Nie jesteś zalogowany.
Jeśli nie posiadasz konta, zarejestruj je już teraz! Pozwoli Ci ono w pełni korzystać z naszego serwisu. Spamerom dziękujemy!
Prosimy o pomoc dla małej Julki — przekaż 1% podatku na Fundacji Dzieciom zdazyć z Pomocą.
Więcej informacji na dug.net.pl/pomagamy/.
Witam
walcze z radiusem z uwierzytelnianiem PEAP. docelowo chce uwierzytelniać hosty po IEEE802.1X na switchach i apekach.
niby klient się uwierzytelnia ale uwierzytelnienie klienta przebiega u 8 requestach :( czy to normalne?
dodatkowo z radiusa chce przydzielać ip, ale jakoś klient tego nie otrzymuje mimo wysłania mu w odpowiedzi.
root@radius:/etc/freeradius# freeradius -X FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client edimax { ipaddr = 172.33.0.10 require_message_authenticator = no secret = "haslo" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=255, length=163 User-Name = "bob" NAS-IP-Address = 172.33.0.10 NAS-Port = 0 Called-Station-Id = "000e2eaab977" Calling-Station-Id = "0016ead9f81e" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000801626f62 Message-Authenticator = 0x0eb6be5806b2514fc502299a6319fcbb # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry bob at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 255 to 172.33.0.10 port 3072 Framed-IP-Address = 172.172.0.123 Framed-IP-Netmask = 255.255.255.0 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfa98d64cfa8941b3a000f615dd9d30c Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=0, length=272 User-Name = "bob" NAS-IP-Address = 172.33.0.10 NAS-Port = 0 Called-Station-Id = "000e2eaab977" Calling-Station-Id = "0016ead9f81e" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201006919800000005f160301005a0100005603014d5b99af581dae9ad38a1055bdc982574d8da7f17773518f840aa1e228cd695300002800390038003500160013000a00330032002f000500040015001200090014001100080006000300ff020100000400230000 State = 0xcfa98d64cfa8941b3a000f615dd9d30c Message-Authenticator = 0x6c33aa2e4e3bcd4438e4bdf819b399fb # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 105 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 95 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 02bc], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 172.33.0.10 port 3072 EAP-Message = 0x0102040019c00000051216030100310200002d03014d5b99af3ca11b848c59994f4cbe099bcf6591a10a857c2b7f488f01b9ae61c3000039010005ff0100010016030102bc0b0002b80002b50002b2308202ae30820196020900d7516cfea3c83fac300d06092a864886f70d01010505003019311730150603550403130e7261646975732e74756b732e706c301e170d3131303231363039313731325a170d3231303231333039313731325a3019311730150603550403130e7261646975732e74756b732e706c30820122300d06092a864886f70d01010105000382010f003082010a0282010100f1941df215f2e3606104ce70a7f43f42aad4e4c506 EAP-Message = 0xae10d2fd94784e37f734411bf4e000c76c64cb15e6ba9b0619cbbc6df9947237315cb5c8f8c27a0c10c3c3caca91c00f23be8138803af4cb9378ede75f770c289c57f5c2c63547ad267803fe9ec07b6b98f03f1c5f5cbaf760c1c9cd5ca43b1f1f923cbbe4906b8af3e684c53a232b755013184e003fdaf00097c1f35fb314ade19b37d8e18f1a1e6d63d561345c8ec40963cb3ef88c8c607c6f9ac9cfd9ffbb2d7bdcce4fc177ee4259f35f9c5928b386cf1840afa8e84bf2ac536516304ba1303071102d707480fa3ecff379f5f53ef249e81f63db9113ad3194118d0aefa8141e50be10bf7852f6abc90203010001300d06092a864886f70d010105 EAP-Message = 0x050003820101004dc92483160ca21bb7ba46d422e1371d1fcdbb85c540d30b783831224bd306efcb3b81020e0f5b695c3c28f82c4d7b3886fa9e9318ea250a582411c4c653c04a4b55bfc53ca9d0874092d571d8e1447986e02e62d720039050427944b32190faeb2705e76e4317d62be4aa4d5b05b1ddc93dd5a343d87faeb2993506fa1f8e65c6b6e8406599b2359955534ce213210c2549ec51c973b917ccf53dacaed8f75fea83dc840415e067d376fa83cdbc3625e9907d6695d5b4f9fb712b6cf11e69253c0e34f491852b440b6beb47cfc135800922eda07fb5924eaa9f51485dd4f6cb6cc6a5e935bba148d475f0a1e063bc036dc14537213a EAP-Message = 0x4fa4e6cc0d1d025e1ff0160301020d0c00020900809c399b906a65c9e465d81e2b4afadc5b84ebe254226caa611330763696438232c97c690f3f33e87a18ce5619eaea2feddfda0d77cb5b413d0b71984ec283742bdb84e19a5fd47cb673d7b83d1834469aa7d24d7fe1730e48633d69ad4e2f7b01d5aeedeb1860f9b0619c80e6ee0c54d3d7dd1dae89312fd128416a6fe4a605a3000102008068a6b33c10f30146d02381dca8027d305feb3113b3441a966e2c36474044115cae68bb1dc2c654dbac9c817d6f8e494bbb31ad8d4a132c15c652df3dcdbd31164625d6e7566973c7e7cb2d3dd8faf93ecd41fad8aa2686e01ab128821ca3b5335a041d EAP-Message = 0x75df73e15cf3c51d4d856758 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfa98d64ceab941b3a000f615dd9d30c Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=1, length=173 User-Name = "bob" NAS-IP-Address = 172.33.0.10 NAS-Port = 0 Called-Station-Id = "000e2eaab977" Calling-Station-Id = "0016ead9f81e" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200061900 State = 0xcfa98d64ceab941b3a000f615dd9d30c Message-Authenticator = 0xc35e248ef58df51251bf1047414cf8e0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 1 to 172.33.0.10 port 3072 EAP-Message = 0x010301221900e4748f1294c6a551216fdad81b5a133a6601003cb64ed6ecf4a79a47068916fbd58e716f4680435bca1b8255987db936be569fcb386f2a262c73ab75c7689fff920ed2622431aa386f4fc5b43264bf63b02b75e5633a08156f616dc662d7676a720baf695a6506482312319ce51a210dda6654c88f0a4f3f679b08236ef8317322e29f6edad81c47ed9fc9d8552a53c07c93cab93e13e2cca8b833c2328386cc532be6873a33924ccf539bb8bd5026ff37d4684d1d08dcaa81f4c4709f72c4b5b1b4288745e034866d79a656a9c1fadee6596269a16481f693437fad19df7ea787c4812ac9b8c7da445cfd719fdb064d411aa6a6011f13 EAP-Message = 0xe8a7e4ce26acfce50f70cd182f6fbca41780100d635aec8a0eaa243e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfa98d64cdaa941b3a000f615dd9d30c Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=2, length=375 User-Name = "bob" NAS-IP-Address = 172.33.0.10 NAS-Port = 0 Called-Station-Id = "000e2eaab977" Calling-Station-Id = "0016ead9f81e" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300d01980000000c616030100861000008200808e00432efe6451a82ca04221f14ddc579c7c01ae46da0e1dce3e1ede1f256a2962511292662bb48cdbc942f95fa64db1953c764dce30587fc45845a7ef5b6350c508b9b113286b947bc04b03f726611614e7d89e8a3efea0d4ec506aa3a51a1e64cee9ad2c73fe79bfd529b240a092e2ddebd33013c418f6390d829c4e20b1a614030100010116030100301ddaf2fc78b690228d1bc20c1b553ff4dd98e829abaa704e237b7bc278620c05ba48becbeccf211a532635b10bd69413 State = 0xcfa98d64cdaa941b3a000f615dd9d30c Message-Authenticator = 0xe6a459792023fc35df7daedf8dbf029a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to 172.33.0.10 port 3072 EAP-Message = 0x0104004119001403010001011603010030853d44d54816ca70d3116d8b361979da2a107e4772d249da6be439683ac807ebcd431a201bbb7042ea83283a038f8d6d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfa98d64ccad941b3a000f615dd9d30c Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=3, length=173 User-Name = "bob" NAS-IP-Address = 172.33.0.10 NAS-Port = 0 Called-Station-Id = "000e2eaab977" Calling-Station-Id = "0016ead9f81e" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400061900 State = 0xcfa98d64ccad941b3a000f615dd9d30c Message-Authenticator = 0x679861d01d46e3409b73248905b01b6f # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 3 to 172.33.0.10 port 3072 EAP-Message = 0x0105002b1900170301002003433bbd1c1917e5c121c67701fab463cee47252c67f0d6224043402c7c3fe88 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfa98d64cbac941b3a000f615dd9d30c Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=4, length=247 User-Name = "bob" NAS-IP-Address = 172.33.0.10 NAS-Port = 0 Called-Station-Id = "000e2eaab977" Calling-Station-Id = "0016ead9f81e" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0205005019001703010020350b7a2b2ebce5f5a399270ae60c0524eaacb155f11ccd7a0998603aad837b511703010020f1a2935aebdfc3c467ca148b5aa28dd50d2310bc3a6f0aa0537c67e0570acfc9 State = 0xcfa98d64cbac941b3a000f615dd9d30c Message-Authenticator = 0xc8bfafe539b8fb91a9862a8836c89015 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - bob [peap] Got inner identity 'bob' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0205000801626f62 server { PEAP: Setting User-Name to bob Sending tunneled request EAP-Message = 0x0205000801626f62 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "bob" NAS-IP-Address = 172.33.0.10 NAS-Port = 0 Called-Station-Id = "000e2eaab977" Calling-Station-Id = "0016ead9f81e" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[mschap] returns noop ++[control] returns noop [eap] EAP packet type response id 5 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry bob at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Framed-IP-Address = 172.172.0.123 Framed-IP-Netmask = 255.255.255.0 EAP-Message = 0x0106001d1a01060018108c07ae32db579d63fcf4472741c0140b626f62 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x60568bf16050917e540aa23de005f625 [peap] Got tunneled reply RADIUS code 11 Framed-IP-Address = 172.172.0.123 Framed-IP-Netmask = 255.255.255.0 EAP-Message = 0x0106001d1a01060018108c07ae32db579d63fcf4472741c0140b626f62 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x60568bf16050917e540aa23de005f625 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 4 to 172.33.0.10 port 3072 EAP-Message = 0x0106004b19001703010040f117a5f66f93682e9fb81c06cbddebab20cc4c03aca97cc08ec525070a23f1ae05c106b04569d3999384b9543a3784bf479536f7821e4c0a28141bfa3fdcb47f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfa98d64caaf941b3a000f615dd9d30c Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=5, length=295 User-Name = "bob" NAS-IP-Address = 172.33.0.10 NAS-Port = 0 Called-Station-Id = "000e2eaab977" Calling-Station-Id = "0016ead9f81e" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0206008019001703010020866b63154d48e8e35432898f581536246ea847823f4eb07c2ab37e5874050a891703010050d197f8068a88905b0099ee1e0cc631ae74838be6057d44f3af88c9c41d1dc6c44ccfe59ae3b3105574be5e6640a2c82a9836fc487827ef9d8631eef74d33959bc0c3daa71d7f3002017dd2791be84f6a State = 0xcfa98d64caaf941b3a000f615dd9d30c Message-Authenticator = 0x0191348f460c43c33ed55b533b1a90b7 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 128 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0206003e1a02060039318155759d417f23ac9271f69f7ccf95e300000000000000004f84ccbc385b42702fd76241996d292a240baaaf359d817100626f62 server { PEAP: Setting User-Name to bob Sending tunneled request EAP-Message = 0x0206003e1a02060039318155759d417f23ac9271f69f7ccf95e300000000000000004f84ccbc385b42702fd76241996d292a240baaaf359d817100626f62 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "bob" State = 0x60568bf16050917e540aa23de005f625 NAS-IP-Address = 172.33.0.10 NAS-Port = 0 Called-Station-Id = "000e2eaab977" Calling-Station-Id = "0016ead9f81e" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[mschap] returns noop ++[control] returns noop [eap] EAP packet type response id 6 length 62 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry bob at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: bob [mschap] Told to do MS-CHAPv2 for bob with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Framed-IP-Address = 172.172.0.123 Framed-IP-Netmask = 255.255.255.0 EAP-Message = 0x010700331a0306002e533d46313144384145393441333241444538393938464630454146314437343435424332453335373443 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x60568bf16151917e540aa23de005f625 [peap] Got tunneled reply RADIUS code 11 Framed-IP-Address = 172.172.0.123 Framed-IP-Netmask = 255.255.255.0 EAP-Message = 0x010700331a0306002e533d46313144384145393441333241444538393938464630454146314437343435424332453335373443 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x60568bf16151917e540aa23de005f625 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 5 to 172.33.0.10 port 3072 EAP-Message = 0x0107005b190017030100507afeb639bf38be468307dcb5adf6527e591d05f53b4034eed399397e26d291b5ea945bbd3126bc774268c351e2ac81eb96d8e7e1a52b3f750a11607234acc2fed1d9499c841ebc89e2296b2d1fbb93b0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfa98d64c9ae941b3a000f615dd9d30c Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=6, length=247 User-Name = "bob" NAS-IP-Address = 172.33.0.10 NAS-Port = 0 Called-Station-Id = "000e2eaab977" Calling-Station-Id = "0016ead9f81e" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0207005019001703010020c0a6e754c365c558115e2c65e621bd655f7ef434f028e5bbfc1516ace3b4548e170301002082736822c120b58e8eec204bd8bbd7b7ea41d9392706e41f4f5a07a3dabe6f39 State = 0xcfa98d64c9ae941b3a000f615dd9d30c Message-Authenticator = 0xcbe80472c4a7394313374ee26fde1319 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020700061a03 server { PEAP: Setting User-Name to bob Sending tunneled request EAP-Message = 0x020700061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "bob" State = 0x60568bf16151917e540aa23de005f625 NAS-IP-Address = 172.33.0.10 NAS-Port = 0 Called-Station-Id = "000e2eaab977" Calling-Station-Id = "0016ead9f81e" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[mschap] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry bob at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel } # server inner-tunnel [peap] Got tunneled reply code 2 Framed-IP-Address = 172.172.0.123 Framed-IP-Netmask = 255.255.255.0 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xb977bd72d56cd5f93ac093254c30f1ff MS-MPPE-Recv-Key = 0x92e4a04b31522cfa6ccecd9a185cb6c8 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "bob" [peap] Got tunneled reply RADIUS code 2 Framed-IP-Address = 172.172.0.123 Framed-IP-Netmask = 255.255.255.0 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xb977bd72d56cd5f93ac093254c30f1ff MS-MPPE-Recv-Key = 0x92e4a04b31522cfa6ccecd9a185cb6c8 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "bob" [peap] Tunneled authentication was successful. [peap] SUCCESS [peap] Saving tunneled attributes for later ++[eap] returns handled Sending Access-Challenge of id 6 to 172.33.0.10 port 3072 EAP-Message = 0x0108003b1900170301003007ceca193ef1a187a79f79d1f8f7a63190408a631ec678e71bc4af071cd00ab7e28b7473d9b109ee30756eb88b7257a4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfa98d64c8a1941b3a000f615dd9d30c Finished request 7. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=7, length=263 User-Name = "bob" NAS-IP-Address = 172.33.0.10 NAS-Port = 0 Called-Station-Id = "000e2eaab977" Calling-Station-Id = "0016ead9f81e" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0208006019001703010020b28a4f39b5d7e99183468b06ae03505f866aaf7defe51bf86c9ba4982cf007d51703010030479d1054c468b9ea726b9422e3a66eed74d38b1eb63c3aa26fc969e36585a45e02d860217a6034ed757b04acc216b705 State = 0xcfa98d64c8a1941b3a000f615dd9d30c Message-Authenticator = 0x4314a73187da3b0baf96f3a3fc903eb5 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [peap] Using saved attributes from the original Access-Accept Framed-IP-Address = 172.172.0.123 Framed-IP-Netmask = 255.255.255.0 User-Name = "bob" [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 7 to 172.33.0.10 port 3072 Framed-IP-Address = 172.172.0.123 Framed-IP-Netmask = 255.255.255.0 User-Name = "bob" MS-MPPE-Recv-Key = 0xa8b116188719ee417d1ca4a1ae0cd2b880bf97345abbec801bd882b709ee4f6a MS-MPPE-Send-Key = 0xeacf0351be2305fa7216cdf2562ea5a506c579a7587a83c5cfdeac79fc34fc11 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 255 with timestamp +7 Cleaning up request 1 ID 0 with timestamp +7 Cleaning up request 2 ID 1 with timestamp +7 Cleaning up request 3 ID 2 with timestamp +7 Cleaning up request 4 ID 3 with timestamp +7 Cleaning up request 5 ID 4 with timestamp +7 Cleaning up request 6 ID 5 with timestamp +7 Cleaning up request 7 ID 6 with timestamp +7 Cleaning up request 8 ID 7 with timestamp +7 Ready to process requests.
radiusd.conf
prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/
eap.conf
eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom CA_path = ${cadir} cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no max_entries = 255 } verify { } } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } mschapv2 { } }
sites-enabled/default
authorize { preprocess chap mschap digest suffix eap { ok = return } files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp exec attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap }
sites-enabled/inner-tunel
server inner-tunnel { listen { ipaddr = 127.0.0.1 port = 18120 type = auth } authorize { mschap update control { Proxy-To-Realm := LOCAL } eap { ok = return } files expiration logintime } authenticate { Auth-Type MS-CHAP { mschap } eap } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap }
Offline
Na jakiej sieciówice postawiłeś tego Radiusa? Chyba wymagana jest taka która no problem śmiga z hostapd, z doświadczenia mogę Ci powiedzieć - że błędy podobne do opisanych występowały u mnie, właśnie na kartach ze słabym wsparciem AP i zmąconymi sterownikami...
Offline
[quote=Huk]Na jakiej sieciówice postawiłeś tego Radiusa? Chyba wymagana jest taka która no problem śmiga z hostapd, z doświadczenia mogę Ci powiedzieć - że błędy podobne do opisanych występowały u mnie, właśnie na kartach ze słabym wsparciem AP i zmąconymi sterownikami...[/quote]
tu nie chodzi o sieciówke. w ramach testów mam radiusa postawionego na virtualboxie (bardzo łatwo i szybko przywrócić system do początkowego stanu) ze zbridgeowaną sieciówką w laptopie. server radius bedzie tylko do tego. nie będzie, nie ma, na nim żadnych sieciówek wlanowych zeby stawiać hostapd.
zresztą sugerując się twoją podpowiedzią odnośnie sieciówki, na szybko postawiłem tego radiusa na stacjonarce (sieciówka Intelowska gigabit, serwerowa) i przypadek jest ten sam.
----
właśnie wyczytałem w dokumentacji, iż EAP nie obsługuje przydzielania adresów ip. jeśli radius ma przyznawać adresy to tym musi zajmować się autentykator lub "zewnętrzny" serwer DHCP :(
Ostatnio edytowany przez Nicram (2011-02-16 16:02:39)
Offline
Opisałem jakiś czas temu konfigurację FreeRadius, może Ci się to przyda:
http://www.tomczuk.info/2011/02/freeradius-eap-tls/
Rozwiązałeś może ten problem, u mnie autoryzacja wygląda podobnie.
Ostatnio edytowany przez czeri (2011-10-17 18:44:02)
Offline
[quote=czeri]Rozwiązałeś może ten problem, u mnie autoryzacja wygląda podobnie.[/quote]
Jeśli wygląda podobnie to znaczy, że jest ok. Moja nie wiedza na temat radiusa spowodowała właśnie ten wątek. Jest to opisane na stronie producenta, że zanim nastąpi accept radius musi z suplikantem powymieniać troche informacji, z reguły jest to 8-10 :)
Offline
[quote=Nicram][quote=czeri]Rozwiązałeś może ten problem, u mnie autoryzacja wygląda podobnie.[/quote]
Jeśli wygląda podobnie to znaczy, że jest ok. Moja nie wiedza na temat radiusa spowodowała właśnie ten wątek. Jest to opisane na stronie producenta, że zanim nastąpi accept radius musi z suplikantem powymieniać troche informacji, z reguły jest to 8-10 :)[/quote]
Nie wiedziałem tego, dzięki wielkie za uświadomienie tego faktu, bo już myślałem, że mam skopaną konfigurację.
Offline
[quote=Nicram]właśnie wyczytałem w dokumentacji, iż EAP nie obsługuje przydzielania adresów ip. jeśli radius ma przyznawać adresy to tym musi zajmować się autentykator lub "zewnętrzny" serwer DHCP :([/quote]
Tylko teraz jak zmusić zewnętrzny serwer dhcp żeby przydzielał odpowiednie zakresy adresów dla odpowiednich grup użytkowników.
Chodzi mi tutaj o realizację uprawnień. Chyba, że istnieje jakaś inna metoda realizacji uprawnień np. do stron www.
przykładowo kierownik ma mieć dostęp do facebooka a kowalski juz nie.
Offline
A czy zewnętrzny serwer DHCP jest w stanie zwrócić Framed-Ip-Address ?
Chce mieć wszystko w logach, ale niestety brakuje mi adresu ip hosta.
Offline
[quote=czeri]A czy zewnętrzny serwer DHCP jest w stanie zwrócić Framed-Ip-Address ?
Chce mieć wszystko w logach, ale niestety brakuje mi adresu ip hosta.[/quote]
Też mam/miałem ten problem. niestety nie znalazłem rozwiązania, żeby zewnętrzny serwer dhcp korzystał z radiusa :(
Ale freeradius ma zaimplementowaną usługę dhcp, co prawda jest w fazie rozwoju i producent nie zaleca jeszcze używać tego produkcyjnie, ale jest, można potestować.
mi na chwilę obecną w dhcp brakuje możliwości accountingu klienta. robię to poprzez pppoe, ale chętnie przerzuciłbym się na dhcp - mniej problematyczne dla klienta. Niestety w dhcp nie jestem w stanie stwierdzić czy klient jest "zalogowany" czy nie i ile już zassał/wysłał danych :(
Offline
Time (s) | Query |
---|---|
0.00010 | SET CHARSET latin2 |
0.00007 | SET NAMES latin2 |
0.00078 | SELECT u.*, g.*, o.logged FROM punbb_users AS u INNER JOIN punbb_groups AS g ON u.group_id=g.g_id LEFT JOIN punbb_online AS o ON o.ident='18.226.222.76' WHERE u.id=1 |
0.00060 | UPDATE punbb_online SET logged=1732474193 WHERE ident='18.226.222.76' |
0.00050 | SELECT * FROM punbb_online WHERE logged<1732473893 |
0.00063 | DELETE FROM punbb_online WHERE ident='18.227.48.131' |
0.00061 | SELECT topic_id FROM punbb_posts WHERE id=165717 |
0.00006 | SELECT id FROM punbb_posts WHERE topic_id=18344 ORDER BY posted |
0.00077 | SELECT t.subject, t.closed, t.num_replies, t.sticky, f.id AS forum_id, f.forum_name, f.moderators, fp.post_replies, 0 FROM punbb_topics AS t INNER JOIN punbb_forums AS f ON f.id=t.forum_id LEFT JOIN punbb_forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id=3) WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND t.id=18344 AND t.moved_to IS NULL |
0.00005 | SELECT search_for, replace_with FROM punbb_censoring |
0.00373 | SELECT u.email, u.title, u.url, u.location, u.use_avatar, u.signature, u.email_setting, u.num_posts, u.registered, u.admin_note, p.id, p.poster AS username, p.poster_id, p.poster_ip, p.poster_email, p.message, p.hide_smilies, p.posted, p.edited, p.edited_by, g.g_id, g.g_user_title, o.user_id AS is_online FROM punbb_posts AS p INNER JOIN punbb_users AS u ON u.id=p.poster_id INNER JOIN punbb_groups AS g ON g.g_id=u.group_id LEFT JOIN punbb_online AS o ON (o.user_id=u.id AND o.user_id!=1 AND o.idle=0) WHERE p.topic_id=18344 ORDER BY p.id LIMIT 0,25 |
0.00111 | UPDATE punbb_topics SET num_views=num_views+1 WHERE id=18344 |
Total query time: 0.00901 s |