- Freeradius-Users - lists.freeradius.org

RE: CIsco Pix and FreeRadius....
by Sills, Tripp 18 Jan '06

18 Jan '06

Does freeradius offer authorization as well. I am trying to use the filter-id attribute. -----Original Message----- From: freeradius-users-bounces+tripp=dmenet.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tripp=dmenet.com@lists.freeradius.org] On Behalf Of Zoltan Ori Sent: Wednesday, January 18, 2006 11:08 AM To: FreeRadius users mailing list Subject: Re: CIsco Pix and FreeRadius.... On Wednesday 18 January 2006 09:40, Sills, Tripp wrote: > users: Matched entry DEFAULT at line 179 > users: Matched entry DEFAULT at line 191 >From the users file you can read: # If you are not sure why a particular reply is being sent by the # server, then run the server in debugging mode (radiusd -X), and # you will see which entries in this file are matched. # # When an authentication request is received from the comm server, # these values are tested. Only the first match is used unless the # "Fall-Through" variable is set to "Yes". # # A special user named "DEFAULT" matches on all usernames. # You can have several DEFAULT entries. All entries are processed # in the order they appear in this file. The first entry that # matches the login-request will stop processing unless you use # the Fall-Through variable. You aren't matching tripp. Put your entries at the top or comment out all the DEFAULT entries you don't care about. Zoltan Ori - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: CIsco Pix and FreeRadius....
by Sills, Tripp 18 Jan '06

18 Jan '06

I am not altering the users file all I have in it is : I was using the same username and password for both. Below is my users file. # # Please read the documentation file ../doc/processing_users_file, # or 'man 5 users' (after installing the server) for more information. # # This file contains authentication security and configuration # information for each user. Accounting requests are NOT processed # through this file. Instead, see 'acct_users', in this directory. # # The first field is the user's name and can be up to # 253 characters in length. This is followed (on the same line) with # the list of authentication requirements for that user. This can # include password, comm server name, comm server port number, protocol # type (perhaps set by the "hints" file), and huntgroup name (set by # the "huntgroups" file). # # If you are not sure why a particular reply is being sent by the # server, then run the server in debugging mode (radiusd -X), and # you will see which entries in this file are matched. # # When an authentication request is received from the comm server, # these values are tested. Only the first match is used unless the # "Fall-Through" variable is set to "Yes". # # A special user named "DEFAULT" matches on all usernames. # You can have several DEFAULT entries. All entries are processed # in the order they appear in this file. The first entry that # matches the login-request will stop processing unless you use # the Fall-Through variable. # # If you use the database support to turn this file into a .db or .dbm # file, the DEFAULT entries _have_ to be at the end of this file and # you can't have multiple entries for one username. # # You don't need to specify a password if you set Auth-Type += System # on the list of authentication requirements. The RADIUS server # will then check the system password file. # # Indented (with the tab character) lines following the first # line indicate the configuration values to be passed back to # the comm server to allow the initiation of a user session. # This can include things like the PPP configuration values # or the host to log the user onto. # # You can include another `users' file with `$INCLUDE users.other' # # # For a list of RADIUS attributes, and links to their definitions, # see: # # http://www.freeradius.org/rfc/attributes.html # # # Deny access for a specific user. Note that this entry MUST # be before any other 'Auth-Type' attribute which results in the user # being authenticated. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #lameuser Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # Deny access for a group of users. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # # This is a complete entry for "steve". Note that there is no Fall-Through # entry so that no DEFAULT entry will be used, and the user will NOT # get any attributes in addition to the ones listed here. # #steve Auth-Type := Local, User-Password == "testing" # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP # # This is an entry for a user with a space in their name. # Note the double quotes surrounding the name. # "John Doe" User-Password == "hello" Reply-Message = "Hello, %u" test User-Password == "testing123" Reply-Message = "Hello, %u" # Test TLS Certificate based user FreeRADIUS.net-Client User-Password == "demo" Reply-Message = "Hello, %u" # # Dial user back and telnet to the default host for that port # #Deg Auth-Type := Local, User-Password == "ge55ged" # Service-Type = Callback-Login-User, # Login-IP-Host = 0.0.0.0, # Callback-Number = "9,5551212", # Login-Service = Telnet, # Login-TCP-Port = Telnet # # Another complete entry. After the user "dialbk" has logged in, the # connection will be broken and the user will be dialed back after which # he will get a connection to the host "timeshare1". # #dialbk Auth-Type := Local, User-Password == "callme" # Service-Type = Callback-Login-User, # Login-IP-Host = timeshare1, # Login-Service = PortMaster, # Callback-Number = "9,1-800-555-1212" # # user "swilson" will only get a static IP number if he logs in with # a framed protocol on a terminal server in Alphen (see the huntgroups file). # # Note that by setting "Fall-Through", other attributes will be added from # the following DEFAULT entries # #swilson Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.65, # Fall-Through = Yes # # If the user logs in as 'username.shell', then authenticate them # against the system database, give them shell access, and stop processing # the rest of the file. # #DEFAULT Suffix == ".shell", Auth-Type := System # Service-Type = Login-User, # Login-Service = Telnet, # Login-IP-Host = your.shell.machine # # The rest of this file contains the several DEFAULT entries. # DEFAULT entries match with all login names. # Note that DEFAULT entries can also Fall-Through (see first entry). # A name-value pair from a DEFAULT entry will _NEVER_ override # an already existing name-value pair. # # # First setup all accounts to be checked against the UNIX /etc/passwd. # (Unless a password was already given earlier in this file). # #DEFAULT Auth-Type = System # Fall-Through = 1 # # Set up different IP address pools for the terminal servers. # Note that the "+" behind the IP address means that this is the "base" # IP address. The Port-Id (S0, S1 etc) will be added to it. # #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.32+, # Fall-Through = Yes #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "delft" # Framed-IP-Address = 192.168.2.32+, # Fall-Through = Yes # # Defaults for all framed connections. # DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes # # Default for PPP: dynamic IP address, PPP mode, VJ-compression. # NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected # by the terminal server in which case there may not be a "P" suffix. # The terminal server sends "Framed-Protocol = PPP" for auto PPP. # DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression. # DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for SLIP: dynamic IP address, SLIP mode. # DEFAULT Hint == "SLIP" Framed-Protocol = SLIP # # Last default: rlogin to our main server. # #DEFAULT # Service-Type = Login-User, # Login-Service = Rlogin, # Login-IP-Host = shellbox.ispdomain.com # # # # Last default: shell on the local terminal server. # # # DEFAULT # Service-Type = Shell-User # On no match, the user is denied access. tripp Auth-Type := Local, User-Password == "tripp" tripp1 Auth-Type := System, User-Password == "tripp1" Tripp Sills Senior Network Engineer - Information Technology tripp(a)dmenet.com Direct Mail Express 2441 Bellevue Avenue Extension Daytona Beach, FL Office # (386) 271 - 3288 Cell # (386) 566 - 4053 Fax # (386) 271 - 3289 The information in this Internet e-mail, including attachments, is confidential and may be legally privileged. It is intended solely for the addressee. Access by any other person to this Internet e-mail is not authorized. If you are not the intended recipient, please delete this Internet e-mail and notify me by return e-mail or at (386) 271-3288. Any unauthorized disclosure of the parties to this e-mail, and any unauthorized disclosure, dissemination, distribution, copying, or any action taken or omitted to be taken in reliance on this email, including attachments, is prohibited and may be unlawful. -----Original Message----- From: freeradius-users-bounces+tripp=dmenet.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tripp=dmenet.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, January 17, 2006 1:32 PM To: FreeRadius users mailing list Subject: Re: CIsco Pix and FreeRadius.... "Sills, Tripp" <tripp(a)dmenet.com> wrote: > Notice the first request that comes from the 10.2.0.69...It is using the > test aaa-server from the PIX itself. The other 2 are when I am > connecting to the VPN client and trying to authenicate. It says Auth > Type unknown. Any ideas Alan? The only differences is in which entries it matches in the "users" file. Read those entries to see what it's doing, and why. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

rlm_eap_peap: No data inside of the tunnel.
by gerardma＠planet.nl 18 Jan '06

18 Jan '06

Hi All, I have a small problem with my FreeRadius configuration. I have configured FreeRadius with LDAP authentication, this part seems to work fine. I am using an Extreme Summit switch, as radius client and I am using an Windows XP sp2 workstation with PEAP / 802.1x authentication. What is happing: First FreeRadius shows this error: rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 086e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase Later on FreeRadius shows: rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully And at the end: rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: group authenticate returns invalid for request 5 auth: Failed to validate the user. What is going on? I have included the whole log: =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2006.01.18 10:37:22 =~=~=~=~=~=~=~=~=~=~=~= rad_recv: Access-Request packet from host 10.61.100.163:1306, id=104, length=96 User-Name = "gerard" EAP-Message = 0x0201000b01676572617264 NAS-IP-Address = 10.61.100.163 Service-Type = Login-User Calling-Station-Id = "00-10-b5-f4-98-0e" NAS-Port-Type = Ethernet Message-Authenticator = 0xe19cdef787567dad9b16fa10a14c19c8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "gerard", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for gerard radius_xlat: '(CN=gerard)' radius_xlat: 'ou=radius,ou=servicos,ou=brt,o=btp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to IDIIBSA01D.brasiltelecom.com.br:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/root.b64 rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as cn=admin,o=btp/novell to IDIIBSA01D.brasiltelecom.com.br:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=radius,ou=servicos,ou=brt,o=btp, with filter (CN=gerard) rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user gerard authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 104 to 10.61.100.163:1306 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0a085f59b12ad9d7496d5537e1684e39 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.61.100.163:1307, id=144, length=183 User-Name = "gerard" EAP-Message = 0x0202005019800000004616030100410100003d030143ce8bd85fe37086d9ba7c2f652 fab40d74ddc70e1d10a9b510dc5a339e1d13200001600040005000a0009006400620003 00060013001200630100 NAS-IP-Address = 10.61.100.163 Service-Type = Login-User Calling-Station-Id = "00-10-b5-f4-98-0e" NAS-Port-Type = Ethernet State = 0x0a085f59b12ad9d7496d5537e1684e39 Message-Authenticator = 0xaa19c30a287bea21f1fc92796bf34875 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "gerard", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for gerard radius_xlat: '(CN=gerard)' radius_xlat: 'ou=radius,ou=servicos,ou=brt,o=btp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=radius,ou=servicos,ou=brt,o=btp, with filter (CN=gerard) rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user gerard authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 086e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 144 to 10.61.100.163:1307 EAP-Message = 0x0103040a19c0000008cb160301004a02000046030143ce3715701f886b5fe1961eb2f 13112fc2c0ecaee638df5e0c6c6e26270fba1208e530e6bfd57cc2d80de3acf32db22e6 eb73bf380cae255e0411e7d5f22cb99f000400160301086e0b00086a000867000432308 2042e30820397a003020102020101300d06092a864886f70d0101050500308193310b30 09060355040613024252310b30090603550408130244463111300f06035504071308427 26173696c696131173015060355040a130e42726173696c2054656c65636f6d310c300a 060355040b1303706f63311630140603550403130d43412046524545524144495553312 5302306092a EAP-Message = 0x864886f70d0109011616676d616e7376656c646572406e6f76656c6c2e636f6d301e1 70d3036303131373136343631365a170d3037303131373136343631365a308198310b30 09060355040613024252310b30090603550408130244463111300f06035504071308427 26173696c696131173015060355040a130e42726173696c2054656c65636f6d310c300a 060355040b1303706f63311b30190603550403131253657276657220436572746966696 36174653125302306092a864886f70d0109011616676d616e7376656c646572406e6f76 656c6c2e636f6d30819f300d06092a864886f70d010101050003818d003081890281810 0b485b502a7 EAP-Message = 0x2183a9393af8b1ccbe86fb8d30b639f076ef499e033dd64ac09082360210661ae0415 4e1ae1865f38a3d1a52d14512fc131a465e2b23414d1dfe4cece01c8475aca7b86e9592 409e1c40abc1f5399e3d534fe819a5b5497d1893acc4b80a5b4666af178d43f6c80a873 14b606ae939ebf224d97bf82b12d62313330203010001a3820189308201853009060355 1d1304023000303006096086480186f842010d04231621596153542047656e657261746 56420536572766572204365727469666963617465301106096086480186f84201010404 03020640300b0603551d0f040403020520301d0603551d0e041604146891e5076f1932a 70e3b4c6562 EAP-Message = 0x118872dda901533081c00603551d230481b83081b58014b00ac384a4e7d530b3c5f98 c322116e79ee67cdba18199a48196308193310b3009060355040613024252310b300906 03550408130244463111300f0603550407130842726173696c696131173015060355040 a130e42726173696c2054656c65636f6d310c300a060355040b1303706f633116301406 03550403130d434120465245455241444955533125302306092a864886f70d010901161 6676d616e7376656c646572406e6f76656c6c2e636f6d82010030210603551d11041a30 188116676d616e7376656c646572406e6f76656c6c2e636f6d30210603551d12041a301 88116676d61 EAP-Message = 0x6e7376656c646572406e6f76656c6c2e636f6d300d06 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdd3ec07c0191676261d0e4ce0c3fa25b Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.61.100.163:1308, id=154, length=109 User-Name = "gerard" EAP-Message = 0x020300061900 NAS-IP-Address = 10.61.100.163 Service-Type = Login-User Calling-Station-Id = "00-10-b5-f4-98-0e" NAS-Port-Type = Ethernet State = 0xdd3ec07c0191676261d0e4ce0c3fa25b Message-Authenticator = 0xcc29588da47c92c9e269c87affc2869d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "gerard", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for gerard radius_xlat: '(CN=gerard)' radius_xlat: 'ou=radius,ou=servicos,ou=brt,o=btp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=radius,ou=servicos,ou=brt,o=btp, with filter (CN=gerard) rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user gerard authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 154 to 10.61.100.163:1308 EAP-Message = 0x010404061940092a864886f70d0101050500038181000205eecdae633cd135dab90f7 5ca327619de070b396234105574565878af2f12d3b2880c181ec848c291904cd10ac3a1 74d062dc2d973eac54ad1dba922833971d0ed9a206de16af6990257c6746222f1f8ee90 8eabcb3c78bae8fccd77bdd1281f77cd61a91ba4fa020795397efe058881e7746be1cec ca19d1c564d0fdd5bf00042f3082042b30820394a003020102020100300d06092a86488 6f70d0101050500308193310b3009060355040613024252310b30090603550408130244 463111300f0603550407130842726173696c696131173015060355040a130e427261736 96c2054656c EAP-Message = 0x65636f6d310c300a060355040b1303706f63311630140603550403130d43412046524 5455241444955533125302306092a864886f70d0109011616676d616e7376656c646572 406e6f76656c6c2e636f6d301e170d3036303131373136343532315a170d31363031313 53136343532315a308193310b3009060355040613024252310b30090603550408130244 463111300f0603550407130842726173696c696131173015060355040a130e427261736 96c2054656c65636f6d310c300a060355040b1303706f63311630140603550403130d43 4120465245455241444955533125302306092a864886f70d0109011616676d616e73766 56c64657240 EAP-Message = 0x6e6f76656c6c2e636f6d30819f300d06092a864886f70d010101050003818d0030818 902818100d4e8aa933101cb98013f00769eb5abb75e56d1f4c814448d5474a8436679a4 86f9145100d85fa7caf44d2eefec155c19fe72a9d4b18d01172e84bf71b4744fdd090e9 6d9407556aac00f7ebd961d0c27de0db43a687f018e4a8960d53c5447a7b26a6d9a29fa 8619a016d035da45920740116060c073bd46ce0afb585c2a845d0203010001a382018b3 0820187300f0603551d130101ff040530030101ff302c06096086480186f842010d041f 161d596153542047656e657261746564204341204365727469666963617465301106096 086480186f8 EAP-Message = 0x420101040403020106300b0603551d0f040403020106301d0603551d0e04160414b00 ac384a4e7d530b3c5f98c322116e79ee67cdb3081c00603551d230481b83081b58014b0 0ac384a4e7d530b3c5f98c322116e79ee67cdba18199a48196308193310b30090603550 40613024252310b30090603550408130244463111300f0603550407130842726173696c 696131173015060355040a130e42726173696c2054656c65636f6d310c300a060355040 b1303706f63311630140603550403130d43412046524545524144495553312530230609 2a864886f70d0109011616676d616e7376656c646572406e6f76656c6c2e636f6d82010 03021060355 EAP-Message = 0x1d11041a30188116676d616e7376656c6465 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7150ed65353ef2022dee73d433e192aa Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.61.100.163:1309, id=159, length=109 User-Name = "gerard" EAP-Message = 0x020400061900 NAS-IP-Address = 10.61.100.163 Service-Type = Login-User Calling-Station-Id = "00-10-b5-f4-98-0e" NAS-Port-Type = Ethernet State = 0x7150ed65353ef2022dee73d433e192aa Message-Authenticator = 0xeaf20f5b61b128ef9986805685fd37c7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "gerard", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for gerard radius_xlat: '(CN=gerard)' radius_xlat: 'ou=radius,ou=servicos,ou=brt,o=btp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=radius,ou=servicos,ou=brt,o=btp, with filter (CN=gerard) rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user gerard authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 159 to 10.61.100.163:1309 EAP-Message = 0x010500d1190072406e6f76656c6c2e636f6d30210603551d12041a30188116676d616 e7376656c646572406e6f76656c6c2e636f6d300d06092a864886f70d01010505000381 8100723c99761ae5cec5d55285ca0707476e79fafbaca909e91f870551f89094aacb0aa e7e64b67bc4ecff762bfda8179c095976c84ba2b3cc57d76cb4544f1b5a06c74c69cf93 dd5f1bc43a84e7585891f98622a060c5eec233961eacc2280888842637d7e9e54b4e6dc d8cfc179e26571494b6b048ef971d9f691489795bf0854616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaa09869be221b1fc5be6bd91ac9be02f Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.61.100.163:1310, id=184, length=295 User-Name = "gerard" EAP-Message = 0x020500c01980000000b6160301008610000082008094fb643ad1caa3531226eccee88 35ed0e8622db1b9928d6e525d82d33ba1423dc0ad4e683fb8d019c92fa856aa36797a14 e1ada1a4a35158e57380b44fcd1297deed1faf4cec10e2ab190052d1d3045e103583352 9796813de4427d0ea18660117c755b0b78b3eca7e885c95e68070a088aaeca95583d5ff ff843923a7f945c9140301000101160301002074b18550966b0547b6ea63b9d2a019481 2f1d5057574c0ff2bea3138ae6b5936 NAS-IP-Address = 10.61.100.163 Service-Type = Login-User Calling-Station-Id = "00-10-b5-f4-98-0e" NAS-Port-Type = Ethernet State = 0xaa09869be221b1fc5be6bd91ac9be02f Message-Authenticator = 0x26c1db34620f7fba70b88fd10c20a8fe Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "gerard", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for gerard radius_xlat: '(CN=gerard)' radius_xlat: 'ou=radius,ou=servicos,ou=brt,o=btp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=radius,ou=servicos,ou=brt,o=btp, with filter (CN=gerard) rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user gerard authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 184 to 10.61.100.163:1310 EAP-Message = 0x01060031190014030100010116030100201bc94fd6fd777e8b17b635f36e76ce1b931 ae376b4eb525261d9893c440d839f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf58547812f2481d8505e8f93b54b39e6 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.61.100.163:1311, id=194, length=136 User-Name = "gerard" EAP-Message = 0x020600211980000000171503010012956ef02404c98a859e53ea90188213b46205 NAS-IP-Address = 10.61.100.163 Service-Type = Login-User Calling-Station-Id = "00-10-b5-f4-98-0e" NAS-Port-Type = Ethernet State = 0xf58547812f2481d8505e8f93b54b39e6 Message-Authenticator = 0x0b6eb59957e0a25f9a24a11464e7bf30 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "gerard", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 33 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for gerard radius_xlat: '(CN=gerard)' radius_xlat: 'ou=radius,ou=servicos,ou=brt,o=btp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=radius,ou=servicos,ou=brt,o=btp, with filter (CN=gerard) rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user gerard authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: group authenticate returns invalid for request 5 auth: Failed to validate the user. Login incorrect: [gerard] (from client extreme port 0 cli 00-10-b5-f4- 98-0e) Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.61.100.163:1311, id=194, length=136 Sending Access-Reject of id 194 to 10.61.100.163:1311 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 104 with timestamp 43ce3715 Cleaning up request 1 ID 144 with timestamp 43ce3715 Cleaning up request 2 ID 154 with timestamp 43ce3715 Cleaning up request 3 ID 159 with timestamp 43ce3715 Cleaning up request 4 ID 184 with timestamp 43ce3715 Cleaning up request 5 ID 194 with timestamp 43ce3715 Nothing to do. Sleeping until we see a request. Thanks guys! Gerard

2 1

Problem with regular expression and MySQL
by Fabio 18 Jan '06

18 Jan '06

Hi, I am freeRADIUS 1.0.5 for authenticating wireless users with PEAP and TTLS. I use a MySQL database for storing the password and the system works well. Howerver I have encountered a problem. I use the following line in file users for checking the passwords of the users that connect from a NAS-ID starting with NASSQL and having a suffix of "@mydomain.com": DEFAULT Freeradius-Proxied-To == 127.0.0.1, NAS-Identifier =~ "^(^(NASSQL))", Suffix == "@mydomain.com", Autz-Type := SQL The line Freeradius-Proxied-To == 127.0.0.1 is used for checking in the database, only requests that contain the identity internal to the SSL tunnel and not the anonymous identity (I don't know if this is the right way to do it, but it's the only solution I find it to work). With this setting the system runs well. Now I want that only users coming from the domain "@mydomain.com" and having a name of only numbers can access the MySQL, so I change that line to: DEFAULT Freeradius-Proxied-To == 127.0.0.1, NAS-Identifier =~ "^(^(NASSQL))", User-Name =~ "^(^[0-9]+)((a)mydomain.com)$", Autz-Type := SQL This seems to work when not using MySQL, but the problem arises when doing the SQL request: seem that when using the regular expression the User-Name got canceled This is the relevant part of the log with Suffix but without regular expression on the User-Name : radius_xlat: '57920' rlm_sql (sql): sql_set_user escaped user --> '57920' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM login_wireless WHERE Username = '57920' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM login_wireless WHERE Username = ' And this is the log with the regular expression on the User-Name: radius_xlat: '' modcall[authorize]: module "sql" returns fail for request 7 modcall: group Autz-Type returns fail for request 7 PEAP: Got tunneled reply RADIUS code 0 PEAP: Unknown RADIUS packet type 0: rejecting tunneled user rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 Now radius_xlat is '' and not '57920' as in the precedent request. What am I doing wrong? Thanks, Fabio Pedretti

1 0

RE: CIsco Pix and FreeRadius....
by Sills, Tripp 18 Jan '06

18 Jan '06

Here is another debug of the failure Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: ../etc/raddb/proxy.conf Config: including file: ../etc/raddb/clients.conf Config: including file: ../etc/raddb/snmp.conf Config: including file: ../etc/raddb/eap.conf Config: including file: ../etc/raddb/sql.conf main: prefix = ".." main: localstatedir = "../var" main: logdir = "../var/log/radius" main: libdir = "../lib" main: radacctdir = "../var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "../var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "../var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "../bin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is ../lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "../var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Server.pem" tls: certificate_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Server.crt" tls: CA_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Root.crt" tls: private_key_password = "demo" tls: dh_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/dh" tls: random_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "../etc/raddb/huntgroups" preprocess: hints = "../etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "../etc/raddb/users" files: acctusersfile = "../etc/raddb/acct_users" files: preproxy_usersfile = "../etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "../var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "../var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=88, length=154 User-Name = "tripp" User-Password = "tripp" NAS-Port = 755 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp/tripp] (from client BorderPatrol port 755 cli 24.73.134.236) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 88 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 88 with timestamp 43ce52ec Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=89, length=155 User-Name = "tripp1" User-Password = "tripp1" NAS-Port = 755 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "tripp1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp1/tripp1] (from client BorderPatrol port 755 cli 24.73.134.236) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 89 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 89 with timestamp 43ce52f5 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=90, length=154 User-Name = "tripp" User-Password = "tripp1" NAS-Port = 755 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp/tripp1] (from client BorderPatrol port 755 cli 24.73.134.236) Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 90 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 90 with timestamp 43ce52fe Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=91, length=154 User-Name = "tripp" User-Password = " " NAS-Port = 755 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns ok for request 3 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp/ ] (from client BorderPatrol port 755 cli 24.73.134.236) Delaying request 3 for 1 seconds Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 91 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 91 with timestamp 43ce530d Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=92, length=155 User-Name = "tripp1" User-Password = "tripp1" NAS-Port = 755 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "tripp1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns ok for request 4 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp1/tripp1] (from client BorderPatrol port 755 cli 24.73.134.236) Delaying request 4 for 1 seconds Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 92 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 92 with timestamp 43ce5314 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=93, length=154 User-Name = "tripp" User-Password = "tripp" NAS-Port = 755 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 5 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns ok for request 5 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp/tripp] (from client BorderPatrol port 755 cli 24.73.134.236) Delaying request 5 for 1 seconds Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 93 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 93 with timestamp 43ce531c Nothing to do. Sleeping until we see a request. Terminate batch job (Y/N)? Tripp Sills Senior Network Engineer - Information Technology tripp(a)dmenet.com Direct Mail Express 2441 Bellevue Avenue Extension Daytona Beach, FL Office # (386) 271 - 3288 Cell # (386) 566 - 4053 Fax # (386) 271 - 3289 The information in this Internet e-mail, including attachments, is confidential and may be legally privileged. It is intended solely for the addressee. Access by any other person to this Internet e-mail is not authorized. If you are not the intended recipient, please delete this Internet e-mail and notify me by return e-mail or at (386) 271-3288. Any unauthorized disclosure of the parties to this e-mail, and any unauthorized disclosure, dissemination, distribution, copying, or any action taken or omitted to be taken in reliance on this email, including attachments, is prohibited and may be unlawful. -----Original Message----- From: freeradius-users-bounces+tripp=dmenet.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tripp=dmenet.com@lists.freeradius.org] On Behalf Of Sills, Tripp Sent: Wednesday, January 18, 2006 9:12 AM To: FreeRadius users mailing list Subject: RE: CIsco Pix and FreeRadius.... I am not altering the users file all I have in it is : I was using the same username and password for both. Below is my users file. # # Please read the documentation file ../doc/processing_users_file, # or 'man 5 users' (after installing the server) for more information. # # This file contains authentication security and configuration # information for each user. Accounting requests are NOT processed # through this file. Instead, see 'acct_users', in this directory. # # The first field is the user's name and can be up to # 253 characters in length. This is followed (on the same line) with # the list of authentication requirements for that user. This can # include password, comm server name, comm server port number, protocol # type (perhaps set by the "hints" file), and huntgroup name (set by # the "huntgroups" file). # # If you are not sure why a particular reply is being sent by the # server, then run the server in debugging mode (radiusd -X), and # you will see which entries in this file are matched. # # When an authentication request is received from the comm server, # these values are tested. Only the first match is used unless the # "Fall-Through" variable is set to "Yes". # # A special user named "DEFAULT" matches on all usernames. # You can have several DEFAULT entries. All entries are processed # in the order they appear in this file. The first entry that # matches the login-request will stop processing unless you use # the Fall-Through variable. # # If you use the database support to turn this file into a .db or .dbm # file, the DEFAULT entries _have_ to be at the end of this file and # you can't have multiple entries for one username. # # You don't need to specify a password if you set Auth-Type += System # on the list of authentication requirements. The RADIUS server # will then check the system password file. # # Indented (with the tab character) lines following the first # line indicate the configuration values to be passed back to # the comm server to allow the initiation of a user session. # This can include things like the PPP configuration values # or the host to log the user onto. # # You can include another `users' file with `$INCLUDE users.other' # # # For a list of RADIUS attributes, and links to their definitions, # see: # # http://www.freeradius.org/rfc/attributes.html # # # Deny access for a specific user. Note that this entry MUST # be before any other 'Auth-Type' attribute which results in the user # being authenticated. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #lameuser Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # Deny access for a group of users. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # # This is a complete entry for "steve". Note that there is no Fall-Through # entry so that no DEFAULT entry will be used, and the user will NOT # get any attributes in addition to the ones listed here. # #steve Auth-Type := Local, User-Password == "testing" # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP # # This is an entry for a user with a space in their name. # Note the double quotes surrounding the name. # "John Doe" User-Password == "hello" Reply-Message = "Hello, %u" test User-Password == "testing123" Reply-Message = "Hello, %u" # Test TLS Certificate based user FreeRADIUS.net-Client User-Password == "demo" Reply-Message = "Hello, %u" # # Dial user back and telnet to the default host for that port # #Deg Auth-Type := Local, User-Password == "ge55ged" # Service-Type = Callback-Login-User, # Login-IP-Host = 0.0.0.0, # Callback-Number = "9,5551212", # Login-Service = Telnet, # Login-TCP-Port = Telnet # # Another complete entry. After the user "dialbk" has logged in, the # connection will be broken and the user will be dialed back after which # he will get a connection to the host "timeshare1". # #dialbk Auth-Type := Local, User-Password == "callme" # Service-Type = Callback-Login-User, # Login-IP-Host = timeshare1, # Login-Service = PortMaster, # Callback-Number = "9,1-800-555-1212" # # user "swilson" will only get a static IP number if he logs in with # a framed protocol on a terminal server in Alphen (see the huntgroups file). # # Note that by setting "Fall-Through", other attributes will be added from # the following DEFAULT entries # #swilson Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.65, # Fall-Through = Yes # # If the user logs in as 'username.shell', then authenticate them # against the system database, give them shell access, and stop processing # the rest of the file. # #DEFAULT Suffix == ".shell", Auth-Type := System # Service-Type = Login-User, # Login-Service = Telnet, # Login-IP-Host = your.shell.machine # # The rest of this file contains the several DEFAULT entries. # DEFAULT entries match with all login names. # Note that DEFAULT entries can also Fall-Through (see first entry). # A name-value pair from a DEFAULT entry will _NEVER_ override # an already existing name-value pair. # # # First setup all accounts to be checked against the UNIX /etc/passwd. # (Unless a password was already given earlier in this file). # #DEFAULT Auth-Type = System # Fall-Through = 1 # # Set up different IP address pools for the terminal servers. # Note that the "+" behind the IP address means that this is the "base" # IP address. The Port-Id (S0, S1 etc) will be added to it. # #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.32+, # Fall-Through = Yes #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "delft" # Framed-IP-Address = 192.168.2.32+, # Fall-Through = Yes # # Defaults for all framed connections. # DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes # # Default for PPP: dynamic IP address, PPP mode, VJ-compression. # NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected # by the terminal server in which case there may not be a "P" suffix. # The terminal server sends "Framed-Protocol = PPP" for auto PPP. # DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression. # DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for SLIP: dynamic IP address, SLIP mode. # DEFAULT Hint == "SLIP" Framed-Protocol = SLIP # # Last default: rlogin to our main server. # #DEFAULT # Service-Type = Login-User, # Login-Service = Rlogin, # Login-IP-Host = shellbox.ispdomain.com # # # # Last default: shell on the local terminal server. # # # DEFAULT # Service-Type = Shell-User # On no match, the user is denied access. tripp Auth-Type := Local, User-Password == "tripp" tripp1 Auth-Type := System, User-Password == "tripp1" Tripp Sills Senior Network Engineer - Information Technology tripp(a)dmenet.com Direct Mail Express 2441 Bellevue Avenue Extension Daytona Beach, FL Office # (386) 271 - 3288 Cell # (386) 566 - 4053 Fax # (386) 271 - 3289 The information in this Internet e-mail, including attachments, is confidential and may be legally privileged. It is intended solely for the addressee. Access by any other person to this Internet e-mail is not authorized. If you are not the intended recipient, please delete this Internet e-mail and notify me by return e-mail or at (386) 271-3288. Any unauthorized disclosure of the parties to this e-mail, and any unauthorized disclosure, dissemination, distribution, copying, or any action taken or omitted to be taken in reliance on this email, including attachments, is prohibited and may be unlawful. -----Original Message----- From: freeradius-users-bounces+tripp=dmenet.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tripp=dmenet.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, January 17, 2006 1:32 PM To: FreeRadius users mailing list Subject: Re: CIsco Pix and FreeRadius.... "Sills, Tripp" <tripp(a)dmenet.com> wrote: > Notice the first request that comes from the 10.2.0.69...It is using the > test aaa-server from the PIX itself. The other 2 are when I am > connecting to the VPN client and trying to authenicate. It says Auth > Type unknown. Any ideas Alan? The only differences is in which entries it matches in the "users" file. Read those entries to see what it's doing, and why. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Dummy newbie question
by Fernando 18 Jan '06

18 Jan '06

Hy! I have a dummy question... running radtest, i get a Accept-Accept, and everything seems ok, but the database radacct table doesn't get updated, in fact the table is blank after many tests. Is it normal? Or i've mistaken something? Thanks for the help Fernando S. SanInternet Systems www.saninternet.com

3 2

RE: FreeRADIUS with PEAP(MSCHAPv2), MySQL and LDAP?
by Palmer J.D.F. 18 Jan '06

18 Jan '06

Hi Phil, Many thanks for the reply. I'm sorry the detail was lacking I'll try to explain myself a little better now. Firstly, what we do already and why I want to use MySQL... At the moment we run FR as a RADIUS proxy that proxies requests to a number of RADIUS servers based on the username. Presently we use the 'users' file to do this, the users file is built from our mail tables; amongst other things the users file maps a username to a home RADIUS server and a VLAN; basically I want to use MySQL to replace the users file; I don't want to actually authenticate against details in the MySQL database. The reason we use the mail tables is that it contains every user and the respective server that their mail goes to, we use the SMTP server name to determine which domain a user's RADIUS requests should be sent to. We use the Proxy_To_Realm directive in the users file to forward a user's request to the correct server. The reason I now want to use a database is because it will give us the ability to add more user data fields and a database would be more manageable, as the current users file has 38554 entries and is growing. Why I want to use LDAP... All of our user data is held in various MS ADS or Novell NDS directories, currently we run an IAS machine on each of our AD domains to handle the proxied requests forwarded by the FR server; my thinking was that it seems a little pointless to have these IAS boxes if I could use FR to set up the PEAP tunnels then verify the user's credentials against the appropriate domain's LDAP server. I ideally want to use PEAP(MSCHAPv2) though, mainly from a support, but also from an encryption strength point of view; however it appears that unless something clever can be done to verify MSCHAPv2 against MS or Novell LDAP it looks like I may be stuck with the nasty IAS boxes. I hope that makes some sense. Many thanks, Jezz Palmer. > -----Original Message----- > From: freeradius-users- > bounces+j.d.f.palmer=swansea.ac.uk(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+j.d.f.palmer=swansea.ac.uk(a)lists.freeradius.org] On Behalf Of Phil > Mayers > Sent: 17 January 2006 21:03 > To: FreeRadius users mailing list > Subject: Re: FreeRADIUS with PEAP(MSCHAPv2), MySQL and LDAP? > > Palmer J.D.F. wrote: > > Hi, > > > > > > > > I am currently trying to create a new auth system for our WPA 802.1x > > WiFi network. > > > > Thus far I have the server authenticating using PEAP(MSCHAPv2) against a > > users file containing a simple test user/pass pair. > > > > What I would now like to do is use MySQL to contain user data such as > > the VLAN to be assigned to that user and which LDAP server their account > > Assuming you know how to make the VLAN assignment work at all, then this > is trivial. > > Assigning a completely dynamic LDAP server might be a little more tricky. > > If you know what set of LDAP server(s) you want to use in advance, then > you could do this: > > modules { > ldap ldap1 { > # config here > } > ldap ldap2 { > # config here > } > } > > authorize { > preprocess > mysql > mschap > eap > > Autz-Type Ldap1 { > ldap1 > } > Autz-Type Ldap2 { > ldap2 > } > } > > The "mysql" module/tables will need to set Autz-Type on the requests, at > which point the authorize stanza will be run *again* executing the > conditional sections. > > ...however making this work correctly in the presence of eap/ms-chapv2 > will not be straightforward, and in any event you have the other issue... > > > exists on, then use LDAP to verify the credentials. > > The only "verification" LDAP can do of credentials is to proxy PAP > requests to LDAP simple binds. You cannot check MS-CHAP "against" an > LDAP server. > > However using LDAP as a database, as it was intendended, then *if* the > LDAP server contains either plaintext password or the NT/LM hashes, the > radius server can read them, and the ldap module is configured to get > them from LDAP, then FreeRadius can perform the MS-CHAP inside itself. > > > > > The idea being that a PEAP request comes in, tunnel gets built etc, the > > user gets looked up in the MySQL database, the credentials are then > > authenticated against the correct LDAP (or RADIUS) server, then on > > success an access-accept along with the user's VLAN is passed back to > > the NAS. > > This seems extremely hard work. Why would you use both MySQL and LDAP? > > > > > > > > > The question is, is it possible for PEAP(MSCHAPv2) and LDAP with MySQL > > to interact in this way? > > Your question is not precise enough for me to be sure exactly what you > want. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

3 2

dictionary.3gpp2 note
by Alexander Serkin 18 Jan '06

18 Jan '06

hi, According to http://www.3gpp2.org/Public_html/specs/P.S0001-B_v2.0_041004.pdf (page 65) the attribute 41 (3GPP2-R-P-Session-Id) in dictionary.3gpp2 should be integer, not string. And i'd remove the comment '#' on it in the file. Thanks, -- als

1 0

Error: Assertion failed in request_list.c, line 1119
by masetio 18 Jan '06

18 Jan '06

i'm using freeradius-snapshot-20060115 i have error --> Tue Jan 17 19:56:34 2006 : Error: rlm_sql: Failed to create the pair: Unknown at tribute "1" Tue Jan 17 19:56:34 2006 : Error: rlm_sql (sql): Error getting data from databas e Tue Jan 17 19:56:34 2006 : Error: rlm_sql (sql): SQL query error; rejecting user Tue Jan 17 20:00:16 2006 : Info: Ready to process requests. Tue Jan 17 20:00:55 2006 : Error: Assertion failed in request_list.c, line 1119 i dont understan with code request_list.c ??? plz... How to debug this problem ? -- ~_|[]~

1 1

eap authentication and proxy radius
by Matteo Paoli 18 Jan '06

18 Jan '06

It's possible configure Freeradius to request two eap authentication? For example, the supplicant starts the eap-tls and the authentication is ok. But the server radius don't send Access Accept but it requests a new authentication (for example eap-md5). If also eap-md5 is ok, the supplicant is authenticated. authentication supplicant = (authentication eap-tls) && (authentication eap-md5) If the first answer is Yes. It's possible that the first authentication is forwarded to remote radius server and the second one is resolved locally? authentication supplicant = (authentication eap-tls on remote radius server) && (authentication eap-md5 on proxy radius server) Many thanks, Matteo Paoli -- Matteo Paoli

2 1