- Freeradius-Users - lists.freeradius.org

Configuring a proxied and local authentication
by Samuel Degrande 02 Dec '05

02 Dec '05

Hello. Fist, I would like to apologize if my question is really too simple, but I think that I don't exactly understand the configuration philosophy of freeradius. I did configure one radius server (A) to proxy incoming requests to an other radius server (B, this later one using pam). First question: I don't find a way to add a NAS-Identifier value inside the proxied request, so that B server could check it... I tried: <username> Proxy-To-Realm := <realm>, NAS-Identifier := <id> and <username> Proxy-To-Realm := <realm>, NAS-Identifier += <id> (i'm using radtest to check my configuration, perhaps it's the problem ?) Second question: How to configure the A server so that if B rejects the request, then A will check in a local user base (through pam) ? As I said, I'm just perhaps too bad, and did not understand how all this thing works, but please help me anyway :-) Thanks. -- Samuel Degrande LIFL - UMR8022 CNRS - INRIA Futurs - Bat M3 Phone: (33)3.28.77.85.30 USTL - Universite de Lille 1 Fax: (33)3.28.77.85.37 59655 VILLENEUVE D'ASCQ CEDEX - FRANCE [CA certs: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html ]

3 3

LDAP, FreeRadius, and Schema
by Matt Juszczak 02 Dec '05

02 Dec '05

Hi all, I was wondering what everyone uses for an account objectClass? Right now I'm using "Person", which makes the dn: cn=<user>,ou=Radius,dc=mydomain,dc=net However, indexing the cn would index the CN of other OU's as well ... . I'm just wondering what people use. I know "Account" could also be used. Regards, Matt

3 3

RE: Freeradius How to integrate Active Directory and return groupattribute to VPN Concentrator
by Alhagie Puye 02 Dec '05

02 Dec '05

Ok, So I played around some more with the settings. Actually "group" and "groupofnames" are not correct attributes for user. It is supposed to be "memberof". So I changed line in ldap.attrmap to look like: replyItem Class memberof Now I'm getting replyItems but the data looks like garbage. I want it to return the group name. Here is the output: * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 1 status: Connected last used: Wed Nov 30 15:43:08 2005 ** Outstanding Requests: * msgid 19, origid 16, status InProgress outstanding referrals 0, parent count 1 * msgid 17, origid 16, status Request Completed outstanding referrals 0, parent count 1 * msgid 16, origid 16, status Request Completed outstanding referrals 1, parent count 0 ** Response Queue: * msgid 16, type 100 ldap_chkResponseList for msgid=16, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 16, all 1 ldap_read: message type search-result msgid 19, original id 16 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 19 merged parent (id 16) error info: result errno 0, error <>, matched <> request 16 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 16, msgid 16) ldap_free_request (origid 16, msgid 19) ldap_free_request (origid 16, msgid 17) ldap_free_connection ldap_send_unbind ldap_free_connection: actually freed adding response id 16 type 101: ldap_parse_result ldap_get_dn ldap_get_values rlm_ldap: looking for check items in directory... ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values rlm_ldap: looking for reply items in directory... ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values rlm_ldap: Adding memberof as Class, value CN & op=11 rlm_ldap: Adding memberof as Class, value CN & op=11 rlm_ldap: Adding memberof as Class, value CN & op=11 rlm_ldap: Adding memberof as Class, value CN & op=11 ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values rlm_ldap: user apuye authorized to use remote access ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "apuye" with password "XXXXXXXXX" rlm_ldap: user DN: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave rlm_ldap: (re)connect to SERVER.corp.van.dwave:389, authentication 1 ldap_create rlm_ldap: bind as CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave/XXXXXXXXX to SERVER.corp.van.dwave:389 ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection ldap_int_open_connection ldap_connect_to_host: TCP SERVER.corp.van.dwave:389 ldap_new_socket: 7 ldap_prepare_socket: 7 ldap_connect_to_host: Trying w.x.y.z:389 ldap_connect_timeout: fd: 7 tm: 10 async: 0 ldap_ndelay_on: 7 ldap_is_sock_ready: 7 ldap_ndelay_off: 7 ldap_open_defconn: successful ldap_send_server_request rlm_ldap: waiting for bind result ... ldap_result msgid 1 ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL wait4msg (timeout 40 sec, 0 usec), msgid 1 wait4msg continue, msgid 1, all 1 ** Connections: * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 2 status: Connected last used: Wed Nov 30 15:43:08 2005 ** Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 1, all 1 ldap_read: message type bind msgid 1, original id 1 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 1 request 1 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_result ldap_msgfree rlm_ldap: Bind was successful rlm_ldap: user apuye authenticated succesfully ldap_free_connection ldap_send_unbind ldap_free_connection: actually freed modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 225 to 127.0.0.1:54101 Service-Type = Login-User Class = 0x434e Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 225 with timestamp 438e390c Nothing to do. Sleeping until we see a request. Hmm....I guess I would have to send both user and group information to get this working. I would like to authenticate the user but it is actually the group name that I need returned. Here is the LDIF format for the group: dn: CN=itops,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave changetype: add member: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van, DC=dwave cn: itops description: IT Operations Staff dSCorePropagationData: 20041203232658.0Z dSCorePropagationData: 20041203231653.0Z dSCorePropagationData: 20041203221337.0Z dSCorePropagationData: 20040820205210.0Z dSCorePropagationData: 16020125025705.0Z mail: all-itops(a)datawave.ca groupType: -2147483646 instanceType: 4 distinguishedName: CN=itops,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=corp,DC=van,DC=dwave objectClass: group objectGUID:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX== objectSid:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX== name: itops sAMAccountName: itops sAMAccountType: 268435456 uSNChanged: 5713274 uSNCreated: 1615 whenChanged: 20050902200841.0Z whenCreated: 20030119021132.0Z msSFU30GidNumber: 1001 msSFU30Name: itops msSFU30NisDomain: corp It is the "name" or "sAMAccountName" attribute that I want returned when a user is authenticated. Thanks, Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Alhagie Puye > >Sent: November 30, 2005 10:35 AM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active Directory > >and return groupattribute to VPN Concentrator > > > >Here is an ldap query output for a user: > > > > > >waggawagga raddb # ldapsearch -LLL -h w.x.y.z -x -b > >'dc=corp,dc=van,dc=dwave' '(&(memberof=CN=rptpcps,OU=DataWave > >Users,DC=corp,DC=van,DC=dwave)(samaccountname=apuye))' -D > >apuye(a)corp.van.dwave -w XXXXXXXX > > > > > >dn: CN=Alhagie Puye,OU=Information Technology,OU=DataWave > >Users,DC=corp,DC=van ,DC=dwave > >memberOf: CN=itops-folder,OU=SHARED FOLDERS,OU=DataWave > >Users,DC=corp,DC=van,D C=dwave > >memberOf: CN=rptpcps,OU=DataWave Users,DC=corp,DC=van,DC=dwave > >memberOf: CN=itops,OU=Information Technology,OU=DataWave > >Users,DC=corp,DC=van, DC=dwave > >memberOf: CN=datawave,OU=DataWave Users,DC=corp,DC=van,DC=dwave > >accountExpires: 9223372036854775807 > >badPasswordTime: 127778245108916810 > >badPwdCount: 0 > >codePage: 0 > >cn: Alhagie Puye > >countryCode: 0 > >description: IT Operations > >displayName: Alhagie Puye > >givenName: Alhagie > >homeDirectory: \\fs1\apuye > >homeDrive: H: > >instanceType: 4 > >lastLogoff: 0 > >lastLogon: 127778426282888816 > >logonCount: 196 > >msNPAllowDialin: TRUE > >distinguishedName: CN=Alhagie Puye,OU=Information > >Technology,OU=DataWave Users ,DC=corp,DC=van,DC=dwave > >objectCategory: > >CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=van,DC=dwave > >objectClass: top > >objectClass: person > >objectClass: organizationalPerson > >objectClass: user > >objectGUID:: oO1UkRu8RkScNIOHmaB/qw== > >objectSid:: AQUAAAAAAAUVAAAAzSmuLihcKk12fipaZwkAAA== > >primaryGroupID: 513 > >profilePath: \\fs2\profiles\apuye > >pwdLastSet: 127771529310887572 > >name: Alhagie Puye > >sAMAccountName: apuye > >sAMAccountType: 805306368 > >sn: Puye > >userAccountControl: 512 > >userParameters:: > >bTogICAgICAgICAgICAgICAgICAgIGQJICAgICAgICAgICAgICAgICAgICAgI > > > >CAgUBAaCAFDdHhDZmdQcmVzZW5045S15pSx5oiw44GiGAgBQ3R4Q2ZnRmxhZ3 > >Mx44Cw44Gm4 > >6Cy44 > > > >C5FggBQ3R4Q2FsbGJhY2vjgLDjgLDjgLDjgLASCAFDdHhTaGFkb3fjhLDjgLD > >jgLDjgLAoCA > >FDdHh > > > >NYXhDb25uZWN0aW9uVGltZeOAsOOAsOOAsOOAsC4IAUN0eE1heERpc2Nvbm5l > >Y3Rpb25UaW1 > >l44Cw > > > >44Cw44Cw44CwHAgBQ3R4TWF4SWRsZVRpbWXjgLDjgLDjgLDjgLAiCAFDdHhLZ > >Xlib2FyZExh > >eW91d > > > >OOAsOOAsOOAsOOAsCoCAUN0eE1pbkVuY3J5cHRpb25MZXZlbOOEsCACAUN0eF > >dvcmtEaXJlY > >3Rvcn > > > >njgLAgAgFDdHhOV0xvZ29uU2VydmVy44CwGAIBQ3R4V0ZIb21lRGly44CwIgI > >BQ3R4V0ZIb2 > >1lRGl > > > >yRHJpdmXjgLAgAgFDdHhXRlByb2ZpbGVQYXRo44CwIgIBQ3R4SW5pdGlhbFBy > >b2dyYW3jgLA > >iAgFD > > dHhDYWxsYmFja051bWJlcuOAsA== > >userPrincipalName: apuye(a)corp.van.dwave > >uSNChanged: 7588047 > >uSNCreated: 5713011 > >whenChanged: 20051122170851.0Z > >whenCreated: 20050902184213.0Z > > > ># refldap://corp.van.dwave/CN=Configuration,DC=corp,DC=van,DC=dwave > > > > > > > >I would like the group that the user is a member of to be > >sent back in the replyItem. I need this value for locking > >the user into groups on the Cisco VPN Concentrator. That's > >the only portion I'm missing. > > > >Here is an output of the debug when I authenticate the user: > > > >put_filter: "(cn=itops)" > >put_filter: simple > >put_simple_filter: "cn=itops" > >ldap_send_initial_request > >ldap_send_server_request > >ldap_result msgid 15 > >ldap_chkResponseList for msgid=15, all=1 > >ldap_chkResponseList returns NULL wait4msg (timeout 40 sec, > >0 usec), msgid 15 wait4msg continue, msgid 15, all 1 > >** Connections: > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 15, origid 15, status InProgress > > outstanding referrals 0, parent count 0 > >** Response Queue: > > Empty > >ldap_chkResponseList for msgid=15, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 15, all 1 > >ldap_read: message type search-entry msgid 15, original id 15 > >wait4msg: 39 secs to go > >wait4msg continue, msgid 15, all 1 > >** Connections: > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 15, origid 15, status InProgress > > outstanding referrals 0, parent count 0 > >** Response Queue: > > * msgid 15, type 100 > >ldap_chkResponseList for msgid=15, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 15, all 1 > >ldap_read: message type search-result msgid 15, original id > >15 new result: res_errno: 0, res_error: <>, res_matched: <> > >read1msg: 0 new referrals > >read1msg: mark request completed, id = 15 request 15 done > >res_errno: 0, res_error: <>, res_matched: <> > >ldap_free_request (origid 15, msgid 15) ldap_free_connection > >ldap_free_connection: refcnt 1 > >adding response id 15 type 101: > >ldap_parse_result > >ldap_msgfree > >ldap_msgfree > >rlm_ldap::ldap_groupcmp: User found in group itops > >rlm_ldap: ldap_release_conn: Release Id: 0 > > users: Matched entry DEFAULT at line 155 > > modcall[authorize]: module "files" returns ok for request 0 > >rlm_ldap: - authorize > >rlm_ldap: performing user authorization for apuye > >radius_xlat: '(&(sAMAccountName=apuye)(objectclass=user))' > >radius_xlat: 'DC=corp,DC=van,DC=dwave' > >rlm_ldap: ldap_get_conn: Checking Id: 0 > >rlm_ldap: ldap_get_conn: Got Id: 0 > >rlm_ldap: performing search in DC=corp,DC=van,DC=dwave, with filter > >(&(sAMAccountName=apuye)(objectclass=user)) > >ldap_search > >put_filter: "(&(sAMAccountName=apuye)(objectclass=user))" > >put_filter: AND > >put_filter_list "(sAMAccountName=apuye)(objectclass=user)" > >put_filter: "(sAMAccountName=apuye)" > >put_filter: simple > >put_simple_filter: "sAMAccountName=apuye" > >put_filter: "(objectclass=user)" > >put_filter: simple > >put_simple_filter: "objectclass=user" > >ldap_send_initial_request > >ldap_send_server_request > >ldap_result msgid 16 > >ldap_chkResponseList for msgid=16, all=1 > >ldap_chkResponseList returns NULL wait4msg (timeout 40 sec, > >0 usec), msgid 16 wait4msg continue, msgid 16, all 1 > >** Connections: > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 16, origid 16, status InProgress > > outstanding referrals 0, parent count 0 > >** Response Queue: > > Empty > >ldap_chkResponseList for msgid=16, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 16, all 1 > >ldap_read: message type search-entry msgid 16, original id 16 > >wait4msg: 39 secs to go > >wait4msg continue, msgid 16, all 1 > >** Connections: > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 16, origid 16, status InProgress > > outstanding referrals 0, parent count 0 > >** Response Queue: > > * msgid 16, type 100 > >ldap_chkResponseList for msgid=16, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 16, all 1 > >ldap_read: message type search-reference msgid 16, original > >id 16 ldap_chase_v3referrals > >ldap_url_parse_ext(ldap://corp.van.dwave/CN=Configuration,DC= > >corp,DC=van > >,DC=dwave) > >re_encode_request: new msgid 17, new dn > ><CN=Configuration,DC=corp,DC=van,DC=dwave> > >re_encode_request new request is: > >ber_dump: buf=0x0815ec00 ptr=0x0815ef76 end=0x0815fbdc len=886 > > 0000: 72 64 72 64 00 00 00 00 00 00 00 00 00 00 00 00 > >rdrd............ > > 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0370: 00 00 00 00 00 00 ...... > > > >ldap_chase_v3referral: msgid 16, url > >"ldap://corp.van.dwave/CN=Configuration,DC=corp,DC=van,DC=dwave" > >ldap_send_server_request > >ldap_new_connection > >ldap_int_open_connection > >ldap_connect_to_host: TCP corp.van.dwave:389 > >ldap_new_socket: 7 > >ldap_prepare_socket: 7 > >ldap_connect_to_host: Trying w.x.y.z:389 > >ldap_connect_timeout: fd: 7 tm: 10 async: 0 > >ldap_ndelay_on: 7 > >ldap_is_sock_ready: 7 > >ldap_ndelay_off: 7 > >anonymous rebind via ldap_bind_s > >ldap_bind_s > >ldap_simple_bind_s > >ldap_sasl_bind_s > >ldap_sasl_bind > >ldap_send_initial_request > >ldap_send_server_request > >ldap_result msgid 18 > >ldap_chkResponseList for msgid=18, all=1 > >ldap_chkResponseList returns NULL wait4msg (infinite > >timeout), msgid 18 wait4msg continue, msgid 18, all 1 > >** Connections: > >* host: corp.van.dwave port: 0 > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > rebind in progress > > queue is empty > > > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 18, origid 18, status InProgress > > outstanding referrals 0, parent count 0 > > * msgid 16, origid 16, status InProgress > > outstanding referrals 1, parent count 0 > >** Response Queue: > > * msgid 16, type 100 > >ldap_chkResponseList for msgid=18, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 18, all 1 > >ldap_read: message type search-result msgid 16, original id > >16 new result: res_errno: 0, res_error: <>, res_matched: <> > >read1msg: 0 new referrals > >read1msg: mark request completed, id = 16 ldap_free_connection > >ldap_free_connection: refcnt 1 > >wait4msg continue, msgid 18, all 1 > >** Connections: > >* host: corp.van.dwave port: 0 > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > rebind in progress > > queue is empty > > > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 1 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 18, origid 18, status InProgress > > outstanding referrals 0, parent count 0 > > * msgid 16, origid 16, status Request Completed > > outstanding referrals 1, parent count 0 > >** Response Queue: > > * msgid 16, type 100 > >ldap_chkResponseList for msgid=18, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 18, all 1 > >ldap_read: message type bind msgid 18, original id 18 new > >result: res_errno: 0, res_error: <>, res_matched: <> > >read1msg: 0 new referrals > >read1msg: mark request completed, id = 18 request 18 done > >res_errno: 0, res_error: <>, res_matched: <> > >ldap_free_request (origid 18, msgid 18) ldap_free_connection > >ldap_free_connection: refcnt 1 > >ldap_parse_result > >ldap_msgfree > >read1msg: 1 new referrals > >wait4msg: 39 secs to go > >wait4msg continue, msgid 16, all 1 > >** Connections: > >* host: corp.van.dwave port: 0 > > refcnt: 1 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 1 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 17, origid 16, status InProgress > > outstanding referrals 0, parent count 1 > > * msgid 16, origid 16, status Request Completed > > outstanding referrals 1, parent count 0 > >** Response Queue: > > * msgid 16, type 100 > >ldap_chkResponseList for msgid=16, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 16, all 1 > >ldap_read: message type search-reference msgid 17, original > >id 16 ldap_chase_v3referrals > >ldap_url_parse_ext(ldap://corp.van.dwave/CN=Schema,CN=Configu > >ration,DC=c > >orp,DC=van,DC=dwave) > >re_encode_request: new msgid 19, new dn > ><CN=Schema,CN=Configuration,DC=corp,DC=van,DC=dwave> > >re_encode_request new request is: > >ber_dump: buf=0x0815fbe0 ptr=0x0815ff60 end=0x08160bbc len=896 > > 0000: 72 64 72 64 00 00 00 00 00 00 00 00 00 00 00 00 > >rdrd............ > > 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > >ldap_chase_v3referral: msgid 17, url > >"ldap://corp.van.dwave/CN=Schema,CN=Configuration,DC=corp,DC= > >van,DC=dwav > >e" > >ldap_send_server_request > >read1msg: search ref chased, mark request chasing refs, id = 17 > >read1msg: 1 new referrals > >wait4msg: 39 secs to go > >wait4msg continue, msgid 16, all 1 > >** Connections: > >* host: corp.van.dwave port: 0 > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 1 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 19, origid 16, status InProgress > > outstanding referrals 0, parent count 1 > > * msgid 17, origid 16, status ChasingRefs > > outstanding referrals 0, parent count 1 > > * msgid 16, origid 16, status Request Completed > > outstanding referrals 2, parent count 0 > >** Response Queue: > > * msgid 16, type 100 > >ldap_chkResponseList for msgid=16, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 16, all 1 > >ldap_read: message type search-result msgid 17, original id > >16 new result: res_errno: 0, res_error: <>, res_matched: <> > >read1msg: 0 new referrals > >read1msg: mark request completed, id = 17 merged parent (id > >16) error info: result errno 0, error <>, matched <> > >ldap_free_connection > >ldap_free_connection: refcnt 1 > >wait4msg: 39 secs to go > >wait4msg continue, msgid 16, all 1 > >** Connections: > >* host: corp.van.dwave port: 0 > > refcnt: 1 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 1 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 19, origid 16, status InProgress > > outstanding referrals 0, parent count 1 > > * msgid 17, origid 16, status Request Completed > > outstanding referrals 0, parent count 1 > > * msgid 16, origid 16, status Request Completed > > outstanding referrals 1, parent count 0 > >** Response Queue: > > * msgid 16, type 100 > >ldap_chkResponseList for msgid=16, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 16, all 1 > >ldap_read: message type search-result msgid 19, original id > >16 new result: res_errno: 0, res_error: <>, res_matched: <> > >read1msg: 0 new referrals > >read1msg: mark request completed, id = 19 merged parent (id > >16) error info: result errno 0, error <>, matched <> request 16 done > >res_errno: 0, res_error: <>, res_matched: <> > >ldap_free_request (origid 16, msgid 16) ldap_free_request > >(origid 16, msgid 19) ldap_free_request (origid 16, msgid > >17) ldap_free_connection ldap_send_unbind > >ldap_free_connection: actually freed > >adding response id 16 type 101: > >ldap_parse_result > >ldap_get_dn > >ldap_get_values > >rlm_ldap: looking for check items in directory... > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >rlm_ldap: looking for reply items in directory... > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >rlm_ldap: user apuye authorized to use remote access ldap_msgfree > >rlm_ldap: ldap_release_conn: Release Id: 0 > > modcall[authorize]: module "ldap" returns ok for request 0 > >modcall: group authorize returns ok for request 0 > > rad_check_password: Found Auth-Type LDAP > >auth: type "LDAP" > > Processing the authenticate section of radiusd.conf > >modcall: entering group Auth-Type for request 0 > >rlm_ldap: - authenticate > >rlm_ldap: login attempt by "apuye" with password "XXXXXXXX2" > >rlm_ldap: user DN: CN=Alhagie Puye,OU=Information > >Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave > >rlm_ldap: (re)connect to SERVER.corp.van.dwave:389, > >authentication 1 ldap_create > >rlm_ldap: bind as CN=Alhagie Puye,OU=Information > >Technology,OU=DataWave > >Users,DC=corp,DC=van,DC=dwave/XXXXXXXX2 to > >SERVER.corp.van.dwave:389 ldap_bind ldap_simple_bind > >ldap_sasl_bind ldap_send_initial_request ldap_new_connection > >ldap_int_open_connection > >ldap_connect_to_host: TCP SERVER.corp.van.dwave:389 > >ldap_new_socket: 7 > >ldap_prepare_socket: 7 > >ldap_connect_to_host: Trying w.x.y.z:389 > >ldap_connect_timeout: fd: 7 tm: 10 async: 0 > >ldap_ndelay_on: 7 > >ldap_is_sock_ready: 7 > >ldap_ndelay_off: 7 > >ldap_open_defconn: successful > >ldap_send_server_request > >rlm_ldap: waiting for bind result ... > >ldap_result msgid 1 > >ldap_chkResponseList for msgid=1, all=1 > >ldap_chkResponseList returns NULL > >wait4msg (timeout 40 sec, 0 usec), msgid 1 wait4msg > >continue, msgid 1, all 1 > >** Connections: > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 1, origid 1, status InProgress > > outstanding referrals 0, parent count 0 > >** Response Queue: > > Empty > >ldap_chkResponseList for msgid=1, all=1 > >ldap_chkResponseList returns NULL > >ldap_int_select > >read1msg: msgid 1, all 1 > >ldap_read: message type bind msgid 1, original id 1 new > >result: res_errno: 0, res_error: <>, res_matched: <> > >read1msg: 0 new referrals > >read1msg: mark request completed, id = 1 request 1 done > >res_errno: 0, res_error: <>, res_matched: <> > >ldap_free_request (origid 1, msgid 1) ldap_free_connection > >ldap_free_connection: refcnt 1 > >ldap_parse_result > >ldap_msgfree > >rlm_ldap: Bind was successful > >rlm_ldap: user apuye authenticated succesfully > >ldap_free_connection ldap_send_unbind > >ldap_free_connection: actually freed > > modcall[authenticate]: module "ldap" returns ok for request 0 > >modcall: group Auth-Type returns ok for request 0 Sending > >Access-Accept of id 162 to 127.0.0.1:51232 > > Service-Type = Login-User > >Finished request 0 > >Going to the next request > >--- Walking the entire request list --- > >Waking up in 6 seconds... > >--- Walking the entire request list --- > >Cleaning up request 0 ID 162 with timestamp 438ded0e Nothing > >to do. Sleeping until we see a request. > > > > > >My radiusd.conf: > > > > filter = > >"(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(objec > >tclass=user > >))" > > groupname_attribute = "cn" > > groupmembership_filter = > >"(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass= > >top)(unique > >member=%{Ldap-UserDn}))" > > groupmembership_attribute = memberOf > > > > > > > > > >My ldap.attrmap: > > > > replyItem Class group > > > > > > > >My users file: > > > >DEFAULT Ldap-Group == "itops" > > Auth-Type := LDAP, > > Service-Type = Login, > > > > > > > > > >Thanks in advance > > > >Alhagie Puye - Network Engineer > >Datawave Group of Companies > >(604)295-1817 > > > >> >-----Original Message----- > >> >From: freeradius-users-bounces(a)lists.freeradius.org > >> >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of > >> >Dusty Doris > >> >Sent: November 30, 2005 7:16 AM > >> >To: FreeRadius users mailing list > >> >Subject: RE: Freeradius How to integrate Active Directory > >and return > >> >group attribute to VPN Concentrator > >> > > >> >> Radiusd.conf: > >> >> > >> >> filter = > >> >> > >> >"(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(membe > >> >rOf=CN=rp > >> >> tp cps,OU=Datawave Users,DC=corp,DC=van,DC=dwave))" > >> >> > >> >> This works fine. However I can't get it to return any > >> >replyItems. Has > >> >> anyone gotten this to work with Active Directory? All the > >> >docs I see > >> >> on the Net refeerence OpenLDAP. I'm sure there is a lot of > >> >folks out > >> >> there running Windows 2000/2003 Active Directory. > >> >> > >> >> I have spent a couple of days on this not having much > >> >luck. Here are a > >> >> few questions that would help me a bit. > >> >> > >> >> 1) Do I need groupname_attribute to get this to work? > >> >> > >> >> 2) What about groupmembership_filter and > >groupmembership_attribute? > >> >> > >> >> My ldap.attrmap looks like this: > >> >> > >> >> replyItem Class groupofnames > >> >> replyItem Class group > >> >> > >> >> I think the above is correct. Can some shed some light on this? > >> > > >> >Is group and groupofnames something that is an attribute > >of a user? > >> >When freeradius searches for reply items it is searching for > >> >attributes of that user. > >> > > >> >eg: > >> > > >> >dn: cn=someuser,... > >> >group: somegroup > >> > > >> >Should then add > >> > > >> >Class = somegroup > >> > > >> >to the reply items. > >> > > >> >If you want to make reply items attached to a group, > >rather than in > >> >individual, you will need to set the User-Profile attribute. > >> > > >> >For example, > >> > > >> >dn: cn=somegroup,ou=groups,... > >> >group: somegroup > >> > > >> >Then in the users file. > >> > > >> >DEFAULT Ldap-Group == somegroup, User-Profile := > >> >"cn=somegroup,ou=groups,..." > >> > > >> >You may be able to do this dynamically using xlat or > >something like > >> >huntgroups too. If you want an example, send us an > >example of a user > >> >and group from AD in ldif format and an example of a > >radius packet > >> >that you would expect in the reply and I'll see if I can > >come up with > >> >an idea for ya. > >> > > >> > > >> > > >> >- > >> >List info/subscribe/unsubscribe? See > >> >http://www.freeradius.org/list/users.html > >> > > > > > > >Disclaimer: This message (including any attachments) is > >confidential, may be privileged and is only intended for the > >person to whom it is addressed. If you have received it by > >mistake please notify the sender by return e-mail and delete > >this message from your system. Any unauthorized use or > >dissemination of this message in whole or in part is > >strictly prohibited. E-mail communications are inherently > >vulnerable to interception by unauthorized parties and are > >susceptible to change. We will use alternate communication > >means upon request. > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

2 1

RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]
by Bohannan, Chad W 02 Dec '05

02 Dec '05

We were able to move past this particular problem. For anyone who may have a similar issue.... Port 512 (tcp&udp for EZEC service) need to be allowed in addition to the standard 137-139, 445, & 389. So if you are running TCP wrappers or ip tables make certain it is allowed.... cheers -----Original Message----- From: Bohannan, Chad W Sent: Thursday, December 01, 2005 11:27 AM To: 'charles schwartz'; 'FreeRadius users mailing list' Subject: RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial] Hello, I am attempting to have FR authenticate administrative access for my Cisco gear against AD. The problem I am having is this. When I attempt to join the realm <<net ads join -U UID>> the command appears successful and from the AD side, the system has joined (visable in AD), however the proccess hangs on the FR side. If I stop the process and reissue the command, I get the following output and the process again hangs: [2005/12/01 11:08:36, 0] libads/ldap.c:ads_add_machine_acct(1405) ads_add_machine_acct: Host account for rws-radius01 already exists - modifying old account <<ntlm_auth --request-nt-key --domain=mydomain --username= \myuid>> NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) <<wbinfo -a UID%PASSWD>> plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user UID%PASSWD with plaintext password challenge/response password authentication failed error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO Could not authenticate user UID with challenge/response I am sure there is something simple I have overlooked, but I am unable to find it at this point. Any suggestions would be much appreciated. Chad -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of charles schwartz Sent: Tuesday, November 22, 2005 11:28 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial] Hi list, A lot of people on this list would like to integrate Active Directory with FreeRADIUS in order to provide a transparent user authentication login process. There are at least 2 ways to integrate AD: LDAP and NTLM. I've written a tutorial about how to do this with NTLM (winbind, ntlm_auth). The Windows supplicants are configured to work with PEAP and MSCHAPv2. You can download it from here: http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tutorial.pdf Good luck! Regards, Charles Schwartz - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Freeradius How to integrate Active Directory and return group attribute to VPN Concentrator
by Alhagie Puye 02 Dec '05

02 Dec '05

> >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Dusty Doris > >Sent: November 30, 2005 7:16 AM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active Directory > >and return group attribute to VPN Concentrator > > > >> Radiusd.conf: > >> > >> filter = > >> > >"(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(membe > >rOf=CN=rp > >> tp cps,OU=Datawave Users,DC=corp,DC=van,DC=dwave))" > >> > >> This works fine. However I can't get it to return any > >replyItems. Has > >> anyone gotten this to work with Active Directory? All the > >docs I see > >> on the Net refeerence OpenLDAP. I'm sure there is a lot of > >folks out > >> there running Windows 2000/2003 Active Directory. > >> > >> I have spent a couple of days on this not having much > >luck. Here are a > >> few questions that would help me a bit. > >> > >> 1) Do I need groupname_attribute to get this to work? > >> > >> 2) What about groupmembership_filter and groupmembership_attribute? > >> > >> My ldap.attrmap looks like this: > >> > >> replyItem Class groupofnames > >> replyItem Class group > >> > >> I think the above is correct. Can some shed some light on this? > > > >Is group and groupofnames something that is an attribute of > >a user? When freeradius searches for reply items it is > >searching for attributes of that user. > > > >eg: > > > >dn: cn=someuser,... > >group: somegroup > > > >Should then add > > > >Class = somegroup > > > >to the reply items. > > > >If you want to make reply items attached to a group, rather > >than in individual, you will need to set the User-Profile attribute. > > > >For example, > > > >dn: cn=somegroup,ou=groups,... > >group: somegroup > > > >Then in the users file. > > > >DEFAULT Ldap-Group == somegroup, User-Profile := > >"cn=somegroup,ou=groups,..." > > > >You may be able to do this dynamically using xlat or > >something like huntgroups too. If you want an example, send > >us an example of a user and group from AD in ldif format and > >an example of a radius packet that you would expect in the > >reply and I'll see if I can come up with an idea for ya. I'm still waiting for some help with this.....I have sent all the information that you requested. I have gotten it to return the group name but it is also returning the username as well and the username is returned after the group name. Is there is way to return just the groupname? I really would like to resolve this issue ones and for all. I'm really surprised that there are not folks on the list who have Active Directory users that they want to use to lock VPN users into groups on the VPN Concentrator. If really there isn't, I would put a howto on this when I get it working and post it on the list. Here is my latest output: rlm_ldap: performing search in CN=itops,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave, with filter (cn=itops) rlm_ldap::ldap_groupcmp: User found in group itops rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 163 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for apuye radius_xlat: '(&(sAMAccountName=apuye)(objectclass=user))' radius_xlat: 'DC=corp,DC=van,DC=dwave' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in DC=corp,DC=van,DC=dwave, with filter (&(sAMAccountName=apuye)(objectclass=user)) rlm_ldap: performing search in CN=itops,ou=Information Technology,ou=Datawave Users,dc=corp,dc=van,dc=dwave, with filter (objectclass=group) rlm_ldap: Adding samaccountname as Class, value itops & op=11 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding samaccountname as Class, value apuye & op=11 rlm_ldap: user apuye authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_ldap: - authenticate rlm_ldap: login attempt by "apuye" with password "XXXXXXXXXXX" rlm_ldap: user DN: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave rlm_ldap: (re)connect to huckster.corp.van.dwave:389, authentication 1 rlm_ldap: bind as CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave/XXXXXXXXXX to huckster.corp.van.dwave:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user apuye authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 1 modcall: group Auth-Type returns ok for request 1 Sending Access-Accept of id 4 to 10.99.1.50:1031 Class = 0x6170757965 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 4 with timestamp 438e98b2 Nothing to do. Sleeping until we see a request. Thanks, Alhagie. > > > > > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

RE: Freeradius How to integrate Active Directory[ADIntegrationWindowsXP NTLM Tutorial]
by Alhagie Puye 02 Dec '05

02 Dec '05

Thanks Dusty. That's very helpful. I have one little problem. I was hoping someone can shed some light on it. For the Active Directory security, I need to specify the username as "Domain\user" instead of just "user" for the identity in radiusd.conf "user(a)domain.com" doesn't seem to work. Here is the output: rad_recv: Access-Request packet from host 192.168.42.1:50667, id=146, length=57 User-Name = "user" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "apuye", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for apuye radius_xlat: '(uid=apuye)' radius_xlat: 'dc=ad,dc=puyenet,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to orion.puyenet.com:389, authentication 0 rlm_ldap: bind as cn=apuye(a)ad.puyenet.com,ou=users,dc=ad,dc=puyenet,dc=com/password to orion.puyenet.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 4 modcall: group authorize returns fail for request 4 Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 146 with timestamp 4388ab87 Nothing to do. Sleeping until we see a request. The radiusd.conf file looks like this for the ldap section: ldap { server = "orion.puyenet.com" # identity = "cn=admin,o=My Org,c=UA" identity = "cn=apuye(a)ad.puyenet.com,ou=users,dc=ad,dc=puyenet,dc=com" password = password #basedn = "o=My Org,c=UA" basedn = "dc=ad,dc=puyenet,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" Thanks in advance. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Dusty Doris > >Sent: November 25, 2005 9:43 AM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active > >Directory[ADIntegrationWindowsXP NTLM Tutorial] > > > > > >> So, the question again is if the VPN Concentrator is only sending > >> username and password, do I need ntml_auth or ms-chap? FreeRADIUS > >> doesn't have any usernames and password and will query Active > >> Directory for the actual authentication. > >> > >> Thanks, > >> > > > >If the packet is merely containing plaintext username and > >password, then you can probably just use rlm_ldap against AD > >and hit it directly. Just need to setup a user with read > >access to the directory to do the initial bind with and > >search of the user for authorization. Then the user will be > >authenticated by doing a bind against AD with the > >username/password in the packet. > > > >BTW - I use freeradius w/ ldap for cisco VPN concentrators > >as well, although its openldap instead of AD. To pass back > >the class attribute, you must modify ldap.attrmap and > >specify the reply item of Class to match what you call it in > >the directory. > > > >eg: > > > >replyItem Class radiusClass > > > >Then in the directory, you have > > > >dn: cn=someuser,... > >... > >radiusClass: "OU=myvpngroup;" > > > >So, for AD, you'll need to extend the schema and add an > >attribute for this. Or if you already have something that > >you can use, just modify ldap.attrmap to know what it is. > > > >-Dusty Doris > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

3 4

EAP/TLS Configuration - Addition
by Madhuraka Godahewa 02 Dec '05

02 Dec '05

Hi Again, This email refers to the earlier email sent with the subject "EAP/TLS Configuration". After having some trouble with the Windows XP and freeRADIUS, I was able to connect to the AP. But, in the configuration (Windows XP), I removed the check mark at 'Validate Server Certificate'. Then, suddenly, it started working. Anybody knows the reason for this? Further, after establishing the connection, I terminated the connection (by disabling the network connection). Then, I tried to connect again (by enabling). But, this time, the user machine connected to the AP automatically (without asking for the credentials.). It seems like something has cached these entries. Anybody knows how to clear this cache? Thanking You., -------------------------------------------------------------------------------- Madhuraka Godahewa Telecommunications Engineer Research and Development Unit Electroteks Global Networks (Pvt.) Ltd. Mobile: + 94-777-647055

2 1

RE: IPv6 Support
by Paulo Alexandre Caceres Ferreira 02 Dec '05

02 Dec '05

Hi again, How I can test IPv6 Freeradius authentication? You know any IPv6 RADIUS client to interact with Freeradius and perform an IPv6 authentication? In IPv4 I find many clients, but to IPv6, I don't found any clients yet. Please reply to me where I can get the client used to test CVS Freeradius IPv6 authentication, and others if they exist. Thanks in advance, Paulo Ferreira ./Caceres --------------------- > > Paulo Alexandre Caceres Ferreira <caceres(a)alumni.ipt.pt> wrote: > > Freeradius support authentication over IPv6? > > The CVS snapshot does. > > > If Freeradius doesn't support IPv6, and somebody know a RADIUS that > > support, please reply to me the name of that application. > > Some commercial servers. Not all, though. > > FreeRADIUS is the only open source server that I know of that > implements IPv6. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: PEAP without MAC is OK but with MAC...
by Rudi Verago [vlain] 02 Dec '05

02 Dec '05

Thanks!!! Calling-Station-ID was ok but in the email I put another MAC... The solution was the copy_request_to_tunnel...thanks again. Your email with "the solution of the problem" was the faster I had never received in every mailing list. Bye, Rudi -> > My problem is using MAC address also, simply adding the parameter Calling-Station-Id doesn't work: -> > -> > "rudi" User-Password == "xxxxx" Calling-Station-Id == "00-e3-44-5E-1A-B2" -> ... -> -> > rad_recv: Access-Request packet from host 192.168.0.100:1143, id=0, length=190 -> ... -> > Calling-Station-Id = "00-12-F0-1E-2A-B2" -> -> Try cutting & pasting the Calling-Station-Id from the debug log into -> the "users" file. -> -> You may also want to set "copy_request_to_tunnel" in the peap{} -> section of eap.conf. -> -> Alan DeKok.

1 0

PEAP without MAC is OK but with MAC...
by Rudi Verago [vlain] 02 Dec '05

02 Dec '05

I use the last version of freeradius on a Ubuntu box, my supplicant is a XP machine. I set PEAP and all works ok, this is the simple configuration for the file user "rudi" User-Password == "xxxxx" All is perfect also with MySQL...so FreeRADIUS is great ;-) My problem is using MAC address also, simply adding the parameter Calling-Station-Id doesn't work: "rudi" User-Password == "xxxxx" Calling-Station-Id == "00-e3-44-5E-1A-B2" I try to use different format for MAC, local auth, peap auth, proxy and others solution find on mailing list...but nothing. Any help? The log for radius -X -A is below. Thanks in advance and good work, Rudi --------------------------------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.100:1143, id=0, length=190 Message-Authenticator = 0xd87583bdf395a663b9a67308180dc61d Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020000090172756469 NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 0 to 192.168.0.100:1143 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xde8d05c0e49d7edba8d0d222cab8b3ce Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=1, length=279 Message-Authenticator = 0x4316604de774b7306d299d3e55b8198c Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0xde8d05c0e49d7edba8d0d222cab8b3ce Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201005019800000004616030100410100003d0301438f8fd1de0dba3cf40cc34ab346ddb01173c54cab6ee58d0898091f77a565b800001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0552], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 1 to 192.168.0.100:1143 EAP-Message = 0x0102040a19c0000005af160301004a020000460301438f8fd8a520523b675257784d58c8386b3f37558a11ccddba4adc9cf3fb15f220abbd731ea80d7bbc7c2d651b30f151787172727002e269018589ecf389398c6700040016030105520b00054e00054b00024f3082024b308201b4a003020102020900f38118d0ad652d8a300d06092a864886f70d0101050500305a310b3009060355040613024974310b3009060355040813025044310f300d060355040a1306496d74656368310d300b06035504031304726f6f74311e301c06092a864886f70d010901160f766c61696e406c696265726f2e6974301e170d3035313132333032333130335a17 EAP-Message = 0x0d3036313132333032333130335a305c310b3009060355040613024974310b3009060355040813025044310f300d060355040a1306496d74656368310f300d06035504031306736572766572311e301c06092a864886f70d010901160f766c61696e406c696265726f2e697430819f300d06092a864886f70d010101050003818d0030818902818100b4ba5fcde942ead9afe5d72ee7cd1c7728afcbc35c6f13402d388f27cfaf91f2e0fb9f646f19f06ad1264163663bb4f01be56b5a77943d6c7da7ea0615efdd0f73ea2fe48a73c2a0ec94d7b4e80ffaf9045d6dbdd6a7598b7bc04ea578462ea5c37fb861551b507409c923f7281a952b00529438 EAP-Message = 0xf8d0d95afe4110d4d414587d0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100179b16a6218fc7c7ed5abf765de15bf2e41628d55ead746bc079aa4df49bf6e23c5f3bd57961b2f9995a286fba7baa5f8bf4e32da7b0aeac722854cea5d7df39f856732dd03228429c2e787801464875385c165aec6dc5f421a70fd2b252cd44c8c9aacd61e26617cd074fcc5c958736c33f46f32b8e56b31cc99caa98bef5890002f6308202f23082025ba003020102020900f38118d0ad652d88300d06092a864886f70d0101050500305a310b3009060355040613024974310b3009060355 EAP-Message = 0x040813025044310f300d060355040a1306496d74656368310d300b06035504031304726f6f74311e301c06092a864886f70d010901160f766c61696e406c696265726f2e6974301e170d3035313132333032333032315a170d3037313132333032333032315a305a310b3009060355040613024974310b3009060355040813025044310f300d060355040a1306496d74656368310d300b06035504031304726f6f74311e301c06092a864886f70d010901160f766c61696e406c696265726f2e697430819f300d06092a864886f70d010101050003818d0030818902818100aee79505f48a78028de7b7b3c58fa3fce84149432fa0a1ef14752b333bb8 EAP-Message = 0xd110ee0a186915f8dbb3240a087ea9153b99e468d03c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x179071aba06de19a0958315876b949ee Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=2, length=205 Message-Authenticator = 0x97859340fec8fb806913d8ef90c5c65b Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0x179071aba06de19a0958315876b949ee Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 2 to 192.168.0.100:1143 EAP-Message = 0x010301b5190048f2e9958c1dad57415c322d99da976059b925190118a0b6968263f0bbbce197d6c4ed0c3db0f06b8e41105244cacc9a2d97c4c18b56c25ae663ede1413c088ce4807286a633a742b10c61df0203010001a381bf3081bc301d0603551d0e0416041432ecae8aaa28e7e5d6f8e17669a549b893caef1430818c0603551d23048184308181801432ecae8aaa28e7e5d6f8e17669a549b893caef14a15ea45c305a310b3009060355040613024974310b3009060355040813025044310f300d060355040a1306496d74656368310d300b06035504031304726f6f74311e301c06092a864886f70d010901160f766c61696e406c696265726f EAP-Message = 0x2e6974820900f38118d0ad652d88300c0603551d13040530030101ff300d06092a864886f70d0101050500038181005f4867dea3b5fa4239419bcb875e2af572a77e7bf7c084480d919752ed530384a89daf7ff2223ed43636a5fb9f132d6d7f74b62b88c9c6331b11cf64a4cdf74200475b7677546a1c388d21d8831bb5ae50d96506fa326a6cfa22da33bd70e75ce33efa69d3c05497f18a998d297629244164eb1412f4e13ddff445c6f1b166dd16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4a893a6285080cf5575b7da11c1ab084 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=3, length=391 Message-Authenticator = 0x451d99411934d423a8b9b9d5f5244b5e Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0x4a893a6285080cf5575b7da11c1ab084 Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300c01980000000b616030100861000008200807ee4cd8473260bc1e113ec94e036d308a018581ace9795d81b9c16c8e1f3d56bc411ad05509b6b0dee0996f994accd45132446533cd22cb83106837ec4bdd53010bd160a410bf55199f544af71fad9b3a269182e26095efe8f433e3ea5a257579969df4ee971e0555e46f1bcf2b886e7466fb4aa8b9c36f66682263a0ccf3c3e14030100010116030100200832777727f3a5290e93af5fd22fa8f29ef53c463cdad803837907668f2fc883 NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 3 to 192.168.0.100:1143 EAP-Message = 0x01040031190014030100010116030100200bb4a68cfcc4968939302a56e07f615e81fef7b372e451d7ebf1d3b4af23f914 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x848271c657c7b72869965b8b9b1aa0e7 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=4, length=205 Message-Authenticator = 0x8cbf322de5f1827b6de13925a6f80899 Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0x848271c657c7b72869965b8b9b1aa0e7 Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400061900 NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 4 to 192.168.0.100:1143 EAP-Message = 0x0105002019001703010015467fe443ab3108e93e16dd343d25757bd383eb3793 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdeb9a28614e38559a0a146be34580acb Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=5, length=231 Message-Authenticator = 0x9010bc7a6769502afaebdfb5ea20c098 Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0xdeb9a28614e38559a0a146be34580acb Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02050020190017030100150a5b8130f55f9062962001b28d574a36da2da50864 NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 32 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - rudi rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020500090172756469 PEAP: Got tunneled identity of rudi PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to rudi PEAP: Sending tunneled request EAP-Message = 0x020500090172756469 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "rudi" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 163 modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x0106001e1a0106001910d536b9291afdf00621dcfc6a51bc86dc72756469 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x32911aa2856cc4631f2b54871272d85f PEAP: Processing from tunneled session code 0x8123b48 11 EAP-Message = 0x0106001e1a0106001910d536b9291afdf00621dcfc6a51bc86dc72756469 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x32911aa2856cc4631f2b54871272d85f PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 5 to 192.168.0.100:1143 EAP-Message = 0x010600351900170301002a269c325eb8730d5264be98ca62699f87ca0e4005766d0e6a68c1fde618bb76bbe0ac67b24f9e4bfb03ba Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc079ddee6f5011d526cd9f176e7bcdfa Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=6, length=285 Message-Authenticator = 0x44d126e6c63d26d44e8162bb569ee110 Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0xc079ddee6f5011d526cd9f176e7bcdfa Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020600561900170301004b717cf225414fc50e7f65402ad3d01a726987fe92004513ac270be6036677a7cb61f0df0fdd733dc620fae4661cae926dde7f3d4ed3cc1f1ca424bd0d78322763289c982838443c13a11d1a NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 86 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0206003f1a0206003a317856a82853fc381ff5633d33ce7bb6bd0000000000000000649941400aec4c84b5738f58640b70957cdfa61712c1052d0072756469 PEAP: Setting User-Name to rudi PEAP: Adding old state with 32 91 PEAP: Sending tunneled request EAP-Message = 0x0206003f1a0206003a317856a82853fc381ff5633d33ce7bb6bd0000000000000000649941400aec4c84b5738f58640b70957cdfa61712c1052d0072756469 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "rudi" State = 0x32911aa2856cc4631f2b54871272d85f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 163 modcall[authorize]: module "files" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for rudi with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: group Auth-Type returns reject for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: group authenticate returns reject for request 6 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x8123020 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 6 to 192.168.0.100:1143 EAP-Message = 0x010700261900170301001ba019fb828bb271211545e1863a0054813d58ee90ffb3a68fdfd93e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf4c68d8303984625b6d877b06f4a70d0 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=7, length=237 Message-Authenticator = 0x84092205643db6f1a95bf152ed6aa7fe Service-Type = Framed-User User-Name = "rudi" Framed-MTU = 1488 State = 0xf4c68d8303984625b6d877b06f4a70d0 Called-Station-Id = "00-11-95-E6-77-87:IMTECH" Calling-Station-Id = "00-12-F0-1E-2A-B2" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020700261900170301001bd235f4d049b5a4d047f7a3e9d766112db6141b4b5d0239ac82239d NAS-IP-Address = 192.168.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "rudi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry rudi at line 101 modcall[authorize]: module "files" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: group authenticate returns invalid for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.100:1143, id=7, length=237 Sending Access-Reject of id 7 to 192.168.0.100:1143 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 438f8fd8 Cleaning up request 1 ID 1 with timestamp 438f8fd8 Cleaning up request 2 ID 2 with timestamp 438f8fd8 Cleaning up request 3 ID 3 with timestamp 438f8fd8 Cleaning up request 4 ID 4 with timestamp 438f8fd8 Cleaning up request 5 ID 5 with timestamp 438f8fd8 Cleaning up request 6 ID 6 with timestamp 438f8fd8 Cleaning up request 7 ID 7 with timestamp 438f8fd8 Nothing to do. Sleeping until we see a request. -----------------------------------------------------------------

2 1