cisco WAP/FreeRadius/OpenLDAP
Matthew Arguin
matt.arguin at currensee.com
Wed Nov 2 16:41:18 CET 2011
So based on a previous recommendation, i just upgraded my freeradius2 to
2.1.12. here is the latest radtest run:
[root at ops2 modules]# radtest marguin2 r0adkill localhost 0 <secret>
Sending Access-Request of id 177 to 127.0.0.1 port 1812
User-Name = "marguin2"
User-Password = "r0adkill"
NAS-IP-Address = 127.0.0.1
NAS-Port = 0
Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=177,
length=30
Filter-Id = "wireless"
and here is the debug when i test a laptop connecting:
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 57047, id=177,
length=78
User-Name = "marguin2"
User-Password = "r0adkill"
NAS-IP-Address = 127.0.0.1
NAS-Port = 0
Message-Authenticator = 0x1ef5c6c6cf3f4ec1042b39d10a933a02
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "marguin2", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
[ldap] performing user authorization for marguin2
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> marguin2
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) ->
(uid=marguin2)
[ldap] expand: ou=people,dc=currensee,dc=com ->
ou=people,dc=currensee,dc=com
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] attempting LDAP reconnection
[ldap] (re)connect to ldap.local.currensee.com:389, authentication 0
[ldap] setting TLS CACert File to /etc/ldap/csca.crt
[ldap] bind as cn=manager,dc=currensee,dc=com/VcnxJbFqeAuAFyiu3zvi to
ldap.local.currensee.com:389
[ldap] waiting for bind result ...
[ldap] Bind was successful
[ldap] performing search in ou=people,dc=currensee,dc=com, with
filter (uid=marguin2)
[ldap] checking if remote access for marguin2 is allowed by radiusFilterId
[ldap] looking for check items in directory...
[ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM"
[ldap] looking for reply items in directory...
[ldap] radiusFilterId -> Filter-Id = "wireless"
[ldap] user marguin2 authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns updated
Found Auth-Type = PAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group PAP {...}
[pap] login attempt with password "r0adkill"
[pap] Using CRYPT password "tGS8HbszeyDmM"
[pap] User authenticated successfully
++[pap] returns ok
# Executing section post-auth from file /etc/raddb/sites-enabled/default
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 177 to 127.0.0.1 port 57047
Filter-Id = "wireless"
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 177 with timestamp +8
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=130, length=133
User-Name = "anonymous"
Framed-MTU = 1400
Called-Station-Id = "64a0.e729.b890"
Calling-Station-Id = "1c65.9d32.fb68"
Service-Type = Login-User
Message-Authenticator = 0x25e770a8cf7f8577f8a4915a0a234c74
EAP-Message = 0x0202000e01616e6f6e796d6f7573
NAS-Port-Type = Wireless-802.11
NAS-Port = 1911
NAS-Port-Id = "1911"
NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 2 length 14
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
[ldap] performing user authorization for anonymous
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> anonymous
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) ->
(uid=anonymous)
[ldap] expand: ou=people,dc=currensee,dc=com ->
ou=people,dc=currensee,dc=com
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] performing search in ou=people,dc=currensee,dc=com, with
filter (uid=anonymous)
[ldap] object not found
[ldap] search failed
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns notfound
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.
Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 130 to 192.168.10.31 port 1645
EAP-Message = 0x010300061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8ca945078caa5cbc436d046d9dce36c6
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=131, length=229
User-Name = "anonymous"
Framed-MTU = 1400
Called-Station-Id = "64a0.e729.b890"
Calling-Station-Id = "1c65.9d32.fb68"
Service-Type = Login-User
Message-Authenticator = 0x26889f61e8de8e2c6e10b74f96a452f1
EAP-Message =
0x0203005c190016030100510100004d03014eb1639686848537ddd0c96aa8062750416eae950922291bbba0af9cfae968a300002600390038003500160013000a00330032002f00050004001500120009001400110008000600030100
NAS-Port-Type = Wireless-802.11
NAS-Port = 1911
NAS-Port-Id = "1911"
State = 0x8ca945078caa5cbc436d046d9dce36c6
NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 3 length 92
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] (other): before/accept initialization
[peap] TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 0051], ClientHello
[peap] TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 002a], ServerHello
[peap] TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 06cd], Certificate
[peap] TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange
[peap] TLS_accept: SSLv3 write key exchange A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
[peap] TLS_accept: SSLv3 write server done A
[peap] TLS_accept: SSLv3 flush data
[peap] TLS_accept: Need to read more data: SSLv3 read client
certificate A
In SSL Handshake Phase
In SSL Accept mode
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 131 to 192.168.10.31 port 1645
EAP-Message =
0x0104040019c00000089c160301002a0200002603014eb163754412671a1fbb6aaea55315df6c22964f750047734d2cb35b79efe94a0000390016030106cd0b0006c90006c60002a6308202a23082020b0203100028300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f
EAP-Message =
0x63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3131313032313135313134335a170d3231313032303135313134335a3077310b3009060355040613025553311630140603550408130d4d61737361636875736574747331183016060355040a130f43757272656e7365652c20496e632e31133011060355040b130a4f7065726174696f6e733121301f060355040313186f7073322e6c6f63616c2e63757272656e7365652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100dbd67230f6e9b1f8d37cd689371e4965f6760ef34369b95ea48e1ef153be887b5dd5ef31
EAP-Message =
0x7a47e5d66048731d7458d9ae1ebe0508aa349d4fa74dd0c077cdca1fb2af2868d309e938cd6222f3c6737116ff656e10bbb175b76e2aa83c35efc2b0655f3bf669cabbad375d98d89c84f9d30b5887ac5225685c5bee55176ce2fe890203010001300d06092a864886f70d01010405000381810023558f75bca5500a1b7ca225f46cd98622ef05c01cc43e000dcae1cd19b8d8fcf7c53d2dff7c6403781839d0dd4a0bffb4eec337967c32665ee5f11720e09760c222e2fc6a029b0d4eb33c45614d21a6fb55cb6f01df47958d97578160057f0d23aa685539931ad0229522218b7d7c31f9fb1b8e94a9b88d6e8bc4f410a9701400041a308204163082
EAP-Message =
0x037fa003020102020900d869d83ec24831ce300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3130303432363138323634325a170d3230303432353138323634325a
EAP-Message = 0x3081b931183016060355040a
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8ca945078dad5cbc436d046d9dce36c6
Finished request 2.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=132, length=143
User-Name = "anonymous"
Framed-MTU = 1400
Called-Station-Id = "64a0.e729.b890"
Calling-Station-Id = "1c65.9d32.fb68"
Service-Type = Login-User
Message-Authenticator = 0x5b640da8918d526233c3ccf055c38e7b
EAP-Message = 0x020400061900
NAS-Port-Type = Wireless-802.11
NAS-Port = 1911
NAS-Port-Id = "1911"
State = 0x8ca945078dad5cbc436d046d9dce36c6
NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 4 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 132 to 192.168.10.31 port 1645
EAP-Message =
0x010503fc1940130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100d6e8fe8f9e3905fcd63f0c9f3b9eded323e8b7a1e47ef23d8d53a29572e41656e189ccd616664ad52ea7
EAP-Message =
0x36ee86a2e1fe0696e1fe24e0345cd5b3167530ef0d6b7a58f9f55774d7a403b9a03e5d9374118a1dbb30fcab8c8bc499ef62b3aac1aec00134b635416c73e2f555b24e08933cefe2fb2a47024ee61ab51490f1cae3070203010001a38201223082011e300c0603551d13040530030101ff301d0603551d0e04160414706ed0933d93523470a6e9bc979d124333df14b03081ee0603551d230481e63081e38014706ed0933d93523470a6e9bc979d124333df14b0a181bfa481bc3081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d01090116
EAP-Message =
0x12726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479820900d869d83ec24831ce300d06092a864886f70d010104050003818100d435d275a02b5e04e17e75b6046bbd1ab3ca33299cee907f2bd9c7603b3da4a23ee97e677e97e442bd855e8c2dffc351e134e03fbec16ad71eb7608c62c29bd2a2aaa2660013bc8d76520a5a9f3b516dcbddf6a773564e57c29e20d0a614a6116a36aef3cdfb
EAP-Message =
0xdc510f1058d291e6310d9b53c8b17e521038a866f3510355ef29160301018d0c0001890080ff76d1db8e9c6aa6bbe3d1bcc691f539a047acfa556255866a6d802ab6698cb71cf82f2fb16dfe236b5855ea6c50768f5725618bf523493f97785eda71b4aab842513a83fdb1b2466f94df90ec6c771bc6c8004fe3695f678f44ed4618b609c0e8eaf250ea9aef1bfc6213d2e48bd75258d4b20fcb2ea89eb6f562a93619ebeb0001020080457f5a1c896e293042889a80baf76d52658d76eb64c92baa31e4b901a3b469af59ab71d68674af7c35a774d47fbfb3f9dbe504edc8caba6587868c7679d1274437a5fec323ecf5bb1dab4b41a12549484a1d94
EAP-Message = 0x83acccdaba7cfbd7
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8ca945078eac5cbc436d046d9dce36c6
Finished request 3.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=133, length=143
User-Name = "anonymous"
Framed-MTU = 1400
Called-Station-Id = "64a0.e729.b890"
Calling-Station-Id = "1c65.9d32.fb68"
Service-Type = Login-User
Message-Authenticator = 0xbcb3f7da663c62412c3d92eb9610b21a
EAP-Message = 0x020500061900
NAS-Port-Type = Wireless-802.11
NAS-Port = 1911
NAS-Port-Id = "1911"
State = 0x8ca945078eac5cbc436d046d9dce36c6
NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 5 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 133 to 192.168.10.31 port 1645
EAP-Message =
0x010600b61900b77eba9bc0d843a1e70cbc91337bad9c2f401fd7f237bfdd0121dd64bc036829e6972a13ab0080216a3ef15f4e23893134c1e8a68c4b204bc3f0049e345d68abe39e46dad39a5993492fc2e5fc889e16b8336dc0b4500ca85ab762cfc2981d8a72eb7e5a3ba754a257e2cd8404a97485640634fee929d3ca79a902fccc99ea73b7076b222b84b699e72f6302625e7cdad6afd38a17585f4175ceb5196a4c403cca197e6aa19d9b16030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8ca945078faf5cbc436d046d9dce36c6
Finished request 4.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=134, length=341
User-Name = "anonymous"
Framed-MTU = 1400
Called-Station-Id = "64a0.e729.b890"
Calling-Station-Id = "1c65.9d32.fb68"
Service-Type = Login-User
Message-Authenticator = 0xd9d6c025a9cc8adf9b335e7da36824d1
EAP-Message =
0x020600cc19001603010086100000820080f936761756c50ab1fa1ebd2fbff6e71af919343742eb224468dae4bc4a0314cdf271c6ca9313cdd7efb584731d4c6ceba4a447e6e8a836b615ad353a5c6e41c31c4d2a6a3a2f3afbd373accbec80df6900bcaea06b7e7b9a0fc77e6c92603aa10413fb61d035760f58c7cfdd197ffc8ce8632df0c5096bc0ae23bf0dfa4c8ccf1403010001011603010030f2be8bbb65decb68454b4de12d99dde34bd5d1a039db44a9b14da5c5378388a0954eda1a5d4c386d797ee84c8d5923e7
NAS-Port-Type = Wireless-802.11
NAS-Port = 1911
NAS-Port-Id = "1911"
State = 0x8ca945078faf5cbc436d046d9dce36c6
NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 6 length 204
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange
[peap] TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]
[peap] <<< TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]
[peap] TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 write finished A
[peap] TLS_accept: SSLv3 flush data
[peap] (other): SSL negotiation finished successfully
SSL Connection Established
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 134 to 192.168.10.31 port 1645
EAP-Message =
0x01070041190014030100010116030100300d1ee2c2c4bc3706cb476ffa3b74949d84502de1b01a5f6da3efef07c438426b4d17e4e07e0d703389d1e9dc08b1b22d
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8ca9450788ae5cbc436d046d9dce36c6
Finished request 5.
Going to the next request
Waking up in 1.3 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=135, length=143
User-Name = "anonymous"
Framed-MTU = 1400
Called-Station-Id = "64a0.e729.b890"
Calling-Station-Id = "1c65.9d32.fb68"
Service-Type = Login-User
Message-Authenticator = 0x70dc4102a65e57d3bb58ee3ae0b975ac
EAP-Message = 0x020700061900
NAS-Port-Type = Wireless-802.11
NAS-Port = 1911
NAS-Port-Id = "1911"
State = 0x8ca9450788ae5cbc436d046d9dce36c6
NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 7 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3
[peap] eaptls_process returned 3
[peap] EAPTLS_SUCCESS
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] returns handled
Sending Access-Challenge of id 135 to 192.168.10.31 port 1645
EAP-Message =
0x0108002b190017030100204dfc77d11a861969c087157ec956873654e4212570ff9a9c8f74abf27a24bea2
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8ca9450789a15cbc436d046d9dce36c6
Finished request 6.
Going to the next request
Waking up in 1.3 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=136, length=217
User-Name = "anonymous"
Framed-MTU = 1400
Called-Station-Id = "64a0.e729.b890"
Calling-Station-Id = "1c65.9d32.fb68"
Service-Type = Login-User
Message-Authenticator = 0xfcfd2de20f4dd17fe27a932940065613
EAP-Message =
0x0208005019001703010020a741a4d57b7df591341632d17eb4fbdd1e8a55f3e22b10c7bcb9c4b75ea3cdba17030100204e5f007345bed18e9454e29df1c9bb1482d137e2f4da1945eaaca40d5cd45aca
NAS-Port-Type = Wireless-802.11
NAS-Port = 1911
NAS-Port-Id = "1911"
State = 0x8ca9450789a15cbc436d046d9dce36c6
NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 8 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - marguin2
[peap] Got inner identity 'marguin2'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
EAP-Message = 0x0208000d016d61726775696e32
server {
[peap] Setting User-Name to marguin2
Sending tunneled request
EAP-Message = 0x0208000d016d61726775696e32
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "marguin2"
server inner-tunnel {
# Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
++[unix] returns updated
[suffix] No '@' in User-Name = "marguin2", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 8 length 13
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
[ldap] performing user authorization for marguin2
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> marguin2
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) ->
(uid=marguin2)
[ldap] expand: ou=people,dc=currensee,dc=com ->
ou=people,dc=currensee,dc=com
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] performing search in ou=people,dc=currensee,dc=com, with
filter (uid=marguin2)
[ldap] checking if remote access for marguin2 is allowed by radiusFilterId
[ldap] looking for check items in directory...
[ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM"
[ldap] looking for reply items in directory...
[ldap] radiusFilterId -> Filter-Id = "wireless"
[ldap] user marguin2 authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set. Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
Filter-Id = "wireless"
EAP-Message =
0x010900221a0109001d101541ae87d9536c451df82fbb9eabdc3e6d61726775696e32
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x769c0ec5769514377b463afe53c96b87
[peap] Got tunneled reply RADIUS code 11
Filter-Id = "wireless"
EAP-Message =
0x010900221a0109001d101541ae87d9536c451df82fbb9eabdc3e6d61726775696e32
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x769c0ec5769514377b463afe53c96b87
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 136 to 192.168.10.31 port 1645
EAP-Message =
0x0109004b19001703010040ffb90c9da2e7017a24ff61dac25db142af27fa741fdb60fcc0c440acf0dcc75f5e6d7536ce64ee54612024ecb7bb0862e6bacb09b424babdf78c0b9d17d31f19
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8ca945078aa05cbc436d046d9dce36c6
Finished request 7.
Going to the next request
Waking up in 0.3 seconds.
Cleaning up request 1 ID 130 with timestamp +60
Cleaning up request 2 ID 131 with timestamp +60
Cleaning up request 3 ID 132 with timestamp +60
Cleaning up request 4 ID 133 with timestamp +60
Waking up in 3.5 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=137, length=217
User-Name = "anonymous"
Framed-MTU = 1400
Called-Station-Id = "64a0.e729.b890"
Calling-Station-Id = "1c65.9d32.fb68"
Service-Type = Login-User
Message-Authenticator = 0x8f599fef2ab96537cbe0039355513370
EAP-Message =
0x020900501900170301002036347ccd731b599adf5ecabb4068fa5940970abfb4951607a87ef622fae453c21703010020a837e04a9155a6e12a5814378ee3efee9986e5069e0714a1cea941ff2f5492cf
NAS-Port-Type = Wireless-802.11
NAS-Port = 1911
NAS-Port-Id = "1911"
State = 0x8ca945078aa05cbc436d046d9dce36c6
NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 9 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type nak
[peap] Got tunneled request
EAP-Message = 0x020900060306
server {
[peap] Setting User-Name to marguin2
Sending tunneled request
EAP-Message = 0x020900060306
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "marguin2"
State = 0x769c0ec5769514377b463afe53c96b87
server inner-tunnel {
# Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
++[unix] returns updated
[suffix] No '@' in User-Name = "marguin2", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 9 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
[ldap] performing user authorization for marguin2
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> marguin2
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) ->
(uid=marguin2)
[ldap] expand: ou=people,dc=currensee,dc=com ->
ou=people,dc=currensee,dc=com
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] performing search in ou=people,dc=currensee,dc=com, with
filter (uid=marguin2)
[ldap] checking if remote access for marguin2 is allowed by radiusFilterId
[ldap] looking for check items in directory...
[ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM"
[ldap] looking for reply items in directory...
[ldap] radiusFilterId -> Filter-Id = "wireless"
[ldap] user marguin2 authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set. Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP NAK
[eap] EAP-NAK asked for EAP-Type/gtc
[eap] processing type gtc
[gtc] expand: Password: -> Password:
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
Filter-Id = "wireless"
EAP-Message = 0x010a000f0650617373776f72643a20
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x769c0ec5779608377b463afe53c96b87
[peap] Got tunneled reply RADIUS code 11
Filter-Id = "wireless"
EAP-Message = 0x010a000f0650617373776f72643a20
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x769c0ec5779608377b463afe53c96b87
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 137 to 192.168.10.31 port 1645
EAP-Message =
0x010a002b19001703010020bc50433da891fded937957b95bc1d6d39b57d7ebe06d6e578c2cce0a84ecfe8c
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8ca945078ba35cbc436d046d9dce36c6
Finished request 8.
Going to the next request
Waking up in 2.3 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=138, length=217
User-Name = "anonymous"
Framed-MTU = 1400
Called-Station-Id = "64a0.e729.b890"
Calling-Station-Id = "1c65.9d32.fb68"
Service-Type = Login-User
Message-Authenticator = 0xe64adb38adc28db3b0e34547c38dd977
EAP-Message =
0x020a0050190017030100207294fdf97f3535985e24cd9a3c263476e4b9b0619349cbbb3d825e650cbf14701703010020e1bd830a1c52f8807d7e1b7c7b012163d5b581622eb0fbf5652ec7a450e76c5c
NAS-Port-Type = Wireless-802.11
NAS-Port = 1911
NAS-Port-Id = "1911"
State = 0x8ca945078ba35cbc436d046d9dce36c6
NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 10 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type gtc
[peap] Got tunneled request
EAP-Message = 0x020a000d06723061646b696c6c
server {
[peap] Setting User-Name to marguin2
Sending tunneled request
EAP-Message = 0x020a000d06723061646b696c6c
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "marguin2"
State = 0x769c0ec5779608377b463afe53c96b87
server inner-tunnel {
# Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
++[unix] returns updated
[suffix] No '@' in User-Name = "marguin2", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 10 length 13
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
[ldap] performing user authorization for marguin2
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> marguin2
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) ->
(uid=marguin2)
[ldap] expand: ou=people,dc=currensee,dc=com ->
ou=people,dc=currensee,dc=com
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] performing search in ou=people,dc=currensee,dc=com, with
filter (uid=marguin2)
[ldap] checking if remote access for marguin2 is allowed by radiusFilterId
[ldap] looking for check items in directory...
[ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM"
[ldap] looking for reply items in directory...
[ldap] radiusFilterId -> Filter-Id = "wireless"
[ldap] user marguin2 authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set. Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/gtc
[eap] processing type gtc
[gtc] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
[gtc] +- entering group PAP {...}
[pap] login attempt with password "r0adkill"
[pap] Using CRYPT password "*"
[pap] Passwords don't match
++[pap] returns reject
[eap] Handler failed in EAP/gtc
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
} # server inner-tunnel
[peap] Got tunneled reply code 3
Filter-Id = "wireless"
EAP-Message = 0x040a0004
Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code 3
Filter-Id = "wireless"
EAP-Message = 0x040a0004
Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] returns handled
Sending Access-Challenge of id 138 to 192.168.10.31 port 1645
EAP-Message =
0x010b002b19001703010020bc8ab82b419f499978e7d5faedce851471945ab65159cc3b5762de33d8eeb94b
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8ca9450784a25cbc436d046d9dce36c6
Finished request 9.
Going to the next request
Waking up in 0.8 seconds.
Cleaning up request 5 ID 134 with timestamp +64
Cleaning up request 6 ID 135 with timestamp +64
Waking up in 1.0 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=139, length=217
User-Name = "anonymous"
Framed-MTU = 1400
Called-Station-Id = "64a0.e729.b890"
Calling-Station-Id = "1c65.9d32.fb68"
Service-Type = Login-User
Message-Authenticator = 0x6eef9b0bc3f36009729481a23b6e8326
EAP-Message =
0x020b005019001703010020292b726e855a04ed0d00ef8437129fc3bff157c8cf703900a952f77e9575aeab1703010020bbddafa3746eafb2871786e57813ad848b14ff4f24df4312b8bfa8325ce5ab25
NAS-Port-Type = Wireless-802.11
NAS-Port = 1911
NAS-Port-Id = "1911"
State = 0x8ca9450784a25cbc436d046d9dce36c6
NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 11 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state send tlv failure
[peap] Received EAP-TLV response.
[peap] The users session was previously rejected: returning reject (again.)
[peap] *** This means you need to read the PREVIOUS messages in the
debug output
[peap] *** to find out the reason why the user was rejected.
[peap] *** Look for "reject" or "fail". Those earlier messages will
tell you.
[peap] *** what went wrong, and how to fix the problem.
[eap] Handler failed in EAP/peap
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> anonymous
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 10 for 1 seconds
Going to the next request
Waking up in 0.4 seconds.
Cleaning up request 7 ID 136 with timestamp +64
Waking up in 0.5 seconds.
Sending delayed reject for request 10
Sending Access-Reject of id 139 to 192.168.10.31 port 1645
EAP-Message = 0x040b0004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 1.1 seconds.
Cleaning up request 8 ID 137 with timestamp +66
Waking up in 1.5 seconds.
Cleaning up request 9 ID 138 with timestamp +68
Waking up in 2.3 seconds.
Cleaning up request 10 ID 139 with timestamp +69
Ready to process requests.
On 11/1/2011 2:09 AM, freeradius-users-request at lists.freeradius.org wrote:
> Send Freeradius-Users mailing list submissions to
> freeradius-users at lists.freeradius.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> http://lists.freeradius.org/mailman/listinfo/freeradius-users
> or, via email, send a message with subject or body 'help' to
> freeradius-users-request at lists.freeradius.org
>
> You can reach the person managing the list at
> freeradius-users-owner at lists.freeradius.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Freeradius-Users digest..."
>
>
> Today's Topics:
>
> 1. Re: IPv6 ready? (Alan Buxey)
> 2. Re: cisco WAP/FreeRadius/OpenLDAP (Alan Buxey)
> 3. Re: add field in radcheck table (gary)
> 4. Re: add field in radcheck table (Fajar A. Nugraha)
> 5. Client hostname in clients.conf instead of IP address (tohaikmeng)
> 6. Re: Client hostname in clients.conf instead of IP address
> (Fajar A. Nugraha)
> 7. Re: add field in radcheck table (gary)
> 8. Re: add field in radcheck table (Fajar A. Nugraha)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Mon, 31 Oct 2011 19:23:09 +0000
> From: Alan Buxey<A.L.M.Buxey at lboro.ac.uk>
> Subject: Re: IPv6 ready?
> To: FreeRadius users mailing list
> <freeradius-users at lists.freeradius.org>
> Message-ID:<20111031192309.GC19191 at lboro.ac.uk>
> Content-Type: text/plain; charset=iso-8859-1
>
> Hi,
>> Thank you all for your help. I added two more listen blocks in
>> radiusd.conf and I updated detail { ... with the following:
>> %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} and it works but
>> ..... (there's always a but). if we use an IPv6 address, then
>> Packet-Src-APv6-Address value will be, for instance, 0:0:0:0:0:0:0:0, and
>> the path becomes :
>>
>> ?????????????? ${radacctdir}/0:0:0:0:0:0:0:0/detail-%Y%m%d.log
>>
>> but FR crashes since it cannot create a folder with that name. Is there
>> any way of overcoming this issue? replace : with . or so???
> well, you asked how it could be done..you didnt say you were
> trying this on Windows! whats the next surprise?
>
> I would do something like use PERL to make %{Packet-Src-IPv6-Address} become
> sanitized..... eg assign %{Tmp-String-0} and use SED to swap : with -
>
> this means no single source code line change and easily adaptable to whatever
> else you might come across....
>
> then use simly use %{Tmp-String-0} in your detail module config....
>
>
> alan
>
>
> ------------------------------
>
> Message: 2
> Date: Mon, 31 Oct 2011 19:25:49 +0000
> From: Alan Buxey<A.L.M.Buxey at lboro.ac.uk>
> Subject: Re: cisco WAP/FreeRadius/OpenLDAP
> To: FreeRadius users mailing list
> <freeradius-users at lists.freeradius.org>
> Message-ID:<20111031192549.GD19191 at lboro.ac.uk>
> Content-Type: text/plain; charset=us-ascii
>
> Hi,
>
>> so now the password is not clear text in the log as it was before but
>> still seeing that no good password error....but then there is that line
>> towards the bottom that sasys user authorized to use remote access... do
>> i need to configure Filter-Id or something in the sites-enabled/default
>> or innertunnel or something like that?
> getting confused with authorization and authentication? check your requirements
> in LDAP - do they match (eg CN/DN?)
>
> have you got PAP listed after the ldap and is the auto_header enabled in the pap
> module?
>
> alan
>
>
> ------------------------------
>
> Message: 3
> Date: Tue, 1 Nov 2011 10:07:00 +0800
> From: "gary"<gary.yang at browan.com>
> Subject: Re: add field in radcheck table
> To: "FreeRadius users mailing list"
> <freeradius-users at lists.freeradius.org>
> Message-ID:<003901cc983a$f335b490$cd15a8c0 at ggyy40fbc8fbae>
> Content-Type: text/plain; format=flowed; charset="iso-8859-1";
> reply-type=original
>
> ----- Original Message -----
> From: "Fajar A. Nugraha"<list at fajar.net>
> To: "FreeRadius users mailing list"<freeradius-users at lists.freeradius.org>
> Sent: Monday, October 31, 2011 8:34 PM
> Subject: Re: add field in radcheck table
>
>
>> On Mon, Oct 31, 2011 at 5:23 PM, gary<gary.yang at browan.com> wrote:
>>> Hi Fajar
>>> I think the secondname field may be realm instead of.
>> First rule before asking anything: make SURE you know what you want.
>> When you're not even sure, how can others help you?
>>
>>> I am thinking this in case without proxy, using local database it can
>>> determine by two field "username+realm" instead one check field username
>>> such as "gary at companyA" . User can see his/her name like "gary" only
>>> without
>>> "@companyA" character.
>> What do you mean "User can SEE"?
>>
>> The question is simple. What does the user put as username? How do you
>> want to process that username?
>>
>> If the user only inputs "gary", and you don't know how you you can get
>> the realm, then how can FR do what you want? By being psychic?
>>
> Sorry for my poor english.
> > From the login page,user can type his name and select pull-down option for
> the realm and then send to FR server for authentication.
> for example, gary at domain1 and gary at domain2 come from different company and
> both in same database.
> I can directly input gary at domain1 and gary at domain2 as user name for
> authentication.
> but I would like to separate two field for checking.
> user can see(probably read) user infomation(eg:logout page) only user name
> instead of gary at domain1 .
> Furthermore, in case lot of data in radcheck, it can be search,sort...etc
> according to the realm field to improve server performance.
>
>> --
>> Fajar
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>
>
> ------------------------------
>
> Message: 4
> Date: Tue, 1 Nov 2011 10:02:22 +0700
> From: "Fajar A. Nugraha"<list at fajar.net>
> Subject: Re: add field in radcheck table
> To: FreeRadius users mailing list
> <freeradius-users at lists.freeradius.org>
> Message-ID:
> <CAG1y0scMgFLgQivxcF+i12pUyFcMWWzZuXYgn8VdfMmz4QRBqw at mail.gmail.com>
> Content-Type: text/plain; charset=ISO-8859-1
>
> On Tue, Nov 1, 2011 at 9:07 AM, gary<gary.yang at browan.com> wrote:
>>> From the login page,user can type his name and select pull-down option for
>> the realm and then send to FR server for authentication.
>> for example, gary at domain1 and gary at domain2 come from different company and
>> both in same database.
>> I can directly input gary at domain1 and gary at domain2 as user name for
>> authentication.
>> but I would like to separate two field for checking.
>> user can see(probably read) user infomation(eg:logout page) only user name
>> instead of gary at domain1 .
> This is a captive portal setup, right? FR doesn't really care what
> user puts in "drop down box", it only cares what the NAS (e.g.
> chillispot) sends. And the NAS doesn't really care what the user
> inputs, it only cares what the captive portal sends it (which may or
> may not be the same as what the user inputs).
>
> For example, in my setup the captive portal adds a realm automatically
> (user can't put it manually) and pre-process the password that user
> entered (e.g. using a custom hash).
>
> In that setup there's really no need to separate user and realm. Just
> use the default setup.
>
>> Furthermore, in case lot of data in radcheck, it can be search,sort...etc
>> according to the realm field to improve server performance.
> I actually think the easiest way is to just add a "realm" field in
> radcheck as ENUM type, indexed, used only for search/sorting purposes,
> updated automatically by mysql trigger. That way you don't have to
> modify anything on FR side.
>
--
Matthew Arguin
Currensee, Inc.
54 Canal St, 4th Floor
Boston, MA 02114
(617) 986-4758 (Office)
_________________________________________________________________________
This email and any files transmitted with it are confidential and intended solely for the addressee. If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system.
© 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions.
Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824
More information about the Freeradius-Users
mailing list