- Freeradius-Users - lists.freeradius.org

PEAP problems, never see an Access-Accept
by Jorgen Rosink 03 Feb '06

03 Feb '06

Had a hard time to even start FreeRadius on my Debian Unstable system with a working PEAP module (yes, I'm aware of OpenSSL licences and eap_tls / eap_peap linking problems with Debian, _now_ ;-) ) I'm currently using the 20060202-snapshot. With this version (also tried 20060130, same behaviour) I'm able to create PEAP enabled Debian packages, after manually editing. the pcap section in the main Makefile. The problem now is that I'm trying to authenticate a default WindowsXP SP2 supplicant (ipw2200 nic) with PEAP, mschapv2 and a HP ProCurve 520WL Access Point in 802.1x mode (latest firmware). Below my FreeRadius startup and a attempt to authenticate, could someone please point me in a direction what's going on, I've no clue what's wrong... Also Google told me that the last line here isn't harmful : rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A =================================================== Starting - reading configuration files ... read_config_files: reading dictionary Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: checkrad = "/usr/sbin/checkrad" main: debug_level = 0 main: proxy_requests = yes log: syslog_facility = "daemon" proxy: retry_delay = 5 proxy: retry_count = 3 proxy: default_fallback = yes proxy: dead_time = 120 proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no read_config_files: reading realms main: port = 1812 listen: type = "auth" listen: ipaddr = * listen: port = 0 listen: type = "acct" listen: ipaddr = * listen: port = 0 client: secret = "VerySecret" client: shortname = "localhost" client: nastype = "other" client: secret = "VerySecret" client: shortname = "AccessPoint" radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: input_pairs = "request" exec: shell_escape = yes rlm_exec: wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded expiration expiration: reply-message = "Password Has Expired " Module: Instantiated expiration (expiration) Module: Loaded logintime logintime: reply-message = "You are calling outside your allowed timespan " logintime: minimum-timeout = 60 Module: Instantiated logintime (logintime) Module: Loaded PAP pap: encryption_scheme = "auto" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: authtype = "MS-CHAP" Module: Instantiated mschap (mschap) Module: Loaded System unix: radwtmp = "/var/log/freeradius/radwtmp" Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/example.key" tls: certificate_file = "/etc/freeradius/certs/example.crt" tls: CA_file = "/etc/ssl/certs/ca-example.pem" tls: dh_file = "/etc/freeradius/certs/example.dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: header = "%t" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Nothing to do. Sleeping until we see a request. ================================================================ rad_recv: Access-Request packet from host 172.17.10.251 port 6001, id=39, length=124 User-Name = "test" NAS-IP-Address = 172.17.10.251 Called-Station-Id = "00-08-02-76-00-90;" Calling-Station-Id = "00-0e-35-34-dd-3b" NAS-Identifier = "AccessPoint" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100090174657374 Message-Authenticator = 0x0a0b124bc3aa323410bbcd011db21736 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall[authorize]: module "unix" returns notfound for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry test at line 71 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "expiration" returns noop for request 0 modcall[authorize]: module "logintime" returns noop for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 39 to 172.17.10.251 port 6001 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x94610f5f14ece8a99c37e49bc6b1ce2a Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 172.17.10.251 port 6001, id=40, length=213 User-Name = "test" NAS-IP-Address = 172.17.10.251 Called-Station-Id = "00-08-02-76-00-90;" Calling-Station-Id = "00-0e-35-34-dd-3b" NAS-Identifier = "AccessPoint" State = 0x94610f5f14ece8a99c37e49bc6b1ce2a Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202005019800000004616030100410100003d030143e28e48e1b0cbcbfff3673946177ef43f9af64238acc0b5b047fdeb872fa3b200001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x1bc6f95ab0468d016eb825511eaf513a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 modcall[authorize]: module "unix" returns notfound for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry test at line 71 modcall[authorize]: module "files" returns ok for request 1 modcall[authorize]: module "expiration" returns noop for request 1 modcall[authorize]: module "logintime" returns noop for request 1 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 09ae], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 40 to 172.17.10.251 port 6001 EAP-Message = 0x0103040a19c000000a0b160301004a02000046030143e28e4fa3e533156bf17d077dd383df77a4b0c6dd0b0ea554c81025ba87265e20987e09a118d7d4643e14a9a4d32eb9311dfad012d1275e3a43c5de640e40db6b00040016030109ae0b0009aa0009a70004ed308204e9308203d1a003020102020101300d06092a864886f70d0101040500308196310b3009060355040613024e4c310b3009060355040813025a483112301006035504071309526f7474657264616d31173015060355040a130e526f73696e6b20646f74204e65743111300f060355040b13085365637572697479311a301806035504031311526f73696e6b20646f74204e6574 EAP-Message = 0x204341311e301c06092a864886f70d010901160f696e666f40726f73696e6b2e6e6574301e170d3036303132393037343732305a170d3136303132373037343732305a30819d310b3009060355040613024e4c310b3009060355040813025a483112301006035504071309526f7474657264616d31173015060355040a130e526f73696e6b20646f74204e65743111300f060355040b130853656375726974793121301f06035504031318686f6f6664646f6f732e6c616e2e726f73696e6b2e6e6574311e301c06092a864886f70d010901160f696e666f40726f73696e6b2e6e657430820122300d06092a864886f70d01010105000382010f003082 EAP-Message = 0x010a0282010100c331b85436fc16272576c3cf056710891c6cd8ad3630cae76f558ff147de6a5124439061753006b6371deec022b92d3829dbdce53e6844e883e5c5d0e8a7330200c73a579a1a3479ab439ce5c4d48931b9b723c83f3d543e1e24b22b027f388d94b1b323b14bb5dbb384c560563a278b28e2d8e2a352e8ec68cc6e9cf1ff4fa75114d7dd69d2752e3be06eb5f30a01aa6a2fbd2d34ce2abee138f37c709866746d25baf2cd1266239ad0f6704b1ca3a64c43befbda5f6d2e391f7413c21dedeaecee9def8565483e300e31718fbf57b9af813c234d0e51515ab33615ce7a08d00d94806578409e96ca33857ab8b280151e1d6b0f9ad7 EAP-Message = 0xe5943c4bf705839f7da70203010001a38201373082013330090603551d1304023000301106096086480186f8420101040403020640302606096086480186f842010d041916174f70656e53534c20536572766572205365637572697479301d0603551d0e04160414ec2a249c5f57bbf34e79d270fff5abfe1463cb0f3081cb0603551d230481c33081c080148a5c01ab1c1801ee324a8c09b176ac94fe65c433a1819ca48199308196310b3009060355040613024e4c310b3009060355040813025a483112301006035504071309526f7474657264616d31173015060355040a130e526f73696e6b20646f74204e65743111300f060355040b13085365 EAP-Message = 0x637572697479311a301806035504031311526f73696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x25410c5b38ac7fca242181fd9fe7bb91 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 172.17.10.251 port 6001, id=41, length=139 User-Name = "test" NAS-IP-Address = 172.17.10.251 Called-Station-Id = "00-08-02-76-00-90;" Calling-Station-Id = "00-0e-35-34-dd-3b" NAS-Identifier = "AccessPoint" State = 0x25410c5b38ac7fca242181fd9fe7bb91 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0x3356877f603457a2d74f2342d5cc3384 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 modcall[authorize]: module "unix" returns notfound for request 2 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry test at line 71 modcall[authorize]: module "files" returns ok for request 2 modcall[authorize]: module "expiration" returns noop for request 2 modcall[authorize]: module "logintime" returns noop for request 2 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 41 to 172.17.10.251 port 6001 EAP-Message = 0x0104040619406b20646f74204e6574204341311e301c06092a864886f70d010901160f696e666f40726f73696e6b2e6e6574820900e1a1176971c7d6ef300d06092a864886f70d01010405000382010100936a55c46e4232e60ac99c2a3e0a41f7294acf42c671e57a2b290c81fc780cbc1672550ed0b2075b5c3fb829397de0b292481e59cd3dec251949ecf0da075c2f35c71dbaa17100be339eae3f1ac867f560d6a6bad30ee12ec014c7fb196d9f92db57e26231c56e868f0962ae11b0c6e8198c446769f35b011cdd627721b7a9e03b9bc873e415f3083a5d36a6d504c10fcc6192751e4112d3bf40110ec56a788112e85c3d1a7734be3ecaeb1a EAP-Message = 0xde5794cd97ab9c48d64d071d116050923ebbe4251dba7f269b224736c1a621158a1cc0f2edd2f6066b9263be575e9e006f553695596368fe3b03e184c416971d384a4d1c5d5085a6efb0fbb0f4c0bfeaa259e2730004b4308204b030820398a003020102020900e1a1176971c7d6ef300d06092a864886f70d0101050500308196310b3009060355040613024e4c310b3009060355040813025a483112301006035504071309526f7474657264616d31173015060355040a130e526f73696e6b20646f74204e65743111300f060355040b13085365637572697479311a301806035504031311526f73696e6b20646f74204e6574204341311e301c0609 EAP-Message = 0x2a864886f70d010901160f696e666f40726f73696e6b2e6e6574301e170d3036303132393037343730375a170d3136303132373037343730375a308196310b3009060355040613024e4c310b3009060355040813025a483112301006035504071309526f7474657264616d31173015060355040a130e526f73696e6b20646f74204e65743111300f060355040b13085365637572697479311a301806035504031311526f73696e6b20646f74204e6574204341311e301c06092a864886f70d010901160f696e666f40726f73696e6b2e6e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100bf7c0ba29a35022161 EAP-Message = 0xd2546491864131250e741334a9f18212353b35ace6cb1281968d3ec7f6ab88048de1b0f3265fc0a714e2adb1394952606810e13edd6eb6bd24b70a1232338783af60efcc1ec7a363f8e1b63ea57551a232b113a8930f52bcc7ac3c4eabdfbdd800489405de961210a7b210b4d1e75392aac8154b5d778415d7c0ccff812bb6bd43f7dc0f525543d5720c772bfcba21684d595346409a4d0705e2fbc84adaefa80efc6b38746e52f33c1cc823ba590ba1e17edf2443d7a5eac959d45a0c935990b0cb191a1ec7316eb39a9e1fc78f80fe573c8ebff4b5740f201fc8a5fe22e764f495489816cb9367e781b5ced688d591d6cf68370cd5e10203010001a3 EAP-Message = 0x81fe3081fb301d0603551d0e041604148a5c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbb987803b65fb7f9b0c99ae0443b8f73 Finished request 2 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 172.17.10.251 port 6001, id=42, length=139 User-Name = "test" NAS-IP-Address = 172.17.10.251 Called-Station-Id = "00-08-02-76-00-90;" Calling-Station-Id = "00-0e-35-34-dd-3b" NAS-Identifier = "AccessPoint" State = 0xbb987803b65fb7f9b0c99ae0443b8f73 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0x91246da75dc4e2c5333731902452ebaf Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 modcall[authorize]: module "unix" returns notfound for request 3 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry test at line 71 modcall[authorize]: module "files" returns ok for request 3 modcall[authorize]: module "expiration" returns noop for request 3 modcall[authorize]: module "logintime" returns noop for request 3 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 42 to 172.17.10.251 port 6001 EAP-Message = 0x01050211190001ab1c1801ee324a8c09b176ac94fe65c4333081cb0603551d230481c33081c080148a5c01ab1c1801ee324a8c09b176ac94fe65c433a1819ca48199308196310b3009060355040613024e4c310b3009060355040813025a483112301006035504071309526f7474657264616d31173015060355040a130e526f73696e6b20646f74204e65743111300f060355040b13085365637572697479311a301806035504031311526f73696e6b20646f74204e6574204341311e301c06092a864886f70d010901160f696e666f40726f73696e6b2e6e6574820900e1a1176971c7d6ef300c0603551d13040530030101ff300d06092a864886f7 EAP-Message = 0x0d010105050003820101008b539267e12479731db7c4353f6993462f3b0432a4db800e760bf22f4764cce2ad0462ecb6ab73dd3a0f07d7b695d53c9008a7fab743091e3c977ed5cc8f2f9f1e5e65248f29d419525e0e2c4afaa3649390b988c9157f7ecae4f8db85a892eb45d66cbf628cf048ff089015fac65d4a0252a165fc7b9eeea913110c55d70d0d65de8bd84357912d0c44675e4cdb55381e444248e1867f2c044e9d837857460720d184f54f0e7bc2f127268aeb7d01c6d18dcab21303d6f2204dd019ff32c9a28a51ec9f4213f6171a2f427802c9b25f229b3733c26be49aad2899079018aa8e2502650f1b09d1e78a04d4ce9f6b0d8718a5 EAP-Message = 0xcc351115abed2bc668813f4e403616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5cc823fc860e51e2a5955798d4b45193 Finished request 3 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 172.17.10.251 port 6001, id=43, length=139 User-Name = "test" NAS-IP-Address = 172.17.10.251 Called-Station-Id = "00-08-02-76-00-90;" Calling-Station-Id = "00-0e-35-34-dd-3b" NAS-Identifier = "AccessPoint" State = 0x5cc823fc860e51e2a5955798d4b45193 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0xd39e91b6065810827896087e5df1d0a5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 modcall[authorize]: module "unix" returns notfound for request 4 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry test at line 71 modcall[authorize]: module "files" returns ok for request 4 modcall[authorize]: module "expiration" returns noop for request 4 modcall[authorize]: module "logintime" returns noop for request 4 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 43 to 172.17.10.251 port 6001 EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6610d79fd88d12d735d46c4a3a66afc8 Finished request 4 Going to the next request Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 39 with timestamp 43e28e4e Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 40 with timestamp 43e28e4f Cleaning up request 3 ID 42 with timestamp 43e28e4f Cleaning up request 2 ID 41 with timestamp 43e28e4f Cleaning up request 4 ID 43 with timestamp 43e28e4f Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.17.10.251 port 6001, id=45, length=124 User-Name = "test" NAS-IP-Address = 172.17.10.251 Called-Station-Id = "00-08-02-76-00-90;" Calling-Station-Id = "00-0e-35-34-dd-3b" NAS-Identifier = "AccessPoint" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300090174657374 Message-Authenticator = 0x68a441a1bd3e96023c83cb4ce0c1b520 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 modcall[authorize]: module "unix" returns notfound for request 6 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 3 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry test at line 71 modcall[authorize]: module "files" returns ok for request 6 modcall[authorize]: module "expiration" returns noop for request 6 modcall[authorize]: module "logintime" returns noop for request 6 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 45 to 172.17.10.251 port 6001 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0727aab76a626cffb7e315efabe50725 Finished request 6 Going to the next request --- Walking the entire request list --- Waking up in 3 seconds... rad_recv: Access-Request packet from host 172.17.10.251 port 6001, id=46, length=213 User-Name = "test" NAS-IP-Address = 172.17.10.251 Called-Station-Id = "00-08-02-76-00-90;" Calling-Station-Id = "00-0e-35-34-dd-3b" NAS-Identifier = "AccessPoint" State = 0x0727aab76a626cffb7e315efabe50725 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204005019800000004616030100410100003d030143e2941081bdb23e8dab82da1809bc9a7236815ffe1a73f1d377090e4840ea6a00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xa46d8e575955fb0b44916f31b12a333c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 modcall[authorize]: module "unix" returns notfound for request 7 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 4 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry test at line 71 modcall[authorize]: module "files" returns ok for request 7 modcall[authorize]: module "expiration" returns noop for request 7 modcall[authorize]: module "logintime" returns noop for request 7 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 09ae], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 46 to 172.17.10.251 port 6001 EAP-Message = 0x0105040a19c000000a0b160301004a02000046030143e2941665928a65ebd19f033bd7d12a6bf54e686c74f7b88de6bfd09ca63cfc20265d3c04973659ee90df12a1252e624eefc45477ba0ac6e2a92fe85c86c3511f00040016030109ae0b0009aa0009a70004ed308204e9308203d1a003020102020101300d06092a864886f70d0101040500308196310b3009060355040613024e4c310b3009060355040813025a483112301006035504071309526f7474657264616d31173015060355040a130e526f73696e6b20646f74204e65743111300f060355040b13085365637572697479311a301806035504031311526f73696e6b20646f74204e6574 EAP-Message = 0x204341311e301c06092a864886f70d010901160f696e666f40726f73696e6b2e6e6574301e170d3036303132393037343732305a170d3136303132373037343732305a30819d310b3009060355040613024e4c310b3009060355040813025a483112301006035504071309526f7474657264616d31173015060355040a130e526f73696e6b20646f74204e65743111300f060355040b130853656375726974793121301f06035504031318686f6f6664646f6f732e6c616e2e726f73696e6b2e6e6574311e301c06092a864886f70d010901160f696e666f40726f73696e6b2e6e657430820122300d06092a864886f70d01010105000382010f003082 EAP-Message = 0x010a0282010100c331b85436fc16272576c3cf056710891c6cd8ad3630cae76f558ff147de6a5124439061753006b6371deec022b92d3829dbdce53e6844e883e5c5d0e8a7330200c73a579a1a3479ab439ce5c4d48931b9b723c83f3d543e1e24b22b027f388d94b1b323b14bb5dbb384c560563a278b28e2d8e2a352e8ec68cc6e9cf1ff4fa75114d7dd69d2752e3be06eb5f30a01aa6a2fbd2d34ce2abee138f37c709866746d25baf2cd1266239ad0f6704b1ca3a64c43befbda5f6d2e391f7413c21dedeaecee9def8565483e300e31718fbf57b9af813c234d0e51515ab33615ce7a08d00d94806578409e96ca33857ab8b280151e1d6b0f9ad7 EAP-Message = 0xe5943c4bf705839f7da70203010001a38201373082013330090603551d1304023000301106096086480186f8420101040403020640302606096086480186f842010d041916174f70656e53534c20536572766572205365637572697479301d0603551d0e04160414ec2a249c5f57bbf34e79d270fff5abfe1463cb0f3081cb0603551d230481c33081c080148a5c01ab1c1801ee324a8c09b176ac94fe65c433a1819ca48199308196310b3009060355040613024e4c310b3009060355040813025a483112301006035504071309526f7474657264616d31173015060355040a130e526f73696e6b20646f74204e65743111300f060355040b13085365 EAP-Message = 0x637572697479311a301806035504031311526f73696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x256fa9fa8661c4589ec569f6d8292b0b Finished request 7 Going to the next request Waking up in 3 seconds... rad_recv: Access-Request packet from host 172.17.10.251 port 6001, id=47, length=139 User-Name = "test" NAS-IP-Address = 172.17.10.251 Called-Station-Id = "00-08-02-76-00-90;" Calling-Station-Id = "00-0e-35-34-dd-3b" NAS-Identifier = "AccessPoint" State = 0x256fa9fa8661c4589ec569f6d8292b0b Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0x396b5797c6d4c74a892e64587bf31920 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 modcall[authorize]: module "unix" returns notfound for request 8 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry test at line 71 modcall[authorize]: module "files" returns ok for request 8 modcall[authorize]: module "expiration" returns noop for request 8 modcall[authorize]: module "logintime" returns noop for request 8 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 8 modcall: leaving group authenticate (returns handled) for request 8 Sending Access-Challenge of id 47 to 172.17.10.251 port 6001 EAP-Message = 0x0106040619406b20646f74204e6574204341311e301c06092a864886f70d010901160f696e666f40726f73696e6b2e6e6574820900e1a1176971c7d6ef300d06092a864886f70d01010405000382010100936a55c46e4232e60ac99c2a3e0a41f7294acf42c671e57a2b290c81fc780cbc1672550ed0b2075b5c3fb829397de0b292481e59cd3dec251949ecf0da075c2f35c71dbaa17100be339eae3f1ac867f560d6a6bad30ee12ec014c7fb196d9f92db57e26231c56e868f0962ae11b0c6e8198c446769f35b011cdd627721b7a9e03b9bc873e415f3083a5d36a6d504c10fcc6192751e4112d3bf40110ec56a788112e85c3d1a7734be3ecaeb1a EAP-Message = 0xde5794cd97ab9c48d64d071d116050923ebbe4251dba7f269b224736c1a621158a1cc0f2edd2f6066b9263be575e9e006f553695596368fe3b03e184c416971d384a4d1c5d5085a6efb0fbb0f4c0bfeaa259e2730004b4308204b030820398a003020102020900e1a1176971c7d6ef300d06092a864886f70d0101050500308196310b3009060355040613024e4c310b3009060355040813025a483112301006035504071309526f7474657264616d31173015060355040a130e526f73696e6b20646f74204e65743111300f060355040b13085365637572697479311a301806035504031311526f73696e6b20646f74204e6574204341311e301c0609 EAP-Message = 0x2a864886f70d010901160f696e666f40726f73696e6b2e6e6574301e170d3036303132393037343730375a170d3136303132373037343730375a308196310b3009060355040613024e4c310b3009060355040813025a483112301006035504071309526f7474657264616d31173015060355040a130e526f73696e6b20646f74204e65743111300f060355040b13085365637572697479311a301806035504031311526f73696e6b20646f74204e6574204341311e301c06092a864886f70d010901160f696e666f40726f73696e6b2e6e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100bf7c0ba29a35022161 EAP-Message = 0xd2546491864131250e741334a9f18212353b35ace6cb1281968d3ec7f6ab88048de1b0f3265fc0a714e2adb1394952606810e13edd6eb6bd24b70a1232338783af60efcc1ec7a363f8e1b63ea57551a232b113a8930f52bcc7ac3c4eabdfbdd800489405de961210a7b210b4d1e75392aac8154b5d778415d7c0ccff812bb6bd43f7dc0f525543d5720c772bfcba21684d595346409a4d0705e2fbc84adaefa80efc6b38746e52f33c1cc823ba590ba1e17edf2443d7a5eac959d45a0c935990b0cb191a1ec7316eb39a9e1fc78f80fe573c8ebff4b5740f201fc8a5fe22e764f495489816cb9367e781b5ced688d591d6cf68370cd5e10203010001a3 EAP-Message = 0x81fe3081fb301d0603551d0e041604148a5c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcb8a8fb8a929b76ebdac65a87b1f7753 Finished request 8 Going to the next request Waking up in 3 seconds... rad_recv: Access-Request packet from host 172.17.10.251 port 6001, id=48, length=139 User-Name = "test" NAS-IP-Address = 172.17.10.251 Called-Station-Id = "00-08-02-76-00-90;" Calling-Station-Id = "00-0e-35-34-dd-3b" NAS-Identifier = "AccessPoint" State = 0xcb8a8fb8a929b76ebdac65a87b1f7753 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600061900 Message-Authenticator = 0x3e9078ef884941e52695cb8531567ed1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 modcall[authorize]: module "unix" returns notfound for request 9 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 users: Matched entry test at line 71 modcall[authorize]: module "files" returns ok for request 9 modcall[authorize]: module "expiration" returns noop for request 9 modcall[authorize]: module "logintime" returns noop for request 9 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 9 modcall: leaving group authenticate (returns handled) for request 9 Sending Access-Challenge of id 48 to 172.17.10.251 port 6001 EAP-Message = 0x01070211190001ab1c1801ee324a8c09b176ac94fe65c4333081cb0603551d230481c33081c080148a5c01ab1c1801ee324a8c09b176ac94fe65c433a1819ca48199308196310b3009060355040613024e4c310b3009060355040813025a483112301006035504071309526f7474657264616d31173015060355040a130e526f73696e6b20646f74204e65743111300f060355040b13085365637572697479311a301806035504031311526f73696e6b20646f74204e6574204341311e301c06092a864886f70d010901160f696e666f40726f73696e6b2e6e6574820900e1a1176971c7d6ef300c0603551d13040530030101ff300d06092a864886f7 EAP-Message = 0x0d010105050003820101008b539267e12479731db7c4353f6993462f3b0432a4db800e760bf22f4764cce2ad0462ecb6ab73dd3a0f07d7b695d53c9008a7fab743091e3c977ed5cc8f2f9f1e5e65248f29d419525e0e2c4afaa3649390b988c9157f7ecae4f8db85a892eb45d66cbf628cf048ff089015fac65d4a0252a165fc7b9eeea913110c55d70d0d65de8bd84357912d0c44675e4cdb55381e444248e1867f2c044e9d837857460720d184f54f0e7bc2f127268aeb7d01c6d18dcab21303d6f2204dd019ff32c9a28a51ec9f4213f6171a2f427802c9b25f229b3733c26be49aad2899079018aa8e2502650f1b09d1e78a04d4ce9f6b0d8718a5 EAP-Message = 0xcc351115abed2bc668813f4e403616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x17ac3f7c07a1e6664f16e4f442042b30 Finished request 9 Going to the next request Waking up in 3 seconds... rad_recv: Access-Request packet from host 172.17.10.251 port 6001, id=49, length=139 User-Name = "test" NAS-IP-Address = 172.17.10.251 Called-Station-Id = "00-08-02-76-00-90;" Calling-Station-Id = "00-0e-35-34-dd-3b" NAS-Identifier = "AccessPoint" State = 0x17ac3f7c07a1e6664f16e4f442042b30 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700061900 Message-Authenticator = 0xa1f601a8731d7b6e2f58a54a12161cc8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 10 modcall[authorize]: module "preprocess" returns ok for request 10 modcall[authorize]: module "chap" returns noop for request 10 modcall[authorize]: module "mschap" returns noop for request 10 modcall[authorize]: module "unix" returns notfound for request 10 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 10 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 10 users: Matched entry test at line 71 modcall[authorize]: module "files" returns ok for request 10 modcall[authorize]: module "expiration" returns noop for request 10 modcall[authorize]: module "logintime" returns noop for request 10 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 10 modcall: leaving group authorize (returns updated) for request 10 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 10 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 10 modcall: leaving group authenticate (returns handled) for request 10 Sending Access-Challenge of id 49 to 172.17.10.251 port 6001 EAP-Message = 0x010800061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d583820eec8338593117c0e78b0012a Finished request 10 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 44 with timestamp 43e29414 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 9 ID 48 with timestamp 43e29416 Cleaning up request 7 ID 46 with timestamp 43e29416 Cleaning up request 6 ID 45 with timestamp 43e29416 Cleaning up request 8 ID 47 with timestamp 43e29416 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 10 ID 49 with timestamp 43e29417 Nothing to do. Sleeping until we see a request.

2 2

RE: Unable to connect TCP/IP error 733 -resolution
by Galloway, David Mr KRS 03 Feb '06

03 Feb '06

Thanks for the response Chad. RESOLUTION: Configuration wasn't correct on the AS5400 (which I don't have access to, so couldn't check the config), it was pointing to an old DHCP server which was causing the error. For troubleshooting we setup DHCP on the AS5400 and the connection worked flawlessly. Pointed to the *correct* DHCP server and it connected successfully. Now we're on our way to using LDAP for authentication. Wish us luck!!! :) Regards, David Galloway Public Networks Administration KRS IT Network Operations Help Desk (805) 355-2444 Direct (805) 355-4512 ________________________________ From: freeradius-users-bounces+david.l.galloway=us.army.mil(a)lists.freeradius.org [mailto:freeradius-users-bounces+david.l.galloway=us.army.mil@lists.freeradi us.org] On Behalf Of Bohannan, Chad W Sent: Friday, February 03, 2006 7:55 AM To: FreeRadius users mailing list Subject: RE: Unable to connect TCP/IP error 733 >>Hi All.... >>Here's an issue I'm getting, and I seem to not be able to find any answers elsewhere on the internet. >>We're testing currently and our client is dialing into our NAS, the NAS sends the auth. request to the RADIUS, RADIUS authenticates and returns a good request.... BUT!!!!! On the client side the connection is quickly dropped >>when it moves to "Registering Your Computer on The Network" and returns the error message of -Checking network protocol connections... TCP/IP CP reported error 733. A connection to the remote computer could not be >>completed. You might need to adjust the protocols on this computer.- >>The protocol on the Client is set to PPP. When I checked out various modem sites they kept referring to problems negotiating mult-link for single link connections... That option is off by default on Windows XP (which is the client). >>So I'm quite stuck, not sure exactly which way to go and what changed to make on the RADIUS side to resolve this connection issue. Try debugging PPP on the AS side. You may also want to debug DHCP packets. It has been a while, but I think that error refers to the client being unable to obtain an IP address.

1 0

New accounting database each month
by Eduardo Bejar 02 Feb '06

02 Feb '06

Hi, Is there a way to configure freeradius to create a new MySQL accounting database each month? (in example: jan_06_radacct, feb_06_radacct, etc). The database should be created the first minute of the first day of each month. This is required for backup/database size. Thanks! Edo

4 3

Creating different groups
by Eduardo Bejar 02 Feb '06

02 Feb '06

Hi, I´m using Freeradius with MySQL authentication and accounting. Ok, if I want to allow access to a user, I add it to the radcheck table with UserName = "username" Attribute = "Crypt-Password" Op = "==" Value = "encryptedpassword" If I want to deny it I just add UserName = "username" Attribute = "Auth-Type" Op = "==" Value = "Reject" Now, my question is, which attribute, op and values should I use to allow access to a user only between certain hours? Which are the possible values that the field Attribute can have? Thanks for your comments, Edo

2 1

RE: Unable to connect TCP/IP error 733
by Bohannan, Chad W 02 Feb '06

02 Feb '06

>>Hi All.... >>Here's an issue I'm getting, and I seem to not be able to find any answers elsewhere on the internet. >>We're testing currently and our client is dialing into our NAS, the NAS sends the auth. request to the RADIUS, RADIUS authenticates and returns a good request.... BUT!!!!! On the client side the connection is quickly dropped >>when it moves to "Registering Your Computer on The Network" and returns the error message of -Checking network protocol connections... TCP/IP CP reported error 733. A connection to the remote computer could not be >>completed. You might need to adjust the protocols on this computer.- >>The protocol on the Client is set to PPP. When I checked out various modem sites they kept referring to problems negotiating mult-link for single link connections... That option is off by default on Windows XP (which is the client). >>So I'm quite stuck, not sure exactly which way to go and what changed to make on the RADIUS side to resolve this connection issue. Try debugging PPP on the AS side. You may also want to debug DHCP packets. It has been a while, but I think that error refers to the client being unable to obtain an IP address.

1 0

Digest W/HA1 Authentication
by Tavis P 02 Feb '06

02 Feb '06

I'm just curious which attribute type (or digest module configuration) i need to use to enable HA1 digest authentication in Freeradius 1.1.0? I havn't been any to find any documentation regarding this feature except for the blurb in the Changelog for 1.1.0

2 4

Cisco VSA hack
by Peter Hicks 02 Feb '06

02 Feb '06

All, I've set with_cisco_vsa_hack = yes in radiusd.conf on a box running FreeRADIUS 1.0.4, but when running "freeradius -X", I still see accounting packets with un-hacked Cisco-AVPair entries during debug: rad_recv: Accounting-Request packet from host xxxx:1636, id=198, length=292 ... Cisco-AVPair = "ssid=default" ... I expected to see: ssid = "default" or similar. Is this output merely the accounting request packet as it's received, before preprocessing and the cisco_vsa_hack taking place? A quick check of the source code leads me to suspect that the VSA hack won't cater for pairs such as 'Cisco-AVPair = "ssid=default"', but my C knowledge is virtually nonexistant and I may well be misunderstanding the code. Can anyone clarify what's happening, please? I'd be pleasantly surprised if I'm wrong and I really can start using the contents of Cisco-AVPairs for accounting. Best wishes, Peter.

3 2

Freeradius 1.1.0 and rlm_ldap
by futhwo 02 Feb '06

02 Feb '06

A little addition: I also tried to have the authenticate part done by the "files" module, putting in the user file: DEFAULT Auth-Type := LDAP but i still get: Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0

1 0

Freeradius 1.1.0 and rlm_ldap
by futhwo 02 Feb '06

02 Feb '06

Hi I use an AAA infrastructure based on FreeRADIUS, OpenLDAP and pam on some freebsd machines. All worked fine untill i upgraded FreeRADIUS form 1.0.5 to 1.1.0. From there on i cannot authenticate because the Auth-Type attribute is no more valorized to LDAP by the ldap module during authorize section. This is the error: rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 85.239.184.44:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: bind as / to 85.239.184.44:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=ifom-ieo-campus,dc=it, with filter (uid=futhwo) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusAuthType as Auth-Type, value ldap & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusServiceType as Service-Type, value Shell-User & op=11 rlm_ldap: extracted attribute Cisco-AVPair from generic item cisco- avpair="shell:priv-lvl=15" rlm_ldap: user futhwo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds and this is the definition of ldap module in radiusd.conf: ldap { server = "XX.XX.XX.XX" port = 636 basedn = "dc=ifom-ieo-campus,dc=it" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 groupmembership_filter = "(memberuid=%{User-Name})" access_attr_used_for_allow = no set_auth_type = yes } I tried also to change the last 2 directives but it didn't worked. Another thing i tried (as can be seen in the output) is to set the attribute radiusAuthType to "ldap" in the user entry, and/or to set the directive "authtype = LDAP" in the module definition but still didn't work Lurking in the dictionaries,i found this in dictionary.freeradius.internal: VALUE Auth-Type CHAP 1025 # 1026 was LDAP, but we deleted it. Adding it back will break the # ldap module. VALUE Auth-Type PAM 1027 as he author said manually adding the Auth-Type ldap definition prevent the server from starting. So if the Auth-Type LDAP is no more defined,how can i perform authentication against a LDAP server? Thanks in advance to who will help me Regards Ivan

1 0

realm based proxy not working
by Stephen Walsh 02 Feb '06

02 Feb '06

Hi Folks I'm trying to get my Radius server handling requests for other realms now, and have been unsuccessful in the process. Despite my best efforts, the radius server ignores that the login realm is incorrect and attempts to authenticate the user against my LDAP tree. startup with debug shows it's being loaded; Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf <snip> main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no Proxy.conf has; realm DEFAULT { type = radius authhost = xx.xx.xx.xx:1812 accthost = xx.xx.xx.xx.4:1813 secret = <snip> nostrip } realm DEFAULT { type = radius authhost = yy.yy.yy.yy:1812 accthost = yy.yy.yy.yy:1813 secret = <snip> nostrip } realm acu.edu.au { type = radius authhost = LOCAL accthost = LOCAL strip } Radiusd.conf has # PROXY CONFIGURATION # proxy_requests = yes $INCLUDE ${confdir}/proxy.conf #realm module 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = yes } authorize { preprocess suffix auth_log eap ldap1 ldap2 ldap3 ldap4 ldap5 ldap6 ldap7 } The logon is reaching the radius server with the correct realm, can anyone shed any light on this behaviour? I've tried it with our local domain both above and below the default entries, but without luck. Stephen Walsh s.walsh(a)signadou.acu.edu.au Client Support Officer (Technology) Australian Catholic University (Limited) PO Box 256, Dickson ACT 2602 Phone: +61 2 6209 1133 Fax: +61 2 6209 1179 Mobile: +61 419 496796 +++++++++++++++++++++++++++++++++++++++++++++++++ CRICOS Registration: 00004G, 00112C, 00873F, 00885B ABN 15 050 192 660 +++++++++++++++++++++++++++++++++++++++++++++++++

1 0