- Freeradius-Users - lists.freeradius.org

RE: Freeradius How to integrate Active Directory and return group attribute to VPN Concentrator
by Alhagie Puye 02 Dec '05

02 Dec '05

> >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Dusty Doris > >Sent: November 30, 2005 7:16 AM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active Directory > >and return group attribute to VPN Concentrator > > > >> Radiusd.conf: > >> > >> filter = > >> > >"(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(membe > >rOf=CN=rp > >> tp cps,OU=Datawave Users,DC=corp,DC=van,DC=dwave))" > >> > >> This works fine. However I can't get it to return any > >replyItems. Has > >> anyone gotten this to work with Active Directory? All the > >docs I see > >> on the Net refeerence OpenLDAP. I'm sure there is a lot of > >folks out > >> there running Windows 2000/2003 Active Directory. > >> > >> I have spent a couple of days on this not having much > >luck. Here are a > >> few questions that would help me a bit. > >> > >> 1) Do I need groupname_attribute to get this to work? > >> > >> 2) What about groupmembership_filter and groupmembership_attribute? > >> > >> My ldap.attrmap looks like this: > >> > >> replyItem Class groupofnames > >> replyItem Class group > >> > >> I think the above is correct. Can some shed some light on this? > > > >Is group and groupofnames something that is an attribute of > >a user? When freeradius searches for reply items it is > >searching for attributes of that user. > > > >eg: > > > >dn: cn=someuser,... > >group: somegroup > > > >Should then add > > > >Class = somegroup > > > >to the reply items. > > > >If you want to make reply items attached to a group, rather > >than in individual, you will need to set the User-Profile attribute. > > > >For example, > > > >dn: cn=somegroup,ou=groups,... > >group: somegroup > > > >Then in the users file. > > > >DEFAULT Ldap-Group == somegroup, User-Profile := > >"cn=somegroup,ou=groups,..." > > > >You may be able to do this dynamically using xlat or > >something like huntgroups too. If you want an example, send > >us an example of a user and group from AD in ldif format and > >an example of a radius packet that you would expect in the > >reply and I'll see if I can come up with an idea for ya. I'm still waiting for some help with this.....I have sent all the information that you requested. I have gotten it to return the group name but it is also returning the username as well and the username is returned after the group name. Is there is way to return just the groupname? I really would like to resolve this issue ones and for all. I'm really surprised that there are not folks on the list who have Active Directory users that they want to use to lock VPN users into groups on the VPN Concentrator. If really there isn't, I would put a howto on this when I get it working and post it on the list. Here is my latest output: rlm_ldap: performing search in CN=itops,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave, with filter (cn=itops) rlm_ldap::ldap_groupcmp: User found in group itops rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 163 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for apuye radius_xlat: '(&(sAMAccountName=apuye)(objectclass=user))' radius_xlat: 'DC=corp,DC=van,DC=dwave' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in DC=corp,DC=van,DC=dwave, with filter (&(sAMAccountName=apuye)(objectclass=user)) rlm_ldap: performing search in CN=itops,ou=Information Technology,ou=Datawave Users,dc=corp,dc=van,dc=dwave, with filter (objectclass=group) rlm_ldap: Adding samaccountname as Class, value itops & op=11 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding samaccountname as Class, value apuye & op=11 rlm_ldap: user apuye authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_ldap: - authenticate rlm_ldap: login attempt by "apuye" with password "XXXXXXXXXXX" rlm_ldap: user DN: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave rlm_ldap: (re)connect to huckster.corp.van.dwave:389, authentication 1 rlm_ldap: bind as CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave/XXXXXXXXXX to huckster.corp.van.dwave:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user apuye authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 1 modcall: group Auth-Type returns ok for request 1 Sending Access-Accept of id 4 to 10.99.1.50:1031 Class = 0x6170757965 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 4 with timestamp 438e98b2 Nothing to do. Sleeping until we see a request. Thanks, Alhagie. > > > > > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

RE: Freeradius How to integrate Active Directory[ADIntegrationWindowsXP NTLM Tutorial]
by Alhagie Puye 02 Dec '05

02 Dec '05

Thanks Dusty. That's very helpful. I have one little problem. I was hoping someone can shed some light on it. For the Active Directory security, I need to specify the username as "Domain\user" instead of just "user" for the identity in radiusd.conf "user(a)domain.com" doesn't seem to work. Here is the output: rad_recv: Access-Request packet from host 192.168.42.1:50667, id=146, length=57 User-Name = "user" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "apuye", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for apuye radius_xlat: '(uid=apuye)' radius_xlat: 'dc=ad,dc=puyenet,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to orion.puyenet.com:389, authentication 0 rlm_ldap: bind as cn=apuye(a)ad.puyenet.com,ou=users,dc=ad,dc=puyenet,dc=com/password to orion.puyenet.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 4 modcall: group authorize returns fail for request 4 Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 146 with timestamp 4388ab87 Nothing to do. Sleeping until we see a request. The radiusd.conf file looks like this for the ldap section: ldap { server = "orion.puyenet.com" # identity = "cn=admin,o=My Org,c=UA" identity = "cn=apuye(a)ad.puyenet.com,ou=users,dc=ad,dc=puyenet,dc=com" password = password #basedn = "o=My Org,c=UA" basedn = "dc=ad,dc=puyenet,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" Thanks in advance. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Dusty Doris > >Sent: November 25, 2005 9:43 AM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active > >Directory[ADIntegrationWindowsXP NTLM Tutorial] > > > > > >> So, the question again is if the VPN Concentrator is only sending > >> username and password, do I need ntml_auth or ms-chap? FreeRADIUS > >> doesn't have any usernames and password and will query Active > >> Directory for the actual authentication. > >> > >> Thanks, > >> > > > >If the packet is merely containing plaintext username and > >password, then you can probably just use rlm_ldap against AD > >and hit it directly. Just need to setup a user with read > >access to the directory to do the initial bind with and > >search of the user for authorization. Then the user will be > >authenticated by doing a bind against AD with the > >username/password in the packet. > > > >BTW - I use freeradius w/ ldap for cisco VPN concentrators > >as well, although its openldap instead of AD. To pass back > >the class attribute, you must modify ldap.attrmap and > >specify the reply item of Class to match what you call it in > >the directory. > > > >eg: > > > >replyItem Class radiusClass > > > >Then in the directory, you have > > > >dn: cn=someuser,... > >... > >radiusClass: "OU=myvpngroup;" > > > >So, for AD, you'll need to extend the schema and add an > >attribute for this. Or if you already have something that > >you can use, just modify ldap.attrmap to know what it is. > > > >-Dusty Doris > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

3 4

EAP/TLS Configuration - Addition
by Madhuraka Godahewa 02 Dec '05

02 Dec '05

Hi Again, This email refers to the earlier email sent with the subject "EAP/TLS Configuration". After having some trouble with the Windows XP and freeRADIUS, I was able to connect to the AP. But, in the configuration (Windows XP), I removed the check mark at 'Validate Server Certificate'. Then, suddenly, it started working. Anybody knows the reason for this? Further, after establishing the connection, I terminated the connection (by disabling the network connection). Then, I tried to connect again (by enabling). But, this time, the user machine connected to the AP automatically (without asking for the credentials.). It seems like something has cached these entries. Anybody knows how to clear this cache? Thanking You., -------------------------------------------------------------------------------- Madhuraka Godahewa Telecommunications Engineer Research and Development Unit Electroteks Global Networks (Pvt.) Ltd. Mobile: + 94-777-647055

2 1

RE: IPv6 Support
by Paulo Alexandre Caceres Ferreira 02 Dec '05

02 Dec '05

Hi again, How I can test IPv6 Freeradius authentication? You know any IPv6 RADIUS client to interact with Freeradius and perform an IPv6 authentication? In IPv4 I find many clients, but to IPv6, I don't found any clients yet. Please reply to me where I can get the client used to test CVS Freeradius IPv6 authentication, and others if they exist. Thanks in advance, Paulo Ferreira ./Caceres --------------------- > > Paulo Alexandre Caceres Ferreira <caceres(a)alumni.ipt.pt> wrote: > > Freeradius support authentication over IPv6? > > The CVS snapshot does. > > > If Freeradius doesn't support IPv6, and somebody know a RADIUS that > > support, please reply to me the name of that application. > > Some commercial servers. Not all, though. > > FreeRADIUS is the only open source server that I know of that > implements IPv6. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: PEAP without MAC is OK but with MAC...
by Rudi Verago [vlain] 02 Dec '05

02 Dec '05

Thanks!!! Calling-Station-ID was ok but in the email I put another MAC... The solution was the copy_request_to_tunnel...thanks again. Your email with "the solution of the problem" was the faster I had never received in every mailing list. Bye, Rudi -> > My problem is using MAC address also, simply adding the parameter Calling-Station-Id doesn't work: -> > -> > "rudi" User-Password == "xxxxx" Calling-Station-Id == "00-e3-44-5E-1A-B2" -> ... -> -> > rad_recv: Access-Request packet from host 192.168.0.100:1143, id=0, length=190 -> ... -> > Calling-Station-Id = "00-12-F0-1E-2A-B2" -> -> Try cutting & pasting the Calling-Station-Id from the debug log into -> the "users" file. -> -> You may also want to set "copy_request_to_tunnel" in the peap{} -> section of eap.conf. -> -> Alan DeKok.

1 0

PEAP without MAC is OK but with MAC...
by Rudi Verago [vlain] 02 Dec '05

02 Dec '05

I use the last version of freeradius on a Ubuntu box, my supplicant is a XP machine. I set PEAP and all works ok, this is the simple configuration for the file user "rudi" User-Password == "xxxxx" All is perfect also with MySQL...so FreeRADIUS is great ;-) My problem is using MAC address also, simply adding the parameter Calling-Station-Id doesn't work: "rudi" User-Password == "xxxxx" Calling-Station-Id == "00-e3-44-5E-1A-B2" I try to use different format for MAC, local auth, peap auth, proxy and others solution find on mailing list...but nothing. Any help? The log for radius -X -A is below. Thanks in advance and good work, Rudi --------------------------------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.100:1143, id=0, length=190 Message-Authenticator = 0xd87583bdf395a663b9a67308180dc61d Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020000090172756469 NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 0 to 192.168.0.100:1143 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xde8d05c0e49d7edba8d0d222cab8b3ce Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=1, length=279 Message-Authenticator = 0x4316604de774b7306d299d3e55b8198c Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0xde8d05c0e49d7edba8d0d222cab8b3ce Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201005019800000004616030100410100003d0301438f8fd1de0dba3cf40cc34ab346ddb01173c54cab6ee58d0898091f77a565b800001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0552], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 1 to 192.168.0.100:1143 EAP-Message = 0x0102040a19c0000005af160301004a020000460301438f8fd8a520523b675257784d58c8386b3f37558a11ccddba4adc9cf3fb15f220abbd731ea80d7bbc7c2d651b30f151787172727002e269018589ecf389398c6700040016030105520b00054e00054b00024f3082024b308201b4a003020102020900f38118d0ad652d8a300d06092a864886f70d0101050500305a310b3009060355040613024974310b3009060355040813025044310f300d060355040a1306496d74656368310d300b06035504031304726f6f74311e301c06092a864886f70d010901160f766c61696e406c696265726f2e6974301e170d3035313132333032333130335a17 EAP-Message = 0x0d3036313132333032333130335a305c310b3009060355040613024974310b3009060355040813025044310f300d060355040a1306496d74656368310f300d06035504031306736572766572311e301c06092a864886f70d010901160f766c61696e406c696265726f2e697430819f300d06092a864886f70d010101050003818d0030818902818100b4ba5fcde942ead9afe5d72ee7cd1c7728afcbc35c6f13402d388f27cfaf91f2e0fb9f646f19f06ad1264163663bb4f01be56b5a77943d6c7da7ea0615efdd0f73ea2fe48a73c2a0ec94d7b4e80ffaf9045d6dbdd6a7598b7bc04ea578462ea5c37fb861551b507409c923f7281a952b00529438 EAP-Message = 0xf8d0d95afe4110d4d414587d0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100179b16a6218fc7c7ed5abf765de15bf2e41628d55ead746bc079aa4df49bf6e23c5f3bd57961b2f9995a286fba7baa5f8bf4e32da7b0aeac722854cea5d7df39f856732dd03228429c2e787801464875385c165aec6dc5f421a70fd2b252cd44c8c9aacd61e26617cd074fcc5c958736c33f46f32b8e56b31cc99caa98bef5890002f6308202f23082025ba003020102020900f38118d0ad652d88300d06092a864886f70d0101050500305a310b3009060355040613024974310b3009060355 EAP-Message = 0x040813025044310f300d060355040a1306496d74656368310d300b06035504031304726f6f74311e301c06092a864886f70d010901160f766c61696e406c696265726f2e6974301e170d3035313132333032333032315a170d3037313132333032333032315a305a310b3009060355040613024974310b3009060355040813025044310f300d060355040a1306496d74656368310d300b06035504031304726f6f74311e301c06092a864886f70d010901160f766c61696e406c696265726f2e697430819f300d06092a864886f70d010101050003818d0030818902818100aee79505f48a78028de7b7b3c58fa3fce84149432fa0a1ef14752b333bb8 EAP-Message = 0xd110ee0a186915f8dbb3240a087ea9153b99e468d03c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x179071aba06de19a0958315876b949ee Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=2, length=205 Message-Authenticator = 0x97859340fec8fb806913d8ef90c5c65b Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0x179071aba06de19a0958315876b949ee Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 2 to 192.168.0.100:1143 EAP-Message = 0x010301b5190048f2e9958c1dad57415c322d99da976059b925190118a0b6968263f0bbbce197d6c4ed0c3db0f06b8e41105244cacc9a2d97c4c18b56c25ae663ede1413c088ce4807286a633a742b10c61df0203010001a381bf3081bc301d0603551d0e0416041432ecae8aaa28e7e5d6f8e17669a549b893caef1430818c0603551d23048184308181801432ecae8aaa28e7e5d6f8e17669a549b893caef14a15ea45c305a310b3009060355040613024974310b3009060355040813025044310f300d060355040a1306496d74656368310d300b06035504031304726f6f74311e301c06092a864886f70d010901160f766c61696e406c696265726f EAP-Message = 0x2e6974820900f38118d0ad652d88300c0603551d13040530030101ff300d06092a864886f70d0101050500038181005f4867dea3b5fa4239419bcb875e2af572a77e7bf7c084480d919752ed530384a89daf7ff2223ed43636a5fb9f132d6d7f74b62b88c9c6331b11cf64a4cdf74200475b7677546a1c388d21d8831bb5ae50d96506fa326a6cfa22da33bd70e75ce33efa69d3c05497f18a998d297629244164eb1412f4e13ddff445c6f1b166dd16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4a893a6285080cf5575b7da11c1ab084 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=3, length=391 Message-Authenticator = 0x451d99411934d423a8b9b9d5f5244b5e Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0x4a893a6285080cf5575b7da11c1ab084 Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300c01980000000b616030100861000008200807ee4cd8473260bc1e113ec94e036d308a018581ace9795d81b9c16c8e1f3d56bc411ad05509b6b0dee0996f994accd45132446533cd22cb83106837ec4bdd53010bd160a410bf55199f544af71fad9b3a269182e26095efe8f433e3ea5a257579969df4ee971e0555e46f1bcf2b886e7466fb4aa8b9c36f66682263a0ccf3c3e14030100010116030100200832777727f3a5290e93af5fd22fa8f29ef53c463cdad803837907668f2fc883 NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 3 to 192.168.0.100:1143 EAP-Message = 0x01040031190014030100010116030100200bb4a68cfcc4968939302a56e07f615e81fef7b372e451d7ebf1d3b4af23f914 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x848271c657c7b72869965b8b9b1aa0e7 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=4, length=205 Message-Authenticator = 0x8cbf322de5f1827b6de13925a6f80899 Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0x848271c657c7b72869965b8b9b1aa0e7 Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400061900 NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 4 to 192.168.0.100:1143 EAP-Message = 0x0105002019001703010015467fe443ab3108e93e16dd343d25757bd383eb3793 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdeb9a28614e38559a0a146be34580acb Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=5, length=231 Message-Authenticator = 0x9010bc7a6769502afaebdfb5ea20c098 Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0xdeb9a28614e38559a0a146be34580acb Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02050020190017030100150a5b8130f55f9062962001b28d574a36da2da50864 NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 32 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - rudi rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020500090172756469 PEAP: Got tunneled identity of rudi PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to rudi PEAP: Sending tunneled request EAP-Message = 0x020500090172756469 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "rudi" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 163 modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x0106001e1a0106001910d536b9291afdf00621dcfc6a51bc86dc72756469 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x32911aa2856cc4631f2b54871272d85f PEAP: Processing from tunneled session code 0x8123b48 11 EAP-Message = 0x0106001e1a0106001910d536b9291afdf00621dcfc6a51bc86dc72756469 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x32911aa2856cc4631f2b54871272d85f PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 5 to 192.168.0.100:1143 EAP-Message = 0x010600351900170301002a269c325eb8730d5264be98ca62699f87ca0e4005766d0e6a68c1fde618bb76bbe0ac67b24f9e4bfb03ba Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc079ddee6f5011d526cd9f176e7bcdfa Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=6, length=285 Message-Authenticator = 0x44d126e6c63d26d44e8162bb569ee110 Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0xc079ddee6f5011d526cd9f176e7bcdfa Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020600561900170301004b717cf225414fc50e7f65402ad3d01a726987fe92004513ac270be6036677a7cb61f0df0fdd733dc620fae4661cae926dde7f3d4ed3cc1f1ca424bd0d78322763289c982838443c13a11d1a NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 86 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0206003f1a0206003a317856a82853fc381ff5633d33ce7bb6bd0000000000000000649941400aec4c84b5738f58640b70957cdfa61712c1052d0072756469 PEAP: Setting User-Name to rudi PEAP: Adding old state with 32 91 PEAP: Sending tunneled request EAP-Message = 0x0206003f1a0206003a317856a82853fc381ff5633d33ce7bb6bd0000000000000000649941400aec4c84b5738f58640b70957cdfa61712c1052d0072756469 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "rudi" State = 0x32911aa2856cc4631f2b54871272d85f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 163 modcall[authorize]: module "files" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for rudi with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: group Auth-Type returns reject for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: group authenticate returns reject for request 6 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x8123020 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 6 to 192.168.0.100:1143 EAP-Message = 0x010700261900170301001ba019fb828bb271211545e1863a0054813d58ee90ffb3a68fdfd93e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf4c68d8303984625b6d877b06f4a70d0 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=7, length=237 Message-Authenticator = 0x84092205643db6f1a95bf152ed6aa7fe Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0xf4c68d8303984625b6d877b06f4a70d0 Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020700261900170301001bd235f4d049b5a4d047f7a3e9d766112db6141b4b5d0239ac82239d NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: group authenticate returns invalid for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=7, length=237 Sending Access-Reject of id 7 to 192.168.0.100:1143 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 438f8fd8 Cleaning up request 1 ID 1 with timestamp 438f8fd8 Cleaning up request 2 ID 2 with timestamp 438f8fd8 Cleaning up request 3 ID 3 with timestamp 438f8fd8 Cleaning up request 4 ID 4 with timestamp 438f8fd8 Cleaning up request 5 ID 5 with timestamp 438f8fd8 Cleaning up request 6 ID 6 with timestamp 438f8fd8 Cleaning up request 7 ID 7 with timestamp 438f8fd8 Nothing to do. Sleeping until we see a request. -----------------------------------------------------------------

2 1

RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]
by Bohannan, Chad W 01 Dec '05

01 Dec '05

Hello, I am attempting to have FR authenticate administrative access for my Cisco gear against AD. The problem I am having is this. When I attempt to join the realm <<net ads join -U UID>> the command appears successful and from the AD side, the system has joined (visable in AD), however the proccess hangs on the FR side. If I stop the process and reissue the command, I get the following output and the process again hangs: [2005/12/01 11:08:36, 0] libads/ldap.c:ads_add_machine_acct(1405) ads_add_machine_acct: Host account for rws-radius01 already exists - modifying old account <<ntlm_auth --request-nt-key --domain=mydomain --username= \myuid>> NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) <<wbinfo -a UID%PASSWD>> plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user UID%PASSWD with plaintext password challenge/response password authentication failed error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO Could not authenticate user UID with challenge/response I am sure there is something simple I have overlooked, but I am unable to find it at this point. Any suggestions would be much appreciated. Chad -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of charles schwartz Sent: Tuesday, November 22, 2005 11:28 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial] Hi list, A lot of people on this list would like to integrate Active Directory with FreeRADIUS in order to provide a transparent user authentication login process. There are at least 2 ways to integrate AD: LDAP and NTLM. I've written a tutorial about how to do this with NTLM (winbind, ntlm_auth). The Windows supplicants are configured to work with PEAP and MSCHAPv2. You can download it from here: http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tutorial.pdf Good luck! Regards, Charles Schwartz - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

IP address allocation based on Calling-station-id
by Matias E. Fabiano 01 Dec '05

01 Dec '05

Hi all, I have an application running on a server which stores data sent from GPRS phones. In order to do it without traversing the internet, the telco created me an APN which my GPRS phones will use to connect to my server. But my server's application also needs to connect back to the phones, for example, to reprogramm some parameters, and I can't do it because the phone's IPs are changing all the time. One way to solve it is assign IP address statically. So, they told me that what I can do is set up a table on my Radius server with all my phone numbers on one column and the desired IP address on the other, so everytime the user logs in and requests an IP address, i'll assign the same. I've runned some tests and the phone's number comes on the calling-station-id attribute, inside the authentication request. Is possible on freeradius to assign IP address based on the calling-station-id attribute? How can I accomplish this? Best regards and thanks!!!

1 0

802.1x ldap tls
by Paolo Barbato 01 Dec '05

01 Dec '05

Hi list, yes I know that this question has been discussed so many times but, still I'm in trouble. I've set up freeradius in order to authenticate+authorize Cisco NAS of Aironet. I've successfully connected PC/MAC wireless clients using TTLS+PAP with in backend and LDAP DB. Problem arise when I try to make the same with TLS, I mean PEAP+MSCHAP and LDAP DB. THis doesn't works. If I set a local user in users file, that is good, but if I try a LDAP user nothing come. LDAP store plain password. Some hints ? Here, some extracts from log: rlm_ldap: - authorize rlm_ldap: performing user authorization for myRfx radius_xlat: '(uid=myRfx)' radius_xlat: 'o=Consorzio RFX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=Consorzio RFX, with filter (uid=myRfx) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user myRfx authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 9 modcall: group authorize returns updated for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 9 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for myRfx with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 9 modcall: group Auth-Type returns reject for request 9 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 9 modcall: group authenticate returns reject for request 9 auth: Failed to validate the user. Login incorrect: [myRfx/<no User-Password attribute>] (from client localhost port 0) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\tE=691 R=1" EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x9db3b30 3 MS-CHAP-Error = "\tE=691 R=1" EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 9 modcall: group authenticate returns handled for request 9 Sending Access-Challenge of id 239 to 150.178.33.150:1645 EAP-Message = 0x010a002a1900170301001f1daf025ff66ee7cba51f42762f540bf78052e745788d4144c9705681d67359 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2846493df32aa5a3d90a7d4d8c3b4867 Finished request 9 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 150.178.33.150:1645, id=240, length=176 User-Name = "myRfx" Framed-MTU = 1400 Called-Station-Id = "0011.2075.ab11" Calling-Station-Id = "0030.6519.c496" Service-Type = Login-User Message-Authenticator = 0x33f13f5d35c399dbc0f3422dc2c798d9 EAP-Message = 0x020a002a1900170301001fa1cae4d87f9f3e55c42ec8b99729dadddf42ba9a8f4eba029615a9ece90eff NAS-Port-Type = Wireless-802.11 NAS-Port = 12652 State = 0x2846493df32aa5a3d90a7d4d8c3b4867 NAS-IP-Address = 150.178.33.150 NAS-Identifier = "NET26" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 10 modcall[authorize]: module "preprocess" returns ok for request 10 modcall[authorize]: module "chap" returns noop for request 10 modcall[authorize]: module "mschap" returns noop for request 10 rlm_realm: No '@' in User-Name = "myRfx", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 10 rlm_eap: EAP packet type response id 10 length 42 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 10 modcall[authorize]: module "files" returns notfound for request 10 rlm_ldap: - authorize rlm_ldap: performing user authorization for myRfx radius_xlat: '(uid=myRfx)' radius_xlat: 'o=Consorzio RFX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=Consorzio RFX, with filter (uid=myRfx) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user myRfx authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 10 modcall: group authorize returns updated for request 10 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 10 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 10 modcall: group authenticate returns invalid for request 10 auth: Failed to validate the user. Login incorrect: [myRfx/<no User-Password attribute>] (from client rfxnet1 port 12652 cli 0030.6519.c496) Delaying request 10 for 1 seconds Finished request 10 Going to the next request Regards, Paolo. -- ------------------------------------------------------------------------------------------------ Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it Network Administrator phone: (39-049)-829-5097 (39-049)-829-5000 Corso Stati Uniti,4 www: http://www.igi.cnr.it 35127 Camin-Padova PGP: http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org ------------------------------------------------------------------------------------------------

2 3

WLAN 802.1x FreeRadius with LDAP
by Christian Poessinger 01 Dec '05

01 Dec '05

Hello folks, I want to do a setup with a HP Procurve 520wl Access Point, OpenLDAP and FreeRadius with 802.1x and users in my LDAP backend. LDAP and Radius works fine, when i do a radtest user pass radius.domain.tld 0 secret i get an access accept package back. Now i configured my AP to use the Radius server for 802.1x auth, when i want to logon into the WLAN I enter my user and pass that just worked with radtest but I recieve an acces reject package. This is really strange cause the Radius debug mode tells me LDAP connection successfull. I use clear passwords in the backend, so there should be no problem. Anyone has an idea for my problem? Here is the Radius debug message with the access reject packet: rlm_ldap: - authorize rlm_ldap: performing user authorization for user radius_xlat: '(uid=user)' radius_xlat: 'ou=people,dc=domain,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=de, with filter (uid=user) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 11 to xxx.xxx.164.26:6001 EAP-Message = 0x0105040619407c917840ad1cf254e5ca549ca9b1053de4de1e704dc6eb9cec86a35eafabe5 2f60e8ee1a9697a755a713be14acd2db7f3402acb70864e3139ef470c900d024f2fd0f455b94 028c87d7a170ce86f302e35c4e658d09f17016227f0003cf308203cb30820334a00302010202 0900927540ab5d693004300d06092a864886f70d01010405003081a0310b3009060355040613 0244453110300e06035504081307426176617269613112301006035504071309577565727a62 75726731163014060355040a130d4765466f656b6f4d20652e562e31193017060355040b1310 4765466f656b6f4d20652e562e20434131193017060355040313 EAP-Message = 0x104765466f656b6f4d20652e562e204341311d301b06092a864886f70d010901160e636140 6765666f656b6f6d2e6465301e170d3035303531363137313832335a170d3036303531363137 313832335a3081a0310b30090603550406130244453110300e06035504081307426176617269 613112301006035504071309577565727a6275726731163014060355040a130d4765466f656b 6f4d20652e562e31193017060355040b13104765466f656b6f4d20652e562e20434131193017 060355040313104765466f656b6f4d20652e562e204341311d301b06092a864886f70d010901 160e6361406765666f656b6f6d2e646530819f300d06092a8648 EAP-Message = 0x86f70d010101050003818d0030818902818100c8124b32b761710b8c576a5b8f566a1dd8cc 97c423dfd8901cd58b9e90960328233879b3a09ebda855dbaa4376c00318ebc1767173051ae1 5995a1d41c9a6289707d5f7dd1e608ca5071e2aeb99092204f9386789c9ec8d5f754a26e9940 297ffbe547b5d0cf5ee16566abcc7578e25ac6a3b5e57befee43f2828174d27db19f02030100 01a382010930820105301d0603551d0e04160414ac6e4891d5a749d6548d7eda627ca2d64d12 d2693081d50603551d230481cd3081ca8014ac6e4891d5a749d6548d7eda627ca2d64d12d269 a181a6a481a33081a0310b30090603550406130244453110300e EAP-Message = 0x06035504081307426176617269613112301006035504071309577565727a62757267311630 14060355040a130d4765466f656b6f4d20652e562e31193017060355040b13104765466f656b 6f4d20652e562e20434131193017060355040313104765466f656b6f4d20652e562e20434131 1d301b06092a864886f70d010901160e6361406765666f656b6f6d2e6465820900927540ab5d 693004300c0603551d13040530030101ff300d06092a864886f70d0101040500038181004a36 34f23e46d180ec87122ee39ba0c6757d22a23ec39a38e3f282e82efb7428b83d04f665e28b00 e99a88217803c1abb4a0bc90fe6a51a37eec1c1868853a5436d5 EAP-Message = 0x9035f217c35ab4d53d6f1e3d11cdeabc9f77 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc479631c6d6d413371d8af0ebf14ac4f Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host xxx.xxx.164.26:6001, id=12, length=155 User-Name = "user" NAS-IP-Address = xxx.xxx.1.66 Called-Station-Id = "00-08-88-12-2e-3f" Calling-Station-Id = "00-0d-37-ab-2f-c7" NAS-Identifier = "ORiNOCO-AP-2000-00-02-00" State = 0xc479631c6d6d413371d8af0ebf14ac4f Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0xb07e446b64197c49b0ebaca6e799dc53 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for user radius_xlat: '(uid=user)' radius_xlat: 'ou=people,dc=domain,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=de, with filter (uid=user) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 12 to xxx.xxx.164.26:6001 EAP-Message = 0x0106003b1900715e896f163c5ccb279cd28b82295a1bd493ac86f6ffe4733d43f380f4871b 567d14ecb8d5171f15de61995e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xccbffd45885465294711dc5bf8395320 Finished request 3 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host xxx.xxx.164.26:6001, id=13, length=341 User-Name = "user" NAS-IP-Address = xxx.xxx.1.66 Called-Station-Id = "00-08-88-12-2e-3f" Calling-Station-Id = "00-0d-37-ab-2f-c7" NAS-Identifier = "ORiNOCO-AP-2000-00-02-00" State = 0xccbffd45885465294711dc5bf8395320 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600c01980000000b616030100861000008200801942772db96a99e5e538cb1d5d208967 b1353ea1158512bb1bd050ab7e2aca218fe43e45fbb41a076a2a0dad179b456de8d7afce55b7 c72e125ebe3bb4c42ff4804ded92a10e29c9f021a9dcfe7cac9c60fc41d1be343c7cb74b2889 5a5855e476b79b5db1fea73e1d0615baa9bfcca6004b37f7ebc2ef0f54e6d38ba0c57a631403 010001011603010020340f13326352d4d4b739b0a1d5350db6b211be3d1b16345f3429ce4875 18e879 Message-Authenticator = 0x1379379ef003130e6e5d8bc4ea849160 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for user radius_xlat: '(uid=user)' radius_xlat: 'ou=people,dc=domain,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=de, with filter (uid=user) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 13 to xxx.xxx.164.26:6001 EAP-Message = 0x0107003119001403010001011603010020eb7dbacfe1675927e1f3fcf8e5f61914d375ca69 10fcded8e503adb2dbfccbff Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbe4b1111c47a456a9bbe659aa28a4911 Finished request 4 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host xxx.xxx.164.26:6001, id=14, length=182 User-Name = "user" NAS-IP-Address = xxx.xxx.1.66 Called-Station-Id = "00-08-88-12-2e-3f" Calling-Station-Id = "00-0d-37-ab-2f-c7" NAS-Identifier = "ORiNOCO-AP-2000-00-02-00" State = 0xbe4b1111c47a456a9bbe659aa28a4911 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700211980000000171503010012a389dbe218dce122f0104ff21769ccb64b2b Message-Authenticator = 0xca07ce402c4e46c7342a2abc05383cab Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 7 length 33 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for user radius_xlat: '(uid=user)' radius_xlat: 'ou=people,dc=domain,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=de, with filter (uid=user) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: group authenticate returns invalid for request 5 auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host xxx.xxx.164.26:6001, id=14, length=182 Sending Access-Reject of id 14 to xxx.xxx.164.26:6001 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 9 with timestamp 43886940 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 10 with timestamp 43886941 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 11 with timestamp 43886942 Cleaning up request 3 ID 12 with timestamp 43886942 Cleaning up request 4 ID 13 with timestamp 43886942 Cleaning up request 5 ID 14 with timestamp 43886942 Nothing to do. Sleeping until we see a request.

8 26