- Freeradius-Users - lists.freeradius.org

rlm_sql_mysql search path Bug ?
by Jérémy Cluzel 28 Jan '06

28 Jan '06

Hello, I'm under FreeBSD 6.0 - Freeradius 1.0.5 I did an install from the port (/usr/ports/net/freeradius) with rlm_sql_mysql enabled. I set radiusd_enable="YES" in "rc.conf" But when I reboot, radius doesn't start and I got this in my "/var/log/radius.log": Sat Jan 28 00:39:55 2006 : Error: rlm_sql (sql): Could not link driver rlm_sql_mysql: Shared object "libmysqlclient.so.14" not found, required by "rlm_sql_mysql-1.0.5.so" Sat Jan 28 00:39:55 2006 : Error: rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. Sat Jan 28 00:39:55 2006 : Error: radiusd.conf[14]: sql: Module instantiation failed. Very curiously, if I did a "/usr/local/etc/rc.d/radiusd.sh start" then, everything goes fine... may I miss something to do ? Regards, Jeremy

2 1

error if running daemon
by masetio 27 Jan '06

27 Jan '06

I used freeradius-snapshot-20060119 in Debian Sarge implemen sqlcounter module if running with daemon Freeradius crash with log : Thu Jan 26 09:32:46 2006 : Info: Ready to process requests. Thu Jan 26 10:02:58 2006 : Error: Assertion failed in request_list.c, line 1119 but if running with debug mode doesn't have any error. plz i need sugest tengkyu.... ~_|[]~ ------- .:Learning by Doing:.

3 3

Capturing the inner authentication ID for Radius accounting
by CHui 27 Jan '06

27 Jan '06

I have been looking for a way to maintain accurate wireless access and usage information for security auditing purposes. The problem I have is that wireless network users may choose to provide an alternative identity by providing an outer identity in the supplicant software. Although the user still need a legitimate user id/password to pass the EAP TTLS authentication. So far I could not find a "standard" way to track the user identity via Radius accounting records. I do manage to configure the FreeRadius to send the inner authentication user ID to the Cisco Aironet Access point (IOS 12.3(7)JA) using the Radius attribute "Class" (ID 25). For example, in my users file, the following is configured for guest access: DEFAULT Hint == "guest" Auth-Type = sql, Class = "%{User-Name}", Session-Timeout = 3600, Fall-Through = No The actual user id used in the EAP-TTLS authentication is passed to the Cisco Aironet AP via the Class attribute. I have observed that both the Radius "start" and "stop" records sent by the Cisco Aironet AP contained the Class attribute with the actual user's ID. The reason I chose the Class attribute is that it is the only attribute honored by the Aironet AP in Access-Accept message and also included in the radius accounting send by the Aironet AP according to the Cisco IOS Software Config Guide for Aironet APs. Although it seems to work for me, I am not sure about the use of attribute Class for tracking user ID would interfere with other operation (like the one attribute Class was originally designed for)? Also, the attribute Class is of type Octet. Does anyone know of a way to convert it to text in SQL? I would like to convert it to text before writing it into the mySQL database, preferably by way of the accounting_xx_query in the sql.conf file. Thanks Cedric

2 1

Webserver System Hanging when trying to authenticate.
by Frank Reiss 27 Jan '06

27 Jan '06

Hi, I have seen this problems a few time. I setup a Fedora Core 4 - Freeradius server with apache and when I try to login to the webserver it hangs the webserver. Note in this case the web server and Freeradius are on the same server. But I have also seen it where the web server and freeradius are on two different systems and the web server hangs. I have gotten it to work in the past by stopping the firewall on the radius server and authenticating and then restarting the firewall. And everything works for some reason. Which really seems strange. I am running Fedora Core Linux for the web servers. And Redhat ES4 Linux for the radius servers. I am wondering if this is a known problem and what is the resolution to the problem. Frank Reiss Impeva Labs, Inc. Phone: 1-850-872-7099 COMPANY CONFIDENTIAL NOTICE This electronic mail transmission and any accompanying documents contain information belonging to the sender which may be company confidential and legally privileged. If you are not the intended recipient, any disclosure, copying, distribution or action taken in reliance on the message is strictly prohibited. If you have received this message in error, please delete it. Thank You

2 1

Error PROFIND request failed on'/' Error PROFIND of '/': 405 Method Not Allowed (http://192.168.1.75)
by Frank Reiss 27 Jan '06

27 Jan '06

Hi When I try to open up the repository using TortoiseSVN Checkout I receive the following error messages: Error PROFIND request failed on'/' Error PROFIND of '/': 405 Method Not Allowed (http://192.168.1.75) What is causing the Error Message? and how do I correct it? Thank you, Frank Reiss

1 0

simultaneous-use and stateless sessions in sql
by Seferovic Edvin 27 Jan '06

27 Jan '06

Hi, I have set up my new test environment with freeradius-1.1.0 ( with ldap and mysql ) and I just hit the wall as my VPN server ( poptop - MS PPTP ) crashed. I have a session left in my mysql db with "Acct-Stop = 0" which permits user to login again ( after the crash ) because simultaneous-use is set to 1. Are there any workarounds for this scenario? I've found deletestatlesssessions in sql.conf file, but I have no idea how does this work ( it is set to "yes" but no use ). Since my NAS is POPTOP server, type is set to "other" and checkrad cannot check ( or won't check ). At the end of the Simultaneous-Use doc it is mentioned that Idle-Timeout could be used, but this works for specific NASes and not for such VPN server that looses all info about users when crashed. Only way I figured out would be to check for open session before simultaneous-use-query. Since Ive configured my "NAS" to send accounting data every 2 minutes, it would be easy to say "delete all session data where traffic_data = 0 and time difference between now and session_start > 2 Minutes".. but where could I put such query. Does anyone have any suggestions on this topic? I know it is rather complex topic, but I would appreciate any opinions. TIA Regards, Edvin Seferovic PS: sorry for my HTML eMail today !

2 5

Re: AD ldap bind works with 1.01, fails with 1.04
by Stephen Walsh 27 Jan '06

27 Jan '06

> I have no idea. I've looked, and can't see anything that would >affect that. > > Alan DeKok. Hi Alan Thanks for the reply. We ended up reverting the production box to FC3 and 1.01, only to have it fail with the same error! I've since written a ldap module for each student campus/ou specifying it down to ou to search in. ldap Canberra { <snip> basedn = "ou=students,ou=users,ou=signadou,dc=student(etc)" <snip> } and then added an entry for each in Authorize and Authenicate. Why my test box with FC3/1.01 works and nothing else does is beyond me, but this clunky option seems to work. It may be of interest to note that our Student tree is native w2k3, while our staff tree is w2k. I also found an entry on a forum that referred to having to change the hueristic search value on the AD DC, I've pasted it below in the hope it may help someone in the future with the same problem. dmeehan at flcancer dot com 12-Aug-2004 04:26 If your having problems running LDAP searches on the base DC against Active Directory 2k3, you need to set dsHeuristics to 0000002 in Active Directory. This allows searches to function similar to how they did in Active Directory 2k2. You can update dsHeuristics by launching ldp.exe goto 'connection' and create a new connection. Then goto bind and bind to your ldap server. Next select the 'Browse' menu and choose 'modify'. The DN *might* look like this: CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=mycompany,DC=com Attribute is: dsHeuristics Value is: 0000002 Set the operation to replace and you should be set. This solves the 'Operations error' error that happens when attempting to search without specifying an OU. -d

2 1

using stored procedures with freeradius
by Murat Mığdısoğlu 27 Jan '06

27 Jan '06

Hi all, I'm using freeradius with sybase using freetds and unixodbc. For some purposes, i had to use stored procedures and changed sql statements in sql.con to procedure calls like "EXEC -----". I have to question at this point 1) has anyone used this method before? 2) Examining my logs, i found that some sockets getting 'Invalid cursor State' error from unix-odbc driver in some cases and they don't work anymore. What it can be? Thanks in advance Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

2 1

Exec-Program
by Priscilla B 27 Jan '06

27 Jan '06

Hi, Hope someone can help me to give me a more detailed explanation about Exec-Program. I see this in the acct_users file. DEFAULT Acct-Status-Type == Start Exec-Program = "/path/to/exec/acct/start" Do we have to make our own file for this Exec-Program or is there already one provided in the basic package? Or if not, can someone give me an example of this file? Sorry if i ask stupid favor, since I am still newbie in this field. Thanks a lot Priscilla __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

SV: how to set crypted password in 'users' file?
by Torkel Mathisen 27 Jan '06

27 Jan '06

> "Min Qiu" <mqiu(a)globalinternetworking.com> wrote: > > However, cut and past the crypted password from /etc/shadow to > > the entry failed: > > > > mqiu Auth-Type := Local, User-Password == "$1$CWOjXm2v$dzjrc385t1iQXMN0" > > UseL Crypt-Password := "$1$CWOjXm... I'm using PEAP/MS-CHAPv2 for authentication. In the users file I only got the login name and a clear-text password. I really want to start using Crypt-Password, but didn't quite get that to work. Do I understand it correctly you only need to take you standard unix password from /etc/shadow and use that in users with Crypt-Password? # more /etc/shadow tom:jYyrl....:13112:::::: In users file I got: tom Crypt-Password := " jYyrl...." I didn't get that to work. What am I missing here? Couldn't really find much info on it out there. This is the debug log I got: rad_recv: Access-Request packet from host 192.168.2.4:21654, id=120, length=126 User-Name = "tom" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0015.0015.adaa" Message-Authenticator = 0xca4c7181b9338edb3e176297682f33f7 EAP-Message = 0x0201000801746f6d NAS-Port-Type = Wireless-802.11 NAS-Port = 268 Service-Type = Framed-User NAS-IP-Address = 192.168.2.4 NAS-Identifier = "AP1100-D2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 16 modcall[authorize]: module "preprocess" returns ok for request 16 modcall[authorize]: module "mschap" returns noop for request 16 rlm_realm: No '@' in User-Name = "tom", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 16 rlm_eap: EAP packet type response id 1 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 16 users: Matched entry tom at line 91 modcall[authorize]: module "files" returns ok for request 16 modcall: group authorize returns updated for request 16 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 16 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 16 modcall: group authenticate returns handled for request 16 Sending Access-Challenge of id 120 to 192.168.2.4:21654 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01f769bbe79093c3c406a98a01294187 Finished request 16 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.4:21654, id=121, length=238 User-Name = "tom" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0015.0015.adaa" Message-Authenticator = 0xcccf1d38bc8d263feddbb303acbdcb41 EAP-Message = 0x020200661900160301005b01000057030143da12d4d113043b760adb7ce542b365f5d8 806e659d5eb591e677044dd072b000003000390038003500160013000a00330032002f00 66000500040065006400630062006000150012000900140011000800030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 268 State = 0x01f769bbe79093c3c406a98a01294187 Service-Type = Framed-User NAS-IP-Address = 192.168.2.4 NAS-Identifier = "AP1100-D2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 17 modcall[authorize]: module "preprocess" returns ok for request 17 modcall[authorize]: module "mschap" returns noop for request 17 rlm_realm: No '@' in User-Name = "tom", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 17 rlm_eap: EAP packet type response id 2 length 102 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 17 users: Matched entry tom at line 91 modcall[authorize]: module "files" returns ok for request 17 modcall: group authorize returns updated for request 17 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 17 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 005b], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0654], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 010d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 17 modcall: group authenticate returns handled for request 17 Sending Access-Challenge of id 121 to 192.168.2.4:21654 EAP-Message = 0x0103040a19c0000007c3160301004a02000046030143da12ceeff958d58685992a9ce5 bfeb1c5e06eb608854a6bc6a0f8fd0707f1c202526f2d15e84192aa148769550a2367b5d d014351ef0535610fffdc52871e02700390016030106540b00065000064d0002b3308202 af30820218a003020102020900b646b246bff02a86300d06092a864886f70d0101040500 30818d310b3009060355040613024e4f310d300b060355040813044f534c4f310d300b06 0355040713044f534c4f310f300d060355040a130642425320415331133011060355040b 130a66726565726164697573311b301906035504031312436c69656e7420636572746966 6963 EAP-Message = 0x617465311d301b06092a864886f70d010901160e726f6f74406c6f63616c686f737430 1e170d3035313032363132333432385a170d3036313032363132333432385a30818b310b 3009060355040613024e4f310d300b060355040813044f534c4f310d300b060355040713 044f534c4f310f300d060355040a130642425320415331133011060355040b130a667265 657261646975733119301706035504031310526f6f74206365727469666963617465311d 301b06092a864886f70d010901160e726f6f74406c6f63616c686f737430819f300d0609 2a864886f70d010101050003818d0030818902818100eead5285b5e9f7b939a2dfc1b7fe f60a EAP-Message = 0xbd055de0ba27b2ef81244e0eabad60241727ff5fc724f36147d08ea5f9e3f0110dfb5a 2397c3906a00ab8eb28509e4a672b2c948c0b8007785f550b3908c2f49d7a113d6e7198d 9606e567fc38be816fb2acf60f18bfe56d0617ff7e651439ce9c8ed40363b5b1e4d0d96f 59a468a6650203010001a317301530130603551d25040c300a06082b0601050507030130 0d06092a864886f70d01010405000381810050aa5f1713a5025d21f128094104579eb85a 9ded57072baf72b2c0e3fbea766eb53c62e9bc2a5d1bc22f2615cc1fe88487e2d0b7e5ea a045a8ae1734a85f28e6cd70d3340c2a51bfe7b974c13b9a1a4abebe373312d1d4b987e3 2368 EAP-Message = 0x1edad7e4a54456fd7989e901485e9f2fcf7e8ed8e57fae97fb2fdd1fba5a50c683b7da 7f00039430820390308202f9a003020102020900b646b246bff02a84300d06092a864886 f70d010104050030818d310b3009060355040613024e4f310d300b060355040813044f53 4c4f310d300b060355040713044f534c4f310f300d060355040a13064242532041533113 3011060355040b130a66726565726164697573311b301906035504031312436c69656e74 206365727469666963617465311d301b06092a864886f70d010901160e726f6f74406c6f 63616c686f7374301e170d3035313032363132333432335a170d30373130323631323334 3233 EAP-Message = 0x5a30818d310b3009060355040613024e4f310d300b06 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9d55183272e7e8d147d1763ad5c8ed57 Finished request 17 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.4:21654, id=122, length=142 User-Name = "tom" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0015.0015.adaa" Message-Authenticator = 0xa593725371800702100eab1ea8ad7cb4 EAP-Message = 0x020300061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 268 State = 0x9d55183272e7e8d147d1763ad5c8ed57 Service-Type = Framed-User NAS-IP-Address = 192.168.2.4 NAS-Identifier = "AP1100-D2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 18 modcall[authorize]: module "preprocess" returns ok for request 18 modcall[authorize]: module "mschap" returns noop for request 18 rlm_realm: No '@' in User-Name = "tom", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 18 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 18 users: Matched entry tom at line 91 modcall[authorize]: module "files" returns ok for request 18 modcall: group authorize returns updated for request 18 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 18 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 18 modcall: group authenticate returns handled for request 18 Sending Access-Challenge of id 122 to 192.168.2.4:21654 EAP-Message = 0x010403c919000355040813044f534c4f310d300b060355040713044f534c4f310f300d 060355040a130642425320415331133011060355040b130a66726565726164697573311b 301906035504031312436c69656e74206365727469666963617465311d301b06092a8648 86f70d010901160e726f6f74406c6f63616c686f737430819f300d06092a864886f70d01 0101050003818d0030818902818100bb9dc7f9a6b879ddde091ded35f3137693d1a9fa9d 2e2f1e20e1e49c9daf077fd1c4066e8e409eda68baac046ff390baedad93e603fdde7304 6df106c9c3775eb0e024a2682faf6469e778758b9c782a11ad0dcc25edca8f9efdee96cc c1bc EAP-Message = 0x84850d853d4435da9ab22ec6c3dc4e6d9137e0ec36d705c923055aa8b900d833350203 010001a381f53081f2301d0603551d0e04160414227f0709429785a3169b9817627cd456 d617f2283081c20603551d230481ba3081b78014227f0709429785a3169b9817627cd456 d617f228a18193a4819030818d310b3009060355040613024e4f310d300b060355040813 044f534c4f310d300b060355040713044f534c4f310f300d060355040a13064242532041 5331133011060355040b130a66726565726164697573311b301906035504031312436c69 656e74206365727469666963617465311d301b06092a864886f70d010901160e726f6f74 406c EAP-Message = 0x6f63616c686f7374820900b646b246bff02a84300c0603551d13040530030101ff300d 06092a864886f70d0101040500038181001fb7ec3488fd3b6349d6cc33b5c6451ce1c2e8 ef8db6f4818cd017991f9649141c1767553c20303e262fec4bb351cda19b403bab78aa37 236ffc78dace1a39089ff037eb911a5133bc6b1f0275cc9e68bc4c8f487a4d2cdc8e7061 34e512d7e715ca81c5a7bb6cc668ca8181e898befeab40773de8f3eb6629ecd2c79d5f74 f1160301010d0c0001090040bd26276ade89a82c9cc4fa1af559608f7824b64ef630bdf0 368d885e300720c516da851d828b40f658ffbd6060bb0b6d23e138a280c51e9944d23bc6 9d73 EAP-Message = 0xe66f000105004080781b4e0ebdfa4dde79fda9c2f99c36ba8434b8e2c6cbe4b873a6b8 f0c24494ce3ea163d3eb05d651079abef679ef2dde838e41ebafb42b534aaec821898a59 0080de2086a54d938f2c2d3a446413db13fe9eeb5d8159fed74beac2212ef1c1f809a1a6 b8275a4d21930a65094da267d45e76c039694ae341c61fbf742172b930dcd3718bf71093 8a95e8fbac60df82e40de250aace712bf1b0b0354c3f3cca05f78f8ed5789033d1d27799 cde792a039a14a50e6f923662b6a6da34d03a9b1dad916030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe587790d87edd421fd760ed8b79baaf5 Finished request 18 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.4:21654, id=123, length=276 User-Name = "tom" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0015.0015.adaa" Message-Authenticator = 0xe46a52fc04818d9d38a198f1bf467c50 EAP-Message = 0x0204008c190016030100461000004200401956b7a782c3ab01a817f72f7d57ba9f512f 37ee81d23f258450a3bfbe137146d1430bd6940591585c9f8276b3cfe3db7782ee27656f a5948d3cf0818d83edd81403010001011603010030a8e41dd1f61c4a47083ac2b58605c0 5847306b109d5038dd412c77f790c627ec38c5a5813ea9edd0da4e9cacade1ee34 NAS-Port-Type = Wireless-802.11 NAS-Port = 268 State = 0xe587790d87edd421fd760ed8b79baaf5 Service-Type = Framed-User NAS-IP-Address = 192.168.2.4 NAS-Identifier = "AP1100-D2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 19 modcall[authorize]: module "preprocess" returns ok for request 19 modcall[authorize]: module "mschap" returns noop for request 19 rlm_realm: No '@' in User-Name = "tom", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 19 rlm_eap: EAP packet type response id 4 length 140 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 19 users: Matched entry tom at line 91 modcall[authorize]: module "files" returns ok for request 19 modcall: group authorize returns updated for request 19 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 19 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 19 modcall: group authenticate returns handled for request 19 Sending Access-Challenge of id 123 to 192.168.2.4:21654 EAP-Message = 0x0105004119001403010001011603010030ce2c434e35fb212ac38231785cfe6254011f 6ba35117e4646cf00bbf953c6b066f22bcee4cc8b3ef5cc39256db3caaeb Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf025fd8e565713ab2d84e5c2e70d458d Finished request 19 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.4:21654, id=124, length=142 User-Name = "tom" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0015.0015.adaa" Message-Authenticator = 0x67a54a6c52f34f3fb1c2345eab772beb EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 268 State = 0xf025fd8e565713ab2d84e5c2e70d458d Service-Type = Framed-User NAS-IP-Address = 192.168.2.4 NAS-Identifier = "AP1100-D2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 20 modcall[authorize]: module "preprocess" returns ok for request 20 modcall[authorize]: module "mschap" returns noop for request 20 rlm_realm: No '@' in User-Name = "tom", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 20 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 20 users: Matched entry tom at line 91 modcall[authorize]: module "files" returns ok for request 20 modcall: group authorize returns updated for request 20 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 20 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 20 modcall: group authenticate returns handled for request 20 Sending Access-Challenge of id 124 to 192.168.2.4:21654 EAP-Message = 0x0106005019001703010020861055143e567a7983ee6fdee7b96ee5ac168b27f53cfa7a 483a887edb3e5fad1703010020274966df3940b946f0133ab5b369666fa2b951a8dcef3a 33a39e1f0149fd0a2c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4351dc490c0b5fa9ce050331e95b4a8c Finished request 20 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.4:21654, id=125, length=216 User-Name = "tom" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0015.0015.adaa" Message-Authenticator = 0xb74a9c2705a1e4a5bb285e1f237f6907 EAP-Message = 0x0206005019001703010020b98d88b09105603c50aed6c63b0a496280dc967239c0dcf7 b0fc6d44d4066f8417030100209b45c361ff602db1f721657022bc562ccd60e2944d0909 2b3f584ca382208a66 NAS-Port-Type = Wireless-802.11 NAS-Port = 268 State = 0x4351dc490c0b5fa9ce050331e95b4a8c Service-Type = Framed-User NAS-IP-Address = 192.168.2.4 NAS-Identifier = "AP1100-D2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 21 modcall[authorize]: module "preprocess" returns ok for request 21 modcall[authorize]: module "mschap" returns noop for request 21 rlm_realm: No '@' in User-Name = "tom", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 21 rlm_eap: EAP packet type response id 6 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 21 users: Matched entry tom at line 91 modcall[authorize]: module "files" returns ok for request 21 modcall: group authorize returns updated for request 21 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 21 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - tom rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0206000801746f6d PEAP: Got tunneled identity of tom PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to tom PEAP: Sending tunneled request EAP-Message = 0x0206000801746f6d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "tom" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 21 modcall[authorize]: module "preprocess" returns ok for request 21 modcall[authorize]: module "mschap" returns noop for request 21 rlm_realm: No '@' in User-Name = "tom", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 21 rlm_eap: EAP packet type response id 6 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 21 users: Matched entry tom at line 91 modcall[authorize]: module "files" returns ok for request 21 modcall: group authorize returns updated for request 21 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 21 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 21 modcall: group authenticate returns handled for request 21 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x0107001d1a0107001810f559eab1de040978486cc8240bc9fc38746f6d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x87e2826b16f8823836e26ab0eb30ea43 PEAP: Processing from tunneled session code 13f990 11 EAP-Message = 0x0107001d1a0107001810f559eab1de040978486cc8240bc9fc38746f6d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x87e2826b16f8823836e26ab0eb30ea43 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 21 modcall: group authenticate returns handled for request 21 Sending Access-Challenge of id 125 to 192.168.2.4:21654 EAP-Message = 0x0107006019001703010020e3b653d595d25e64701bedcbf517dab7528b7daa7011a867 c75fcbc5aa3848f01703010030d47a1361647a15fad7d74625539b6c5e48aaef79a73b14 376c819190100a72c4bb4e3f4732ad303a36e8841934e43de7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc8c29a6f523c9436faf6b89c2be76270 Finished request 21 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.4:21654, id=126, length=264 User-Name = "tom" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0015.0015.adaa" Message-Authenticator = 0x9d2ad1b239f7b15e750e94398f63000b EAP-Message = 0x02070080190017030100209878c315a02346056bdf20f975ef71910a1a3499443cbae0 33def49166ea9f4c1703010050c3c779df9414a351e45f38633330f0c9b43e27141c6959 115b1a2c8041e551d8ba4da1f4b35356a6eb94b879d1f0f441136e707266df25a79e6238 4b6b6c3c388bb5156f1e39bd8f73972a62783b31ee NAS-Port-Type = Wireless-802.11 NAS-Port = 268 State = 0xc8c29a6f523c9436faf6b89c2be76270 Service-Type = Framed-User NAS-IP-Address = 192.168.2.4 NAS-Identifier = "AP1100-D2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 22 modcall[authorize]: module "preprocess" returns ok for request 22 modcall[authorize]: module "mschap" returns noop for request 22 rlm_realm: No '@' in User-Name = "tom", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 22 rlm_eap: EAP packet type response id 7 length 128 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 22 users: Matched entry tom at line 91 modcall[authorize]: module "files" returns ok for request 22 modcall: group authorize returns updated for request 22 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 22 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0207003e1a020700393142075ce59f9f56c20c9450dacfb16719000000000000000082 6eced611d60ee5d7210dae21fc092feea130cda60dc20b00746f6d PEAP: Setting User-Name to tom PEAP: Adding old state with 87 e2 PEAP: Sending tunneled request EAP-Message = 0x0207003e1a020700393142075ce59f9f56c20c9450dacfb16719000000000000000082 6eced611d60ee5d7210dae21fc092feea130cda60dc20b00746f6d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "tom" State = 0x87e2826b16f8823836e26ab0eb30ea43 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 22 modcall[authorize]: module "preprocess" returns ok for request 22 modcall[authorize]: module "mschap" returns noop for request 22 rlm_realm: No '@' in User-Name = "tom", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 22 rlm_eap: EAP packet type response id 7 length 62 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 22 users: Matched entry tom at line 91 modcall[authorize]: module "files" returns ok for request 22 modcall: group authorize returns updated for request 22 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 22 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 22 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for tom with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 22 modcall: group Auth-Type returns reject for request 22 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 22 modcall: group authenticate returns reject for request 22 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 13d510 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 22 modcall: group authenticate returns handled for request 22 Sending Access-Challenge of id 126 to 192.168.2.4:21654 EAP-Message = 0x010800501900170301002034ec685c2b912545f1031530f58388b24aece3d1c5a1e6ad 7524be8fae97e666170301002092e90a5a4fa826732e0e6f7d40e5f7e2e479be944828ac 1cfc5c834ce25d63ee Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcf7e24cad3cbebfbecc69ab44ffbf055 Finished request 22 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.4:21654, id=127, length=216 User-Name = "tom" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0015.0015.adaa" Message-Authenticator = 0x23d78c9d414b457846d9b2e67ac8a3fb EAP-Message = 0x02080050190017030100208eae795e2f64e1197538b8b8d43a62e36a5fc554ab74ce71 9c4792f5c8f1950e1703010020c246d14d200e1f734767a119ea00370e15b84bbf8cf0e0 de160acdaa668d6fab NAS-Port-Type = Wireless-802.11 NAS-Port = 268 State = 0xcf7e24cad3cbebfbecc69ab44ffbf055 Service-Type = Framed-User NAS-IP-Address = 192.168.2.4 NAS-Identifier = "AP1100-D2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 23 modcall[authorize]: module "preprocess" returns ok for request 23 modcall[authorize]: module "mschap" returns noop for request 23 rlm_realm: No '@' in User-Name = "tom", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 23 rlm_eap: EAP packet type response id 8 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 23 users: Matched entry tom at line 91 modcall[authorize]: module "files" returns ok for request 23 modcall: group authorize returns updated for request 23 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 23 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 23 modcall: group authenticate returns invalid for request 23 auth: Failed to validate the user. Delaying request 23 for 1 seconds Finished request 23 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.4:21654, id=127, length=216 Sending Access-Reject of id 127 to 192.168.2.4:21654 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 16 ID 120 with timestamp 43da12ce Cleaning up request 17 ID 121 with timestamp 43da12ce Cleaning up request 18 ID 122 with timestamp 43da12ce Cleaning up request 19 ID 123 with timestamp 43da12ce Cleaning up request 20 ID 124 with timestamp 43da12ce Cleaning up request 21 ID 125 with timestamp 43da12ce Cleaning up request 22 ID 126 with timestamp 43da12ce Cleaning up request 23 ID 127 with timestamp 43da12ce Nothing to do. Sleeping until we see a request.

3 2