- Freeradius-Users - lists.freeradius.org

Problem with PEAP and LDAP
by Carlos Martínez-Troncoso Cera 24 Aug '05

24 Aug '05

Hello. We are trying to use FreeRadius with PEAP and LDAP. Our access point is a 3Com 8750, is talking with a FreeRadius 1.0.4, Freeradius talks with LDAP (Sun One Messaging Server 5.1) and our PEAP clients are Windows XP and 2000. First we configured FreeRadius with LDAP, it works well, then we tried to use this with EAP, it works when we use local users, but when we try to authenticate and authorize PEAP users in LDAP, it doesn´t work. The error is: modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 5 rlm_mschap: Told to do MS-CHAPv2 for cmartinez with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 5 modcall: group Auth-Type returns reject for request 5 I was looking how Sun ONE stores the passwords, it uses SSHA (Salted Secure Hashing Algoritm), I think this is the problem, because I suposse it looks for NT-LM Hashing passwords, what can I do and where can I find info about it? Thank you in advance. Carlos

3 4

Freeradius denies auth when "Framed-IP-Address" set
by Gerret Apelt 24 Aug '05

24 Aug '05

Hi all -- Debian Sarge 2.4.27-2-386 kernel freeRadius (dpkg version 1.0.2-4) MySQL Server (dpkg version 4.1.11a-4) I have been using FreeRadius successfully for half a year. All my setup does is authenticate dialup connections. Radius auth requests come in from a NAS, and once authentication has been successful, the NAS will assign an IP address out of its pool. I use mysql to store 'User-Password' attribute/value pairs, where the password is stored in cleartext (there is PAP and CHAP authentication). This all works very well. I am now trying to have FreeRadius also assign IP Address and Netmask to a subset of the user accounts, and that's where I'm getting stuck: As soon as I add the additional attributes "Framed-IP-Address" and "Framed-IP-Netmask" to the table, FreeRadius will reject the authentication request. When using PAP, radius.log reports: Wed Aug 24 09:31:27 2005 : Auth: Login incorrect: [gerret/testme] When using CHAP, radius.log reports: Wed Aug 24 09:33:25 2005 : Auth: Login incorrect (rlm_chap: Clear text password not available): [gerret/<CHAP-Password>] This issue goes away as soon as I delete rows with id 1343 and 1344 below: mysql> select id, username, attribute, value, op from login_accounts where username='gerret'; +------+----------+-------------------+----+---------------+ | id | username | attribute | op | value | +------+----------+-------------------+----+---------------+ | 414 | gerret | User-Password | == | testme | | 1343 | gerret | Framed-IP-Address | == | 65.166.58.202 | | 1344 | gerret | Framed-IP-Netmask | == | 255.255.254.0 | +------+----------+-------------------+----+---------------+ When running in full debug mode, FreeRadius outputs the exact queries it fires at the database. I have run these queries manually: the 'authorize_check_query' returns the three rows listed above. All other queries return the empty set. Then at the end of the debug output: rlm_sql (sql): No matching entry in the database for request from user [gerret] rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns notfound for request 7 modcall: group authorize returns ok for request 7 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [gerret/testme] (from client north port 0 cli 00:02:6F:37:D9:D4) Am I filling the wrong rows into the database? I dont understand how authentication can fail due to the addition of two extra attributes -- especially since the queries still return the "User-Password" information. It looks like this post describes a similar issue: http://lists.cistron.nl/pipermail/freeradius-users/2005-January/039705.html Any help on this is much appreciated :) cheers Gerret

2 1

Re: Mobile phone authentication
by sean 24 Aug '05

24 Aug '05

Hi, If I understand you properly you are trying to authenticate users by their mobile phone number.If that's right you need Kannel. You can download the latest version from http://www.kannel.org There is a bit of a learning curve but once you have authenticated the user you can pass them off to your Radius billing system. I presume that the authentication will arrive via SMS, WAP or HTTP if it's 3G. I hope this helps. If you need more advice you can email me at sean(a)topup.ie Regards, Sean

1 0

Constructing imcoming message.
by Iandc Davies 24 Aug '05

24 Aug '05

Hi all, I'm trying to construct a simple program that will allow me to take some information from another source (possibly a pointer to a structure passed in) and populate the RADIUS_PACKET template. A separate process will then be used to send this message over UDP to the radius server. The information I'm trying to parse is as follows (these are test values only) :- Code=1 packet->code Identifier=1 (can increase due to how many requests) packet->id Length=total length of message packet->data_len Authenticator=32 octets (random to send to RADIUS but md5 hashed on reply) packet->vector Attributes: packet->data NAS-IP-Address=eg. d5 89 45 26 (213.137.69.38) PW_NAS_IP_ADDERSS NAS-PORT-TYPE=5 (virtual) PW_NAS_PORT_TYPE User-Name="12345678" PW_USER_NAME Disgest-Response=16 octets PW_DIGEST_REPONSE Digest-Attributes= Realm(1) = "deltathree" PW_DIGEST_REALM Nonce(2) = "3bada1a0" PW_DIGEST_NONCE Method(3) = "INVITE" PW_DIGEST_METHOD URI(4) = "sip:96226491335@213.137.69.38" PW_DIGEST_URI Algorithm(5) = "md5" PW_DIGEST_ALGORITHM User-Name(10) = "12345678" PW_DIGEST_USER_NAME On the right for the Code/Id/length/Authenticator are straight forward, as they have their own types. For the attributes, I'm getting a bit stuck as these are VSA AVP's. I think I've managed to id the functions that I need ( paircreate() and pairadd() ) but unsure how they are used. I've stated what I think each AVP is represented by (as these are #define int) but the VALUE_PAIR structure has name, attribute and type information relating to them. Is the name just a straight car string ? (left hand side of equals above) Any help gratefully received. Ian Davies IMS-SIPAC Software Development Engineer

2 1

piping radacct details to a script
by marc racal 24 Aug '05

24 Aug '05

hi all, is there a way to pipe radacct details to a script before it writes to the log file? how do you do this? thanks. regards, marc -- Get Firefox! http://tinyurl.com/cocg2 The browser you can trust.

2 5

Error compiling cvs-snapshot on FreeBSD 5.4-RELEASE
by Valeriy V. Peshkoff 24 Aug '05

24 Aug '05

Hi! I'm still unable to compile CVS version of freeradius on Freebsd Configure it like that ./configure --prefix=/usr/local/radius Only this seems bad to me ..... checking net/if.h usability... no checking net/if.h presence... yes configure: WARNING: net/if.h: present but cannot be compiled configure: WARNING: net/if.h: check for missing prerequisite headers? configure: WARNING: net/if.h: see the Autoconf documentation configure: WARNING: net/if.h: section "Present But Cannot Be Compiled" configure: WARNING: net/if.h: proceeding with the preprocessor's result configure: WARNING: net/if.h: in the future, the compiler will take precedence configure: WARNING: ## ------------------------------------------ ## configure: WARNING: ## Report this to the AC_PACKAGE_NAME lists. ## configure: WARNING: ## ------------------------------------------ ## checking for net/if.h... yes ...... radius1[root]:.../freeradius-snapshot-20050823 # gmake all gmake[1]: Entering directory `/root/freeradius-snapshot-20050823' Making all in libltdl... gmake[2]: Entering directory `/root/freeradius-snapshot-20050823/libltdl' /usr/local/bin/gmake all-am gmake[3]: Entering directory `/root/freeradius-snapshot-20050823/libltdl' /usr/local/bin/bash ./libtool --mode=compile --tag=CC gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -c -o ltdl.lo ltdl.c mkdir .libs gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -c ltdl.c -fPIC -DPIC -o .libs/ltdl.o ltdl.c:119:5: warning: "HAVE_ARGZ_H" is not defined ltdl.c:131:5: warning: "WITH_DMALLOC" is not defined ltdl.c:229:5: warning: "WITH_DMALLOC" is not defined ltdl.c:563:7: warning: "HAVE_ARGZ_APPEND" is not defined ltdl.c:605:7: warning: "HAVE_ARGZ_CREATE_SEP" is not defined ltdl.c:668:7: warning: "HAVE_ARGZ_INSERT" is not defined ltdl.c:725:7: warning: "HAVE_ARGZ_NEXT" is not defined ltdl.c: In function `rpl_argz_next': ltdl.c:752: warning: cast discards qualifiers from pointer target type ltdl.c:770:7: warning: "HAVE_ARGZ_STRINGIFY" is not defined ltdl.c:1057:5: warning: "HAVE_SYS_DL_H" is not defined ltdl.c: At top level: ltdl.c:1104: warning: function declaration isn't a prototype ltdl.c:1119: warning: function declaration isn't a prototype ltdl.c:1135: warning: function declaration isn't a prototype ltdl.c:1165:5: warning: "HAVE_SHL_LOAD" is not defined ltdl.c:1519:5: warning: "HAVE_DLD" is not defined ltdl.c:1587:5: warning: "HAVE_DYLD" is not defined ltdl.c:1948: warning: function declaration isn't a prototype ltdl.c:1967: warning: function declaration isn't a prototype ltdl.c:1989: warning: function declaration isn't a prototype ltdl.c:1997: warning: function declaration isn't a prototype ltdl.c:2035: warning: function declaration isn't a prototype ltdl.c: In function `presym_open': ltdl.c:2067: warning: cast discards qualifiers from pointer target type ltdl.c: At top level: ltdl.c:2085: warning: function declaration isn't a prototype ltdl.c:2095: warning: function declaration isn't a prototype ltdl.c:2214:5: warning: "HAVE_SHL_LOAD" is not defined ltdl.c:2223:5: warning: "HAVE_DLD" is not defined ltdl.c:2226:5: warning: "HAVE_DYLD" is not defined ltdl.c:2455: warning: function declaration isn't a prototype ltdl.c: In function `foreach_dirinpath': ltdl.c:2684: warning: comparison between signed and unsigned ltdl.c:2693: warning: comparison between signed and unsigned ltdl.c: In function `try_dlopen': ltdl.c:3137: warning: comparison between signed and unsigned ltdl.c: In function `lt_dlpath_insertdir': ltdl.c:3989: warning: comparison between signed and unsigned ltdl.c: In function `lt_dlinsertsearchdir': ltdl.c:4051: warning: cast discards qualifiers from pointer target type ltdl.c: At top level: ltdl.c:2769: warning: unused parameter 'ignored' ltdl.c:1135: warning: unused parameter 'loader_data' ltdl.c:1119: warning: unused parameter 'loader_data' ltdl.c:1104: warning: unused parameter 'loader_data' ltdl.c:1989: warning: unused parameter 'loader_data' ltdl.c:2095: warning: unused parameter 'loader_data' ltdl.c:2085: warning: unused parameter 'loader_data' ltdl.c:2035: warning: unused parameter 'loader_data' ltdl.c:1948: warning: unused parameter 'loader_data' gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -c ltdl.c -o ltdl.o >/dev/null 2>&1 /usr/local/bin/bash ./libtool --mode=link --tag=CC gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -o libltdl.la -rpath /usr/local/radius//lib -no-undefined -version-info 4:0:1 ltdl.lo -lcrypto -lpthread gcc -shared .libs/ltdl.o -lcrypto -lpthread -Wl,-soname -Wl,libltdl.so.4 -o .libs/libltdl.so.4 (cd .libs && rm -f libltdl.so && ln -s libltdl.so.4 libltdl.so) (cd .libs && rm -f libltdl.so && ln -s libltdl.so.4 libltdl.so) ar cru .libs/libltdl.a ltdl.o ranlib .libs/libltdl.a creating libltdl.la (cd .libs && rm -f libltdl.la && ln -s ../libltdl.la libltdl.la) gmake[3]: Leaving directory `/root/freeradius-snapshot-20050823/libltdl' gmake[2]: Leaving directory `/root/freeradius-snapshot-20050823/libltdl' Making all in src... gmake[2]: Entering directory `/root/freeradius-snapshot-20050823/src' gmake[3]: Entering directory `/root/freeradius-snapshot-20050823/src' Making all in include... gmake[4]: Entering directory `/root/freeradius-snapshot-20050823/src/include' gmake[4]: Цель `all' не требует выполнения команд. gmake[4]: Leaving directory `/root/freeradius-snapshot-20050823/src/include' Making all in lib... gmake[4]: Entering directory `/root/freeradius-snapshot-20050823/src/lib' /root/freeradius-snapshot-20050823/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -D_LIBRADIUS -I../include -DHMAC_SHA1_DATA_PROBLEMS -c dict.c mkdir .libs gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -D_LIBRADIUS -I../include -DHMAC_SHA1_DATA_PROBLEMS -c dict.c -fPIC -DPIC -o .libs/dict.o In file included from ../include/libradius.h:38, from dict.c:42: /usr/include/sys/socket.h:243: error: redefinition of `struct sockaddr_storage' dict.c: In function `dict_stat_free': dict.c:113: warning: passing arg 1 of `free' discards qualifiers from pointer target type dict.c:115: warning: passing arg 1 of `free' discards qualifiers from pointer target type dict.c:125: warning: passing arg 1 of `free' discards qualifiers from pointer target type dict.c: In function `dict_attrbyname': dict.c:1155: warning: comparison between signed and unsigned gmake[4]: *** [dict.lo] Ошибка 1 gmake[4]: Leaving directory `/root/freeradius-snapshot-20050823/src/lib' gmake[3]: *** [common] Ошибка 2 gmake[3]: Leaving directory `/root/freeradius-snapshot-20050823/src' gmake[2]: *** [all] Ошибка 2 gmake[2]: Leaving directory `/root/freeradius-snapshot-20050823/src' gmake[1]: *** [common] Ошибка 2 gmake[1]: Leaving directory `/root/freeradius-snapshot-20050823' gmake: *** [all] Ошибка 2 radius1[root]:.../freeradius-snapshot-20050823 # -- Russia, St. Petersburg Quantum Communications Valeriy V. Peshkov | simps(a)quantum.ru +7 (812) 327-6131 +7 (812) 327-1442

2 4

AW: Mobile phone authentification
by Marc.Schlueter＠comneon.com 24 Aug '05

24 Aug '05

Well, thank you for the correction. Actually a radius server IS involved in authentication process of mobile terminals, no operator could live without it. Nevertheless after further investigation I found out that a radius server wouldn't help me in my scenario without a connection to the operators network (the relevant entity is called GGSN). marc -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von Alan DeKok Gesendet: Dienstag, 23. August 2005 20:03 An: FreeRadius users mailing list Betreff: Re: Mobile phone authentification <Marc.Schlueter(a)comneon.com> wrote: > I'd like to use FREERADIUS as an authentification method for mobile > phones, but I'm not sure First, it's not "authentification", it's "authentication", without an "f". > Now I was told that RADIUS is the solution. RADIUS is able to detect > the actual sender information and delivers this information to the > proxy/gateway which is then able to insert the missing value into the > sender-header and everybody's happy ;) > > Someone was able to follow my thoughts? Nope. RADIUS doesn't "detect sender information". I'm not sure you understand what RADIUS does. It's just authentication and accounting, for the most part. It doesn't appear to be involved at all in the scenario you described. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Acct-Session-Id too long
by Rohaizam Abu Bakar 24 Aug '05

24 Aug '05

Dear all, FreeRADIUS 1.0.4 I'm using mysql to store accounting...especially to check simultaneous-use.. but one case as below, i received a long "Acct-Session-Id" ... and cannot fit into mysql... and problem to update Stop record... should I change column size from char32 to reasonable value ? pls advise.. thanks.. Acct-Session-Id = "erx atm 2/3.10601218:60.1218:0165889995" +--------------+----------------------------------+------------------+---------------------+-------------+ | nasipaddress | AcctSessionId | AcctUniqueId | acctstoptime | nasporttype | +--------------+----------------------------------+------------------+---------------------+-------------+ | 61.6.191.247 | erx atm 2/3.10601218:60.1218:016 | ebe88dbb3457c826 | 2005-08-22 10:32:52 | xDSL |

4 3

matching accounting packets in the acct_users file
by Tariq Rashid 24 Aug '05

24 Aug '05

i would like to filter off interim accoutning packets from specific domains to a different proxy target - as follows... # interim/status/alive accounting records are actually sent to the processing domain DEFAULT User-Name =~ "@.*\.abc\.co\.uk$", Acct-Status-Type == Alive, Proxy-To-Realm := "filterradius" # following is used to map subdomains of *.easynet.co.uk # to be proxied according to the realm easynet.co.uk DEFAULT User-Name =~ "@.*\.abc\.co\.uk$", Proxy-To-Realm := "abc.co.uk" however, the first rule is never matched when i send packets with the following attributes: Attributes: Acct-Status-Type = Alive, User-Name = "test(a)xyz.abc.co.uk" do i have the syntax wrong? tariq

1 0

Re: Windows Client Authentification bevore Domain logon
by Steven Atkinson 24 Aug '05

24 Aug '05

At 12:49 23/08/05, you wrote: >Hi, thanks for your email! > >Ok, i tried it out but i have some problems. If i use the DWORT String you >sent me it has no efekkt. I found an other DWORT Key which Sounds >"AuthMode" and with this DWORT he only tries to authentificate with the >machine account. Maybe you have made a typing mistake in your email?? Whoops - You are right it was a typing mistake, it is AuthMode. >Ok, but my problem ist, that when he tries to authentificate with the >Computer Account i see in the radius debugging modse that he only tried to >use the default entry in the user File and not the "Client3" Entry. It >seems that he does not find the right Computer Certificate or the >Freeradius does not find the Right Entry in his user File??? I am new to freeRADIUS myself in order to get my system working I followed the instructions in these web pages, http://www.linuxjournal.com/article/8017, http://www.linuxjournal.com/article/8095, http://www.linuxjournal.com/article/8151. It does look like a certificates problem, but then I am very new to FreeRADIUS and I spent a considerable amount of time adjusting settings to make it work. >This is the output from Freeradius -X -A when the DWORT "AuthMode" is set >to 2 > > > >Starting - reading configuration files ... >reread_config: reading radiusd.conf >Config: including file! : /etc/freeradius/proxy.conf >Config: including file: /etc/freeradius/clients.conf >Config: including file: /etc/freeradius/snmp.conf >Config: including file: /etc/freeradius/eap.conf >Config: including file: /etc/freeradius/sql.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/freeradius" > main: libdir = "/usr/lib/freeradius" > main: radacctdir = "/var/log/freeradius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/freeradius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/! run/freeradius/freeradius.pid" > main: user = "freerad" >&nbs >p;main: group = "freerad" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 >read_config_files: reading dictionary >read_config_files: reading naslist >Using deprecated naslist file. Support for this will go away soon. >read_config_files: reading clients >read_config_files: reading realms >radiusd: entering modules setup >Module: Library ! search path is /usr/lib/freeradius >Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" >rlm_exec: Wait=yes but no output defined. Did you mean output=none? >Module: Instantiated exec (exec) >Module: Loaded expr >Module: Instantiated expr (expr) >Module: Loaded PAP > pap: encryption_scheme = "crypt" >Module: Instantiated pap (pap) >Module: Loaded CHAP >Module: Instantiated chap (chap) >Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" >Module: Instantiated mschap (mschap) >Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > ! ;unix: shadow = "/etc/shadow" > unix: group = "(null)" > ;unix: radwtmp = "/var/log/freeradius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 >Module: Instantiated unix (unix) >Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no >rlm_eap: Loaded and initialized type md5 >rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" >rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/etc/ssl/certs/8021x-server.pem" > tls: certificate_file = "/etc/ssl/certs/8021x-server.pem" > tls: CA_file = "/etc/ssl/certs/root.pem" > tls: private_key_pa! ssword = "whatever" > tls: dh_file = "/etc/ssl/certs/dh" > tls: random_file = "/etc/ssl/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" >rlm_eap: Loaded and initialized type tls > mschapv2: with_ntdomain_hack = no >rlm_eap: Loaded and initialized type mschapv2 >Module: Instantiated eap (eap) >Module: Loaded preprocess > preprocess: huntgroups = "/etc/freeradius/huntgroups" > preprocess: hints = "/etc/freeradius/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no >Module: Instantiated preprocess (preprocess) >Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no realm: ignore_null = no >Module: Instantiated realm (suffix ) >Module: Loaded files > files: usersfile = "/etc/freeradius/users" > files: acctusersfile = "/etc/freeradius/acct_users" > files: preproxy_usersfile = "/etc/freeradius/preproxy_users" > files: compat = "no" >Module: Instantiated files (files) >Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" >Module: Instantiated acct_unique (acct_unique) >Module: Loaded detail > detail: detailfile = > "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no >Module: Instantiated detail (detail) >Module: Loaded radutmp > radutmp: filename = "/var/log/freeradius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: ca! llerid = yes >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Listening on proxy *:1814 >Ready to process requests. >rad_recv: Access-Request packet from host 10.40.0.254:1024, id=103, length=120 > NAS-IP-Address = 10.40.0.254 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0x8e013b02cf39c8b291f8a9d790f3bd6a > NAS-Port = 8 > Framed-MTU = 1490 > User-Name = "host/Client3" > Calling-Station-Id = "00-10-5A-F7-F0-BA" > EAP-Message = 0x02ff001101686f73742f436c69656e7433 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > &nbs! >p; rlm_realm: No <mailto:'@'>'@' in User-Name = "host/Cli ent3", looking >up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 255 length 17 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > users: Matched entry DEFAULT at line 181 > users: Matched entry DEFAULT at line 200 > modcall[authorize]: module "files" returns ok for request 0 >modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type tls > rlm_eap_tls: Requiring client certificate > rlm_eap_tls: Initiate > rlm_eap_tls: ! Start returned 1 > modcall[authenticate]: module "eap" returns handled for request 0 >modcall: group authenticate returns handled for request 0 >Sending Access-Challenge of id 103 to 10.40.0.254:1024 > Framed-IP-Address = 255.255.255.254 > Framed-MTU = 576 > Service-Type = Framed-User > EAP-Message = 0x010000060d20 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x1814a65439afaa74487aa379af48ead9 >Finished request 0 >Going to the next request >--- Walking the entire request list --- >Waking up in 6 seconds... >--- Walking the entire request list --- >Cleaning up request 0 ID 103 with timestamp 430b0c7e >Nothing to do. Sleeping until we see a request. >rad_recv: Access-Request packet from host 10.40.0.254:1024, id=104, length=120 > NAS-IP-Address = 10.40.0.254 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0xe3868d2! de84c592e7e54eb355b23752f > NAS-Port = 8 > Framed-MTU = 1490 > User-Name = "host/Client3" > Calling-Station-Id = "00-10-5A-F7-F0-BA" > EAP-Message = 0x0201001101686f73742f436c69656e7433 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No <mailto:'@'>'@' in User-Name = "host/Client3", looking > up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: EAP packet type response id 1 length 17 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > users: Matched entry DEFAULT at li! ne 181 > users: Matched entry DEFAULT at line 200 > modcall[authorize]: module "files" returns ok for request 1 >modcall: group authorize returns updated for request 1 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 1 > > Fallibroome High School Priory Lane Macclesfield Cheshire SK10 4AF

1 0