- Freeradius-Users - lists.freeradius.org

pppoe+radius
by Wassim abbas 11 Sep '05

11 Sep '05

Hello I want to use freeradius with pppoe-server both runing on the same machine but i cant get radius working i loaded the radius.so in the pppoe-option file but it says raidus is not responding and timed out so please if any one have done it before and can send me the config file, im using the user files without mysql thanks -- Slackware Inside

2 1

RE: mysql connections - segmentation fault
by Jonathan De Graeve 11 Sep '05

11 Sep '05

Have freeradius running on Debian 3.0 and Debian 3.1 without any problems. J. -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas M. Verzonden: zondag 11 september 2005 10:54 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: mysql connections - segmentation fault Hello, i´ve installed FR 1.0.4, now when i start the server, during the connection to a mysql database, after the first one there is a segmentation fault. It is working with just one connection , but i can´t find the reason for this. Maybe it has already been reported, i found similar in the internet, but no solution. I´m running FR on a Debian 3.01 machine. Thanks for all, Andreas M - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

How to add sub-attributes in a dictionary file?
by Toyoda 09 Sep '05

09 Sep '05

---------- Forwarded message ---------- Hello, Could you let me know how to add a sub-attributes in a dictionary file? For example, there is an attribute DIGEST_ATTRIBUTE = 207 and its sub-attribute SIP_URI = 4. How can I define this sub-attribute to the dictionary file? I'd appreciate your help. J Toyoda

2 1

rlm_perl / rlm_python
by ricklim＠telus.net 09 Sep '05

09 Sep '05

Hi there, Could someone tell me what versions of freeradius have rlm_perl? I have a fedora box with freeradius 1.0.1 installed, I have downloaded the 1.0.4 version and it has references to rlm_perl in it. Do I have to install the 1.0.4 version to get rlm_perl? A very subjective question here... what is better to use rlm_perl or rlm_python? I would have to learn python, but if the general concensus is to go with python I'll do it. TIA

2 2

RE: rlm_perl / rlm_python
by Jonathan De Graeve 09 Sep '05

09 Sep '05

I think there's a bug in the latest perl versions. When you are running Debian 3.1 (perl 5.8.4) and want experimental package you may want to link libperl.so into freeradius, if you don't you get an error when you start the freeradius server with rlm_perl enabled Like: /usr/sbin/freeradius: relocation error: /usr/lib/perl/5.8/auto/IO/IO.so: undefined symbol: Perl_Tstack_sp_ptr (failed! run '/usr/sbin/freeradius -x' to find out why.) I solved this with recompile configure option: --with-rlm-perl-lib-dir=/usr/lib/libperl.so.5.8.4 You also can do LD_PRELOAD=/usr/lib/libperl.so freeradius but I would suggest the first option... J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Thor Spruyt Verzonden: vrijdag 9 september 2005 23:19 Aan: FreeRadius users mailing list Onderwerp: Re: rlm_perl / rlm_python ricklim(a)telus.net wrote: > Hi there, > Could someone tell me what versions of freeradius have rlm_perl? All latest version have it. But it's unstable and therefore you have to compile from source using --with-experimental-modules > Do I have to install the 1.0.4 version to get rlm_perl? No, but latest version is best :) > A very subjective question here... what is better to use rlm_perl or > rlm_python? I think that rlm_perl is likely to be supported better than rlm_python. > I would have to learn python, but if the general concensus is to go > with python I'll do it. Go for rlm_perl -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

how to add a sub-attributes in a dictionary
by Toyoda 09 Sep '05

09 Sep '05

Hello, I would like to know how to add a sub-attributes in a dictionary file? For example, there is an attribute DIGEST_ATTRIBUTE = 207 and its sub-attribute SIP_URI = 4. How can I define this sub-attribute to the dictionary file? I'd appreciate your help. J Toyoda

1 0

Re: Windows Client Authentification bevore Domain logon
by Armin Krämer 09 Sep '05

09 Sep '05

Ok, the hole day i tried to get it to work but this time when i install the certificate as a machine zertifikate the radius authentifikation log ends up with this log below. The Certificates where generated with openssl and all works fine as User certificates but not as computer zertificate. I set the Registry Patch which was diescribed in the mailing list to a value of 2. If anyone konws why this doesnt work please mail me. rad_recv: Access-Request packet from host 10.40.0.254:1024, id=125, length=120 NAS-IP-Address = 10.40.0.254 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x75b32a36b118137416c352ac114ec00c NAS-Port = 8 Framed-MTU = 1490 User-Name = "host/Client5" Calling-Station-Id = "00-10-5A-F7-F0-BA" EAP-Message = 0x02ff001101686f73742f436c69656e7435 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "host/Client5", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 255 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 181 users: Matched entry DEFAULT at line 200 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 125 to 10.40.0.254:1024 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010000060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3409168c713d79e19e09bf2f2ab092c9 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 125 with timestamp 430c8459 Nothing to do. Sleeping until we see a request. FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> schrieb am 24.08.05 09:52:57: At 12:49 23/08/05, you wrote: >Hi, thanks for your email! > >Ok, i tried it out but i have some problems. If i use the DWORT String you >sent me it has no efekkt. I found an other DWORT Key which Sounds >"AuthMode" and with this DWORT he only tries to authentificate with the >machine account. Maybe you have made a typing mistake in your email?? Whoops - You are right it was a typing mistake, it is AuthMode. >Ok, but my problem ist, that when he tries to authentificate with the >Computer Account i see in the radius debugging modse that he only tried to >use the default entry in the user File and not the "Client3" Entry. It >seems that he does not find the right Computer Certificate or the >Freeradius does not find the Right Entry in his user File??? I am new to freeRADIUS myself in order to get my system working I followed the instructions in these web pages, http://www.linuxjournal.com/article/8017, http://www.linuxjournal.com/article/8095, http://www.linuxjournal.com/article/8151. It does look like a certificates problem, but then I am very new to FreeRADIUS and I spent a considerable amount of time adjusting settings to make it work. >This is the output from Freeradius -X -A when the DWORT "AuthMode" is set >to 2 > > > >Starting - reading configuration files ... >reread_config: reading radiusd.conf >Config: including file! : /etc/freeradius/proxy.conf >Config: including file: /etc/freeradius/clients.conf >Config: including file: /etc/freeradius/snmp.conf >Config: including file: /etc/freeradius/eap.conf >Config: including file: /etc/freeradius/sql.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/freeradius" > main: libdir = "/usr/lib/freeradius" > main: radacctdir = "/var/log/freeradius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/freeradius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/! run/freeradius/freeradius.pid" > main: user = "freerad" >&nbs >p;main: group = "freerad" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 >read_config_files: reading dictionary >read_config_files: reading naslist >Using deprecated naslist file. Support for this will go away soon. >read_config_files: reading clients >read_config_files: reading realms >radiusd: entering modules setup >Module: Library ! search path is /usr/lib/freeradius >Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" >rlm_exec: Wait=yes but no output defined. Did you mean output=none? >Module: Instantiated exec (exec) >Module: Loaded expr >Module: Instantiated expr (expr) >Module: Loaded PAP > pap: encryption_scheme = "crypt" >Module: Instantiated pap (pap) >Module: Loaded CHAP >Module: Instantiated chap (chap) >Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" >Module: Instantiated mschap (mschap) >Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > ! ;unix: shadow = "/etc/shadow" > unix: group = "(null)" > ;unix: radwtmp = "/var/log/freeradius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 >Module: Instantiated unix (unix) >Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no >rlm_eap: Loaded and initialized type md5 >rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" >rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/etc/ssl/certs/8021x-server.pem" > tls: certificate_file = "/etc/ssl/certs/8021x-server.pem" > tls: CA_file = "/etc/ssl/certs/root.pem" > tls: private_key_pa! ssword = "whatever" > tls: dh_file = "/etc/ssl/certs/dh" > tls: random_file = "/etc/ssl/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" >rlm_eap: Loaded and initialized type tls > mschapv2: with_ntdomain_hack = no >rlm_eap: Loaded and initialized type mschapv2 >Module: Instantiated eap (eap) >Module: Loaded preprocess > preprocess: huntgroups = "/etc/freeradius/huntgroups" > preprocess: hints = "/etc/freeradius/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no >Module: Instantiated preprocess (preprocess) >Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no realm: ignore_null = no >Module: Instantiated realm (suffix ) >Module: Loaded files > files: usersfile = "/etc/freeradius/users" > files: acctusersfile = "/etc/freeradius/acct_users" > files: preproxy_usersfile = "/etc/freeradius/preproxy_users" > files: compat = "no" >Module: Instantiated files (files) >Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" >Module: Instantiated acct_unique (acct_unique) >Module: Loaded detail > detail: detailfile = > "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no >Module: Instantiated detail (detail) >Module: Loaded radutmp > radutmp: filename = "/var/log/freeradius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: ca! llerid = yes >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Listening on proxy *:1814 >Ready to process requests. >rad_recv: Access-Request packet from host 10.40.0.254:1024, id=103, length=120 > NAS-IP-Address = 10.40.0.254 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0x8e013b02cf39c8b291f8a9d790f3bd6a > NAS-Port = 8 > Framed-MTU = 1490 > User-Name = "host/Client3" > Calling-Station-Id = "00-10-5A-F7-F0-BA" > EAP-Message = 0x02ff001101686f73742f436c69656e7433 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > &nbs! >p; rlm_realm: No <mailto:'@'>'@' in User-Name = "host/Cli ent3", looking >up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 255 length 17 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > users: Matched entry DEFAULT at line 181 > users: Matched entry DEFAULT at line 200 > modcall[authorize]: module "files" returns ok for request 0 >modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type tls > rlm_eap_tls: Requiring client certificate > rlm_eap_tls: Initiate > rlm_eap_tls: ! Start returned 1 > modcall[authenticate]: module "eap" returns handled for request 0 >modcall: group authenticate returns handled for request 0 >Sending Access-Challenge of id 103 to 10.40.0.254:1024 > Framed-IP-Address = 255.255.255.254 > Framed-MTU = 576 > Service-Type = Framed-User > EAP-Message = 0x010000060d20 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x1814a65439afaa74487aa379af48ead9 >Finished request 0 >Going to the next request >--- Walking the entire request list --- >Waking up in 6 seconds... >--- Walking the entire request list --- >Cleaning up request 0 ID 103 with timestamp 430b0c7e >Nothing to do. Sleeping until we see a request. >rad_recv: Access-Request packet from host 10.40.0.254:1024, id=104, length=120 > NAS-IP-Address = 10.40.0.254 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0xe3868d2! de84c592e7e54eb355b23752f > NAS-Port = 8 > Framed-MTU = 1490 > User-Name = "host/Client3" > Calling-Station-Id = "00-10-5A-F7-F0-BA" > EAP-Message = 0x0201001101686f73742f436c69656e7433 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No <mailto:'@'>'@' in User-Name = "host/Client3", looking > up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: EAP packet type response id 1 length 17 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > users: Matched entry DEFAULT at li! ne 181 > users: Matched entry DEFAULT at line 200 > modcall[authorize]: module "files" returns ok for request 1 >modcall: group authorize returns updated for request 1 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 1 > > Fallibroome High School Priory Lane Macclesfield Cheshire SK10 4AF - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

8 15

Ascend-Data-Filter replies sent, but something amiss
by Justin M. Parker 09 Sep '05

09 Sep '05

Greetings. I've got freeradius (radiusd: FreeRADIUS Version 1.0.2, for host , built on Sep 7 2005 at 14:10:37) running, and authenticating well. My user names, passwords, and nas's are stored in a MySQL database. I have a user of name, say, "justin" belonging to group "dialin". The radgroupreply table has four rows of data like this: id GroupName Attribute op Value prio 1 dialin Ascend-Data-Filter += ip in forward est 0 2 dialin Ascend-Data-Filter += ip in forward dst ip x.x.x.x/32 0 3 dialin Ascend-Data-Filter += ip in drop tcp dstport = 25 0 4 dialin Ascend-Data-Filter += ip in forward 0 Here's what wvdial does with the Ascend-Data-Filters in place: --> WvDial: Internet dialer version 1.54.0 --> Initializing modem. --> Sending: ATZ ATZ OK --> Sending: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 W2 ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 W2 OK --> Modem initialized. --> Sending: ATDT<number> --> Waiting for carrier. ATDT<number> CONNECT 50666 --> Carrier detected. Waiting for prompt. <login prompt> --> Looks like a login prompt. --> Sending: <login@realm> Password: --> Looks like a password prompt. --> Sending: (password) Remote Authentication server timeout. <login prompt> --> Looks like a login prompt. --> Sending: <login@realm> Password: --> Looks like a password prompt. --> Sending: (password) ** Bad Password <login prompt> --> Looks like a login prompt. --> Sending: <login@realm> --> Don't know what to do! Starting pppd and hoping for the best. --> Starting pppd at Fri Sep 9 12:45:58 2005 --> pid of pppd: 11381 --> Using interface ppp0 --> Disconnecting at Fri Sep 9 12:46:02 2005 --> The PPP daemon has died: Authentication error. --> We failed to authenticate ourselves to the peer. --> Maybe bad account or password? (exit code = 19) --> man pppd explains pppd error codes in more detail. --> I guess that's it for now, exiting --> The PPP daemon has died. (exit code = 19) There's an awful lot of output from radius -X running while I attempt to auth, but here's something that sticks out: rlm_sql (sql): Released sql socket id: 5 modcall[post-auth]: module "sql" returns ok for request 1 modcall: group post-auth returns ok for request 1 Sending Access-Accept of id 67 to <ip:port> Ascend-Data-Filter += 0x697020696e20666f72776172642074637020657374 Ascend-Data-Filter += 0x697020696e20666f7277617264206473746970203230382e31322e3136352e302f3234 Ascend-Data-Filter += 0x697020696e2064726f702074637020647374706f7274203d203235 Ascend-Data-Filter += 0x697020696e20666f7277617264 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 67 with timestamp 4321cf66 Nothing to do. Sleeping until we see a request. As far as radiusd knows, I logged in. Removing my user from that dialin group (and thus not sending the group's replies) allows me to login as usual. Any ideas? Do those filter replies look right? they almost look like hex to me, not binary. I've tried X-Ascend-Data-Filter and Ascend-Data-Filter. Changing the op to := sends only the first of the four replies. In the attrs file, I've added the below line to my DEFAULT set: Ascend-Data-Filter =* ANY Any replies appreciated. -justin

1 1

CHAP Authentication But LDAP Authorization?
by Adam Tauno Williams 09 Sep '05

09 Sep '05

I have CHAP (PEAP) authentication working against my Samba PDC via ntlm_auth. I want to use that authentication but have users and their parameters from an LDAP DSA (that contains the SAM Samba is using). I see that a radius schema file is included and has an auxilliary objectclass. But I can't seem to find any informaiton on using LDAP for the user database but EAP/ntlm_auth for the authentication. Is this possible? -- Adam Tauno Williams - http://www.whitemice.org

1 0

Re: Not going past "Sending Access-Challenge"
by Adam Tauno Williams 09 Sep '05

09 Sep '05

Adam Tauno Williams <E-mail Protected> wrote: >> I'm trying to setup RADIUS/WPA authentication using PEAP as >> described in - >> http://www.ibiblio.org/pub/Linux/docs/HOWTO/8021X-HOWTO - but I >> never seem to get past the "Sending Access-Challenge" after I enter >> my username and password on the client. User is simply an entry in >> the users file with a clear text password. I've gone over the >> config several times, but nothing jumps out at me as an error >> message. Alan DeKok wrote: > The problem most likely is that the AP isn't seeing the response, or >it isn't liking the response. Check the IP addresses that the packet >use, via "tcpdump". Okay, I've etherealled the connection and I see an "Access-Request" from the WAP to the RADIUS server, then an "Access-Challenge" from the RADIUS serve to the WAP, and nothing else. What should the WAP's response to an "Access-Challenge" response be? The WAP is 192.168.1.42 and the RADIUS server is 192.168.1.47 No. Time Source Destination Protocol Info 8 0.839425 192.168.1.42 192.168.1.47 RADIUS Access-Request(1) (id=26, l=133) Frame 8 (175 bytes on wire, 175 bytes captured) Ethernet II, Src: noor.morrison.iserv.net (00:0f:3d:43:6a:3c), Dst: tor.morrison.iserv.net (00:0d:60:0f:fd:4a) Internet Protocol, Src: 192.168.1.42 (192.168.1.42), Dst: 192.168.1.47 (192.168.1.47) User Datagram Protocol, Src Port: groove-dpp (1211), Dst Port: radius (1812) Radius Protocol Code: Access-Request (1) Packet identifier: 0x1a (26) Length: 133 Authenticator: 14E77EEE7405E31F02AB6A803EB478A1 Attribute Value Pairs AVP: l=10 t=User-Name(1): awilliam AVP: l=6 t=NAS-IP-Address(4): 192.168.1.42 AVP: l=6 t=NAS-Port(5): 0 AVP: l=19 t=Called-Station-Id(30): 00-0F-3D-43-6A-3C AVP: l=19 t=Calling-Station-Id(31): 00-14-A5-30-BC-27 AVP: l=8 t=NAS-Identifier(32): wap001 AVP: l=6 t=Framed-MTU(12): 1380 AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19) AVP: l=15 t=EAP-Message(79) Last Segment[1] Length: 13 EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 1 Length: 13 Type: Identity [RFC3748] (1) Identity (8 bytes): awilliam AVP: l=18 t=Message-Authenticator(80): 92C34CC691D9BC0D5B49F180B2F4EA59 Length: 16 Message-Authenticator: 92C34CC691D9BC0D5B49F180B2F4EA59 No. Time Source Destination Protocol Info 15 0.842887 192.168.1.47 192.168.1.42 RADIUS Access-challenge(11) (id=26, l=83) Frame 15 (125 bytes on wire, 125 bytes captured) Ethernet II, Src: tor.morrison.iserv.net (00:0d:60:0f:fd:4a), Dst: noor.morrison.iserv.net (00:0f:3d:43:6a:3c) Internet Protocol, Src: 192.168.1.47 (192.168.1.47), Dst: 192.168.1.42 (192.168.1.42) User Datagram Protocol, Src Port: radius (1812), Dst Port: groove-dpp (1211) Radius Protocol Code: Access-challenge (11) Packet identifier: 0x1a (26) Length: 83 Authenticator: DE3DC989610D986213D85EF526EA47BD Attribute Value Pairs AVP: l=19 t=Reply-Message(18): EAPTEST Hello, %u Length: 17 Reply-Message: EAPTEST Hello, %u AVP: l=8 t=EAP-Message(79) Last Segment[1] Length: 6 EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 2 Length: 6 Type: PEAP [Palekar] (25) Flags(0x20): Start PEAP version 0 AVP: l=18 t=Message-Authenticator(80): 36719CCCEE09502EA6C644C5EEC62B87 Length: 16 Message-Authenticator: 36719CCCEE09502EA6C644C5EEC62B87 AVP: l=18 t=State(24): 4CA90CA7DE0086900AEB2E8BB35E773A Length: 16 State: 4CA90CA7DE0086900AEB2E8BB35E773A No. Time Source Destination Protocol Info 16 0.879314 192.168.1.42 192.168.1.47 RADIUS Access-Request(1) (id=27, l=218) Frame 16 (260 bytes on wire, 260 bytes captured) Ethernet II, Src: noor.morrison.iserv.net (00:0f:3d:43:6a:3c), Dst: tor.morrison.iserv.net (00:0d:60:0f:fd:4a) Internet Protocol, Src: 192.168.1.42 (192.168.1.42), Dst: 192.168.1.47 (192.168.1.47) User Datagram Protocol, Src Port: groove-dpp (1211), Dst Port: radius (1812) Radius Protocol Code: Access-Request (1) Packet identifier: 0x1b (27) Length: 218 Authenticator: FBD53DBF46F4F69697F2427EDE5176A3 Attribute Value Pairs AVP: l=10 t=User-Name(1): awilliam AVP: l=6 t=NAS-IP-Address(4): 192.168.1.42 AVP: l=6 t=NAS-Port(5): 0 AVP: l=19 t=Called-Station-Id(30): 00-0F-3D-43-6A-3C AVP: l=19 t=Calling-Station-Id(31): 00-14-A5-30-BC-27 AVP: l=8 t=NAS-Identifier(32): wap001 AVP: l=6 t=Framed-MTU(12): 1380 AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19) AVP: l=82 t=EAP-Message(79) Last Segment[1] Length: 80 EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 2 Length: 80 Type: PEAP [Palekar] (25) Flags(0x80): Length PEAP version 0 Length: 70 Secure Socket Layer AVP: l=18 t=State(24): 4CA90CA7DE0086900AEB2E8BB35E773A Length: 16 State: 4CA90CA7DE0086900AEB2E8BB35E773A AVP: l=18 t=Message-Authenticator(80): DF3CCA452EF2AF5D0CAA8EB46534127D Length: 16 Message-Authenticator: DF3CCA452EF2AF5D0CAA8EB46534127D No. Time Source Destination Protocol Info 23 0.885616 192.168.1.47 192.168.1.42 RADIUS Access-challenge(11) (id=27, l=1119) Frame 23 (1161 bytes on wire, 1161 bytes captured) Ethernet II, Src: tor.morrison.iserv.net (00:0d:60:0f:fd:4a), Dst: noor.morrison.iserv.net (00:0f:3d:43:6a:3c) Internet Protocol, Src: 192.168.1.47 (192.168.1.47), Dst: 192.168.1.42 (192.168.1.42) User Datagram Protocol, Src Port: radius (1812), Dst Port: groove-dpp (1211) Radius Protocol Code: Access-challenge (11) Packet identifier: 0x1b (27) Length: 1119 Authenticator: 51DB666236DA04D0B72A4E99FAE73956 Attribute Value Pairs AVP: l=19 t=Reply-Message(18): EAPTEST Hello, %u Length: 17 Reply-Message: EAPTEST Hello, %u AVP: l=255 t=EAP-Message(79) Segment[1] AVP: l=255 t=EAP-Message(79) Segment[2] AVP: l=255 t=EAP-Message(79) Segment[3] AVP: l=255 t=EAP-Message(79) Segment[4] AVP: l=24 t=EAP-Message(79) Last Segment[5] Length: 22 EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 3 Length: 1034 Type: PEAP [Palekar] (25) Flags(0xC0): Length More PEAP version 0 Length: 3974 EAP-TLS Fragments (3974 bytes): #23(1024), #35(1024), #46(1024), #54(902) Secure Socket Layer AVP: l=18 t=Message-Authenticator(80): F4814C72EEE61CD5CEFC53B36B267D4C Length: 16 Message-Authenticator: F4814C72EEE61CD5CEFC53B36B267D4C AVP: l=18 t=State(24): D338F7D46B55BA06D75A99DAB2F12D57 Length: 16 State: D338F7D46B55BA06D75A99DAB2F12D57 No. Time Source Destination Protocol Info 27 2.062088 192.168.1.42 192.168.1.47 RADIUS Access-Request(1) (id=28, l=144) Frame 27 (186 bytes on wire, 186 bytes captured) Ethernet II, Src: noor.morrison.iserv.net (00:0f:3d:43:6a:3c), Dst: tor.morrison.iserv.net (00:0d:60:0f:fd:4a) Internet Protocol, Src: 192.168.1.42 (192.168.1.42), Dst: 192.168.1.47 (192.168.1.47) User Datagram Protocol, Src Port: groove-dpp (1211), Dst Port: radius (1812) Radius Protocol Code: Access-Request (1) Packet identifier: 0x1c (28) Length: 144 Authenticator: 77439BFA74CDEE8C8B73E043554916F0 Attribute Value Pairs AVP: l=10 t=User-Name(1): awilliam AVP: l=6 t=NAS-IP-Address(4): 192.168.1.42 AVP: l=6 t=NAS-Port(5): 0 AVP: l=19 t=Called-Station-Id(30): 00-0F-3D-43-6A-3C AVP: l=19 t=Calling-Station-Id(31): 00-14-A5-30-BC-27 AVP: l=8 t=NAS-Identifier(32): wap001 AVP: l=6 t=Framed-MTU(12): 1380 AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19) AVP: l=8 t=EAP-Message(79) Last Segment[1] Length: 6 EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 3 Length: 6 Type: PEAP [Palekar] (25) Flags(0x0): PEAP version 0 AVP: l=18 t=State(24): D338F7D46B55BA06D75A99DAB2F12D57 Length: 16 State: D338F7D46B55BA06D75A99DAB2F12D57 AVP: l=18 t=Message-Authenticator(80): 7A8DCF047F1B584608FE71A8EAB584AC Length: 16 Message-Authenticator: 7A8DCF047F1B584608FE71A8EAB584AC No. Time Source Destination Protocol Info 35 2.068415 192.168.1.47 192.168.1.42 RADIUS Access-challenge(11) (id=28, l=1115) Frame 35 (1157 bytes on wire, 1157 bytes captured) Ethernet II, Src: tor.morrison.iserv.net (00:0d:60:0f:fd:4a), Dst: noor.morrison.iserv.net (00:0f:3d:43:6a:3c) Internet Protocol, Src: 192.168.1.47 (192.168.1.47), Dst: 192.168.1.42 (192.168.1.42) User Datagram Protocol, Src Port: radius (1812), Dst Port: groove-dpp (1211) Radius Protocol Code: Access-challenge (11) Packet identifier: 0x1c (28) Length: 1115 Authenticator: 2A5E1665347BA87046D857CAB331686F Attribute Value Pairs AVP: l=19 t=Reply-Message(18): EAPTEST Hello, %u Length: 17 Reply-Message: EAPTEST Hello, %u AVP: l=255 t=EAP-Message(79) Segment[1] AVP: l=255 t=EAP-Message(79) Segment[2] AVP: l=255 t=EAP-Message(79) Segment[3] AVP: l=255 t=EAP-Message(79) Segment[4] AVP: l=20 t=EAP-Message(79) Last Segment[5] Length: 18 EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 4 Length: 1030 Type: PEAP [Palekar] (25) Flags(0x40): More PEAP version 0 EAP-TLS Fragments (3974 bytes): #23(1024), #35(1024), #46(1024), #54(902) Secure Socket Layer AVP: l=18 t=Message-Authenticator(80): 755BE6D63AA6F48DC661705F2EE3A5AD Length: 16 Message-Authenticator: 755BE6D63AA6F48DC661705F2EE3A5AD AVP: l=18 t=State(24): 6A14161A7B2A4D2A2B0EED6451D7555F Length: 16 State: 6A14161A7B2A4D2A2B0EED6451D7555F -- Adam Tauno Williams - http://www.whitemice.org

1 1