- Freeradius-Users - lists.freeradius.org

eap instantiation errors
by Paul Manyika 11 Jun '15

11 Jun '15

Hi I am trying co configure free radius on a freebsd10 server When i try to run "radiusd -X" I get radiusd: FreeRADIUS Version 2.2.7, for host i386-portbld-freebsd10.0, built on Jun 10 2015 at 12:35:41 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/cache including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/dhcp_sqlippool including configuration file /usr/local/etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radrelay including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { user = "freeradius" group = "freeradius" allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib/freeradius-2.2.7" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = yes auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ?Ø¿âââ?( Ø¿âA modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_pam Module: Instantiating module "pam" from file /usr/local/etc/raddb/modules/pam pam { pam_auth = "radiusd" } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } rlm_eap: No such sub-type for default EAP type ttls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[312]: Failed to find "eap" in the "modules" section. /usr/local/etc/raddb/sites-enabled/default[254]: Errors parsing authenticate section. Can someone pliz show me what i did wrong? __________________________________________________________________ Find a local lawyer and free legal information at FindLaw.com.

2 1

rewrite attribute in freeradius 3
by Aleksander Vines 11 Jun '15

11 Jun '15

Hi list, I'm trying to set up Freeradius (3.0.4 - as its whats included in the centos repo) for Eduroam. It should act as a proxy to an internal server. Essentially, what I'm stuck at now is to rewrite the incoming User-Name attribute to remove the @domain postfix. In earlier versions I could use something like this: attr_rewrite rewrite_realm { attribute = User-Name searchin = packet searchfor = "^(.*)(a)adsl\.realm1$" replacewith = "%{1}" ignore_case = no new_attribute = no max_matches = 10 append = no } However, it seems its not supported in Freeradius 3:

2 2

EAP-TTLS with PAP and Mac Authentication is not working together
by Sunil Kulkarni -X (sunikulk - PERSISTENT SYSTEMS INC at Cisco) 11 Jun '15

11 Jun '15

Hello All, I am using FreeRadius 3.0.8 version. I am able configure EAP-TTLS with PAP on FreeRadius. I have to handle following scenarios when request coming from one of the client IP. I have followed http://wiki.freeradius.org/guide/Mac-Auth to achieve this. 1. MAC Authentication 2. EAP-TTLS with PAP Following are my files: Client.conf client <client_ip_address> { ipaddr = <client_ip_address> secret = <secret_key> shortname = <client_ip_address> virtual_server = client-listener } Client-lister server client- listener { authorize { if (EAP-Message) { eap } else { preprocess files if (ok) { update control { Auth-Type := Accept } } else { # reject update control { Auth-Type := Reject } } } } } When I removed virtual_server = client-listener from client.conf file, EAP-TTLS with PAP will work correctly. However, when I am testing with virtual_server = client-listener, FreeRadius is not able to identify EAP auth type. Below are few lines from log file: ............ ............ (0) NAS-Port-Type = Wireless-802.11 (0) EAP-Message = 0x0201001a016f73752d64303a61363a33373a62373a33363a6539 (0) Message-Authenticator = 0x917afa7c89cd3ab4ec557774b058f177 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/client- listener (0) authorize { (0) if (EAP-Message) { (0) if (EAP-Message) -> TRUE (0) if (EAP-Message) { (0) eap: Peer sent code Response (2) ID 1 length 26 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # if (EAP-Message) = ok (0) ... skipping else for request 0: Preceding "if" was taken (0) } # authorize = ok (0) Found Auth-Type = EAP (0) Auth-Type sub-section not found. Ignoring. (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) Delaying response for 1.000000 seconds ....... ....... Am I missing any configuration? --- Thanks, Sunil Kulkarni

2 1

users with passwords that contain "%"
by Chris Geiger 11 Jun '15

11 Jun '15

I’m having a strange issue with this. Some users have a % in their password and FreeRADIUS is reading it like a variable. Currently running version 2.1.12 Any one have a solution? Chris Geiger Solutions Architect p. 213-406-9011 e. cgeiger(a)vpls.net w. www.vpls.net 24 hour VTAC Support: 866-616-9099

2 1

Howto use rlm_python or how another way to use "rocket codes"
by Jesse Schlüter 10 Jun '15

10 Jun '15

Hello everyone, I am trying to find a simple solution for the following problem. I have a device for which I need authentication in form of a username and pre-generated one-time-pads. The device speaks radius flawlessly, so I though the easiest setup would be a radius server. The authentication system should be as small and rugged as possible, so no fancy stuff around ist wanted. This is supposed to an access of last resort to certain systems. So it should be working even if everything else is breaking down (like active-directory and stuff like that). Finally I found out that it is possible to "program" my own authentication plugin using python for freeradius. There is only one problem: zero documentation. I found the python example "prepaid.py" somewhere on the internet, so I was able to put my own module together. But how do I tell freeradius to use this module? I am not a freeradius expert, and I went through the wiki, but again, documentation seems to be sparse on details. Thanks for any hints, Jesse -- Jesse Schlüter mail: jesse.schlueter(a)helix360.de

2 3

Many exchanges between supplicant and the server - EAP-TLS
by vince technical address 10 Jun '15

10 Jun '15

Hello, On a radius server configured with EAP-TLS, logs contain many exchanges between the station and the server. It seems logical with the handshake TLS but each station response of access challenge causes the execution of the authorize section. Can you tell me if this is normal? Best regards, Vincent

5 6

Freeradius authentication from Postgres?
by Kim Halavakoski 10 Jun '15

10 Jun '15

Hello, Is it possible to get user authentication from an existing database containing fields for username and password and use this info in authenticating Radius users? What kind of configuration would this require, as I would not like to change the existing database structure with new fields and I just need the usernames and passwords from the database, any other required configurations can be done in static configuration files if needed. Effectively just replacing the following user file to be fetched from a database with username and password fields: > testuser Cleartext-Password := "password" Anybody have example configurations for such a setup? Best regards, Kim Halavakoski khalavakoski(a)gmail.com Sent from my mobile device, excuse my clawfingerness!

3 2

acct-session-start attribute ?
by Jeremy Ravel 10 Jun '15

10 Jun '15

Hi guys, I am beginner in FR. I want to be able to delay the activation of the login. For example i can create an user monday, but i just want allow him to connect only from friday to logon on my network. I tried to use the attribute acct-session-start on the user, but when i use it one user, the user can never log. I get this from the log: Thu May 28 16:18:16 2015 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 39465, id=155, length=277 ChilliSpot-Version = "1.3.0" User-Name = "day2" User-Password = "day2" Service-Type = Login-User Acct-Session-Id = "5567077800000003" Framed-IP-Address = 10.10.4.200 NAS-Port-Type = Wireless-802.11 NAS-Port = 3 NAS-Port-Id = "00000003" Calling-Station-Id = "00-1B-77-16-34-1A" Called-Station-Id = "00-50-56-B2-BF-8D" NAS-IP-Address = 10.10.4.254 NAS-Identifier = "vlan4" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova,Vlan4_ssid" WISPr-Location-Name = "Vlan_4" WISPr-Logoff-URL = " http://10.10.4.254:3990/logoff " Message-Authenticator = 0xee48deacd07a8f3d13df74480fa48198 Thu May 28 16:19:09 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Thu May 28 16:19:09 2015 : Info: +- entering group authorize {...} Thu May 28 16:19:09 2015 : Info: ++? if (!NAS-IP-Address) Thu May 28 16:19:09 2015 : Info: ? Evaluating !(NAS-IP-Address) -> FALSE Thu May 28 16:19:09 2015 : Info: ++? if (!NAS-IP-Address) -> FALSE Thu May 28 16:19:09 2015 : Info: ++[preprocess] returns ok Thu May 28 16:19:09 2015 : Info: ++[chap] returns noop Thu May 28 16:19:09 2015 : Info: ++[mschap] returns noop Thu May 28 16:19:09 2015 : Info: ++[digest] returns noop Thu May 28 16:19:09 2015 : Info: [suffix] No '@' in User-Name = "day2", looking up realm NULL Thu May 28 16:19:09 2015 : Info: [suffix] No such realm "NULL" Thu May 28 16:19:09 2015 : Info: ++[suffix] returns noop Thu May 28 16:19:09 2015 : Info: [eap] No EAP-Message, not doing EAP Thu May 28 16:19:09 2015 : Info: ++[eap] returns noop Thu May 28 16:19:09 2015 : Info: [sql] expand: %{User-Name} -> day2 Thu May 28 16:19:09 2015 : Info: [sql] sql_set_user escaped user --> 'day2' Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Thu May 28 16:19:09 2015 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'day2' ORDER BY id Thu May 28 16:19:09 2015 : Info: [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'day2' ORDER BY priority Thu May 28 16:19:09 2015 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'vlan_4' ORDER BY id Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql): Released sql socket id: 3 Thu May 28 16:19:09 2015 : Info: [sql] User day2 not found Thu May 28 16:19:09 2015 : Info: ++[sql] returns notfound Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Entering module authorize code Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Could not find Check item value pair Thu May 28 16:19:09 2015 : Info: ++[chillispot_max_bytes] returns noop Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Entering module authorize code Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Could not find Check item value pair Thu May 28 16:19:09 2015 : Info: ++[noresetcounter] returns noop Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Entering module authorize code Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Could not find Check item value pair Thu May 28 16:19:09 2015 : Info: ++[dailycounter] returns noop Thu May 28 16:19:09 2015 : Info: ++[expiration] returns noop Thu May 28 16:19:09 2015 : Info: ++[logintime] returns noop Thu May 28 16:19:09 2015 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Thu May 28 16:19:09 2015 : Info: ++[pap] returns noop Thu May 28 16:19:09 2015 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Thu May 28 16:19:09 2015 : Info: Failed to authenticate the user. Thu May 28 16:19:09 2015 : Info: Using Post-Auth-Type Reject Thu May 28 16:19:09 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Thu May 28 16:19:09 2015 : Info: +- entering group REJECT {...} Thu May 28 16:19:09 2015 : Info: [sql] expand: %{User-Name} -> day2 Thu May 28 16:19:09 2015 : Info: [sql] sql_set_user escaped user --> 'day2' Thu May 28 16:19:09 2015 : Info: [sql] expand: %{User-Password} -> day2 Thu May 28 16:19:09 2015 : Info: [sql] expand: INSERT INTO radpostauth (user, pass, reply, date) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply acket-Type}', '%S') -> INSERT INTO radpostauth (user, pass, reply, date) VALUES ( 'day2', 'day2', 'Access-Reject', ' 2015-05-28 16 :19:09') Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (user, pass, reply, date) VALUES ( 'day2', 'day2', 'Access-Reject', ' 2015-05-28 16 :19:09') Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql): Released sql socket id: 2 Thu May 28 16:19:09 2015 : Info: ++[sql] returns ok Thu May 28 16:19:09 2015 : Info: [attr_filter.access_reject] expand: %{User-Name} -> day2 Thu May 28 16:19:09 2015 : Debug: attr_filter: Matched entry DEFAULT at line 11 But if i dont give him, the attribute he can logon. If somone has any clue ? Thanks

2 15

issues with running freeradius3.0.8 certificate authentication
by syed latheef 10 Jun '15

10 Jun '15

Hi We had installed the freeradius 3.0.8 in our redhat machine but the certificate is not getting authenticated . the logs are in line along with this mail .this machine previously was running freeradius older version which was working fine .please help us resolve this issue . Thanks Latheef.S logs attached =========== n Jun 8 05:57:20 2015 : Debug: (151) EAP-Message = 0x019603ec19c00000093416030100510200004d030155756700e53bdacb99665df630bde73d39d1c5c6fce32ea9d05be3e568648039201e7488ca35449034fe49d15fb01baa51f3c1aa01f3a3c21555b9c302f338fbc20035000005ff0100010016030108d00b0008cc0008c90003de308203da308202c2 Mon Jun 8 05:57:20 2015 : Debug: (151) Message-Authenticator = 0x00000000000000000000000000000000 Mon Jun 8 05:57:20 2015 : Debug: (151) State = 0x209817dc210e0ee756ad6df1b14e725e Mon Jun 8 05:57:20 2015 : Debug: (151) Finished request Mon Jun 8 05:57:20 2015 : Debug: Waking up in 4.9 seconds. Mon Jun 8 05:57:20 2015 : Debug: (152) Received Access-Request Id 48 from 192.168.3.201:1024 to 192.168.3.48:1812 length 225 Mon Jun 8 05:57:20 2015 : Debug: (152) Framed-MTU = 1480 Mon Jun 8 05:57:20 2015 : Debug: (152) NAS-IP-Address = 192.168.3.201 Mon Jun 8 05:57:20 2015 : Debug: (152) NAS-Identifier = 'HP ProCurve Switch 2824' Mon Jun 8 05:57:20 2015 : Debug: (152) User-Name = 'ctc' Mon Jun 8 05:57:20 2015 : Debug: (152) Service-Type = Framed-User Mon Jun 8 05:57:20 2015 : Debug: (152) Framed-Protocol = PPP Mon Jun 8 05:57:20 2015 : Debug: (152) NAS-Port = 2 Mon Jun 8 05:57:20 2015 : Debug: (152) NAS-Port-Type = Ethernet Mon Jun 8 05:57:20 2015 : Debug: (152) NAS-Port-Id = '2' Mon Jun 8 05:57:20 2015 : Debug: (152) Called-Station-Id = '00-0e-7f-c4-98-60' Mon Jun 8 05:57:20 2015 : Debug: (152) Calling-Station-Id = '50-65-f3-5c-e9-ed' Mon Jun 8 05:57:20 2015 : Debug: (152) Connect-Info = 'CONNECT Ethernet 1000Mbps Full duplex' Mon Jun 8 05:57:20 2015 : Debug: (152) Tunnel-Type:0 = VLAN Mon Jun 8 05:57:20 2015 : Debug: (152) Tunnel-Medium-Type:0 = IEEE-802 Mon Jun 8 05:57:20 2015 : Debug: (152) Tunnel-Private-Group-Id:0 = '1' Mon Jun 8 05:57:20 2015 : Debug: (152) State = 0x209817dc210e0ee756ad6df1b14e725e Mon Jun 8 05:57:20 2015 : Debug: (152) EAP-Message = 0x029600061900 Mon Jun 8 05:57:20 2015 : Debug: (152) Message-Authenticator = 0x39b1ce0cd6391f6f3c41fa7b4bb58913 Mon Jun 8 05:57:20 2015 : Debug: (152) session-state: No cached attributes Mon Jun 8 05:57:20 2015 : Debug: (152) # Executing section authorize from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (152) authorize { Mon Jun 8 05:57:20 2015 : Debug: (152) policy filter_username { Mon Jun 8 05:57:20 2015 : Debug: (152) if (!&User-Name) { Mon Jun 8 05:57:20 2015 : Debug: (152) if (!&User-Name) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ / /) { Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ / /) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /@.*@/ ) { Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /@.*@/ ) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /\.\./ ) { Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /\.\./ ) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Mon Jun 8 05:57:20 2015 : Debug: (152) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /\.$/) { Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /\.$/) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /(a)\./) { Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /(a)\./) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) } # policy filter_username = notfound Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [preprocess] = ok Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: calling chap (rlm_chap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: returned from chap (rlm_chap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [chap] = noop Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: calling mschap (rlm_mschap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: returned from mschap (rlm_mschap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [mschap] = noop Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: calling digest (rlm_digest) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: returned from digest (rlm_digest) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [digest] = noop Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: calling suffix (rlm_realm) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) suffix: Checking for suffix after "@" Mon Jun 8 05:57:20 2015 : Debug: (152) suffix: No '@' in User-Name = "ctc", looking up realm NULL Mon Jun 8 05:57:20 2015 : Debug: (152) suffix: No such realm "NULL" Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: returned from suffix (rlm_realm) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [suffix] = noop Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: calling eap (rlm_eap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Peer sent code Response (2) ID 150 length 6 Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Continuing tunnel setup Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: returned from eap (rlm_eap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [eap] = ok Mon Jun 8 05:57:20 2015 : Debug: (152) } # authorize = ok Mon Jun 8 05:57:20 2015 : Debug: (152) Found Auth-Type = EAP Mon Jun 8 05:57:20 2015 : Debug: (152) # Executing group from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (152) authenticate { Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authenticate]: calling eap (rlm_eap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Expiring EAP session with state 0x209817dc210e0ee7 Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Finished EAP session with state 0x209817dc210e0ee7 Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Previous EAP request found for state 0x209817dc210e0ee7, released from the list Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Peer sent method PEAP (25) Mon Jun 8 05:57:20 2015 : Debug: (152) eap: EAP PEAP (25) Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Calling eap_peap to process EAP data Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: processing EAP-TLS Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: Received TLS ACK Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: Received TLS ACK Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: ACK handshake fragment handler Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: eaptls_verify returned 1 Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: eaptls_process returned 13 Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: FR_TLS_HANDLED Mon Jun 8 05:57:20 2015 : Debug: (152) eap: EAP session adding &reply:State = 0x209817dc220f0ee7 Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authenticate]: returned from eap (rlm_eap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [eap] = handled Mon Jun 8 05:57:20 2015 : Debug: (152) } # authenticate = handled Mon Jun 8 05:57:20 2015 : Debug: (152) Using Post-Auth-Type Challenge Mon Jun 8 05:57:20 2015 : Debug: (152) Post-Auth-Type sub-section not found. Ignoring. Mon Jun 8 05:57:20 2015 : Debug: (152) # Executing group from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (152) session-state: Nothing to cache Mon Jun 8 05:57:20 2015 : Debug: (152) Sent Access-Challenge Id 48 from 192.168.3.48:1812 to 192.168.3.201:1024 length 0 Mon Jun 8 05:57:20 2015 : Debug: (152) EAP-Message = 0x019703e81940d027670910cd24815ce68c509691a6027d4d32c742fd2152db96203c01477e40e1fb397b2d854dadef536faac0190c02f09dadbd8c92c64b0f874bc4cd223be761823ab9c83910b648daf987435b98be5aca01f12238ff7c9651390663cfd2b91b0004e5308204e1308203c9a003020102 Mon Jun 8 05:57:20 2015 : Debug: (152) Message-Authenticator = 0x00000000000000000000000000000000 Mon Jun 8 05:57:20 2015 : Debug: (152) State = 0x209817dc220f0ee756ad6df1b14e725e Mon Jun 8 05:57:20 2015 : Debug: (152) Finished request Mon Jun 8 05:57:20 2015 : Debug: Waking up in 4.9 seconds. Mon Jun 8 05:57:20 2015 : Debug: (153) Received Access-Request Id 49 from 192.168.3.201:1024 to 192.168.3.48:1812 length 225 Mon Jun 8 05:57:20 2015 : Debug: (153) Framed-MTU = 1480 Mon Jun 8 05:57:20 2015 : Debug: (153) NAS-IP-Address = 192.168.3.201 Mon Jun 8 05:57:20 2015 : Debug: (153) NAS-Identifier = 'HP ProCurve Switch 2824' Mon Jun 8 05:57:20 2015 : Debug: (153) User-Name = 'ctc' Mon Jun 8 05:57:20 2015 : Debug: (153) Service-Type = Framed-User Mon Jun 8 05:57:20 2015 : Debug: (153) Framed-Protocol = PPP Mon Jun 8 05:57:20 2015 : Debug: (153) NAS-Port = 2 Mon Jun 8 05:57:20 2015 : Debug: (153) NAS-Port-Type = Ethernet Mon Jun 8 05:57:20 2015 : Debug: (153) NAS-Port-Id = '2' Mon Jun 8 05:57:20 2015 : Debug: (153) Called-Station-Id = '00-0e-7f-c4-98-60' Mon Jun 8 05:57:20 2015 : Debug: (153) Calling-Station-Id = '50-65-f3-5c-e9-ed' Mon Jun 8 05:57:20 2015 : Debug: (153) Connect-Info = 'CONNECT Ethernet 1000Mbps Full duplex' Mon Jun 8 05:57:20 2015 : Debug: (153) Tunnel-Type:0 = VLAN Mon Jun 8 05:57:20 2015 : Debug: (153) Tunnel-Medium-Type:0 = IEEE-802 Mon Jun 8 05:57:20 2015 : Debug: (153) Tunnel-Private-Group-Id:0 = '1' Mon Jun 8 05:57:20 2015 : Debug: (153) State = 0x209817dc220f0ee756ad6df1b14e725e Mon Jun 8 05:57:20 2015 : Debug: (153) EAP-Message = 0x029700061900 Mon Jun 8 05:57:20 2015 : Debug: (153) Message-Authenticator = 0xdc642a3312c2b7a0bf5c5700b86cc72f Mon Jun 8 05:57:20 2015 : Debug: (153) session-state: No cached attributes Mon Jun 8 05:57:20 2015 : Debug: (153) # Executing section authorize from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (153) authorize { Mon Jun 8 05:57:20 2015 : Debug: (153) policy filter_username { Mon Jun 8 05:57:20 2015 : Debug: (153) if (!&User-Name) { Mon Jun 8 05:57:20 2015 : Debug: (153) if (!&User-Name) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ / /) { Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ / /) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /@.*@/ ) { Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /@.*@/ ) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /\.\./ ) { Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /\.\./ ) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Mon Jun 8 05:57:20 2015 : Debug: (153) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /\.$/) { Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /\.$/) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /(a)\./) { Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /(a)\./) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) } # policy filter_username = notfound Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [preprocess] = ok Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: calling chap (rlm_chap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: returned from chap (rlm_chap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [chap] = noop Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: calling mschap (rlm_mschap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: returned from mschap (rlm_mschap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [mschap] = noop Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: calling digest (rlm_digest) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: returned from digest (rlm_digest) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [digest] = noop Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: calling suffix (rlm_realm) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) suffix: Checking for suffix after "@" Mon Jun 8 05:57:20 2015 : Debug: (153) suffix: No '@' in User-Name = "ctc", looking up realm NULL Mon Jun 8 05:57:20 2015 : Debug: (153) suffix: No such realm "NULL" Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: returned from suffix (rlm_realm) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [suffix] = noop Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: calling eap (rlm_eap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Peer sent code Response (2) ID 151 length 6 Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Continuing tunnel setup Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: returned from eap (rlm_eap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [eap] = ok Mon Jun 8 05:57:20 2015 : Debug: (153) } # authorize = ok Mon Jun 8 05:57:20 2015 : Debug: (153) Found Auth-Type = EAP Mon Jun 8 05:57:20 2015 : Debug: (153) # Executing group from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (153) authenticate { Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authenticate]: calling eap (rlm_eap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Expiring EAP session with state 0x209817dc220f0ee7 Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Finished EAP session with state 0x209817dc220f0ee7 Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Previous EAP request found for state 0x209817dc220f0ee7, released from the list Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Peer sent method PEAP (25) Mon Jun 8 05:57:20 2015 : Debug: (153) eap: EAP PEAP (25) Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Calling eap_peap to process EAP data Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: processing EAP-TLS Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: Received TLS ACK Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: Received TLS ACK Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: ACK handshake fragment handler Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: eaptls_verify returned 1 Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: eaptls_process returned 13 Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: FR_TLS_HANDLED Mon Jun 8 05:57:20 2015 : Debug: (153) eap: EAP session adding &reply:State = 0x209817dc23000ee7 Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authenticate]: returned from eap (rlm_eap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [eap] = handled Mon Jun 8 05:57:20 2015 : Debug: (153) } # authenticate = handled Mon Jun 8 05:57:20 2015 : Debug: (153) Using Post-Auth-Type Challenge Mon Jun 8 05:57:20 2015 : Debug: (153) Post-Auth-Type sub-section not found. Ignoring. Mon Jun 8 05:57:20 2015 : Debug: (153) # Executing group from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (153) session-state: Nothing to cache Mon Jun 8 05:57:20 2015 : Debug: (153) Sent Access-Challenge Id 49 from 192.168.3.48:1812 to 192.168.3.201:1024 length 0 Mon Jun 8 05:57:20 2015 : Debug: (153) EAP-Message = 0x0198017619007479820900c7ba6febe19fb88e300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d010105050003820101004aeb0a79893906ef633d Mon Jun 8 05:57:20 2015 : Debug: (153) Message-Authenticator = 0x00000000000000000000000000000000 Mon Jun 8 05:57:20 2015 : Debug: (153) State = 0x209817dc23000ee756ad6df1b14e725e Mon Jun 8 05:57:20 2015 : Debug: (153) Finished request Mon Jun 8 05:57:20 2015 : Debug: Waking up in 4.9 seconds. Mon Jun 8 05:57:20 2015 : Debug: (154) Received Access-Request Id 50 from 192.168.3.201:1024 to 192.168.3.48:1812 length 225 Mon Jun 8 05:57:20 2015 : Debug: (154) Framed-MTU = 1480 Mon Jun 8 05:57:20 2015 : Debug: (154) NAS-IP-Address = 192.168.3.201 Mon Jun 8 05:57:20 2015 : Debug: (154) NAS-Identifier = 'HP ProCurve Switch 2824' Mon Jun 8 05:57:20 2015 : Debug: (154) User-Name = 'ctc' Mon Jun 8 05:57:20 2015 : Debug: (154) Service-Type = Framed-User Mon Jun 8 05:57:20 2015 : Debug: (154) Framed-Protocol = PPP Mon Jun 8 05:57:20 2015 : Debug: (154) NAS-Port = 2 Mon Jun 8 05:57:20 2015 : Debug: (154) NAS-Port-Type = Ethernet Mon Jun 8 05:57:20 2015 : Debug: (154) NAS-Port-Id = '2' Mon Jun 8 05:57:20 2015 : Debug: (154) Called-Station-Id = '00-0e-7f-c4-98-60' Mon Jun 8 05:57:20 2015 : Debug: (154) Calling-Station-Id = '50-65-f3-5c-e9-ed' Mon Jun 8 05:57:20 2015 : Debug: (154) Connect-Info = 'CONNECT Ethernet 1000Mbps Full duplex' Mon Jun 8 05:57:20 2015 : Debug: (154) Tunnel-Type:0 = VLAN Mon Jun 8 05:57:20 2015 : Debug: (154) Tunnel-Medium-Type:0 = IEEE-802 Mon Jun 8 05:57:20 2015 : Debug: (154) Tunnel-Private-Group-Id:0 = '1' Mon Jun 8 05:57:20 2015 : Debug: (154) State = 0x209817dc23000ee756ad6df1b14e725e Mon Jun 8 05:57:20 2015 : Debug: (154) EAP-Message = 0x029800060319 Mon Jun 8 05:57:20 2015 : Debug: (154) Message-Authenticator = 0xb4daff305fd89d80c104cb751486a1d1 Mon Jun 8 05:57:20 2015 : Debug: (154) session-state: No cached attributes Mon Jun 8 05:57:20 2015 : Debug: (154) # Executing section authorize from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (154) authorize { Mon Jun 8 05:57:20 2015 : Debug: (154) policy filter_username { Mon Jun 8 05:57:20 2015 : Debug: (154) if (!&User-Name) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (!&User-Name) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ / /) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ / /) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /@.*@/ ) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /@.*@/ ) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /\.\./ ) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /\.\./ ) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Mon Jun 8 05:57:20 2015 : Debug: (154) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /\.$/) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /\.$/) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /(a)\./) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /(a)\./) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) } # policy filter_username = notfound Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [preprocess] = ok Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling chap (rlm_chap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from chap (rlm_chap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [chap] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling mschap (rlm_mschap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from mschap (rlm_mschap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [mschap] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling digest (rlm_digest) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from digest (rlm_digest) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [digest] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling suffix (rlm_realm) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) suffix: Checking for suffix after "@" Mon Jun 8 05:57:20 2015 : Debug: (154) suffix: No '@' in User-Name = "ctc", looking up realm NULL Mon Jun 8 05:57:20 2015 : Debug: (154) suffix: No such realm "NULL" Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from suffix (rlm_realm) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [suffix] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling eap (rlm_eap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Peer sent code Response (2) ID 152 length 6 Mon Jun 8 05:57:20 2015 : Debug: (154) eap: No EAP Start, assuming it's an on-going EAP conversation Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from eap (rlm_eap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [eap] = updated Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling files (rlm_files) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) files: users: Matched entry DEFAULT at line 182 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from files (rlm_files) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [files] = ok Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling expiration (rlm_expiration) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from expiration (rlm_expiration) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [expiration] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling logintime (rlm_logintime) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from logintime (rlm_logintime) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [logintime] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling pap (rlm_pap) for request 154 Mon Jun 8 05:57:20 2015 : WARNING: (154) pap: No "known good" password found for the user. Not setting Auth-Type Mon Jun 8 05:57:20 2015 : WARNING: (154) pap: Authentication will fail unless a "known good" password is available Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from pap (rlm_pap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [pap] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) } # authorize = updated Mon Jun 8 05:57:20 2015 : Debug: (154) Found Auth-Type = EAP Mon Jun 8 05:57:20 2015 : Debug: (154) # Executing group from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (154) authenticate { Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authenticate]: calling eap (rlm_eap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Expiring EAP session with state 0x209817dc23000ee7 Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Finished EAP session with state 0x209817dc23000ee7 Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Previous EAP request found for state 0x209817dc23000ee7, released from the list Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Peer sent method NAK (3) Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Peer NAK'd our request for PEAP (25) with a request for PEAP (25), skipping... Mon Jun 8 05:57:20 2015 : ERROR: (154) eap: No mutually acceptable types found Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Failed in EAP select Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authenticate]: returned from eap (rlm_eap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [eap] = invalid Mon Jun 8 05:57:20 2015 : Debug: (154) } # authenticate = invalid Mon Jun 8 05:57:20 2015 : Debug: (154) Failed to authenticate the user Mon Jun 8 05:57:20 2015 : Debug: (154) Using Post-Auth-Type Reject Mon Jun 8 05:57:20 2015 : Debug: (154) # Executing group from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (154) Post-Auth-Type REJECT { Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 154 Mon Jun 8 05:57:20 2015 : Debug: %{User-Name} Mon Jun 8 05:57:20 2015 : Debug: Parsed xlat tree: Mon Jun 8 05:57:20 2015 : Debug: attribute --> User-Name Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: EXPAND %{User-Name} Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: --> ctc Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: Matched entry DEFAULT at line 18 Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: Attribute "Framed-Protocol" allowed by 0 rules, disallowed by 0 rules Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: Attribute "Framed-Compression" allowed by 0 rules, disallowed by 0 rules Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: EAP-Message = 0x04980004 allowed by EAP-Message =* 0x Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: Attribute "EAP-Message" allowed by 1 rules, disallowed by 0 rules Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: Message-Authenticator = 0x00000000000000000000000000000000 allowed by Message-Authenticator =* 0x Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: Attribute "Message-Authenticator" allowed by 1 rules, disallowed by 0 rules Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [attr_filter.access_reject] = updated Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[post-auth]: calling eap (rlm_eap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[post-auth]: returned from eap (rlm_eap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [eap] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) policy remove_reply_message_if_eap { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&reply:EAP-Message && &reply:Reply-Message) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) else { Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[post-auth]: calling noop (rlm_always) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[post-auth]: returned from noop (rlm_always) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [noop] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) } # else = noop Mon Jun 8 05:57:20 2015 : Debug: (154) } # policy remove_reply_message_if_eap = noop Mon Jun 8 05:57:20 2015 : Debug: (154) } # Post-Auth-Type REJECT = updated Mon Jun 8 05:57:20 2015 : Debug: (154) Delaying response for 1.000000 seconds Mon Jun 8 05:57:20 2015 : Debug: Waking up in 0.3 seconds. Mon Jun 8 05:57:20 2015 : Debug: Waking up in 0.6 seconds. Mon Jun 8 05:57:21 2015 : Debug: (154) <delay>: Sending delayed response Mon Jun 8 05:57:21 2015 : Debug: (154) <delay>: Sent Access-Reject Id 50 from 192.168.3.48:1812 to 192.168.3.201:1024 length 44 Mon Jun 8 05:57:21 2015 : Debug: (154) <delay>: EAP-Message = 0x04980004 Mon Jun 8 05:57:21 2015 : Debug: (154) <delay>: Message-Authenticator = 0x00000000000000000000000000000000 Mon Jun 8 05:57:21 2015 : Debug: Waking up in 3.9 seconds. Mon Jun 8 05:57:25 2015 : Debug: (151) <done>: Cleaning up request packet ID 47 with timestamp +1844 Mon Jun 8 05:57:25 2015 : Debug: (152) <done>: Cleaning up request packet ID 48 with timestamp +1844 Mon Jun 8 05:57:25 2015 : Debug: (153) <done>: Cleaning up request packet ID 49 with timestamp +1844 Mon Jun 8 05:57:25 2015 : Debug: (154) <delay>: Cleaning up request packet ID 50 with timestamp +1844 Mon Jun 8 05:57:25 2015 : Debug: Waking up in 4.7 seconds. Mon Jun 8 05:57:29 2015 : Debug: (150) <done>: Cleaning up request packet ID 46 with timestamp +1838 Mon Jun 8 05:57:29 2015 : Info: Ready to process requests

3 2

[freeradius-server 3.0.8] errors while compiling
by ICHIBA Sara 10 Jun '15

10 Jun '15

hey, I'm trying to install freeradius-server 3.0.8. I installed successfully talloc 2.1.0 but when I do ./configure in order to install freeradius I have these errors and warnings configure: WARNING: snmpget not found - Simultaneous-Use and checkrad may not work configure: WARNING: snmpwalk not found - Simultaneous-Use and checkrad may not work configure: WARNING: pcap library not found, silently disabling the RADIUS sniffer, and ARP listener. Use --with-pc ap-lib-dir=<path>. configure: WARNING: collectdclient library not found. Use --with-collectdclient-lib-dir=<path>. configure: WARNING: cap library not found, debugger checks will not be enabled. Use --with-cap-lib-dir=<path>. configure: error: in `/root/freeradius-server-3.0.8': configure: error: failed linking to libcrypto. Use --with-openssl-lib-dir=<path>, or --with-openssl=no (builds with out OpenSSL) See `config.log' for more details you can find the complete output of the compilation in the file attached. I'm running on centOS 7.

4 9