f80b9bc7ae8f8bf565941e83c639e86e5eef7877b720f0000820080a9fca434166b7bd12f2cc27bfe2462 EAP-Message = 0x87a99ec1d2579f9db69e725b1b7293b40ad087b41245bdfb338fcf70ce246f0924802e83573fdaad1f87438ede8a2edc7ec46b720edac3c3ad201b58771c2b09a2723fd2a16a8e5b20e9f7a073adb14635a3c2e59b966243fb5e974eea38111093fb27bca1e022225b161574f15a5159b01403010001011603010020a20a05e395b2ed0dfcc2e8f44addda5b3238f904b9f20c6017a772acb12c1608 Message-Authenticator = 0x43ae9e2d4338d3d0d1c91c3db6ca955e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 9 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 8 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns notfound for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 034a], Certificate --> verify error:num=3:unable to get certificate CRL rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B 31460:error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned:s3_srvr.c:2021: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 8 modcall: group authenticate returns handled for request 8 Sending Access-Challenge of id 40 to 192.168.2.169:1038 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010a00110d800000000715030100020230 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb722537bdfd460d8a203eab6301e97d9 Finished request 8 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=41, length=217 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xb722537bdfd460d8a203eab6301e97d9 EAP-Message = 0x020a00060d00 Message-Authenticator = 0x1ffb7e5aeb268158ff2c4a81fb2d07eb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 10 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 9 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns notfound for request 9 modcall: group authorize returns updated for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack alert eaptls_verify returned 4 eaptls_process returned 4 rlm_eap: Handler failed in EAP/tls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 9 modcall: group authenticate returns invalid for request 9 auth: Failed to validate the user. Delaying request 9 for 1 seconds Finished request 9 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=41, length=217 Sending Access-Reject of id 41 to 192.168.2.169:1038 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 37 with timestamp 440ca6c9 Cleaning up request 6 ID 38 with timestamp 440ca6c9 Cleaning up request 7 ID 39 with timestamp 440ca6c9 Cleaning up request 8 ID 40 with timestamp 440ca6c9 Cleaning up request 9 ID 41 with timestamp 440ca6c9 Nothing to do. Sleeping until we see a request.

1 0

pix auth and spawn_flag
by Curtis Doty 06 Mar '06

06 Mar '06

I just found a PIX that kicks out the following auth: User-Name = "bozo" NAS-IP-Address = 10.1.1.1 User-Password = "krusty" NAS-Port = 103 Cisco-AVPair = "ip:source-ip=10.1.1.2" To which freeradius does not respond until *after* the pix sends the first retry packet. The delay is always until the first retry; regardless if whatever I set the pix retry timer. Nor is it affected by the cleanup_delay or reject_delay. However, the last retry is eventually responded to after the 30 second max_request_time. The pix is only collecting timeouts on the aaa-server scoreboard. The problem goes away if radiusd is put in single process mode. Platform is Fedora Core and this is reproducible with their RPMs as well as pristine freeradius 1.1. ../C

2 6

EAP-TTLS
by Santiago Balaguer García 06 Mar '06

06 Mar '06

Hi people, When I configure eap.conf file and re-launch ./radiusd -X appears: ***************************** rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/usr/local/etc/raddb/certs/demoCA/" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" rlm_eap: Loaded and initialized type tls Segmentation default <----------------------ERROR --------------- *********************************** Is it necessary to recompile freeradius source to active EAP-TTLS? Anyway, I read all doc/ about this topic. I am very lucky if someone recomends me links to get more information about these protocol. _________________________________________________________________ Descubre la descarga digital con MSN Music. Más de un millón de canciones. http://music.msn.es/

2 1

proxy problem/question
by VannMann32 . 06 Mar '06

06 Mar '06

Hi ! I'm trying to set up a freeradius (1.1.0) server to proxy ms-chap-v2 to a ms ias server. If I send ms-chap, then the proxy works. But if I send ms-chap-v2 then i get this error message (from debug) : Sending Access-Request of id 1 to 192.168.1.1 port 1812 NAS-Identifier = "vpn.domain.com" NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP User-Name = "username" MS-CHAP-Challenge = 0xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx MS-CHAP2-Response = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy NAS-IP-Address = 192.168.1.10 Proxy-State = 0x3339 Waking up in 3 seconds... rad_recv: Access-Reject packet from host 192.168.1.1:1812, id=1, length=46 Proxy-State = 0x3339 MS-CHAP-Error = "\000E=691 R=0 V=3" Is this possible ? Should it work ? Is it possible to proxy ms-chap-v2 ?

2 3

Proxy accounting and Preproxy_useres
by Assa Tal 06 Mar '06

06 Mar '06

Hello guys/girls I'm a new in this forum And any help will be appriciate Freeradius Version 1.1.0 I'm trying to use proxy accounting to a radius backend server The proxy.conf file look like this and it works fine realm DEFAULT { type = radius authhost=LOCAL accthost=x.x.x.x.:1813 secret=blabla The problem arise when I get a raidus header witout username and without REALM The freeradius server does not proxy this request I was looking at the document and was trying to use the prepproxy_user file to Insert a user name and a realm but I failed the prepproxy_user DEFAULT User-Name =~ "HELP", Auth-Type := Accept, Realm == "HELP", Auth-Type := Accept, Called-Station-Id == 99999, 10x in adv Tal assa

1 0

special characters in passwords + FR + ldap
by Natalia Escalera 06 Mar '06

06 Mar '06

Hello all, Do somebody know how to handle passwords having special characters in between (e.g. $ ) when doing freeradius-ldap authentication? Thank you, Natalia.

2 3