- Freeradius-Users - lists.freeradius.org

RE: Value of Calling-station-id on ethernet
by Guy Davies 11 Oct '05

11 Oct '05

If you're doing 802.1x authentication, then it will be the MAC. The supplicant may not even have an IP address when it communicates with the NAS (the ethernet switch) if it is configured for DHCP. If you're logging into the CLI of a device configured to authenticate using RADIUS, then I would not necessarily expect there to be a Calling-Station-Id. If there were, I'd expect it to be the IP address, since the communication between the remote client and the network device is all via IP. I can't think of any other reason for an Ethernet switch to make a RADIUS request. Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jonathan De Graeve Sent: 11 October 2005 20:04 To: FreeRadius users mailing list Subject: Value of Calling-station-id on ethernet Is this value the mac or the ip address on Ethernet networks. I need to know since I'm programming a radiusclient. J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

authenticate problem XP eap/tls
by Thuis Algemeen 11 Oct '05

11 Oct '05

Hallo everybody, I have a problem with authenticating my laptop with XP to the freeradius server running on Fedora. Seems that the authenticating proces is in an endless loop. The hotfix KB885453 for XP SP2 wireless authentication failure not resolved the problem. Here the log from freeradius, the onl error I can see is : "TLS_accept:error in SSLv3 read client certificate A". Can anyone please teel me what is hoing wrong? With regards, Jurgen $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/var/ssl/fedora.pem" tls: certificate_file = "/var/ssl/fedora.pem" tls: CA_file = "/var/ssl/root.pem" tls: private_key_password = "defcon1" tls: dh_file = "/var/ssl/dh" tls: random_file = "/var/ssl/random-data.bin" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.11.1:2048, id=0, length=141 User-Name = "Jurgen Tessers" NAS-IP-Address = 192.168.11.1 Called-Station-Id = "001217374d34" Calling-Station-Id = "00904bfa38fd" NAS-Identifier = "001217374d34" NAS-Port = 63 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000013014a757267656e2054657373657273 Message-Authenticator = 0x42efd7eecba0f25f6b411ac57d7ea548 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "Jurgen Tessers", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 19 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry Jurgen Tessers at line 98 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 0 to 192.168.11.1:2048 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x758c6f33ed1109d20b05b81c96e35e69 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.11.1:2048, id=0, length=220 User-Name = "Jurgen Tessers" NAS-IP-Address = 192.168.11.1 Called-Station-Id = "001217374d34" Calling-Station-Id = "00904bfa38fd" NAS-Identifier = "001217374d34" NAS-Port = 63 Framed-MTU = 1400 State = 0x758c6f33ed1109d20b05b81c96e35e69 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100500d800000004616030100410100003d03014348fba69c26178521b8234e0344fe364cd297c8175c9b9fc78b1e1b493124bd00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xe525ae2f6a17af6807c4cba4672d8cfe Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '@' in User-Name = "Jurgen Tessers", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry Jurgen Tessers at line 98 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 02ed], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00b6], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 0 to 192.168.11.1:2048 EAP-Message = 0x010204060d80000003fc160301004a0200004603014348fbcebd072024a76a70a8c08fb949728a21e9713d44fbbc38a6f1348783c5206b79ec137c31849951ea86a02e347cfff2bd39195ed056e4d8ec15a87656c23c00040016030102ed0b0002e90002e60002e3308202df30820248a003020102020900fc8e09110b5a3eca300d06092a864886f70d01010405003081a4310b3009060355040613024e4c311630140603550408130d4e6f6f72642042726162616e74311230100603550407130945696e64686f76656e310c300a060355040a13034c414231183016060355040b130f4c414220646576656c6f706d656e7431183016060355040313 EAP-Message = 0x0f4c414220576972656c6573732043413127302506092a864886f70d010901161874687569732d616c67656d65656e406368656c6c6f2e6e6c301e170d3035313030363231323734355a170d3036313030363231323734355a3081a4310b3009060355040613024e4c311630140603550408130d4e6f6f72642042726162616e74311230100603550407130945696e64686f76656e310c300a060355040a13034c414231183016060355040b130f4c414220646576656c6f706d656e74311830160603550403130f4c414220576972656c6573732043413127302506092a864886f70d010901161874687569732d616c67656d65656e406368656c6c6f EAP-Message = 0x2e6e6c30819f300d06092a864886f70d010101050003818d0030818902818100dafaddb5bba8f2e1f54d2bf108425809657fa562555efcacf79362cb331b3e4f7030b88616bfa844a5f080e4ad8d2aac9a10ce9958b1dd4ada4a072739835228adc33bd0bd9fde3f17dd1356d101a26483440459b6f534cc0c622fb4687b34f16498cdeb85fdb939ec8796e633559dc6c99ee31d77cbed8f3bf9aae3453a37b30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000381810025b480d3991d0e431bc87c4647c2a5ad35fbd813fd445c9280bbd24c75531393326e5640edd78bc99f0f8ecc EAP-Message = 0x9bc9bb1c110d1a31aab8891ad1e1c030d114edfb73dfbe273a2e6eb216058ac53068970c8b9327a84f8d94c3dc0c3ee8a19ae8e24f87a962d6d88f72e4ff55880ef3d77aee2961499ae85d4bea5bec7c8e26c7f916030100b60d0000ae02010200a900a73081a4310b3009060355040613024e4c311630140603550408130d4e6f6f72642042726162616e74311230100603550407130945696e64686f76656e310c300a060355040a13034c414231183016060355040b130f4c414220646576656c6f706d656e74311830160603550403130f4c414220576972656c6573732043413127302506092a864886f70d010901161874687569732d616c6765 EAP-Message = 0x6d65656e406368656c6c6f2e6e6c0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc726a400fa2291a52450d13323be42d4 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.11.1:2048, id=0, length=146 User-Name = "Jurgen Tessers" NAS-IP-Address = 192.168.11.1 Called-Station-Id = "001217374d34" Calling-Station-Id = "00904bfa38fd" NAS-Identifier = "001217374d34" NAS-Port = 63 Framed-MTU = 1400 State = 0xc726a400fa2291a52450d13323be42d4 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060d00 Message-Authenticator = 0x054ce4d4cd628812e4711d357c4fddc7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_realm: No '@' in User-Name = "Jurgen Tessers", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry Jurgen Tessers at line 98 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 0 to 192.168.11.1:2048 EAP-Message = 0x0103000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01a742a626d26fb7df45c5d4fc5ecdd1 Finished request 2 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 0 with timestamp 4348fbce Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.11.1:2048, id=0, length=141 User-Name = "Jurgen Tessers" NAS-IP-Address = 192.168.11.1 Called-Station-Id = "001217374d34" Calling-Station-Id = "00904bfa38fd" NAS-Identifier = "001217374d34" NAS-Port = 63 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02010013014a757267656e2054657373657273 Message-Authenticator = 0x2d3a178165a103c97790a2265f4d9d94 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 rlm_realm: No '@' in User-Name = "Jurgen Tessers", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 1 length 19 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry Jurgen Tessers at line 98 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 0 to 192.168.11.1:2048 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xeae76b6fc48204bc626dc0cf8ee55037 Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.11.1:2048, id=0, length=220 User-Name = "Jurgen Tessers" NAS-IP-Address = 192.168.11.1 Called-Station-Id = "001217374d34" Calling-Station-Id = "00904bfa38fd" NAS-Identifier = "001217374d34" NAS-Port = 63 Framed-MTU = 1400 State = 0xeae76b6fc48204bc626dc0cf8ee55037 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200500d800000004616030100410100003d03014348fbc478dfe6e9659dc502bd26acfcd57a22745369041bda99d550e1a50e0100001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xcf01888715ab7f343baf3bc2ff254d6d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 rlm_realm: No '@' in User-Name = "Jurgen Tessers", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry Jurgen Tessers at line 98 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 02ed], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00b6], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 0 to 192.168.11.1:2048 EAP-Message = 0x010304060d80000003fc160301004a0200004603014348fbec928c83e4952e56e503ad2e15c9be0fcfdb780f10197f7b4133ccf53520f0cf5a151df753d8674aa13d8ee4fada2e9236069d7798a8d87c2c94fc1eade600040016030102ed0b0002e90002e60002e3308202df30820248a003020102020900fc8e09110b5a3eca300d06092a864886f70d01010405003081a4310b3009060355040613024e4c311630140603550408130d4e6f6f72642042726162616e74311230100603550407130945696e64686f76656e310c300a060355040a13034c414231183016060355040b130f4c414220646576656c6f706d656e7431183016060355040313 EAP-Message = 0x0f4c414220576972656c6573732043413127302506092a864886f70d010901161874687569732d616c67656d65656e406368656c6c6f2e6e6c301e170d3035313030363231323734355a170d3036313030363231323734355a3081a4310b3009060355040613024e4c311630140603550408130d4e6f6f72642042726162616e74311230100603550407130945696e64686f76656e310c300a060355040a13034c414231183016060355040b130f4c414220646576656c6f706d656e74311830160603550403130f4c414220576972656c6573732043413127302506092a864886f70d010901161874687569732d616c67656d65656e406368656c6c6f EAP-Message = 0x2e6e6c30819f300d06092a864886f70d010101050003818d0030818902818100dafaddb5bba8f2e1f54d2bf108425809657fa562555efcacf79362cb331b3e4f7030b88616bfa844a5f080e4ad8d2aac9a10ce9958b1dd4ada4a072739835228adc33bd0bd9fde3f17dd1356d101a26483440459b6f534cc0c622fb4687b34f16498cdeb85fdb939ec8796e633559dc6c99ee31d77cbed8f3bf9aae3453a37b30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000381810025b480d3991d0e431bc87c4647c2a5ad35fbd813fd445c9280bbd24c75531393326e5640edd78bc99f0f8ecc EAP-Message = 0x9bc9bb1c110d1a31aab8891ad1e1c030d114edfb73dfbe273a2e6eb216058ac53068970c8b9327a84f8d94c3dc0c3ee8a19ae8e24f87a962d6d88f72e4ff55880ef3d77aee2961499ae85d4bea5bec7c8e26c7f916030100b60d0000ae02010200a900a73081a4310b3009060355040613024e4c311630140603550408130d4e6f6f72642042726162616e74311230100603550407130945696e64686f76656e310c300a060355040a13034c414231183016060355040b130f4c414220646576656c6f706d656e74311830160603550403130f4c414220576972656c6573732043413127302506092a864886f70d010901161874687569732d616c6765 EAP-Message = 0x6d65656e406368656c6c6f2e6e6c0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf682d06956d504942902019d3bd263c0 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.11.1:2048, id=0, length=146 User-Name = "Jurgen Tessers" NAS-IP-Address = 192.168.11.1 Called-Station-Id = "001217374d34" Calling-Station-Id = "00904bfa38fd" NAS-Identifier = "001217374d34" NAS-Port = 63 Framed-MTU = 1400 State = 0xf682d06956d504942902019d3bd263c0 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060d00 Message-Authenticator = 0x70679a8fd948dfe126165b99f9dd1b18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 rlm_realm: No '@' in User-Name = "Jurgen Tessers", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry Jurgen Tessers at line 98 modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 0 to 192.168.11.1:2048 EAP-Message = 0x0104000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2bfb625aa5787818e9adeb602d7eedf8 Finished request 5 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 0 with timestamp 4348fbec Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.11.1:2048, id=0, length=141 User-Name = "Jurgen Tessers" NAS-IP-Address = 192.168.11.1 Called-Station-Id = "001217374d34" Calling-Station-Id = "00904bfa38fd" NAS-Identifier = "001217374d34" NAS-Port = 63 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02010013014a757267656e2054657373657273 Message-Authenticator = 0x73f093669adbb4d2de364948a9ba07c5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 rlm_realm: No '@' in User-Name = "Jurgen Tessers", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 1 length 19 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry Jurgen Tessers at line 98 modcall[authorize]: module "files" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 0 to 192.168.11.1:2048 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x97c1db6e5349aa2f0ea68769670a22db Finished request 6 Going to the next request etc, etc $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$4

3 4

freeradius - Called-Station-Id, reporting
by Madhvi Gokool 11 Oct '05

11 Oct '05

> > Hello > We are currently using freeradius to authenticate dialup users. We are > investigating several wasy of improving the service offered to the dialup > users and have encountered several issues: - > > 1. The Called-Station-Id is a 4-digit number in the detail log file. > While testing authentication based on the Called Telephone number, the > Called-Station-Id had to be specified as "1300" instead of "2131300" in > the users file . > If we have two PRI lines , say 3120101 and 2130101, the Called-Station-Id > will be seen as "0101" in both cases. So we'll not be able to > differentiate between the two numbers. Is there a way to configure > freeradius or Cisco5350 RAS to use a 7-digit number as Called-Station-Id. > The Calling -Station-Id however is a 7-digit number. > 2. I have also tested the Login-Time, Max-Daily-Session and > Max-Monthly-Session attributes. If the user is dialing outside the > timeframe set in the users file or has exceeded his daily/monthly quota, > he will not get connected. Excerpt of radius log file below : - > Thu Oct 6 15:26:18 2005 : Auth: Invalid user (rlm_counter: Maximum daily > usage > time reached): [steve/<CHAP-Password>] (from client as port 255 cli > 2117039) > As administrator we'll know why the user got disconnected . > For the user side now, how can we inform the user that > i) he has exceeded his quota and that he should replenish his account. or > ii) he's dialing outside the timeframe he paid for. > iii) he's got xxx seconds of connection time left > Are there any scripts that will interact with freeradius and send these > users an email or sms? > > 3. Does dialup admin work with plain text users file ? > Thanx in advance for your help. > Regds > Madhvi >

2 1

Making user logins expire after a certain time
by Maqbool Hashim 11 Oct '05

11 Oct '05

Hi, Is it possible to tell radius to expire logins after a time period?

2 2

Making user logins expire after a certain time
by Maqbool Hashim 11 Oct '05

11 Oct '05

Hi, Is it possible to tell radius to expire logins after a time period?

1 0

Removing attributes from a reply
by Joe Maimon 11 Oct '05

11 Oct '05

I need to remove an A/V from the reply list, but only if another A/V is already there. For example: If I have the Framed-IP-Address attribute, I need to remove any attribute of Cisco-AVPair -~ "ip:addr-pool.*" (because my NAS's will choke on that and that means I have no way for a fall back pool to be defined by radius for my proxy users who may/are assigned IP addresses by my customer) This needs to be done post-proxy stage for my needs. I have been assuming I would need the new CVS head policy feature for this. Anything I am missing? Joe

3 4

RE: cannot return access accept from proxy to client
by Wilson Lie 10 Oct '05

10 Oct '05

Hi Alan, for Q2, doc/Post-Auth-type don't have information to support branching by realm ? -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Tuesday, October 04, 2005 8:23 AM To: FreeRadius users mailing list Subject: Re: cannot return access accept from proxy to client "Wilson Lie" <wilson.lie(a)ithlgroup.com> wrote: > Q1. Any method such that host B won't goes into [post-auth] when it is receiving result from another server ? I'm not sure what you mean here. Perhaps you could try using complete sentences. I *think* the answer is "source code edits". > Q2. In case host B cannot bypass [post-auth] when receiving result from another server, how can I define multiple > sql section in [post-auth] ? As I cannot find any rule that I can set in [post-auth] such that it can go to [sql1] > for realm A and [sql2] for realm B doc/Post-Auth-Type. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________ (c) 2005 Interactive Technology Holdings Limited Group. All rights reserved. CONFIDENTIALITY: This communication and any attachment(s) is intended solely for the person or organisation to which it is addressed and it may be confidential. This communication may contain confidential or legally privileged material and may not be copied, redistributed or published (in whole or in part) without our prior written consent. This communication may have been intercepted, partially destroyed, arrive late, incomplete or contain viruses and no liability is accepted by any member of the Interactive Technology Holdings Limited Group as a result. If you are not the intended recipient, employee or agent responsible for delivering the message to the intended recipient you must not copy, disclose, distribute or take any action in reliance on it. If you have received this communication in error, please immediately reply and highlight the error to the sender immediately and destroy the original from your computer.

2 1

802.1x client question
by Adam KOSA 10 Oct '05

10 Oct '05

Hi All, this question may be off-topic, but the windows list i was asking could not help. i set up a 802.1x wired authentication in an ethernet network, with all of the following: eap-tls, eap-md5, eap-peap, with freeradius. everything is working great except one thing: 2k and xp is not able to cache the authentication info. with the certificate, the most i could achieve that when logging on, the auth is automatic. but no network until i log on. this is not a radius problem, since the radius and the authentication process is working great. the reason i'm writing is maybe some of you have solved this problem and could help me please. how am i supposed to configure the client to remember the password? I'm open to any solution, even to forget eap-* and use something less secure. thanks Adam

4 3

RE: 802.1x client question
by Jonathan De Graeve 10 Oct '05

10 Oct '05

I'm using securew2 for that... J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Adam KOSA Verzonden: maandag 10 oktober 2005 22:09 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: 802.1x client question Hi All, this question may be off-topic, but the windows list i was asking could not help. i set up a 802.1x wired authentication in an ethernet network, with all of the following: eap-tls, eap-md5, eap-peap, with freeradius. everything is working great except one thing: 2k and xp is not able to cache the authentication info. with the certificate, the most i could achieve that when logging on, the auth is automatic. but no network until i log on. this is not a radius problem, since the radius and the authentication process is working great. the reason i'm writing is maybe some of you have solved this problem and could help me please. how am i supposed to configure the client to remember the password? I'm open to any solution, even to forget eap-* and use something less secure. thanks Adam - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Proxy when module_accounting rejects the request
by Nicolas Baradakis 10 Oct '05

10 Oct '05

I noticed that accounting requests are proxied anyway even if a module of the accounting section rejected the request. I don't know whether this is the expected behaviour or not. In other words: is this a bug or feature ? :-) Perhaps there are reasons to always proxy an accounting request, but I'm thinking the action might be: Return value Proxy Drop -------------------------------------- RLM_MODULE_REJECT X RLM_MODULE_FAIL X RLM_MODULE_OK X RLM_MODULE_HANDLED X RLM_MODULE_INVALID X RLM_MODULE_USERLOCK X RLM_MODULE_NOTFOUND X RLM_MODULE_NOOP X RLM_MODULE_UPDATED X -- Nicolas Baradakis

2 4