- Freeradius-Users - lists.freeradius.org

Installation freeradius server failed
by Muhammad Hasan 18 Jun '14

18 Jun '14

Hi, I want to ask something about installation freeradius server. actually I want to try eap-sim on freeradius 2.2.5 in ubuntu sever 12.04 the step that I was tried are like these: 1. apt-get install dpkg-dev 2. apt-get build-dep freeradius 3. tar xvzf freeradius-server-2.2.5.tar.gz 4. install the packets: a. dpkg -i libfreeradius2_2.2.5+git_i386.deb b. dpkg -i freeradius-common_2.2.5+git_i386.deb c. dpkg -i freeradius-utils_2.2.5+git_i386.deb d. dpkg -i freeradius_2.2.5+git_i386.deb I got failed when the step 4(d). * Checking Freeradius daemon configuration... [fail] invoke-rc.d: initscript freeradius, action "restart" failed Precessing triggers for ureadahead... this is result when i try freeradius -X command: libssl version mismatch. built with: 1000105f linked: 1000100f the problem is mismatch libssl? but I was trying to find the same version. so what should I do? -- Best Regards, Email : muhhasan.1311(a)gmail.com CP : 085694394257

5 11

LDAP auth
by Jon Jenkins 17 Jun '14

17 Jun '14

Hello, I am having some trouble authorizing off ldap from APs - please see the debug below, and let me know if there is anything else I can provide. I am looking at this snippet from the below: ------------------------------------------------------------------------------- Tue Jun 17 11:53:43 2014 : Info: [ldap] user jjenkins authorized to use remote access Tue Jun 17 11:53:43 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Jun 17 11:53:43 2014 : Info: ++[ldap] returns ok Tue Jun 17 11:53:43 2014 : Info: ++[expiration] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[logintime] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[pap] returns noop Tue Jun 17 11:53:43 2014 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the ------------------------------------------------------------------------------- It would seem that my connection to my ldap server is ok, and it finds that my user is authorized - the part that plagues me is why ldap returns ok but the ERROR shows up about no authentication method (Auth-Type) is found. I have made sure that the Auth-Type LDAP section within sites-enabled/default is un-commented, so I am confused why I get that error. I appreciate your time and attention. Best, Jon Full Debug: ------------------------------------------------------------------------------- Tue Jun 17 11:53:32 2014 : Info: FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 3 2012 at 01:22:51 Tue Jun 17 11:53:32 2014 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Tue Jun 17 11:53:32 2014 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Tue Jun 17 11:53:32 2014 : Info: PARTICULAR PURPOSE. Tue Jun 17 11:53:32 2014 : Info: You may redistribute copies of FreeRADIUS under the terms of the Tue Jun 17 11:53:32 2014 : Info: GNU General Public License v2. Tue Jun 17 11:53:32 2014 : Info: Starting - reading configuration files ... Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/radiusd.conf Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/proxy.conf Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/clients.conf Tue Jun 17 11:53:32 2014 : Debug: including files in directory /etc/raddb/modules/ Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/mac2vlan Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/detail Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/passwd Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/pap Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/ldap Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/detail.example.com Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/checkval Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/dynamic_clients Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/radutmp Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/redis Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/expr Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/smbpasswd Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/always Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/counter Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/attr_filter Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/otp Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/chap Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/echo Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/attr_rewrite Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/perl Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/digest Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/mac2ip Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/smsotp Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/linelog Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/detail.log Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/expiration Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/mschap Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/files Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/soh Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/pam Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/opendirectory Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/wimax Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/etc_group Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/ippool Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/replicate Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/rediswho Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/sql_log Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/policy Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/inner-eap Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/sqlcounter_expire_on_login Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/exec Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/ntlm_auth Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/cui Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/realm Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/preprocess Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/unix Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/acct_unique Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/sradutmp Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/modules/logintime Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/eap.conf Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/policy.conf Tue Jun 17 11:53:32 2014 : Debug: including files in directory /etc/raddb/sites-enabled/ Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/sites-enabled/inner-tunnel Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:32 2014 : Debug: including configuration file /etc/raddb/sites-enabled/control-socket Tue Jun 17 11:53:32 2014 : Debug: main { Tue Jun 17 11:53:32 2014 : Debug: user = "radiusd" Tue Jun 17 11:53:32 2014 : Debug: group = "radiusd" Tue Jun 17 11:53:32 2014 : Debug: allow_core_dumps = no Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: including dictionary file /etc/raddb/dictionary Tue Jun 17 11:53:32 2014 : Debug: main { Tue Jun 17 11:53:32 2014 : Debug: name = "radiusd" Tue Jun 17 11:53:32 2014 : Debug: prefix = "/usr" Tue Jun 17 11:53:32 2014 : Debug: localstatedir = "/var" Tue Jun 17 11:53:32 2014 : Debug: sbindir = "/usr/sbin" Tue Jun 17 11:53:32 2014 : Debug: logdir = "/var/log/radius" Tue Jun 17 11:53:32 2014 : Debug: run_dir = "/var/run/radiusd" Tue Jun 17 11:53:32 2014 : Debug: libdir = "/usr/lib64/freeradius" Tue Jun 17 11:53:32 2014 : Debug: radacctdir = "/var/log/radius/radacct" Tue Jun 17 11:53:32 2014 : Debug: hostname_lookups = no Tue Jun 17 11:53:32 2014 : Debug: max_request_time = 30 Tue Jun 17 11:53:32 2014 : Debug: cleanup_delay = 5 Tue Jun 17 11:53:32 2014 : Debug: max_requests = 1024 Tue Jun 17 11:53:32 2014 : Debug: pidfile = "/var/run/radiusd/radiusd.pid" Tue Jun 17 11:53:32 2014 : Debug: checkrad = "/usr/sbin/checkrad" Tue Jun 17 11:53:32 2014 : Debug: debug_level = 0 Tue Jun 17 11:53:32 2014 : Debug: proxy_requests = yes Tue Jun 17 11:53:32 2014 : Debug: log { Tue Jun 17 11:53:32 2014 : Debug: stripped_names = no Tue Jun 17 11:53:32 2014 : Debug: auth = no Tue Jun 17 11:53:32 2014 : Debug: auth_badpass = no Tue Jun 17 11:53:32 2014 : Debug: auth_goodpass = no Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: security { Tue Jun 17 11:53:32 2014 : Debug: max_attributes = 200 Tue Jun 17 11:53:32 2014 : Debug: reject_delay = 1 Tue Jun 17 11:53:32 2014 : Debug: status_server = yes Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: radiusd: #### Loading Realms and Home Servers #### Tue Jun 17 11:53:32 2014 : Debug: proxy server { Tue Jun 17 11:53:32 2014 : Debug: retry_delay = 5 Tue Jun 17 11:53:32 2014 : Debug: retry_count = 3 Tue Jun 17 11:53:32 2014 : Debug: default_fallback = no Tue Jun 17 11:53:32 2014 : Debug: dead_time = 120 Tue Jun 17 11:53:32 2014 : Debug: wake_all_if_all_dead = no Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: home_server localhost { Tue Jun 17 11:53:32 2014 : Debug: ipaddr = 127.0.0.1 Tue Jun 17 11:53:32 2014 : Debug: port = 1812 Tue Jun 17 11:53:32 2014 : Debug: type = "auth" Tue Jun 17 11:53:32 2014 : Debug: secret = "testing123" Tue Jun 17 11:53:32 2014 : Debug: response_window = 20 Tue Jun 17 11:53:32 2014 : Debug: max_outstanding = 65536 Tue Jun 17 11:53:32 2014 : Debug: require_message_authenticator = yes Tue Jun 17 11:53:32 2014 : Debug: zombie_period = 40 Tue Jun 17 11:53:32 2014 : Debug: status_check = "status-server" Tue Jun 17 11:53:32 2014 : Debug: ping_interval = 30 Tue Jun 17 11:53:32 2014 : Debug: check_interval = 30 Tue Jun 17 11:53:32 2014 : Debug: num_answers_to_alive = 3 Tue Jun 17 11:53:32 2014 : Debug: num_pings_to_alive = 3 Tue Jun 17 11:53:32 2014 : Debug: revive_interval = 120 Tue Jun 17 11:53:32 2014 : Debug: status_check_timeout = 4 Tue Jun 17 11:53:32 2014 : Debug: coa { Tue Jun 17 11:53:32 2014 : Debug: irt = 2 Tue Jun 17 11:53:32 2014 : Debug: mrt = 16 Tue Jun 17 11:53:32 2014 : Debug: mrc = 5 Tue Jun 17 11:53:32 2014 : Debug: mrd = 30 Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: home_server_pool my_auth_failover { Tue Jun 17 11:53:32 2014 : Debug: type = fail-over Tue Jun 17 11:53:32 2014 : Debug: home_server = localhost Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: realm example.com { Tue Jun 17 11:53:32 2014 : Debug: auth_pool = my_auth_failover Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: realm LOCAL { Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: radiusd: #### Loading Clients #### Tue Jun 17 11:53:32 2014 : Debug: client localhost { Tue Jun 17 11:53:32 2014 : Debug: ipaddr = 127.0.0.1 Tue Jun 17 11:53:32 2014 : Debug: require_message_authenticator = no Tue Jun 17 11:53:32 2014 : Debug: secret = "testing123" Tue Jun 17 11:53:32 2014 : Debug: nastype = "other" Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: client 172.16.210.0/24 { Tue Jun 17 11:53:32 2014 : Debug: require_message_authenticator = no Tue Jun 17 11:53:32 2014 : Debug: secret = "1ctllc2" Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: radiusd: #### Instantiating modules #### Tue Jun 17 11:53:32 2014 : Debug: instantiate { Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_exec, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_exec Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "exec" from file /etc/raddb/modules/exec Tue Jun 17 11:53:32 2014 : Debug: exec { Tue Jun 17 11:53:32 2014 : Debug: wait = no Tue Jun 17 11:53:32 2014 : Debug: input_pairs = "request" Tue Jun 17 11:53:32 2014 : Debug: shell_escape = yes Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_expr, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_expr Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "expr" from file /etc/raddb/modules/expr Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_expiration, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_expiration Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration Tue Jun 17 11:53:32 2014 : Debug: expiration { Tue Jun 17 11:53:32 2014 : Debug: reply-message = "Password Has Expired " Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_logintime, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_logintime Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime Tue Jun 17 11:53:32 2014 : Debug: logintime { Tue Jun 17 11:53:32 2014 : Debug: reply-message = "You are calling outside your allowed timespan " Tue Jun 17 11:53:32 2014 : Debug: minimum-timeout = 60 Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: radiusd: #### Loading Virtual Servers #### Tue Jun 17 11:53:32 2014 : Debug: server { # from file /etc/raddb/radiusd.conf Tue Jun 17 11:53:32 2014 : Debug: modules { Tue Jun 17 11:53:32 2014 : Debug: Module: Creating Auth-Type = digest Tue Jun 17 11:53:32 2014 : Debug: Module: Creating Auth-Type = LDAP Tue Jun 17 11:53:32 2014 : Debug: Module: Creating Post-Auth-Type = REJECT Tue Jun 17 11:53:32 2014 : Debug: Module: Checking authenticate {...} for more modules to load Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_pap, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_pap Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "pap" from file /etc/raddb/modules/pap Tue Jun 17 11:53:32 2014 : Debug: pap { Tue Jun 17 11:53:32 2014 : Debug: encryption_scheme = "auto" Tue Jun 17 11:53:32 2014 : Debug: auto_header = no Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_chap, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_chap Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "chap" from file /etc/raddb/modules/chap Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_mschap, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_mschap Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap Tue Jun 17 11:53:32 2014 : Debug: mschap { Tue Jun 17 11:53:32 2014 : Debug: use_mppe = yes Tue Jun 17 11:53:32 2014 : Debug: require_encryption = no Tue Jun 17 11:53:32 2014 : Debug: require_strong = no Tue Jun 17 11:53:32 2014 : Debug: with_ntdomain_hack = no Tue Jun 17 11:53:32 2014 : Debug: allow_retry = yes Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_digest, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_digest Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "digest" from file /etc/raddb/modules/digest Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_unix, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_unix Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "unix" from file /etc/raddb/modules/unix Tue Jun 17 11:53:32 2014 : Debug: unix { Tue Jun 17 11:53:32 2014 : Debug: radwtmp = "/var/log/radius/radwtmp" Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_ldap, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_ldap Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap Tue Jun 17 11:53:32 2014 : Debug: ldap { Tue Jun 17 11:53:32 2014 : Debug: server = "localhost" Tue Jun 17 11:53:32 2014 : Debug: port = 389 Tue Jun 17 11:53:32 2014 : Debug: password = "" Tue Jun 17 11:53:32 2014 : Debug: identity = "" Tue Jun 17 11:53:32 2014 : Debug: net_timeout = 1 Tue Jun 17 11:53:32 2014 : Debug: timeout = 4 Tue Jun 17 11:53:32 2014 : Debug: timelimit = 3 Tue Jun 17 11:53:32 2014 : Debug: tls_mode = no Tue Jun 17 11:53:32 2014 : Debug: start_tls = no Tue Jun 17 11:53:32 2014 : Debug: tls_require_cert = "allow" Tue Jun 17 11:53:32 2014 : Debug: tls { Tue Jun 17 11:53:32 2014 : Debug: start_tls = yes Tue Jun 17 11:53:32 2014 : Debug: cacertfile = "/etc/ipa/ca.crt" Tue Jun 17 11:53:32 2014 : Debug: require_cert = "allow" Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: basedn = "cn=accounts,dc=csi,dc=com" Tue Jun 17 11:53:32 2014 : Debug: filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" Tue Jun 17 11:53:32 2014 : Debug: base_filter = "(objectclass=radiusprofile)" Tue Jun 17 11:53:32 2014 : Debug: auto_header = no Tue Jun 17 11:53:32 2014 : Debug: access_attr_used_for_allow = yes Tue Jun 17 11:53:32 2014 : Debug: groupname_attribute = "cn" Tue Jun 17 11:53:32 2014 : Debug: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" Tue Jun 17 11:53:32 2014 : Debug: dictionary_mapping = "/etc/raddb/ldap.attrmap" Tue Jun 17 11:53:32 2014 : Debug: ldap_debug = 0 Tue Jun 17 11:53:32 2014 : Debug: ldap_connections_number = 5 Tue Jun 17 11:53:32 2014 : Debug: compare_check_items = no Tue Jun 17 11:53:32 2014 : Debug: do_xlat = yes Tue Jun 17 11:53:32 2014 : Debug: set_auth_type = yes Tue Jun 17 11:53:32 2014 : Debug: keepalive { Tue Jun 17 11:53:32 2014 : Debug: idle = 60 Tue Jun 17 11:53:32 2014 : Debug: probes = 3 Tue Jun 17 11:53:32 2014 : Debug: interval = 3 Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: Registering ldap_groupcmp for Ldap-Group Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: Registering ldap_xlat with xlat_name ldap Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusClass mapped to RADIUS Class Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type Tue Jun 17 11:53:32 2014 : Debug: rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id Tue Jun 17 11:53:32 2014 : Debug: conns: 0x7f3f6ad123f0 Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_eap, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_eap Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "eap" from file /etc/raddb/eap.conf Tue Jun 17 11:53:32 2014 : Debug: eap { Tue Jun 17 11:53:32 2014 : Debug: default_eap_type = "md5" Tue Jun 17 11:53:32 2014 : Debug: timer_expire = 60 Tue Jun 17 11:53:32 2014 : Debug: ignore_unknown_eap_types = no Tue Jun 17 11:53:32 2014 : Debug: cisco_accounting_username_bug = no Tue Jun 17 11:53:32 2014 : Debug: max_sessions = 4096 Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to sub-module rlm_eap_md5 Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating eap-md5 Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to sub-module rlm_eap_leap Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating eap-leap Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to sub-module rlm_eap_gtc Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating eap-gtc Tue Jun 17 11:53:32 2014 : Debug: gtc { Tue Jun 17 11:53:32 2014 : Debug: challenge = "Password: " Tue Jun 17 11:53:32 2014 : Debug: auth_type = "PAP" Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to sub-module rlm_eap_tls Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating eap-tls Tue Jun 17 11:53:32 2014 : Debug: tls { Tue Jun 17 11:53:32 2014 : Debug: rsa_key_exchange = no Tue Jun 17 11:53:32 2014 : Debug: dh_key_exchange = yes Tue Jun 17 11:53:32 2014 : Debug: rsa_key_length = 512 Tue Jun 17 11:53:32 2014 : Debug: dh_key_length = 512 Tue Jun 17 11:53:32 2014 : Debug: verify_depth = 0 Tue Jun 17 11:53:32 2014 : Debug: CA_path = "/etc/raddb/certs" Tue Jun 17 11:53:32 2014 : Debug: pem_file_type = yes Tue Jun 17 11:53:32 2014 : Debug: private_key_file = "/etc/raddb/certs/server.pem" Tue Jun 17 11:53:32 2014 : Debug: certificate_file = "/etc/raddb/certs/server.pem" Tue Jun 17 11:53:32 2014 : Debug: CA_file = "/etc/raddb/certs/ca.pem" Tue Jun 17 11:53:32 2014 : Debug: private_key_password = "whatever" Tue Jun 17 11:53:32 2014 : Debug: dh_file = "/etc/raddb/certs/dh" Tue Jun 17 11:53:32 2014 : Debug: random_file = "/etc/raddb/certs/random" Tue Jun 17 11:53:32 2014 : Debug: fragment_size = 1024 Tue Jun 17 11:53:32 2014 : Debug: include_length = yes Tue Jun 17 11:53:32 2014 : Debug: check_crl = no Tue Jun 17 11:53:32 2014 : Debug: cipher_list = "DEFAULT" Tue Jun 17 11:53:32 2014 : Debug: cache { Tue Jun 17 11:53:32 2014 : Debug: enable = no Tue Jun 17 11:53:32 2014 : Debug: lifetime = 24 Tue Jun 17 11:53:32 2014 : Debug: max_entries = 255 Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: verify { Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: ocsp { Tue Jun 17 11:53:32 2014 : Debug: enable = no Tue Jun 17 11:53:32 2014 : Debug: override_cert_url = yes Tue Jun 17 11:53:32 2014 : Debug: url = "http://127.0.0.1/ocsp/" Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to sub-module rlm_eap_ttls Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating eap-ttls Tue Jun 17 11:53:32 2014 : Debug: ttls { Tue Jun 17 11:53:32 2014 : Debug: default_eap_type = "md5" Tue Jun 17 11:53:32 2014 : Debug: copy_request_to_tunnel = no Tue Jun 17 11:53:32 2014 : Debug: use_tunneled_reply = no Tue Jun 17 11:53:32 2014 : Debug: virtual_server = "inner-tunnel" Tue Jun 17 11:53:32 2014 : Debug: include_length = yes Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to sub-module rlm_eap_peap Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating eap-peap Tue Jun 17 11:53:32 2014 : Debug: peap { Tue Jun 17 11:53:32 2014 : Debug: default_eap_type = "mschapv2" Tue Jun 17 11:53:32 2014 : Debug: copy_request_to_tunnel = no Tue Jun 17 11:53:32 2014 : Debug: use_tunneled_reply = no Tue Jun 17 11:53:32 2014 : Debug: proxy_tunneled_request_as_eap = yes Tue Jun 17 11:53:32 2014 : Debug: virtual_server = "inner-tunnel" Tue Jun 17 11:53:32 2014 : Debug: soh = no Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating eap-mschapv2 Tue Jun 17 11:53:32 2014 : Debug: mschapv2 { Tue Jun 17 11:53:32 2014 : Debug: with_ntdomain_hack = no Tue Jun 17 11:53:32 2014 : Debug: send_error = no Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: Module: Checking authorize {...} for more modules to load Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_preprocess, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_preprocess Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess Tue Jun 17 11:53:32 2014 : Debug: preprocess { Tue Jun 17 11:53:32 2014 : Debug: huntgroups = "/etc/raddb/huntgroups" Tue Jun 17 11:53:32 2014 : Debug: hints = "/etc/raddb/hints" Tue Jun 17 11:53:32 2014 : Debug: with_ascend_hack = no Tue Jun 17 11:53:32 2014 : Debug: ascend_channels_per_line = 23 Tue Jun 17 11:53:32 2014 : Debug: with_ntdomain_hack = no Tue Jun 17 11:53:32 2014 : Debug: with_specialix_jetstream_hack = no Tue Jun 17 11:53:32 2014 : Debug: with_cisco_vsa_hack = no Tue Jun 17 11:53:32 2014 : Debug: with_alvarion_vsa_hack = no Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_realm, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_realm Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "suffix" from file /etc/raddb/modules/realm Tue Jun 17 11:53:32 2014 : Debug: realm suffix { Tue Jun 17 11:53:32 2014 : Debug: format = "suffix" Tue Jun 17 11:53:32 2014 : Debug: delimiter = "@" Tue Jun 17 11:53:32 2014 : Debug: ignore_default = no Tue Jun 17 11:53:32 2014 : Debug: ignore_null = no Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_files, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_files Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "files" from file /etc/raddb/modules/files Tue Jun 17 11:53:32 2014 : Debug: files { Tue Jun 17 11:53:32 2014 : Debug: usersfile = "/etc/raddb/users" Tue Jun 17 11:53:32 2014 : Debug: acctusersfile = "/etc/raddb/acct_users" Tue Jun 17 11:53:32 2014 : Debug: preproxy_usersfile = "/etc/raddb/preproxy_users" Tue Jun 17 11:53:32 2014 : Debug: compat = "no" Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: Module: Checking preacct {...} for more modules to load Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_acct_unique Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique Tue Jun 17 11:53:32 2014 : Debug: acct_unique { Tue Jun 17 11:53:32 2014 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: Module: Checking accounting {...} for more modules to load Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_detail, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_detail Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "detail" from file /etc/raddb/modules/detail Tue Jun 17 11:53:32 2014 : Debug: detail { Tue Jun 17 11:53:32 2014 : Debug: detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" Tue Jun 17 11:53:32 2014 : Debug: header = "%t" Tue Jun 17 11:53:32 2014 : Debug: detailperm = 384 Tue Jun 17 11:53:32 2014 : Debug: dirperm = 493 Tue Jun 17 11:53:32 2014 : Debug: locking = no Tue Jun 17 11:53:32 2014 : Debug: log_packet_header = no Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_radutmp, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_radutmp Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp Tue Jun 17 11:53:32 2014 : Debug: radutmp { Tue Jun 17 11:53:32 2014 : Debug: filename = "/var/log/radius/radutmp" Tue Jun 17 11:53:32 2014 : Debug: username = "%{User-Name}" Tue Jun 17 11:53:32 2014 : Debug: case_sensitive = yes Tue Jun 17 11:53:32 2014 : Debug: check_with_nas = yes Tue Jun 17 11:53:32 2014 : Debug: perm = 384 Tue Jun 17 11:53:32 2014 : Debug: callerid = yes Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Tue Jun 17 11:53:32 2014 : Debug: Module: Linked to module rlm_attr_filter Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter Tue Jun 17 11:53:32 2014 : Debug: attr_filter attr_filter.accounting_response { Tue Jun 17 11:53:32 2014 : Debug: attrsfile = "/etc/raddb/attrs.accounting_response" Tue Jun 17 11:53:32 2014 : Debug: key = "%{User-Name}" Tue Jun 17 11:53:32 2014 : Debug: relaxed = no Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: Module: Checking session {...} for more modules to load Tue Jun 17 11:53:32 2014 : Debug: Module: Checking post-proxy {...} for more modules to load Tue Jun 17 11:53:32 2014 : Debug: Module: Checking post-auth {...} for more modules to load Tue Jun 17 11:53:32 2014 : Debug: Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter Tue Jun 17 11:53:32 2014 : Debug: attr_filter attr_filter.access_reject { Tue Jun 17 11:53:32 2014 : Debug: attrsfile = "/etc/raddb/attrs.access_reject" Tue Jun 17 11:53:32 2014 : Debug: key = "%{User-Name}" Tue Jun 17 11:53:32 2014 : Debug: relaxed = no Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: } # modules Tue Jun 17 11:53:32 2014 : Debug: } # server Tue Jun 17 11:53:32 2014 : Debug: server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel Tue Jun 17 11:53:32 2014 : Debug: modules { Tue Jun 17 11:53:32 2014 : Debug: Module: Checking authenticate {...} for more modules to load Tue Jun 17 11:53:32 2014 : Debug: Module: Checking authorize {...} for more modules to load Tue Jun 17 11:53:32 2014 : Debug: Module: Checking session {...} for more modules to load Tue Jun 17 11:53:32 2014 : Debug: Module: Checking post-auth {...} for more modules to load Tue Jun 17 11:53:32 2014 : Debug: } # modules Tue Jun 17 11:53:32 2014 : Debug: } # server Tue Jun 17 11:53:32 2014 : Debug: radiusd: #### Opening IP addresses and Ports #### Tue Jun 17 11:53:32 2014 : Debug: listen { Tue Jun 17 11:53:32 2014 : Debug: type = "auth" Tue Jun 17 11:53:32 2014 : Debug: ipaddr = * Tue Jun 17 11:53:32 2014 : Debug: port = 0 Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: listen { Tue Jun 17 11:53:32 2014 : Debug: type = "acct" Tue Jun 17 11:53:32 2014 : Debug: ipaddr = * Tue Jun 17 11:53:32 2014 : Debug: port = 0 Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: listen { Tue Jun 17 11:53:32 2014 : Debug: type = "control" Tue Jun 17 11:53:32 2014 : Debug: listen { Tue Jun 17 11:53:32 2014 : Debug: socket = "/var/run/radiusd/radiusd.sock" Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Debug: listen { Tue Jun 17 11:53:32 2014 : Debug: type = "auth" Tue Jun 17 11:53:32 2014 : Debug: ipaddr = 127.0.0.1 Tue Jun 17 11:53:32 2014 : Debug: port = 18120 Tue Jun 17 11:53:32 2014 : Debug: } Tue Jun 17 11:53:32 2014 : Info: ... adding new socket proxy address * port 32876 Tue Jun 17 11:53:32 2014 : Debug: Listening on authentication address * port 1812 Tue Jun 17 11:53:32 2014 : Debug: Listening on accounting address * port 1813 Tue Jun 17 11:53:32 2014 : Debug: Listening on command file /var/run/radiusd/radiusd.sock Tue Jun 17 11:53:32 2014 : Debug: Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Tue Jun 17 11:53:32 2014 : Debug: Listening on proxy address * port 1814 Tue Jun 17 11:53:32 2014 : Info: Ready to process requests. rad_recv: Access-Request packet from host 172.16.210.102 port 1042, id=34, length=145 User-Name = "jjenkins" NAS-Port = 0 Called-Station-Id = "2E-A4-3C-65-D0-22:CSI" Calling-Station-Id = "84-A6-C8-EE-38-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0241000d016a6a656e6b696e73 Message-Authenticator = 0x32a743ad981f661101a2cd28a0b8000d Tue Jun 17 11:53:40 2014 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:40 2014 : Info: +- entering group authorize {...} Tue Jun 17 11:53:40 2014 : Info: ++[preprocess] returns ok Tue Jun 17 11:53:40 2014 : Info: ++[chap] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[mschap] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[digest] returns noop Tue Jun 17 11:53:40 2014 : Info: [suffix] No '@' in User-Name = "jjenkins", looking up realm NULL Tue Jun 17 11:53:40 2014 : Info: [suffix] No such realm "NULL" Tue Jun 17 11:53:40 2014 : Info: ++[suffix] returns noop Tue Jun 17 11:53:40 2014 : Info: [eap] EAP packet type response id 65 length 13 Tue Jun 17 11:53:40 2014 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Jun 17 11:53:40 2014 : Info: ++[eap] returns updated Tue Jun 17 11:53:40 2014 : Info: ++[files] returns noop Tue Jun 17 11:53:40 2014 : Info: [ldap] performing user authorization for jjenkins Tue Jun 17 11:53:40 2014 : Info: [ldap] expand: %{Stripped-User-Name} -> Tue Jun 17 11:53:40 2014 : Info: [ldap] ... expanding second conditional Tue Jun 17 11:53:40 2014 : Info: [ldap] expand: %{User-Name} -> jjenkins Tue Jun 17 11:53:40 2014 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=jjenkins) Tue Jun 17 11:53:40 2014 : Info: [ldap] expand: cn=accounts,dc=csi,dc=com -> cn=accounts,dc=csi,dc=com Tue Jun 17 11:53:40 2014 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Jun 17 11:53:40 2014 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Jun 17 11:53:40 2014 : Debug: [ldap] attempting LDAP reconnection Tue Jun 17 11:53:40 2014 : Debug: [ldap] (re)connect to localhost:389, authentication 0 Tue Jun 17 11:53:40 2014 : Debug: [ldap] setting TLS CACert File to /etc/ipa/ca.crt Tue Jun 17 11:53:40 2014 : Debug: [ldap] starting TLS Tue Jun 17 11:53:40 2014 : Debug: [ldap] bind as / to localhost:389 Tue Jun 17 11:53:40 2014 : Debug: [ldap] waiting for bind result ... Tue Jun 17 11:53:40 2014 : Debug: [ldap] Bind was successful Tue Jun 17 11:53:40 2014 : Debug: [ldap] performing search in cn=accounts,dc=csi,dc=com, with filter (uid=jjenkins) Tue Jun 17 11:53:40 2014 : Info: [ldap] looking for check items in directory... Tue Jun 17 11:53:40 2014 : Info: [ldap] looking for reply items in directory... Tue Jun 17 11:53:40 2014 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Jun 17 11:53:40 2014 : Info: [ldap] user jjenkins authorized to use remote access Tue Jun 17 11:53:40 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Jun 17 11:53:40 2014 : Info: ++[ldap] returns ok Tue Jun 17 11:53:40 2014 : Info: ++[expiration] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[logintime] returns noop Tue Jun 17 11:53:40 2014 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Jun 17 11:53:40 2014 : Info: ++[pap] returns noop Tue Jun 17 11:53:40 2014 : Info: Found Auth-Type = EAP Tue Jun 17 11:53:40 2014 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:40 2014 : Info: +- entering group authenticate {...} Tue Jun 17 11:53:40 2014 : Info: [eap] EAP Identity Tue Jun 17 11:53:40 2014 : Info: [eap] processing type md5 Tue Jun 17 11:53:40 2014 : Debug: rlm_eap_md5: Issuing Challenge Tue Jun 17 11:53:40 2014 : Info: ++[eap] returns handled Sending Access-Challenge of id 34 to 172.16.210.102 port 1042 EAP-Message = 0x014200160410317c801f5d97eea9e5403dece06dc9ae Message-Authenticator = 0x00000000000000000000000000000000 State = 0xafb682b9aff4865d9c2f9d64fb6bc98c Tue Jun 17 11:53:40 2014 : Info: Finished request 0. Tue Jun 17 11:53:40 2014 : Debug: Going to the next request Tue Jun 17 11:53:40 2014 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.210.102 port 1042, id=35, length=159 User-Name = "jjenkins" NAS-Port = 0 Called-Station-Id = "2E-A4-3C-65-D0-22:CSI" Calling-Station-Id = "84-A6-C8-EE-38-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x024200090319152b11 State = 0xafb682b9aff4865d9c2f9d64fb6bc98c Message-Authenticator = 0xc5744302be2f36ef8d669c4dbc6de8b8 Tue Jun 17 11:53:40 2014 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:40 2014 : Info: +- entering group authorize {...} Tue Jun 17 11:53:40 2014 : Info: ++[preprocess] returns ok Tue Jun 17 11:53:40 2014 : Info: ++[chap] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[mschap] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[digest] returns noop Tue Jun 17 11:53:40 2014 : Info: [suffix] No '@' in User-Name = "jjenkins", looking up realm NULL Tue Jun 17 11:53:40 2014 : Info: [suffix] No such realm "NULL" Tue Jun 17 11:53:40 2014 : Info: ++[suffix] returns noop Tue Jun 17 11:53:40 2014 : Info: [eap] EAP packet type response id 66 length 9 Tue Jun 17 11:53:40 2014 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Jun 17 11:53:40 2014 : Info: ++[eap] returns updated Tue Jun 17 11:53:40 2014 : Info: ++[files] returns noop Tue Jun 17 11:53:40 2014 : Info: [ldap] performing user authorization for jjenkins Tue Jun 17 11:53:40 2014 : Info: [ldap] expand: %{Stripped-User-Name} -> Tue Jun 17 11:53:40 2014 : Info: [ldap] ... expanding second conditional Tue Jun 17 11:53:40 2014 : Info: [ldap] expand: %{User-Name} -> jjenkins Tue Jun 17 11:53:40 2014 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=jjenkins) Tue Jun 17 11:53:40 2014 : Info: [ldap] expand: cn=accounts,dc=csi,dc=com -> cn=accounts,dc=csi,dc=com Tue Jun 17 11:53:40 2014 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Jun 17 11:53:40 2014 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Jun 17 11:53:40 2014 : Debug: [ldap] performing search in cn=accounts,dc=csi,dc=com, with filter (uid=jjenkins) Tue Jun 17 11:53:40 2014 : Info: [ldap] looking for check items in directory... Tue Jun 17 11:53:40 2014 : Info: [ldap] looking for reply items in directory... Tue Jun 17 11:53:40 2014 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Jun 17 11:53:40 2014 : Info: [ldap] user jjenkins authorized to use remote access Tue Jun 17 11:53:40 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Jun 17 11:53:40 2014 : Info: ++[ldap] returns ok Tue Jun 17 11:53:40 2014 : Info: ++[expiration] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[logintime] returns noop Tue Jun 17 11:53:40 2014 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Jun 17 11:53:40 2014 : Info: ++[pap] returns noop Tue Jun 17 11:53:40 2014 : Info: Found Auth-Type = EAP Tue Jun 17 11:53:40 2014 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:40 2014 : Info: +- entering group authenticate {...} Tue Jun 17 11:53:40 2014 : Info: [eap] Request found, released from the list Tue Jun 17 11:53:40 2014 : Info: [eap] EAP NAK Tue Jun 17 11:53:40 2014 : Info: [eap] EAP-NAK asked for EAP-Type/peap Tue Jun 17 11:53:40 2014 : Info: [eap] processing type tls Tue Jun 17 11:53:40 2014 : Info: [tls] Initiate Tue Jun 17 11:53:40 2014 : Info: [tls] Start returned 1 Tue Jun 17 11:53:40 2014 : Info: ++[eap] returns handled Sending Access-Challenge of id 35 to 172.16.210.102 port 1042 EAP-Message = 0x014300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xafb682b9aef59b5d9c2f9d64fb6bc98c Tue Jun 17 11:53:40 2014 : Info: Finished request 1. Tue Jun 17 11:53:40 2014 : Debug: Going to the next request Tue Jun 17 11:53:40 2014 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.210.102 port 1042, id=36, length=268 User-Name = "jjenkins" NAS-Port = 0 Called-Station-Id = "2E-A4-3C-65-D0-22:CSI" Calling-Station-Id = "84-A6-C8-EE-38-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0243007619800000006c160301006701000063030153a07295d1f0ceeda0128f71d91cd1d59852ae2badb19c8c7e8b18e718c65380000018c014c0130035002fc00ac00900380032000a00130005000401000022ff01000100000500050100000000000a0006000400170018000b0002010000230000 State = 0xafb682b9aef59b5d9c2f9d64fb6bc98c Message-Authenticator = 0x89a953413680f47f66c1759a24eeaab1 Tue Jun 17 11:53:40 2014 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:40 2014 : Info: +- entering group authorize {...} Tue Jun 17 11:53:40 2014 : Info: ++[preprocess] returns ok Tue Jun 17 11:53:40 2014 : Info: ++[chap] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[mschap] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[digest] returns noop Tue Jun 17 11:53:40 2014 : Info: [suffix] No '@' in User-Name = "jjenkins", looking up realm NULL Tue Jun 17 11:53:40 2014 : Info: [suffix] No such realm "NULL" Tue Jun 17 11:53:40 2014 : Info: ++[suffix] returns noop Tue Jun 17 11:53:40 2014 : Info: [eap] EAP packet type response id 67 length 118 Tue Jun 17 11:53:40 2014 : Info: [eap] Continuing tunnel setup. Tue Jun 17 11:53:40 2014 : Info: ++[eap] returns ok Tue Jun 17 11:53:40 2014 : Info: Found Auth-Type = EAP Tue Jun 17 11:53:40 2014 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:40 2014 : Info: +- entering group authenticate {...} Tue Jun 17 11:53:40 2014 : Info: [eap] Request found, released from the list Tue Jun 17 11:53:40 2014 : Info: [eap] EAP/peap Tue Jun 17 11:53:40 2014 : Info: [eap] processing type peap Tue Jun 17 11:53:40 2014 : Info: [peap] processing EAP-TLS Tue Jun 17 11:53:40 2014 : Debug: TLS Length 108 Tue Jun 17 11:53:40 2014 : Info: [peap] Length Included Tue Jun 17 11:53:40 2014 : Info: [peap] eaptls_verify returned 11 Tue Jun 17 11:53:40 2014 : Info: [peap] (other): before/accept initialization Tue Jun 17 11:53:40 2014 : Info: [peap] TLS_accept: before/accept initialization Tue Jun 17 11:53:40 2014 : Info: [peap] <<< TLS 1.0 Handshake [length 0067], ClientHello Tue Jun 17 11:53:40 2014 : Info: [peap] TLS_accept: SSLv3 read client hello A Tue Jun 17 11:53:40 2014 : Info: [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello Tue Jun 17 11:53:40 2014 : Info: [peap] TLS_accept: SSLv3 write server hello A Tue Jun 17 11:53:40 2014 : Info: [peap] >>> TLS 1.0 Handshake [length 085e], Certificate Tue Jun 17 11:53:40 2014 : Info: [peap] TLS_accept: SSLv3 write certificate A Tue Jun 17 11:53:40 2014 : Info: [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Tue Jun 17 11:53:40 2014 : Info: [peap] TLS_accept: SSLv3 write server done A Tue Jun 17 11:53:40 2014 : Info: [peap] TLS_accept: SSLv3 flush data Tue Jun 17 11:53:40 2014 : Info: [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A Tue Jun 17 11:53:40 2014 : Debug: In SSL Handshake Phase Tue Jun 17 11:53:40 2014 : Debug: In SSL Accept mode Tue Jun 17 11:53:40 2014 : Info: [peap] eaptls_process returned 13 Tue Jun 17 11:53:40 2014 : Info: [peap] EAPTLS_HANDLED Tue Jun 17 11:53:40 2014 : Info: ++[eap] returns handled Sending Access-Challenge of id 36 to 172.16.210.102 port 1042 EAP-Message = 0x0144040019c0000008a216030100310200002d030153a072940f7084c460f042c4530c4b4b37248cf354fad4b19d5808529e01326c000035000005ff01000100160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3134303631373136333134365a170d3134303831363136333134365a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100b6d103838591bad8f5fdfdb4482c6b1ce6d072e5f00b5569c61d7b99df61843c8c6ce854973146935ce173cab659fb7615eed7c58f6590 EAP-Message = 0xb610d54b50bf79cb66ccb185ea599190b03b57d6c79dde2e4802d6452071cbf25df572719e4eb6e51116735a7d29f82f0c35bef93f0467c196f6b4e18ec6d640007f4a170c0a7de4e05196d823734df72d48ddbde78303559aae3a7c98a6934ac573978d6c8bdacf06c42e48bd28bd5126a602ee4c92fb58668b73d80a86972dd4c697421e7d58c7d0ed089db386cf1fdb91cac8af45f61d08b5d4d11c45384eb630d2089ca3f68e91a4f8f764dccc8ef06f59c441479a95690af2b1d77c46a8193b6824bb0c5f4d190203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003820101009cfd EAP-Message = 0x01369f19a0040c39dc20a8ae2ee30fa334c5516aeb8150799c5b077eefa0d748033c10cb54109482e9e6848b1c111035e8ef41e4d484ccf9e1045ef9052e248c00cbc82a7972b597dff661b1e90f5ef83c3933bb84f35572984bdbc1402feae5a0f95e3902e4edccd0a8094822dc4f93fa392f4a6f6343fe9adba18811e46ef9e35552e4a58e4500a0c2cfc5b0968086a21fdcf7c52d7ed6a64c3f7bdcd61573702b77e2efed8a40cc5e52b2966e3aa5f33d500588aea852021705ea26f1a40ffa21e4615ff37c91c306449fd2777267c658f35f168a2e2169a38538c2aff35d7181df02bf1e350f2a108a584f3d398f614885b525d5fed1ae0e8a3a8b EAP-Message = 0xbd0004ab308204a73082038f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xafb682b9adf29b5d9c2f9d64fb6bc98c Tue Jun 17 11:53:40 2014 : Info: Finished request 2. Tue Jun 17 11:53:40 2014 : Debug: Going to the next request Tue Jun 17 11:53:40 2014 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.210.102 port 1042, id=37, length=156 User-Name = "jjenkins" NAS-Port = 0 Called-Station-Id = "2E-A4-3C-65-D0-22:CSI" Calling-Station-Id = "84-A6-C8-EE-38-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x024400061900 State = 0xafb682b9adf29b5d9c2f9d64fb6bc98c Message-Authenticator = 0x803a2da55bd0b52450537a3b75839783 Tue Jun 17 11:53:40 2014 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:40 2014 : Info: +- entering group authorize {...} Tue Jun 17 11:53:40 2014 : Info: ++[preprocess] returns ok Tue Jun 17 11:53:40 2014 : Info: ++[chap] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[mschap] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[digest] returns noop Tue Jun 17 11:53:40 2014 : Info: [suffix] No '@' in User-Name = "jjenkins", looking up realm NULL Tue Jun 17 11:53:40 2014 : Info: [suffix] No such realm "NULL" Tue Jun 17 11:53:40 2014 : Info: ++[suffix] returns noop Tue Jun 17 11:53:40 2014 : Info: [eap] EAP packet type response id 68 length 6 Tue Jun 17 11:53:40 2014 : Info: [eap] Continuing tunnel setup. Tue Jun 17 11:53:40 2014 : Info: ++[eap] returns ok Tue Jun 17 11:53:40 2014 : Info: Found Auth-Type = EAP Tue Jun 17 11:53:40 2014 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:40 2014 : Info: +- entering group authenticate {...} Tue Jun 17 11:53:40 2014 : Info: [eap] Request found, released from the list Tue Jun 17 11:53:40 2014 : Info: [eap] EAP/peap Tue Jun 17 11:53:40 2014 : Info: [eap] processing type peap Tue Jun 17 11:53:40 2014 : Info: [peap] processing EAP-TLS Tue Jun 17 11:53:40 2014 : Info: [peap] Received TLS ACK Tue Jun 17 11:53:40 2014 : Info: [peap] ACK handshake fragment handler Tue Jun 17 11:53:40 2014 : Info: [peap] eaptls_verify returned 1 Tue Jun 17 11:53:40 2014 : Info: [peap] eaptls_process returned 13 Tue Jun 17 11:53:40 2014 : Info: [peap] EAPTLS_HANDLED Tue Jun 17 11:53:40 2014 : Info: ++[eap] returns handled Sending Access-Challenge of id 37 to 172.16.210.102 port 1042 EAP-Message = 0x014503fc1940a00302010202090084b6b44c2fbb0908300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3134303631373136333134365a170d3134303831363136333134365a308193310b3009060355040613024652310f300d0603550408130652616469757331 EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d14425faab58dc1903ab46788008fe05a0a455bbbd97448504efffa716defed6e2de9bcea58ddfc43a13a84c180ed57498fb599c85be95fe9907cdb957c374123360930164ae1b071a8e52e3ba3843ab2f06f53b13f60b13de4e36ad326fbbaa4cd3f30ca5ec0e4b EAP-Message = 0xc2fa0793c7b474755477dc1ddeb90c27ecfbf33af6d0e2edc89cba2b7a6d10684a3e100ca16a489052402b3b30469f1296bff0167c11ddf3a68d746552887dbd2660bad06bbe4033e96b5146b507ef1a384c002dde7ae1a3b15552a58ddc4bbff38331b3c35dffd0c77ed439725a722ebab17dcf44a71e0e76b8509f1640f187d551d1cdb17d80d73836939601f70ea775095cecbe2bcc390203010001a381fb3081f8301d0603551d0e041604148274d814aac9cce5746db2efa8e26ecd5bbdd0453081c80603551d230481c03081bd80148274d814aac9cce5746db2efa8e26ecd5bbdd045a18199a48196308193310b300906035504061302465231 EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747982090084b6b44c2fbb0908300c0603551d13040530030101ff300d06092a864886f70d010105050003820101009102d14bd7998fb0396d8cafee62b869c1c313920f16166849e69ec11b63f7f9c36dbf31f5da25f3df1633cb8804e1b7d3591c89bfd7a395c8a12b2ea7682b32da4672dee4932a48825b7e EAP-Message = 0xa0e716d5dc21b548 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xafb682b9acf39b5d9c2f9d64fb6bc98c Tue Jun 17 11:53:40 2014 : Info: Finished request 3. Tue Jun 17 11:53:40 2014 : Debug: Going to the next request Tue Jun 17 11:53:40 2014 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.210.102 port 1042, id=38, length=156 User-Name = "jjenkins" NAS-Port = 0 Called-Station-Id = "2E-A4-3C-65-D0-22:CSI" Calling-Station-Id = "84-A6-C8-EE-38-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x024500061900 State = 0xafb682b9acf39b5d9c2f9d64fb6bc98c Message-Authenticator = 0x8d922699881481d5fe2062bd13e9f56b Tue Jun 17 11:53:40 2014 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:40 2014 : Info: +- entering group authorize {...} Tue Jun 17 11:53:40 2014 : Info: ++[preprocess] returns ok Tue Jun 17 11:53:40 2014 : Info: ++[chap] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[mschap] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[digest] returns noop Tue Jun 17 11:53:40 2014 : Info: [suffix] No '@' in User-Name = "jjenkins", looking up realm NULL Tue Jun 17 11:53:40 2014 : Info: [suffix] No such realm "NULL" Tue Jun 17 11:53:40 2014 : Info: ++[suffix] returns noop Tue Jun 17 11:53:40 2014 : Info: [eap] EAP packet type response id 69 length 6 Tue Jun 17 11:53:40 2014 : Info: [eap] Continuing tunnel setup. Tue Jun 17 11:53:40 2014 : Info: ++[eap] returns ok Tue Jun 17 11:53:40 2014 : Info: Found Auth-Type = EAP Tue Jun 17 11:53:40 2014 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:40 2014 : Info: +- entering group authenticate {...} Tue Jun 17 11:53:40 2014 : Info: [eap] Request found, released from the list Tue Jun 17 11:53:40 2014 : Info: [eap] EAP/peap Tue Jun 17 11:53:40 2014 : Info: [eap] processing type peap Tue Jun 17 11:53:40 2014 : Info: [peap] processing EAP-TLS Tue Jun 17 11:53:40 2014 : Info: [peap] Received TLS ACK Tue Jun 17 11:53:40 2014 : Info: [peap] ACK handshake fragment handler Tue Jun 17 11:53:40 2014 : Info: [peap] eaptls_verify returned 1 Tue Jun 17 11:53:40 2014 : Info: [peap] eaptls_process returned 13 Tue Jun 17 11:53:40 2014 : Info: [peap] EAPTLS_HANDLED Tue Jun 17 11:53:40 2014 : Info: ++[eap] returns handled Sending Access-Challenge of id 38 to 172.16.210.102 port 1042 EAP-Message = 0x014600bc19002dec37025d8c9de67c1f804d75521b05104fb4ce3a0274f11e301d5c88ca918e04417ffeb4efab394cc3f8c37d0530c9b2bde8408be97ee66b201d53743806031e57f6b27fd8272b3aa43fab118b98787a4fbd4f3fa3a83b7d496133b1711083dd18b1aa34bef580fdf7447801cbe7f4ce13774990d76bfdbca778a08fb1eebad156811815259f182c90b16042f28c7e195efad068e43dca2f408e4f57c1af3635d71e5173e37b9b19411281cb16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xafb682b9abf09b5d9c2f9d64fb6bc98c Tue Jun 17 11:53:40 2014 : Info: Finished request 4. Tue Jun 17 11:53:40 2014 : Debug: Going to the next request Tue Jun 17 11:53:40 2014 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.210.102 port 1042, id=39, length=488 User-Name = "jjenkins" NAS-Port = 0 Called-Station-Id = "2E-A4-3C-65-D0-22:CSI" Calling-Station-Id = "84-A6-C8-EE-38-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0246015019800000014616030101061000010201004ce8ace299ac5fbf94205af77a39ec4f54a0b30afddc59d8cd4ea2f9b09aa0d0ff259a29db66b77e3b124f5c1b164cd719e6979945643becffdb5d899de1c01b7d8ecd52812700fa6160de5ac87703253fc94e888c9c9db0a815dcc69736fad3947f0c8f9f918a68bf507a82a52e5b653841abee20e825f40d8cb75d54815285f08262b86e9a7cc3121217c73977e7f94a25143d87bd4873195f8b55b9eb3be85d16228bce728ce61eb7215145ca6ddaa496f022c5ae6437f7b461227aed4f1840d4caf9834174c71d5334c547632b00a72559f4b91032aa5289b39f0a008a831c058cd0b46fa222 EAP-Message = 0x00e6170adb9c99dcff3408b76c58dfc0c7daaefb46c116d41403010001011603010030c4d647870943f7859e6dbac47726a85b250024e4225859049b5bdcd4626f9534525c6fe818daf0fd5bfc6e184823c852 State = 0xafb682b9abf09b5d9c2f9d64fb6bc98c Message-Authenticator = 0x2a75ec1ed749a94aa8882486551aedad Tue Jun 17 11:53:40 2014 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:40 2014 : Info: +- entering group authorize {...} Tue Jun 17 11:53:40 2014 : Info: ++[preprocess] returns ok Tue Jun 17 11:53:40 2014 : Info: ++[chap] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[mschap] returns noop Tue Jun 17 11:53:40 2014 : Info: ++[digest] returns noop Tue Jun 17 11:53:40 2014 : Info: [suffix] No '@' in User-Name = "jjenkins", looking up realm NULL Tue Jun 17 11:53:40 2014 : Info: [suffix] No such realm "NULL" Tue Jun 17 11:53:40 2014 : Info: ++[suffix] returns noop Tue Jun 17 11:53:40 2014 : Info: [eap] EAP packet type response id 70 length 253 Tue Jun 17 11:53:40 2014 : Info: [eap] Continuing tunnel setup. Tue Jun 17 11:53:40 2014 : Info: ++[eap] returns ok Tue Jun 17 11:53:40 2014 : Info: Found Auth-Type = EAP Tue Jun 17 11:53:40 2014 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:40 2014 : Info: +- entering group authenticate {...} Tue Jun 17 11:53:40 2014 : Info: [eap] Request found, released from the list Tue Jun 17 11:53:40 2014 : Info: [eap] EAP/peap Tue Jun 17 11:53:40 2014 : Info: [eap] processing type peap Tue Jun 17 11:53:40 2014 : Info: [peap] processing EAP-TLS Tue Jun 17 11:53:40 2014 : Debug: TLS Length 326 Tue Jun 17 11:53:40 2014 : Info: [peap] Length Included Tue Jun 17 11:53:40 2014 : Info: [peap] eaptls_verify returned 11 Tue Jun 17 11:53:40 2014 : Info: [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange Tue Jun 17 11:53:40 2014 : Info: [peap] TLS_accept: SSLv3 read client key exchange A Tue Jun 17 11:53:40 2014 : Info: [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] Tue Jun 17 11:53:40 2014 : Info: [peap] <<< TLS 1.0 Handshake [length 0010], Finished Tue Jun 17 11:53:40 2014 : Info: [peap] TLS_accept: SSLv3 read finished A Tue Jun 17 11:53:40 2014 : Info: [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] Tue Jun 17 11:53:40 2014 : Info: [peap] TLS_accept: SSLv3 write change cipher spec A Tue Jun 17 11:53:40 2014 : Info: [peap] >>> TLS 1.0 Handshake [length 0010], Finished Tue Jun 17 11:53:40 2014 : Info: [peap] TLS_accept: SSLv3 write finished A Tue Jun 17 11:53:40 2014 : Info: [peap] TLS_accept: SSLv3 flush data Tue Jun 17 11:53:40 2014 : Info: [peap] (other): SSL negotiation finished successfully Tue Jun 17 11:53:40 2014 : Debug: SSL Connection Established Tue Jun 17 11:53:40 2014 : Info: [peap] eaptls_process returned 13 Tue Jun 17 11:53:40 2014 : Info: [peap] EAPTLS_HANDLED Tue Jun 17 11:53:40 2014 : Info: ++[eap] returns handled Sending Access-Challenge of id 39 to 172.16.210.102 port 1042 EAP-Message = 0x01470041190014030100010116030100306a2f1a53d32ceb1a8d16fe572479250f8e7263950cac2608c31c190fa517ee11c0ff70c73a823af98558a07676a5a118 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xafb682b9aaf19b5d9c2f9d64fb6bc98c Tue Jun 17 11:53:40 2014 : Info: Finished request 5. Tue Jun 17 11:53:40 2014 : Debug: Going to the next request Tue Jun 17 11:53:40 2014 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.210.102 port 1042, id=40, length=156 User-Name = "jjenkins" NAS-Port = 0 Called-Station-Id = "2E-A4-3C-65-D0-22:CSI" Calling-Station-Id = "84-A6-C8-EE-38-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x024700061900 State = 0xafb682b9aaf19b5d9c2f9d64fb6bc98c Message-Authenticator = 0x7974b678b0b13c90b81a5e6d93f4ecfb Tue Jun 17 11:53:43 2014 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:43 2014 : Info: +- entering group authorize {...} Tue Jun 17 11:53:43 2014 : Info: ++[preprocess] returns ok Tue Jun 17 11:53:43 2014 : Info: ++[chap] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[mschap] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[digest] returns noop Tue Jun 17 11:53:43 2014 : Info: [suffix] No '@' in User-Name = "jjenkins", looking up realm NULL Tue Jun 17 11:53:43 2014 : Info: [suffix] No such realm "NULL" Tue Jun 17 11:53:43 2014 : Info: ++[suffix] returns noop Tue Jun 17 11:53:43 2014 : Info: [eap] EAP packet type response id 71 length 6 Tue Jun 17 11:53:43 2014 : Info: [eap] Continuing tunnel setup. Tue Jun 17 11:53:43 2014 : Info: ++[eap] returns ok Tue Jun 17 11:53:43 2014 : Info: Found Auth-Type = EAP Tue Jun 17 11:53:43 2014 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:43 2014 : Info: +- entering group authenticate {...} Tue Jun 17 11:53:43 2014 : Info: [eap] Request found, released from the list Tue Jun 17 11:53:43 2014 : Info: [eap] EAP/peap Tue Jun 17 11:53:43 2014 : Info: [eap] processing type peap Tue Jun 17 11:53:43 2014 : Info: [peap] processing EAP-TLS Tue Jun 17 11:53:43 2014 : Info: [peap] Received TLS ACK Tue Jun 17 11:53:43 2014 : Info: [peap] ACK handshake is finished Tue Jun 17 11:53:43 2014 : Info: [peap] eaptls_verify returned 3 Tue Jun 17 11:53:43 2014 : Info: [peap] eaptls_process returned 3 Tue Jun 17 11:53:43 2014 : Info: [peap] EAPTLS_SUCCESS Tue Jun 17 11:53:43 2014 : Info: [peap] Session established. Decoding tunneled attributes. Tue Jun 17 11:53:43 2014 : Info: [peap] Peap state TUNNEL ESTABLISHED Tue Jun 17 11:53:43 2014 : Info: ++[eap] returns handled Sending Access-Challenge of id 40 to 172.16.210.102 port 1042 EAP-Message = 0x0148002b190017030100208b842487a9ece6c4645dfe6eab53bac347a26b42fef13f924c7ef558604c59fd Message-Authenticator = 0x00000000000000000000000000000000 State = 0xafb682b9a9fe9b5d9c2f9d64fb6bc98c Tue Jun 17 11:53:43 2014 : Info: Finished request 6. Tue Jun 17 11:53:43 2014 : Debug: Going to the next request Tue Jun 17 11:53:43 2014 : Debug: Waking up in 2.2 seconds. rad_recv: Access-Request packet from host 172.16.210.102 port 1042, id=41, length=193 User-Name = "jjenkins" NAS-Port = 0 Called-Station-Id = "2E-A4-3C-65-D0-22:CSI" Calling-Station-Id = "84-A6-C8-EE-38-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0248002b1900170301002040e1523f190ad3904b2e70b37864dbebbec2ae9506cc37bc3762b602a7bd6c78 State = 0xafb682b9a9fe9b5d9c2f9d64fb6bc98c Message-Authenticator = 0xf105b39afb6a257dd6fbf0542fe7ed2a Tue Jun 17 11:53:43 2014 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:43 2014 : Info: +- entering group authorize {...} Tue Jun 17 11:53:43 2014 : Info: ++[preprocess] returns ok Tue Jun 17 11:53:43 2014 : Info: ++[chap] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[mschap] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[digest] returns noop Tue Jun 17 11:53:43 2014 : Info: [suffix] No '@' in User-Name = "jjenkins", looking up realm NULL Tue Jun 17 11:53:43 2014 : Info: [suffix] No such realm "NULL" Tue Jun 17 11:53:43 2014 : Info: ++[suffix] returns noop Tue Jun 17 11:53:43 2014 : Info: [eap] EAP packet type response id 72 length 43 Tue Jun 17 11:53:43 2014 : Info: [eap] Continuing tunnel setup. Tue Jun 17 11:53:43 2014 : Info: ++[eap] returns ok Tue Jun 17 11:53:43 2014 : Info: Found Auth-Type = EAP Tue Jun 17 11:53:43 2014 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:43 2014 : Info: +- entering group authenticate {...} Tue Jun 17 11:53:43 2014 : Info: [eap] Request found, released from the list Tue Jun 17 11:53:43 2014 : Info: [eap] EAP/peap Tue Jun 17 11:53:43 2014 : Info: [eap] processing type peap Tue Jun 17 11:53:43 2014 : Info: [peap] processing EAP-TLS Tue Jun 17 11:53:43 2014 : Info: [peap] eaptls_verify returned 7 Tue Jun 17 11:53:43 2014 : Info: [peap] Done initial handshake Tue Jun 17 11:53:43 2014 : Info: [peap] eaptls_process returned 7 Tue Jun 17 11:53:43 2014 : Info: [peap] EAPTLS_OK Tue Jun 17 11:53:43 2014 : Info: [peap] Session established. Decoding tunneled attributes. Tue Jun 17 11:53:43 2014 : Info: [peap] Peap state WAITING FOR INNER IDENTITY Tue Jun 17 11:53:43 2014 : Info: [peap] Identity - jjenkins Tue Jun 17 11:53:43 2014 : Info: [peap] Got inner identity 'jjenkins' Tue Jun 17 11:53:43 2014 : Info: [peap] Setting default EAP type for tunneled EAP session. Tue Jun 17 11:53:43 2014 : Info: [peap] Got tunneled request EAP-Message = 0x0248000d016a6a656e6b696e73 server { Tue Jun 17 11:53:43 2014 : Info: [peap] Setting User-Name to jjenkins Sending tunneled request EAP-Message = 0x0248000d016a6a656e6b696e73 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "jjenkins" server inner-tunnel { Tue Jun 17 11:53:43 2014 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel Tue Jun 17 11:53:43 2014 : Info: +- entering group authorize {...} Tue Jun 17 11:53:43 2014 : Info: ++[chap] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[mschap] returns noop Tue Jun 17 11:53:43 2014 : Info: [suffix] No '@' in User-Name = "jjenkins", looking up realm NULL Tue Jun 17 11:53:43 2014 : Info: [suffix] No such realm "NULL" Tue Jun 17 11:53:43 2014 : Info: ++[suffix] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[control] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[files] returns noop Tue Jun 17 11:53:43 2014 : Info: [ldap] performing user authorization for jjenkins Tue Jun 17 11:53:43 2014 : Info: [ldap] expand: %{Stripped-User-Name} -> Tue Jun 17 11:53:43 2014 : Info: [ldap] ... expanding second conditional Tue Jun 17 11:53:43 2014 : Info: [ldap] expand: %{User-Name} -> jjenkins Tue Jun 17 11:53:43 2014 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=jjenkins) Tue Jun 17 11:53:43 2014 : Info: [ldap] expand: cn=accounts,dc=csi,dc=com -> cn=accounts,dc=csi,dc=com Tue Jun 17 11:53:43 2014 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Jun 17 11:53:43 2014 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Jun 17 11:53:43 2014 : Debug: [ldap] performing search in cn=accounts,dc=csi,dc=com, with filter (uid=jjenkins) Tue Jun 17 11:53:43 2014 : Info: [ldap] looking for check items in directory... Tue Jun 17 11:53:43 2014 : Info: [ldap] looking for reply items in directory... Tue Jun 17 11:53:43 2014 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Jun 17 11:53:43 2014 : Info: [ldap] user jjenkins authorized to use remote access Tue Jun 17 11:53:43 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Jun 17 11:53:43 2014 : Info: ++[ldap] returns ok Tue Jun 17 11:53:43 2014 : Info: ++[expiration] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[logintime] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[pap] returns noop Tue Jun 17 11:53:43 2014 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Tue Jun 17 11:53:43 2014 : Info: Failed to authenticate the user. } # server inner-tunnel Tue Jun 17 11:53:43 2014 : Info: [peap] Got tunneled reply code 3 Tue Jun 17 11:53:43 2014 : Info: [peap] Got tunneled reply RADIUS code 3 Tue Jun 17 11:53:43 2014 : Info: [peap] Tunneled authentication was rejected. Tue Jun 17 11:53:43 2014 : Info: [peap] FAILURE Tue Jun 17 11:53:43 2014 : Info: ++[eap] returns handled Sending Access-Challenge of id 41 to 172.16.210.102 port 1042 EAP-Message = 0x0149002b1900170301002040e0262abb96586735b5f83d6e99164c46d2bf568f8147a5105e2afa742d1725 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xafb682b9a8ff9b5d9c2f9d64fb6bc98c Tue Jun 17 11:53:43 2014 : Info: Finished request 7. Tue Jun 17 11:53:43 2014 : Debug: Going to the next request Tue Jun 17 11:53:43 2014 : Debug: Waking up in 2.2 seconds. rad_recv: Access-Request packet from host 172.16.210.102 port 1042, id=42, length=193 User-Name = "jjenkins" NAS-Port = 0 Called-Station-Id = "2E-A4-3C-65-D0-22:CSI" Calling-Station-Id = "84-A6-C8-EE-38-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0249002b19001703010020d4932f0865c11f694a473026923b1187c4fab1e9a1c207df933b817447bb8014 State = 0xafb682b9a8ff9b5d9c2f9d64fb6bc98c Message-Authenticator = 0xc3291af200d8743b9c8296c29b12ca21 Tue Jun 17 11:53:43 2014 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:43 2014 : Info: +- entering group authorize {...} Tue Jun 17 11:53:43 2014 : Info: ++[preprocess] returns ok Tue Jun 17 11:53:43 2014 : Info: ++[chap] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[mschap] returns noop Tue Jun 17 11:53:43 2014 : Info: ++[digest] returns noop Tue Jun 17 11:53:43 2014 : Info: [suffix] No '@' in User-Name = "jjenkins", looking up realm NULL Tue Jun 17 11:53:43 2014 : Info: [suffix] No such realm "NULL" Tue Jun 17 11:53:43 2014 : Info: ++[suffix] returns noop Tue Jun 17 11:53:43 2014 : Info: [eap] EAP packet type response id 73 length 43 Tue Jun 17 11:53:43 2014 : Info: [eap] Continuing tunnel setup. Tue Jun 17 11:53:43 2014 : Info: ++[eap] returns ok Tue Jun 17 11:53:43 2014 : Info: Found Auth-Type = EAP Tue Jun 17 11:53:43 2014 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:43 2014 : Info: +- entering group authenticate {...} Tue Jun 17 11:53:43 2014 : Info: [eap] Request found, released from the list Tue Jun 17 11:53:43 2014 : Info: [eap] EAP/peap Tue Jun 17 11:53:43 2014 : Info: [eap] processing type peap Tue Jun 17 11:53:43 2014 : Info: [peap] processing EAP-TLS Tue Jun 17 11:53:43 2014 : Info: [peap] eaptls_verify returned 7 Tue Jun 17 11:53:43 2014 : Info: [peap] Done initial handshake Tue Jun 17 11:53:43 2014 : Info: [peap] eaptls_process returned 7 Tue Jun 17 11:53:43 2014 : Info: [peap] EAPTLS_OK Tue Jun 17 11:53:43 2014 : Info: [peap] Session established. Decoding tunneled attributes. Tue Jun 17 11:53:43 2014 : Info: [peap] Peap state send tlv failure Tue Jun 17 11:53:43 2014 : Info: [peap] Received EAP-TLV response. Tue Jun 17 11:53:43 2014 : Info: [peap] The users session was previously rejected: returning reject (again.) Tue Jun 17 11:53:43 2014 : Info: [peap] *** This means you need to read the PREVIOUS messages in the debug output Tue Jun 17 11:53:43 2014 : Info: [peap] *** to find out the reason why the user was rejected. Tue Jun 17 11:53:43 2014 : Info: [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. Tue Jun 17 11:53:43 2014 : Info: [peap] *** what went wrong, and how to fix the problem. Tue Jun 17 11:53:43 2014 : Info: [eap] Handler failed in EAP/peap Tue Jun 17 11:53:43 2014 : Info: [eap] Failed in EAP select Tue Jun 17 11:53:43 2014 : Info: ++[eap] returns invalid Tue Jun 17 11:53:43 2014 : Info: Failed to authenticate the user. Tue Jun 17 11:53:43 2014 : Info: Using Post-Auth-Type Reject Tue Jun 17 11:53:43 2014 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Jun 17 11:53:43 2014 : Info: +- entering group REJECT {...} Tue Jun 17 11:53:43 2014 : Info: [attr_filter.access_reject] expand: %{User-Name} -> jjenkins Tue Jun 17 11:53:43 2014 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Jun 17 11:53:43 2014 : Info: ++[attr_filter.access_reject] returns updated Tue Jun 17 11:53:43 2014 : Info: Delaying reject of request 8 for 1 seconds Tue Jun 17 11:53:43 2014 : Debug: Going to the next request Tue Jun 17 11:53:43 2014 : Debug: Waking up in 0.9 seconds. Tue Jun 17 11:53:44 2014 : Info: Sending delayed reject for request 8 Sending Access-Reject of id 42 to 172.16.210.102 port 1042 EAP-Message = 0x04490004 Message-Authenticator = 0x00000000000000000000000000000000 Tue Jun 17 11:53:44 2014 : Debug: Waking up in 1.2 seconds. Tue Jun 17 11:53:45 2014 : Info: Cleaning up request 0 ID 34 with timestamp +8 Tue Jun 17 11:53:45 2014 : Info: Cleaning up request 1 ID 35 with timestamp +8 Tue Jun 17 11:53:45 2014 : Info: Cleaning up request 2 ID 36 with timestamp +8 Tue Jun 17 11:53:45 2014 : Info: Cleaning up request 3 ID 37 with timestamp +8 Tue Jun 17 11:53:45 2014 : Info: Cleaning up request 4 ID 38 with timestamp +8 Tue Jun 17 11:53:45 2014 : Info: Cleaning up request 5 ID 39 with timestamp +8 Tue Jun 17 11:53:45 2014 : Debug: Waking up in 2.6 seconds. Tue Jun 17 11:53:48 2014 : Info: Cleaning up request 6 ID 40 with timestamp +11 Tue Jun 17 11:53:48 2014 : Info: Cleaning up request 7 ID 41 with timestamp +11 Tue Jun 17 11:53:48 2014 : Debug: Waking up in 1.0 seconds. Tue Jun 17 11:53:49 2014 : Info: Cleaning up request 8 ID 42 with timestamp +11 Tue Jun 17 11:53:49 2014 : Info: Ready to process requests.

3 6

EAP & MAC Auth
by Russell Mike 17 Jun '14

17 Jun '14

Hi List Members How can we do EAP authentication & MAC address look up in addition (stored in MySQL DBMS) before accepting? Thanks

2 2

I have installed the latest free radius 3.03-2, radtest command is not found
by blue phoenix 17 Jun '14

17 Jun '14

Fairly new to the Linux/Unix community and it’s CLIs… I have installed the freeradius software via terminal and not via the GUI. sudo yum install freeradius I have this version installed [root@localhost /]# rpm -qa freeradius\* freeradius-3.0.3-2.fc20.i686 I believe that I have installed it correctly since when I issued the 'radiusd -X’ command it is waiting for logs #other commands omitted } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 34199 Ready to process requests. Now I opened another terminal window to edit the user file [root@localhost /]# vi /etc/raddb/users I have added this to the 1st line testing Cleartext-Password := “password” issued :wq! typed this command afterwards: [root@localhost /]# radtest testing password localhost 0 testing123 bash: radtest: command not found... [root@localhost /]# Please help to determine how come I was not able to run radtest and what steps do I need to do in order to successfully install freeradius. Thanks,

2 3

Sanity check on coa
by Phil Mayers 17 Jun '14

17 Jun '14

Can someone just check me here: If I want to send a CoA request from a client, via FR, to the NAS (because the NAS is dumb and will only take CoA packets from the auth/acct server IPs & secrets) then I'm stuck with defining one home server/pool per NAS, right?

2 3

HEX Stripping using attr_rewrite
by Simon Allard 17 Jun '14

17 Jun '14

Hi Freeradius list :-) I am have a bit of an issue with the stripping hex values from my ADSL-Agent-Remote-ID field in my Auth packet. I am using an Alcatel-Lucent 7750SR platform and for some reason they decided when converting a DHCPv6 packet into a radius packet it appends the Enterprise ID (which is a hex number) into the ADSL-Agent-Remote-ID. I end up with a packet looking like this: User-Name = "MDR-POLT01 eth 1/1/01/01/4/1/1:10" User-Password = "" NAS-IP-Address = 60.xxx.xxx.xxx ADSL-Agent-Circuit-Id = "MDR-POLT01 eth 1/1/01/01/4/1/1:10" ADSL-Agent-Remote-Id = "\000\000\000\001CHORUS1234567894" NAS-Port-Type = Ethernet NAS-Port-Id = "pw-2:1101.104" Calling-Station-Id = "\000\000\000\001CHORUS1234567894" NAS-Identifier = "bng" Acct-Session-Id = "E1F15900F37E74538D434C" The issue I seem to be running into, since \000 is a termination value, that freeradius sees the value of attribute ADSL-Agent-Remote-Id as blank. Example below. [sql] expand: %{Orcon-User-Name} -> : User-Name = "MDR-POLT01 eth 1/1/01/01/4/1/1:10" User-Password = "" NAS-IP-Address = 60.xx.xx.xx ADSL-Agent-Circuit-Id = "MDR-POLT01 eth 1/1/01/01/4/1/1:10" ADSL-Agent-Remote-Id = "\000\000\000\001CHORUS1234567894" NAS-Port-Type = Ethernet NAS-Port-Id = "pw-2:1101.104" Calling-Station-Id = "\000\000\000\001CHORUS1234567894" NAS-Identifier = "bng1" Acct-Session-Id = "E1F15900F40272538D8D8E" +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "MDR-POLT01 eth 1/1/01/01/4/1/1:10", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] expand: %{ADSL-Agent-Circuit-Id} -> MDR-POLT01 eth 1/1/01/01/4/1/1:10 ++[files] returns noop [sane_dhcpv6_chorus] expand: \000\000\000\001 -> \000\000\000\001 sane_dhcpv6_chorus: Does not match: ADSL-Agent-Remote-Id = sane_dhcpv6_chorus: Could not find value pair for attribute ADSL-Agent-Remote-Id ++[sane_dhcpv6_chorus] returns ok My attr_rewrite code is: attr_rewrite sane_dhcpv6_chorus { attribute = ADSL-Agent-Remote-Id searchin = packet searchfor = "\\000\\000\\000\\001" replacewith = "" ignore_case = no new_attribute = no max_matches = 10 ## If set to yes then the replace string will be ## appended to the original string append = no } I have raised the issue with the vendor, but I am not holding my breath for a fix anytime soon. Are there any other options in freeradius to get around this?

5 8

LDAP Groups to Freeradius and then Ruckus Wireless?
by Enrique Sainz Baixauli 17 Jun '14

17 Jun '14

Hello there, I'm trying to deploy a FreeRadius server with OpenLDAP. To this end, both are working properly and communicate with each other successfully. I have LDAP groups set up so users belong to a group and I can check from freeradius' users file if a user belongs to a group (and, for example, deny access to all users belonging to a certain group). I must say that, if I enable group checking in users file, I can see rlm_ldap debug info about it searching for group information; but if it's not enabled it doesn't search for groups. The issue here is that the server will be used to authenticate wifi users from a Ruckus ZoneDirector device, which defines roles and assigns roles to the users depending on the groups that the users belong to. This works flawlessly when authenticating against LDAP itself, but if freeradius stands in the middle the group info gets lost somewhere. I know that freeradius can access Ldap-Group variable and know which group the user belongs to, but I'd like it to forward that info to the ZoneDirector (who is actually performing the authentication request against freeradius), so that it can assign the role properly. The LDAP database is set up with two OUs, users and groups, and users being of objectClass inetOrgPerson and groups being groupOfNames. In freeradius, ldap config is mostly default except for server, identity, etc, but with these group-related parameters: groupname_attribute = cn groupmembership_filter = (&(objectClass=groupOfNames)(member=%{control:Ldap-UserDn})) groupmembership_attribute = member # (also tried with memberOf, radiusGroup, radiusGroupName and several others) And, about the server, it is running Debian 7.5, OpenLDAP 2.4.31 and freeradius 2.1.12 (default packages from debian). I can provide any other info that you need :) Thanks everyone in advance!

8 76

Dumb all returned attributes
by Brandon Jozsa 17 Jun '14

17 Jun '14

Want to approach this differently than trying to use cache, as I don't think rlm_cache will fit what I need. At least not how I can logically wrap my head around it anyway... I'm running FR in proxy mode and can collect send user auth to an upstream radius server. Is there any way to collect, and dump, all returned attributes to a text file? If so, how can I do this...I can't find any good articles that show how to really do this. It's for a quick and dirty forklift solution to replace an old, ready to fail RSA server. I want to try dumping the output first, then possibly figure out how to use a rlm_perl to maybe put back into a mysql database for later use. I could really use some help trying to figure this out. -- Brandon

2 2

Freeradius with Active Directory
by Prashant A 16 Jun '14

16 Jun '14

Hi All, I have followed the guide for integrating freeradius with active directory which is mentioned here, http://deployingradius.com/documents/configuration/active_directory.html So finally, radtest -t mschap prashant Active@123 localhost 0 testing123 Gives me following output Sending Access-Request Id 40 from 0.0.0.0:54825 to 127.0.0.1:1812 User-Name = 'prashant' NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0x42b125cb7f6408b4 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000c82b9abb20333db96efcb1f93beb602b39ebbd007a8c0392 Received Access-Accept Id 40 from 127.0.0.1:1812 to 127.0.0.1:54825 length 84 MS-CHAP-MPPE-Keys = 0x MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed But when I try to login from webpage I am getting following response (0) mschap : Client is using MS-CHAPv2 (0) mschap : Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-mycompany.local} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} (0) mschap : EXPAND --username=%{mschap:User-Name:-None} (0) mschap : --> --username=prashant (0)*ERROR: mschap : No NT-Domain was found in the User-Name* (0) mschap : EXPAND --domain=%{%{mschap:NT-Domain}:-mycompany.local} (0) mschap : --> --domain=mycompany.local (0) mschap : Creating challenge hash with username: prashant (0) mschap : EXPAND --challenge=%{mschap:Challenge:-00} (0) mschap : --> --challenge=e5d49180d36eb904 (0) mschap : EXPAND --nt-response=%{mschap:NT-Response:-00} *(0) mschap : --> --nt-response=0000000e0000000000000000000000000000000000000000** **(0) ERROR: mschap : Program returned code (1) and output 'Logon failure (0xc000006d)'* (0) mschap : External script failed. (0) ERROR: mschap : External script says: Logon failure (0xc000006d) (0) ERROR: mschap : MS-CHAP2-Response is incorrect (0) [mschap] = reject (0) } # Auth-Type MS-CHAP = reject Can somebody help me to understand what exactly the issue. I am using FreeRADIUS Version 3.0.3 and Samba version 3.6.3. Thanks & Regards, Prashant

3 6

Re: Issues with building Freeradius on CentOS 6.5: need rlm_cache
by Brandon Jozsa 16 Jun '14

16 Jun '14

Ok, so now that I have this working...rlm_cache is loading just fine, but I think I may be making an error (based on what I want to achieve anyway). I've taken information from the article http://wiki.freeradius.org/modules/Rlm_cache#Two-call-caching, and i see the cache working, but is it in the wrong place? My hope was that if the user doesn't exist in sql (which "tester" doesn't) then forward. When you get a response, cache these attributes (user account, authZ privileges, etc) back into the sql database. I don't see any updates to the radcheck table, but I'm not 100% sure if that's where it should go. Sorry for being slow here...can anyone help, or do I have this wrong? I'm probably missing something easy here or just getting the formatting wrong. output (i can give more if necessary): [sql] User tester not found +++[sql] = notfound ++} # if (notfound) = notfound ++update control { ++} # update control = noop [cache] expand: %{User-Name} -> tester [cache] expand: reply:Reply-Message -> reply:Reply-Message [cache] expand: Cache last updated at %t -> Cache last updated at Fri Jun 13 16:41:10 2014 [cache] expand: ssssssssssssssssssssssssssssssss -> ssssssssssssssssssssssssssssssss [cache] expand: %{randstr:ssssssssssssssssssssssssssssssss} -> gcEKJNqJQcCe4J4qSRlEciZ7DYDhJW7e rlm_cache: Adding entry for "tester", with TTL of 10 ++[cache] = updated +} # group authorize = updated WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 182 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313133 Proxying request 0 to home server 192.168.1.35 port 1812 Sending Access-Request of id 182 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313133 Going to the next request Waking up in 0.9 seconds. Waking up in 19.0 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 42674, id=113, length=76 Sending duplicate proxied request to home server 192.168.1.35 port 1812 - ID: 182 Sending Access-Request of id 182 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313133 Waking up in 14.9 seconds. rad_recv: Access-Accept packet from host 192.168.1.35 port 1812, id=182, length=25 Proxy-State = 0x313133 The config under authorize section: ############ CUSTOM AUTHORIZE STATEMENTS ############ if (!notfound) { update control { Proxy-To-Realm := "DARTH_RSA" } } ############ CUSTOM CACHING REQUIREMENTS ############ update control { Cache-Status-Only = 'yes' } cache if (notfound) { sql } update control { Cache-Status-Only := 'no' } cache ############ CUSTOM AUTHORIZE STATEMENTS ############ On Thu, Jun 12, 2014 at 11:50 PM, Brandon Jozsa <bjozsa(a)gmail.com> wrote: > Hello, > > I've been trying to work through the issues and by searching high and low > for solutions before turning to this users list. I'm sorry if this is a > stupid question (I've seen worse though, so maybe I shouldn't feel bad). > > I have a very high need to use the rlm_cache module with Freeradius on > CentOS 6.5. I'm trying to first us the statement: > > ----- snipped ----- > > authorize { > if (!notfound) { > update control { > Proxy-To-Realm := "SOME_REALM" > } > } > ----- snipped ----- > > which works GREAT alone...but I also want to use the cache function like > so: > > ----- snipped ----- > update control { > Cache-Status-Only = 'yes' > } > cache > if (notfound) { > sql > } > update control { > Cache-Status-Only := 'no' > } > cache > > ----- snipped ----- > > which doesn't work (obviously) because rlm_cache isn't included with > 2.1.12, or so it seems anyway. > > My hope is (it is a hope anyway) that I can collect authN/authZ replies > from an upstream radius server and cache them locally; thus building a > mysql database of users access/privileges and let this run on an > environment before cutting completely over to our new Freeradius setup. > Again, I'm hoping it can work like this...getting rid of RSA and using > LinOTP or MOTP would be so nice; it would be more flexible and user > friendly, but I really need to collect authN and authZ in order to rebuild > our massive user-base. > > My issue...CentOS, which is our "approved platform" (I'm rolling my eyes > and giving air quotes), doesn't have a newer version of Freeradius other > than 2.1.12. I think the rlm_cache modules are only included in 3.0.0 and > higher, is that right? > > So, I started looking on how to build from source...and I found one; great > news I thought!! Enter: > http://confluence.diamond.ac.uk/display/PAAUTH/FreeRADIUS+specs+and+sources…. > I thought this would save the day, but there are broken links for 3.0.0 and > I am running into major issues; it just doesn't seem to work at all. I also > tried to build it out, take the rlm_cache.so lib over to my 2.1.12 > installation, but Freeradius barfed all over that little trick. > > What are my options here? I could really use some help. Any ideas? > > -- > Brandon > -- Brandon

3 16