On Mon, Jan 18, 2010 at 7:38 PM, Alan DeKok
<aland@deployingradius.com> wrote:
Delete that. You don't need it.
Tossed the "Auth-Type := Local" -- I figured that was not needed
Sorry but NOTHING in the default configuration causes the server to
proxy packets to itself.
Maybe proxy to itself was a bad way to describe it, you can interpret the output yourself if you'd like. I took the last 4096 lines of output and cut out 198 of the Proxy-State attributes from each request, which brought it down to around 400 lines. Enjoy. This output is all from one request to authenticate from a WinXP client and only occurs when "nostrip" is present in proxy.conf under realm
example.com.
Alan DeKok.
radiusd -X output begins below (last 4096 lines, shortened for brevity)
Proxy-State = 0x313234...
Proxy-State = 0x313937Proxying request 184 to home server 127.0.0.1 port 1812
Sending Access-Request of id 138 to 127.0.0.1 port 1812 User-Name = "user@example.com"
NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20"
Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20"
NAS-Port = 56 Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d
Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30
... Proxy-State = 0x313937
Going to the next requestrad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=138, length=980
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0xe7395d8a2b4734f027531b160ce32c31
Proxy-State = 0x30...
Proxy-State = 0x313937+- entering group authorize {...}
++[preprocess] returns ok++[chap] returns noop
++[mschap] returns noop[suffix] Looking up realm "example.com" for User-Name = "user@example.com"
[suffix] Found realm "example.com"[suffix] Adding Realm = "example.com"
[suffix] Proxying request from user user to realm example.com[suffix] Preparing to proxy authentication request to realm "example.com"
++[suffix] returns updated[eap] Request is supposed to be proxied to Realm example.com. Not doing EAP.
++[eap] returns noop++[unix] returns notfound
++[files] returns noop++[expiration] returns noop
++[logintime] returns noop++[pap] returns noop
WARNING: Empty section. Using default return values.Sending Access-Request of id 243 to 127.0.0.1 port 1812
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x30...
Proxy-State = 0x313338Proxying request 185 to home server 127.0.0.1 port 1812
Sending Access-Request of id 243 to 127.0.0.1 port 1812 User-Name = "user@example.com"
NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20"
Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20"
NAS-Port = 56 Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d
Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30
... Proxy-State = 0x313338
Going to the next requestrad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=243, length=985
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x70e7c8fb3c9aeecfa1420e1d8684e7de
Proxy-State = 0x30...
Proxy-State = 0x313338+- entering group authorize {...}
++[preprocess] returns ok++[chap] returns noop
++[mschap] returns noop[suffix] Looking up realm "example.com" for User-Name = "user@example.com"
[suffix] Found realm "example.com"[suffix] Adding Realm = "example.com"
[suffix] Proxying request from user user to realm example.com[suffix] Preparing to proxy authentication request to realm "example.com"
++[suffix] returns updated[eap] Request is supposed to be proxied to Realm example.com. Not doing EAP.
++[eap] returns noop++[unix] returns notfound
++[files] returns noop++[expiration] returns noop
++[logintime] returns noop++[pap] returns noop
WARNING: Empty section. Using default return values.Sending Access-Request of id 33 to 127.0.0.1 port 1812
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x30...
Proxy-State = 0x323433Proxying request 186 to home server 127.0.0.1 port 1812
Sending Access-Request of id 33 to 127.0.0.1 port 1812 User-Name = "user@example.com"
NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20"
Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20"
NAS-Port = 56 Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d
Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30
... Proxy-State = 0x313338
Proxy-State = 0x323433Going to the next request
rad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=33, length=990 User-Name = "user@example.com"
NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20"
Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20"
NAS-Port = 56 Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d
Message-Authenticator = 0x61f5446e99b9dda2c4002ec4f82d0774 Proxy-State = 0x30
... Proxy-State = 0x323433
+- entering group authorize {...}++[preprocess] returns ok
++[chap] returns noop++[mschap] returns noop
[suffix] Looking up realm "example.com" for User-Name = "user@example.com"
[suffix] Found realm "example.com"[suffix] Adding Realm = "example.com"
[suffix] Proxying request from user user to realm example.com[suffix] Preparing to proxy authentication request to realm "example.com"
++[suffix] returns updated[eap] Request is supposed to be proxied to Realm example.com. Not doing EAP.
++[eap] returns noop++[unix] returns notfound
++[files] returns noop++[expiration] returns noop
++[logintime] returns noop++[pap] returns noop
WARNING: Empty section. Using default return values.Sending Access-Request of id 34 to 127.0.0.1 port 1812
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x30...
Proxy-State = 0x3333Proxying request 187 to home server 127.0.0.1 port 1812
Sending Access-Request of id 34 to 127.0.0.1 port 1812 User-Name = "user@example.com"
NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20"
Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20"
NAS-Port = 56 Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d
Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30
... Proxy-State = 0x3333
Going to the next requestrad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=34, length=994
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x03998bfa676bbe0703e5d46be2ac2c59
Proxy-State = 0x30...
Proxy-State = 0x3333+- entering group authorize {...}
++[preprocess] returns ok++[chap] returns noop
++[mschap] returns noop[suffix] Looking up realm "example.com" for User-Name = "user@example.com"
[suffix] Found realm "example.com"[suffix] Adding Realm = "example.com"
[suffix] Proxying request from user user to realm example.com[suffix] Preparing to proxy authentication request to realm "example.com"
++[suffix] returns updated[eap] Request is supposed to be proxied to Realm example.com. Not doing EAP.
++[eap] returns noop++[unix] returns notfound
++[files] returns noop++[expiration] returns noop
++[logintime] returns noop++[pap] returns noop
WARNING: Empty section. Using default return values.Sending Access-Request of id 147 to 127.0.0.1 port 1812
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x30...
Proxy-State = 0x3333 Proxy-State = 0x3334
Proxying request 188 to home server 127.0.0.1 port 1812Sending Access-Request of id 147 to 127.0.0.1 port 1812
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x30...
Proxy-State = 0x3333 Proxy-State = 0x3334
Going to the next requestrad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=147, length=998
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0xeba6020979709e88ea30973cdcf74295
Proxy-State = 0x30...
Proxy-State = 0x3333 Proxy-State = 0x3334
+- entering group authorize {...}++[preprocess] returns ok
++[chap] returns noop++[mschap] returns noop
[suffix] Looking up realm "example.com" for User-Name = "user@example.com"
[suffix] Found realm "example.com"[suffix] Adding Realm = "example.com"
[suffix] Proxying request from user user to realm example.com[suffix] Preparing to proxy authentication request to realm "example.com"
++[suffix] returns updated[eap] Request is supposed to be proxied to Realm example.com. Not doing EAP.
++[eap] returns noop++[unix] returns notfound
++[files] returns noop++[expiration] returns noop
++[logintime] returns noop++[pap] returns noop
WARNING: Empty section. Using default return values.Sending Access-Request of id 241 to 127.0.0.1 port 1812
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x30 Proxy-State = 0x3133
... Proxy-State = 0x313437
Proxying request 189 to home server 127.0.0.1 port 1812Sending Access-Request of id 241 to 127.0.0.1 port 1812
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x30 Proxy-State = 0x323437
... Proxy-State = 0x3334
Proxy-State = 0x313437Going to the next request
rad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=241, length=1003 User-Name = "user@example.com"
NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20"
Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20"
NAS-Port = 56 Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d
Message-Authenticator = 0x6821c9ece7894c509901e6be862a5159 Proxy-State = 0x30
... Proxy-State = 0x3334
Proxy-State = 0x313437+- entering group authorize {...}
++[preprocess] returns ok++[chap] returns noop
++[mschap] returns noop[suffix] Looking up realm "example.com" for User-Name = "user@example.com"
[suffix] Found realm "example.com"[suffix] Adding Realm = "example.com"
[suffix] Proxying request from user user to realm example.com[suffix] Preparing to proxy authentication request to realm "example.com"
++[suffix] returns updated[eap] Request is supposed to be proxied to Realm example.com. Not doing EAP.
++[eap] returns noop++[unix] returns notfound
++[files] returns noop++[expiration] returns noop
++[logintime] returns noop++[pap] returns noop
WARNING: Empty section. Using default return values.Sending Access-Request of id 163 to 127.0.0.1 port 1812
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x30 Proxy-State = 0x3339
... Proxy-State = 0x3334
Proxy-State = 0x313437 Proxy-State = 0x323431
Proxying request 190 to home server 127.0.0.1 port 1812Sending Access-Request of id 163 to 127.0.0.1 port 1812
User-Name = "user@example.com" NAS-IP-Address = 192.168.1.1
Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671"
NAS-Identifier = "0016b6e2cc20" NAS-Port = 56
Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x30 Proxy-State = 0x3133
... Proxy-State = 0x313437
Proxy-State = 0x323431Going to the next request
WARNING: Possible DoS attack from host 127.0.0.1: Too many attributes in request (received 201, max 200 are allowed).
Waking up in 0.7 seconds.Waking up in 16.2 seconds.