- Freeradius-Users - lists.freeradius.org

CRL not working....
by Robert Myers 06 Mar '06

06 Mar '06

I'm having some odd troubles here with the check_crl = yes I've added what I think is the appropriate config file directives, I must be missing something. Here is the debug output, any help would be much appreciated -Bob rad_recv: Access-Request packet from host 192.168.2.169:1038, id=37, length=208 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x0206000f01726d796572732d636d64 Message-Authenticator = 0xab51b4a66e5e063bf6ecb0244e478fd6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 5 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 37 to 192.168.2.169:1038 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010700060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x011fcb927c106af30a76bf45e031e026 Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=38, length=291 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0x011fcb927c106af30a76bf45e031e026 EAP-Message = 0x020700500d800000004616030100410100003d0301440cb2749bc2a634cef7356a18a591bab4181aa08ad97702e92c360a5bca7cc900001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x8cd00e8b1b35684ba2b8b81c14861bb9 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 6 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns notfound for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0562], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0073], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 38 to 192.168.2.169:1038 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x0108040a0dc00000062e160301004a020000460301440ca6c9ce32946be1ccac53123187db21cf3feaece1f5da6209b1d150132d6f20427a2b648e04281c7433674b6bff47834d3b252cae63361527f5124a08cb76a300040016030105620b00055e00055b00024730820243308201aca003020102020900b02d53f88c901429300d06092a864886f70d01010405003062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d301e170d303630313331 EAP-Message = 0x3139313831355a170d3037303133313139313831355a3065310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310f300d0603550403130673657276657230819f300d06092a864886f70d010101050003818d0030818902818100d7ecba2856c6c8427536a5100cec4b7ceed9af3e7e9f82ae8a444b0b744724ea3e99b165c59746b2900bbc6218b604a9309322295643f8d168f5d55a9e7e1be81950ab022acf750d5063120b7b56ed8f594a6e89e523e2027ace19e452fe414710f6ed EAP-Message = 0xd0d79cea027e94e35d0f6095fd04db8416c4f11f63bcf02d41d7293e450203010001300d06092a864886f70d010104050003818100a617555e7ca5a90a7e0eef057c96eb6d9dc5b8439ebbb52b7f7925dc68237c529e763580949c851755df0ac76b1451724b866e6bae7945fb64faeb88499084398dc9e7c0cbc31bd8489f27467d683448fb5787eb2b9c66d964232552a46d74c524273ccd6d3a7be29c0439b8f2c20bc96ab16755437270a2b9f647eb9806856a00030e3082030a30820273a003020102020900b02d53f88c901427300d06092a864886f70d01010405003062310b3009060355040613025553311530130603550408130c50656e6e EAP-Message = 0x73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d301e170d3036303133313139313733375a170d3038303133313139313733375a3062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d30819f300d06092a864886f70d010101050003818d0030818902818100cd464aa3398c84bd31985dea600f28cd60f7bced7e6c EAP-Message = 0x749306ff79145fb5e00628fc5908338f312aaf008a99 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa06c77f4cfd37fb9f16ced52ebdc6686 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=39, length=217 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xa06c77f4cfd37fb9f16ced52ebdc6686 EAP-Message = 0x020800060d00 Message-Authenticator = 0x2716dcc5794b1beffe21cf96c356e943 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 8 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 7 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns notfound for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 39 to 192.168.2.169:1038 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010902380d800000062e01c770ef206700cbd397b8f4627e086d6b2872b23e467fff195f007451bcb1547b66ca23a46ec638978c904ca8a942b73928be83ef91154e6c22817461d944f6ed41f7bfd17bc1ba8b6a6295eba1d63549d5dbd30203010001a381c73081c4301d0603551d0e041604147084def1ae8ce1a8344e404cfe763700473b65f43081940603551d2304818c30818980147084def1ae8ce1a8344e404cfe763700473b65f4a166a4643062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009 EAP-Message = 0x060355040b13024954310c300a0603550403130352504d820900b02d53f88c901427300c0603551d13040530030101ff300d06092a864886f70d010104050003818100a4448cd34e1dd346ee6638304d4b8f2e9ee6d8b3fc85c68d71f80b9b74cc549332042dbec402dcf84655c2478cd9ec086c4df0ae8ace50992085005e76fd10b9f7a237984a196d7614437ee9e97e7e621e6b2a07d67d0384e0485960257f2074644699b9ec065cc673a7b05622013abb3beb77d0cd2d1624e7676922eaa6e82f16030100730d00006b020102006600643062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e696131133011 EAP-Message = 0x0603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfc10b5f87ea497dbce8d66694199924f Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=40, length=1387 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xfc10b5f87ea497dbce8d66694199924f EAP-Message = 0x020904900d800000048616030104560b0003460003430003403082033c308202a5a003020102020900b02d53f88c90142c300d06092a864886f70d01010405003062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d301e170d3036303330363231303532345a170d3036303630343231303532345a3069310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a4861727269736275 EAP-Message = 0x7267310c300a060355040a13034d5349310b3009060355040b13024954311330110603550403130a726d796572732d636d6430819f300d06092a864886f70d010101050003818d0030818902818100daf05c6716f9346a5b14322363d56e9e47bce702e316f9961f06beaf89e571b6c81d7ec957bb4103ef28898be6cac14dacfb6d71265134cf9193dc08ce5e05b71d0074daca80665453493ef750381e94f8033f3212e94f7cf24e6ae34537edaf3c3b0a9e09a40cb7fec19c32d0753bfab5d6424acb1e8bb0b7a7bb453d00905d0203010001a381f23081ef30090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c EAP-Message = 0x2047656e657261746564204365727469666963617465301d0603551d0e04160414139d43580e4b595bf65001b9fb711d3a5cf04bc93081940603551d2304818c30818980147084def1ae8ce1a8344e404cfe763700473b65f4a166a4643062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d820900b02d53f88c901427300d06092a864886f70d010104050003818100289d684fa9f9e1df1757e61a0396237d891de9780a69d3db969d0c901ac8 EAP-Message = 0x36722ca531e05c52e116121dd0afabf1d8994b669084140b94c15c9ce05104a021bbfb5e79ede88ceaf592b3366df0d50eafe8bcf4ceaeddf284d3801de3eea9fab5cbe1b539784a825da253facb813e15b36a3eebd68da4add2ab48a7085c799886100000820080c72a0e26751c13b01c91545ff716fe9f16ff0328cfa0eb8822edd6c870b2fe6303e12c642f31edf017cf6cb49d6078b7b69809374f39ea5591144a0e97f882d7f99ea9eb8a3bc2e77f48dd0a9bac62857c51d7221ab13d9261dbe12240f3d9b8547242b4746e7500af619f80b9bc7ae8f8bf565941e83c639e86e5eef7877b720f0000820080a9fca434166b7bd12f2cc27bfe2462 EAP-Message = 0x87a99ec1d2579f9db69e725b1b7293b40ad087b41245bdfb338fcf70ce246f0924802e83573fdaad1f87438ede8a2edc7ec46b720edac3c3ad201b58771c2b09a2723fd2a16a8e5b20e9f7a073adb14635a3c2e59b966243fb5e974eea38111093fb27bca1e022225b161574f15a5159b01403010001011603010020a20a05e395b2ed0dfcc2e8f44addda5b3238f904b9f20c6017a772acb12c1608 Message-Authenticator = 0x43ae9e2d4338d3d0d1c91c3db6ca955e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 9 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 8 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns notfound for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 034a], Certificate --> verify error:num=3:unable to get certificate CRL rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B 31460:error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned:s3_srvr.c:2021: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 8 modcall: group authenticate returns handled for request 8 Sending Access-Challenge of id 40 to 192.168.2.169:1038 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010a00110d800000000715030100020230 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb722537bdfd460d8a203eab6301e97d9 Finished request 8 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=41, length=217 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xb722537bdfd460d8a203eab6301e97d9 EAP-Message = 0x020a00060d00 Message-Authenticator = 0x1ffb7e5aeb268158ff2c4a81fb2d07eb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 10 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 9 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns notfound for request 9 modcall: group authorize returns updated for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack alert eaptls_verify returned 4 eaptls_process returned 4 rlm_eap: Handler failed in EAP/tls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 9 modcall: group authenticate returns invalid for request 9 auth: Failed to validate the user. Delaying request 9 for 1 seconds Finished request 9 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=41, length=217 Sending Access-Reject of id 41 to 192.168.2.169:1038 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 37 with timestamp 440ca6c9 Cleaning up request 6 ID 38 with timestamp 440ca6c9 Cleaning up request 7 ID 39 with timestamp 440ca6c9 Cleaning up request 8 ID 40 with timestamp 440ca6c9 Cleaning up request 9 ID 41 with timestamp 440ca6c9 Nothing to do. Sleeping until we see a request.

1 0

pix auth and spawn_flag
by Curtis Doty 06 Mar '06

06 Mar '06

I just found a PIX that kicks out the following auth: User-Name = "bozo" NAS-IP-Address = 10.1.1.1 User-Password = "krusty" NAS-Port = 103 Cisco-AVPair = "ip:source-ip=10.1.1.2" To which freeradius does not respond until *after* the pix sends the first retry packet. The delay is always until the first retry; regardless if whatever I set the pix retry timer. Nor is it affected by the cleanup_delay or reject_delay. However, the last retry is eventually responded to after the 30 second max_request_time. The pix is only collecting timeouts on the aaa-server scoreboard. The problem goes away if radiusd is put in single process mode. Platform is Fedora Core and this is reproducible with their RPMs as well as pristine freeradius 1.1. ../C

2 6

EAP-TTLS
by Santiago Balaguer García 06 Mar '06

06 Mar '06

Hi people, When I configure eap.conf file and re-launch ./radiusd -X appears: ***************************** rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/usr/local/etc/raddb/certs/demoCA/" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" rlm_eap: Loaded and initialized type tls Segmentation default <----------------------ERROR --------------- *********************************** Is it necessary to recompile freeradius source to active EAP-TTLS? Anyway, I read all doc/ about this topic. I am very lucky if someone recomends me links to get more information about these protocol. _________________________________________________________________ Descubre la descarga digital con MSN Music. Más de un millón de canciones. http://music.msn.es/

2 1

proxy problem/question
by VannMann32 . 06 Mar '06

06 Mar '06

Hi ! I'm trying to set up a freeradius (1.1.0) server to proxy ms-chap-v2 to a ms ias server. If I send ms-chap, then the proxy works. But if I send ms-chap-v2 then i get this error message (from debug) : Sending Access-Request of id 1 to 192.168.1.1 port 1812 NAS-Identifier = "vpn.domain.com" NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP User-Name = "username" MS-CHAP-Challenge = 0xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx MS-CHAP2-Response = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy NAS-IP-Address = 192.168.1.10 Proxy-State = 0x3339 Waking up in 3 seconds... rad_recv: Access-Reject packet from host 192.168.1.1:1812, id=1, length=46 Proxy-State = 0x3339 MS-CHAP-Error = "\000E=691 R=0 V=3" Is this possible ? Should it work ? Is it possible to proxy ms-chap-v2 ?

2 3

Proxy accounting and Preproxy_useres
by Assa Tal 06 Mar '06

06 Mar '06

Hello guys/girls I'm a new in this forum And any help will be appriciate Freeradius Version 1.1.0 I'm trying to use proxy accounting to a radius backend server The proxy.conf file look like this and it works fine realm DEFAULT { type = radius authhost=LOCAL accthost=x.x.x.x.:1813 secret=blabla The problem arise when I get a raidus header witout username and without REALM The freeradius server does not proxy this request I was looking at the document and was trying to use the prepproxy_user file to Insert a user name and a realm but I failed the prepproxy_user DEFAULT User-Name =~ "HELP", Auth-Type := Accept, Realm == "HELP", Auth-Type := Accept, Called-Station-Id == 99999, 10x in adv Tal assa

1 0

special characters in passwords + FR + ldap
by Natalia Escalera 06 Mar '06

06 Mar '06

Hello all, Do somebody know how to handle passwords having special characters in between (e.g. $ ) when doing freeradius-ldap authentication? Thank you, Natalia.

2 3

Accounting-Request with invalid signature!
by 艳华杨 06 Mar '06

06 Mar '06

Hi, everyone I use Hostap(0.2.0, the hostapd is 0.4.7)+Freeradius(1.0.2)+Xsupplicant(1.0.1_, and both of the hostap and freeradius are located in the same machine. So I set 127.0.0.1 in clients.conf as freeradius server's client and set 127.0.0.1 as the radius server in hostapd.conf, and the secret of them is the same. But When I setup the authentication, I got the following informantion on radius server: rad_recv: Accounting-Request packet from host 127.0.0.1:32773, id=0, length=70 Received Accounting-Request packet from 127.0.0.1 with invalid signature! (Shared secret is incorrect.) Server rejecting request 1. Finished request 1 Then I checked the "Shared secret" set in both configure file, they are the same. Why did the error appear? On the other hand, everytime I run the xsupplicant, the destination MAC address will change for a while. And this is what I got: [INT] Called event_core_setup()! [INT] Called cardif_linux_rtnetlink_init()! [INT] ADDING INTERFACE : eth1 [INT] Flags are : 06 [INT] Initializing socket for interface eth1.. [INT] Index : 4 Interface initalized! [INT] Interface eth1 is wireless! [INT] The card reported that the destination MAC address is now 00 40 05 AE B7 7C [INT] Userdata is NULL! [INT] Working with ESSID : hostap [CONFIG] Working from config file /etc/xsupplicant.conf. [CONFIG] Opened socket descriptor #7 [ALL] Processing command : /usr/local/etc/1x/startup.sh [ALL] Returning command : /usr/local/etc/1x/startup.sh [ALL] Actual command being called is /usr/local/etc/1x/startup.sh [INT] Got an RTM_NEWLINK! [INT] Working with an interface with index of 4. [INT] -- Got a new interface request. [INT] Found interface eth1, with index of 4! (Ignored) [ALL] Processing interface eth1... (Flags : 05) [INT] The card reported that the destination MAC address is now 44 44 44 44 44 44 [INT] Successfully set WEP key [1] [INT] Successfully set the WEP transmit key [1] [INT] Successfully set WEP key [2] [INT] Successfully set WEP key [3] [INT] Successfully set WEP key [4] [INT] All 4s for dest mac! [INT] Successfully set WEP key [1] [INT] Successfully set the WEP transmit key [1] [INT] Successfully set WEP key [2] [INT] Successfully set WEP key [3] [INT] Successfully set WEP key [4] [CONFIG] MAC address changed! Updating config! [CONFIG] Working from config file /etc/xsupplicant.conf. [ALL] Unknown error (-1) [ALL] Clock tick! authWhile=29 heldWhile=59 startWhen=0 curState=LOGOFF [STATE] (global) -> DISCONNECTED [INT] Successfully set WEP key [1] [INT] Successfully set the WEP transmit key [1] [INT] Successfully set WEP key [2] [INT] Successfully set WEP key [3] [INT] Successfully set WEP key [4] [INT] All 4s for dest mac! [INT] Successfully set WEP key [1] [INT] Successfully set the WEP transmit key [1] [INT] Successfully set WEP key [2] [INT] Successfully set WEP key [3] [INT] Successfully set WEP key [4] [CONFIG] MAC address changed! Updating config! [CONFIG] Working from config file /etc/xsupplicant.conf. [ALL] Unknown error (-1) [ALL] Clock tick! authWhile=29 heldWhile=59 startWhen=0 curState=LOGOFF [STATE] (global) -> DISCONNECTED Why the destination MAC address could change? And I have checked the address "44 44 44 44 44 44" which means no network is detected. So what's wrong? Anyone can help me? Thanks a lot! Helen --------------------------------- 雅虎1G免费邮箱百分百防垃圾信

1 0

ZyAir B-3000 and freeradius
by Luciano PELLE 05 Mar '06

05 Mar '06

Hi all! I'm new to this list and probably this is not the place where to post this kind of questions. I've searched all over the net and read a lot about various configurations for freeradius, but nothing so simple to solve my problem. Hence here is the problem: I'm using Debian Sarge (kernel 2.6.8-2-686) and I'm trying to use freeradius 1.0.2 with quite all extensions available for my distro (dialupadmin, ldap, mysql, perl etc ...). Freeradius is installed correctly (no error messages, during the setup process) and when I launch it with #freeradius -X I get this output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addre ss, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-% Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. ... I suppose that this means that the server works fine. Now I'd like (and this is the real question) to use the server with a Zyxel ZyAir B-3000 that has a built in RADIUS function to authenticate users and authorize to access my LAN (mostly for using an Internet connection). What is the simplest way to configure the server and the client (ZyAir) to make them works together? How can I test the settings, before to make them operative? If I can't get help here is there anybody that knows a step-by-step tutorial I can download on the Internet (in italian?)? Thanks in advance for your help and support Luciano PELLE

2 1

no username attribute
by Norbert Grochal 05 Mar '06

05 Mar '06

Hi! My users don't use windows xp "zero configuration" service for wifi. They use Ralink Configurator with profiles. Auth EAP/PEAP. Sometimes after reboot AP or 'unhibernate' Windows XP freeradius logs packets with no User-Name attribute: rad_recv: Access-Request packet from host 10.10.10.9:2048, id=115, length=155 NAS-IP-Address = 10.10.10.9 NAS-Port = 0 Called-Station-Id = "00304f41e217" Calling-Station-Id = "000e2e74b798" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000501 Message-Authenticator = 0xebaa8690af8e44f2aa18020db98b43a2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 340 modcall[authorize]: module "preprocess" returns ok for request 340 radius_xlat: '/usr/local/var/log/radius/radacct/10.10.10.9/auth-detail-20060304' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.9/auth-detail-20060304 modcall[authorize]: module "auth_log" returns ok for request 340 modcall[authorize]: module "chap" returns noop for request 340 modcall[authorize]: module "mschap" returns noop for request 340 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 340 rlm_eap: EAP packet type response id 0 length 5 !!!!!! rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 340 modcall[authorize]: module "files" returns notfound for request 340 !!!!!! rlm_sql (sql): zero length username not permitted modcall[authorize]: module "sql" returns invalid for request 340 modcall: leaving group authorize (returns invalid) for request 340 !!!!!! Invalid user: [<no User-Name attribute>] (from client AP9 port 0 cli 000e2e74b798) Delaying request 340 for 1 seconds And user must restart computer to connect to AP... It is possible to set freeradius not to check User-Name? I use User-Name for logging purposes only. freeradius gets login and password from PEAP and authorize even if User-Name is anything. What should I do? Norbert

2 3

oracle question
by Victor Polukcht 05 Mar '06

05 Mar '06

Can i configure FR to use oracle stored procedures for authentication & accounting? -- Victor Polukcht

2 2