Forum Debian Users Gang

Nicram · 2011-02-16 11:25:24

Witam
walcze z radiusem z uwierzytelnianiem PEAP. docelowo chce uwierzytelniać hosty po IEEE802.1X na switchach i apekach.
niby klient się uwierzytelnia ale uwierzytelnienie klienta przebiega u 8 requestach :( czy to normalne?
dodatkowo z radiusa chce przydzielać ip, ale jakoś klient tego nie otrzymuje mimo wysłania mu w odpowiedzi.

Kod:

root@radius:/etc/freeradius# freeradius -X
FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. 
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A 
PARTICULAR PURPOSE. 
You may redistribute copies of FreeRADIUS under the terms of the 
GNU General Public License v2. 
Starting - reading configuration files ...
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/modules/
including configuration file /etc/freeradius/modules/passwd
including configuration file /etc/freeradius/modules/opendirectory
including configuration file /etc/freeradius/modules/cui
including configuration file /etc/freeradius/modules/mac2ip
including configuration file /etc/freeradius/modules/checkval
including configuration file /etc/freeradius/modules/smsotp
including configuration file /etc/freeradius/modules/realm
including configuration file /etc/freeradius/modules/acct_unique
including configuration file /etc/freeradius/modules/otp
including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login
including configuration file /etc/freeradius/modules/ntlm_auth
including configuration file /etc/freeradius/modules/expiration
including configuration file /etc/freeradius/modules/linelog
including configuration file /etc/freeradius/modules/ldap
including configuration file /etc/freeradius/modules/ippool
including configuration file /etc/freeradius/modules/detail.log
including configuration file /etc/freeradius/modules/chap
including configuration file /etc/freeradius/modules/unix
including configuration file /etc/freeradius/modules/policy
including configuration file /etc/freeradius/modules/detail.example.com
including configuration file /etc/freeradius/modules/logintime
including configuration file /etc/freeradius/modules/preprocess
including configuration file /etc/freeradius/modules/always
including configuration file /etc/freeradius/modules/attr_rewrite
including configuration file /etc/freeradius/modules/echo
including configuration file /etc/freeradius/modules/counter
including configuration file /etc/freeradius/modules/dynamic_clients
including configuration file /etc/freeradius/modules/perl
including configuration file /etc/freeradius/modules/expr
including configuration file /etc/freeradius/modules/pam
including configuration file /etc/freeradius/modules/sradutmp
including configuration file /etc/freeradius/modules/digest
including configuration file /etc/freeradius/modules/exec
including configuration file /etc/freeradius/modules/krb5
including configuration file /etc/freeradius/modules/inner-eap
including configuration file /etc/freeradius/modules/pap
including configuration file /etc/freeradius/modules/smbpasswd
including configuration file /etc/freeradius/modules/etc_group
including configuration file /etc/freeradius/modules/attr_filter
including configuration file /etc/freeradius/modules/mschap
including configuration file /etc/freeradius/modules/detail
including configuration file /etc/freeradius/modules/mac2vlan
including configuration file /etc/freeradius/modules/sql_log
including configuration file /etc/freeradius/modules/files
including configuration file /etc/freeradius/modules/wimax
including configuration file /etc/freeradius/modules/radutmp
including configuration file /etc/freeradius/eap.conf
including configuration file /etc/freeradius/policy.conf
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/default
including configuration file /etc/freeradius/sites-enabled/inner-tunnel
main {
    user = "freerad"
    group = "freerad"
    allow_core_dumps = no
}
including dictionary file /etc/freeradius/dictionary
main {
    prefix = "/usr"
    localstatedir = "/var"
    logdir = "/var/log/freeradius"
    libdir = "/usr/lib/freeradius"
    radacctdir = "/var/log/freeradius/radacct"
    hostname_lookups = no
    max_request_time = 30
    cleanup_delay = 5
    max_requests = 1024
    pidfile = "/var/run/freeradius/freeradius.pid"
    checkrad = "/usr/sbin/checkrad"
    debug_level = 0
    proxy_requests = yes
 log {
    stripped_names = no
    auth = no
    auth_badpass = no
    auth_goodpass = no
 }
 security {
    max_attributes = 200
    reject_delay = 1
    status_server = yes
 }
}
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
    retry_delay = 5
    retry_count = 3
    default_fallback = no
    dead_time = 120
    wake_all_if_all_dead = no
 }
 home_server localhost {
    ipaddr = 127.0.0.1
    port = 1812
    type = "auth"
    secret = "testing123"
    response_window = 20
    max_outstanding = 65536
    require_message_authenticator = yes
    zombie_period = 40
    status_check = "status-server"
    ping_interval = 30
    check_interval = 30
    num_answers_to_alive = 3
    num_pings_to_alive = 3
    revive_interval = 120
    status_check_timeout = 4
    irt = 2
    mrt = 16
    mrc = 5
    mrd = 30
 }
 home_server_pool my_auth_failover {
    type = fail-over
    home_server = localhost
 }
 realm example.com {
    auth_pool = my_auth_failover
 }
 realm LOCAL {
 }
radiusd: #### Loading Clients ####
 client edimax {
    ipaddr = 172.33.0.10
    require_message_authenticator = no
    secret = "haslo"
 }
 client localhost {
    ipaddr = 127.0.0.1
    require_message_authenticator = no
    secret = "testing123"
    nastype = "other"
 }
radiusd: #### Instantiating modules ####
 instantiate {
 Module: Linked to module rlm_exec
 Module: Instantiating module "exec" from file /etc/freeradius/modules/exec
  exec {
    wait = no
    input_pairs = "request"
    shell_escape = yes
  }
 Module: Linked to module rlm_expr
 Module: Instantiating module "expr" from file /etc/freeradius/modules/expr
 Module: Linked to module rlm_expiration
 Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration
  expiration {
    reply-message = "Password Has Expired  "
  }
 Module: Linked to module rlm_logintime
 Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime
  logintime {
    reply-message = "You are calling outside your allowed timespan  "
    minimum-timeout = 60
  }
 }
radiusd: #### Loading Virtual Servers ####
server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_mschap
 Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap
  mschap {
    use_mppe = yes
    require_encryption = no
    require_strong = no
    with_ntdomain_hack = no
  }
 Module: Linked to module rlm_eap
 Module: Instantiating module "eap" from file /etc/freeradius/eap.conf
  eap {
    default_eap_type = "peap"
    timer_expire = 60
    ignore_unknown_eap_types = no
    cisco_accounting_username_bug = no
    max_sessions = 4096
  }
 Module: Linked to sub-module rlm_eap_md5
 Module: Instantiating eap-md5
 Module: Linked to sub-module rlm_eap_leap
 Module: Instantiating eap-leap
 Module: Linked to sub-module rlm_eap_gtc
 Module: Instantiating eap-gtc
   gtc {
    challenge = "Password: "
    auth_type = "PAP"
   }
 Module: Linked to sub-module rlm_eap_tls
 Module: Instantiating eap-tls
   tls {
    rsa_key_exchange = no
    dh_key_exchange = yes
    rsa_key_length = 512
    dh_key_length = 512
    verify_depth = 0
    CA_path = "/etc/freeradius/certs"
    pem_file_type = yes
    private_key_file = "/etc/freeradius/certs/server.key"
    certificate_file = "/etc/freeradius/certs/server.pem"
    CA_file = "/etc/freeradius/certs/ca.pem"
    private_key_password = "whatever"
    dh_file = "/etc/freeradius/certs/dh"
    random_file = "/dev/urandom"
    fragment_size = 1024
    include_length = yes
    check_crl = no
    cipher_list = "DEFAULT"
    make_cert_command = "/etc/freeradius/certs/bootstrap"
    cache {
    enable = no
    lifetime = 24
    max_entries = 255
    }
    verify {
    }
   }
 Module: Linked to sub-module rlm_eap_ttls
 Module: Instantiating eap-ttls
   ttls {
    default_eap_type = "md5"
    copy_request_to_tunnel = no
    use_tunneled_reply = no
    virtual_server = "inner-tunnel"
    include_length = yes
   }
 Module: Linked to sub-module rlm_eap_peap
 Module: Instantiating eap-peap
   peap {
    default_eap_type = "mschapv2"
    copy_request_to_tunnel = yes
    use_tunneled_reply = yes
    proxy_tunneled_request_as_eap = yes
    virtual_server = "inner-tunnel"
   }
 Module: Linked to sub-module rlm_eap_mschapv2
 Module: Instantiating eap-mschapv2
   mschapv2 {
    with_ntdomain_hack = no
   }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_files
 Module: Instantiating module "files" from file /etc/freeradius/modules/files
  files {
    usersfile = "/etc/freeradius/users"
    acctusersfile = "/etc/freeradius/acct_users"
    preproxy_usersfile = "/etc/freeradius/preproxy_users"
    compat = "no"
  }
 Module: Checking session {...} for more modules to load
 Module: Linked to module rlm_radutmp
 Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp
  radutmp {
    filename = "/var/log/freeradius/radutmp"
    username = "%{User-Name}"
    case_sensitive = yes
    check_with_nas = yes
    perm = 384
    callerid = yes
  }
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 Module: Linked to module rlm_attr_filter
 Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter
  attr_filter attr_filter.access_reject {
    attrsfile = "/etc/freeradius/attrs.access_reject"
    key = "%{User-Name}"
  }
 } # modules
} # server
server { # from file /etc/freeradius/radiusd.conf
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_pap
 Module: Instantiating module "pap" from file /etc/freeradius/modules/pap
  pap {
    encryption_scheme = "auto"
    auto_header = no
  }
 Module: Linked to module rlm_chap
 Module: Instantiating module "chap" from file /etc/freeradius/modules/chap
 Module: Linked to module rlm_digest
 Module: Instantiating module "digest" from file /etc/freeradius/modules/digest
 Module: Linked to module rlm_unix
 Module: Instantiating module "unix" from file /etc/freeradius/modules/unix
  unix {
    radwtmp = "/var/log/freeradius/radwtmp"
  }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_preprocess
 Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess
  preprocess {
    huntgroups = "/etc/freeradius/huntgroups"
    hints = "/etc/freeradius/hints"
    with_ascend_hack = no
    ascend_channels_per_line = 23
    with_ntdomain_hack = no
    with_specialix_jetstream_hack = no
    with_cisco_vsa_hack = no
    with_alvarion_vsa_hack = no
  }
 Module: Linked to module rlm_realm
 Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm
  realm suffix {
    format = "suffix"
    delimiter = "@"
    ignore_default = no
    ignore_null = no
  }
 Module: Checking preacct {...} for more modules to load
 Module: Linked to module rlm_acct_unique
 Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique
  acct_unique {
    key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
  }
 Module: Checking accounting {...} for more modules to load
 Module: Linked to module rlm_detail
 Module: Instantiating module "detail" from file /etc/freeradius/modules/detail
  detail {
    detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
    header = "%t"
    detailperm = 384
    dirperm = 493
    locking = no
    log_packet_header = no
  }
 Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter
  attr_filter attr_filter.accounting_response {
    attrsfile = "/etc/freeradius/attrs.accounting_response"
    key = "%{User-Name}"
  }
 Module: Checking session {...} for more modules to load
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 } # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
    type = "auth"
    ipaddr = *
    port = 0
}
listen {
    type = "acct"
    ipaddr = *
    port = 0
}
listen {
    type = "auth"
    ipaddr = 127.0.0.1
    port = 18120
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=255, length=163
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    Framed-MTU = 1400
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0200000801626f62
    Message-Authenticator = 0x0eb6be5806b2514fc502299a6319fcbb
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 0 length 8
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry bob at line 2
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 255 to 172.33.0.10 port 3072
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    EAP-Message = 0x010100061920
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64cfa8941b3a000f615dd9d30c
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=0, length=272
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0201006919800000005f160301005a0100005603014d5b99af581dae9ad38a1055bdc982574d8da7f17773518f840aa1e228cd695300002800390038003500160013000a00330032002f000500040015001200090014001100080006000300ff020100000400230000
    State = 0xcfa98d64cfa8941b3a000f615dd9d30c
    Message-Authenticator = 0x6c33aa2e4e3bcd4438e4bdf819b399fb
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 1 length 105
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 95
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap]     (other): before/accept initialization
[peap]     TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 005a], ClientHello  
[peap]     TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 0031], ServerHello  
[peap]     TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 02bc], Certificate  
[peap]     TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange  
[peap]     TLS_accept: SSLv3 write key exchange A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone  
[peap]     TLS_accept: SSLv3 write server done A
[peap]     TLS_accept: SSLv3 flush data
[peap]     TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase 
In SSL Accept mode  
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 0 to 172.33.0.10 port 3072
    EAP-Message = 0x0102040019c00000051216030100310200002d03014d5b99af3ca11b848c59994f4cbe099bcf6591a10a857c2b7f488f01b9ae61c3000039010005ff0100010016030102bc0b0002b80002b50002b2308202ae30820196020900d7516cfea3c83fac300d06092a864886f70d01010505003019311730150603550403130e7261646975732e74756b732e706c301e170d3131303231363039313731325a170d3231303231333039313731325a3019311730150603550403130e7261646975732e74756b732e706c30820122300d06092a864886f70d01010105000382010f003082010a0282010100f1941df215f2e3606104ce70a7f43f42aad4e4c506
    EAP-Message = 0xae10d2fd94784e37f734411bf4e000c76c64cb15e6ba9b0619cbbc6df9947237315cb5c8f8c27a0c10c3c3caca91c00f23be8138803af4cb9378ede75f770c289c57f5c2c63547ad267803fe9ec07b6b98f03f1c5f5cbaf760c1c9cd5ca43b1f1f923cbbe4906b8af3e684c53a232b755013184e003fdaf00097c1f35fb314ade19b37d8e18f1a1e6d63d561345c8ec40963cb3ef88c8c607c6f9ac9cfd9ffbb2d7bdcce4fc177ee4259f35f9c5928b386cf1840afa8e84bf2ac536516304ba1303071102d707480fa3ecff379f5f53ef249e81f63db9113ad3194118d0aefa8141e50be10bf7852f6abc90203010001300d06092a864886f70d010105
    EAP-Message = 0x050003820101004dc92483160ca21bb7ba46d422e1371d1fcdbb85c540d30b783831224bd306efcb3b81020e0f5b695c3c28f82c4d7b3886fa9e9318ea250a582411c4c653c04a4b55bfc53ca9d0874092d571d8e1447986e02e62d720039050427944b32190faeb2705e76e4317d62be4aa4d5b05b1ddc93dd5a343d87faeb2993506fa1f8e65c6b6e8406599b2359955534ce213210c2549ec51c973b917ccf53dacaed8f75fea83dc840415e067d376fa83cdbc3625e9907d6695d5b4f9fb712b6cf11e69253c0e34f491852b440b6beb47cfc135800922eda07fb5924eaa9f51485dd4f6cb6cc6a5e935bba148d475f0a1e063bc036dc14537213a
    EAP-Message = 0x4fa4e6cc0d1d025e1ff0160301020d0c00020900809c399b906a65c9e465d81e2b4afadc5b84ebe254226caa611330763696438232c97c690f3f33e87a18ce5619eaea2feddfda0d77cb5b413d0b71984ec283742bdb84e19a5fd47cb673d7b83d1834469aa7d24d7fe1730e48633d69ad4e2f7b01d5aeedeb1860f9b0619c80e6ee0c54d3d7dd1dae89312fd128416a6fe4a605a3000102008068a6b33c10f30146d02381dca8027d305feb3113b3441a966e2c36474044115cae68bb1dc2c654dbac9c817d6f8e494bbb31ad8d4a132c15c652df3dcdbd31164625d6e7566973c7e7cb2d3dd8faf93ecd41fad8aa2686e01ab128821ca3b5335a041d
    EAP-Message = 0x75df73e15cf3c51d4d856758
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64ceab941b3a000f615dd9d30c
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=1, length=173
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x020200061900
    State = 0xcfa98d64ceab941b3a000f615dd9d30c
    Message-Authenticator = 0xc35e248ef58df51251bf1047414cf8e0
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 2 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 1 to 172.33.0.10 port 3072
    EAP-Message = 0x010301221900e4748f1294c6a551216fdad81b5a133a6601003cb64ed6ecf4a79a47068916fbd58e716f4680435bca1b8255987db936be569fcb386f2a262c73ab75c7689fff920ed2622431aa386f4fc5b43264bf63b02b75e5633a08156f616dc662d7676a720baf695a6506482312319ce51a210dda6654c88f0a4f3f679b08236ef8317322e29f6edad81c47ed9fc9d8552a53c07c93cab93e13e2cca8b833c2328386cc532be6873a33924ccf539bb8bd5026ff37d4684d1d08dcaa81f4c4709f72c4b5b1b4288745e034866d79a656a9c1fadee6596269a16481f693437fad19df7ea787c4812ac9b8c7da445cfd719fdb064d411aa6a6011f13
    EAP-Message = 0xe8a7e4ce26acfce50f70cd182f6fbca41780100d635aec8a0eaa243e16030100040e000000
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64cdaa941b3a000f615dd9d30c
Finished request 2.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=2, length=375
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x020300d01980000000c616030100861000008200808e00432efe6451a82ca04221f14ddc579c7c01ae46da0e1dce3e1ede1f256a2962511292662bb48cdbc942f95fa64db1953c764dce30587fc45845a7ef5b6350c508b9b113286b947bc04b03f726611614e7d89e8a3efea0d4ec506aa3a51a1e64cee9ad2c73fe79bfd529b240a092e2ddebd33013c418f6390d829c4e20b1a614030100010116030100301ddaf2fc78b690228d1bc20c1b553ff4dd98e829abaa704e237b7bc278620c05ba48becbeccf211a532635b10bd69413
    State = 0xcfa98d64cdaa941b3a000f615dd9d30c
    Message-Authenticator = 0xe6a459792023fc35df7daedf8dbf029a
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 3 length 208
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 198
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange  
[peap]     TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]  
[peap] <<< TLS 1.0 Handshake [length 0010], Finished  
[peap]     TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]  
[peap]     TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished  
[peap]     TLS_accept: SSLv3 write finished A
[peap]     TLS_accept: SSLv3 flush data
[peap]     (other): SSL negotiation finished successfully
SSL Connection Established 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 2 to 172.33.0.10 port 3072
    EAP-Message = 0x0104004119001403010001011603010030853d44d54816ca70d3116d8b361979da2a107e4772d249da6be439683ac807ebcd431a201bbb7042ea83283a038f8d6d
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64ccad941b3a000f615dd9d30c
Finished request 3.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=3, length=173
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x020400061900
    State = 0xcfa98d64ccad941b3a000f615dd9d30c
    Message-Authenticator = 0x679861d01d46e3409b73248905b01b6f
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 4 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3 
[peap] eaptls_process returned 3 
[peap] EAPTLS_SUCCESS
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] returns handled
Sending Access-Challenge of id 3 to 172.33.0.10 port 3072
    EAP-Message = 0x0105002b1900170301002003433bbd1c1917e5c121c67701fab463cee47252c67f0d6224043402c7c3fe88
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64cbac941b3a000f615dd9d30c
Finished request 4.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=4, length=247
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0205005019001703010020350b7a2b2ebce5f5a399270ae60c0524eaacb155f11ccd7a0998603aad837b511703010020f1a2935aebdfc3c467ca148b5aa28dd50d2310bc3a6f0aa0537c67e0570acfc9
    State = 0xcfa98d64cbac941b3a000f615dd9d30c
    Message-Authenticator = 0xc8bfafe539b8fb91a9862a8836c89015
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 5 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - bob
[peap] Got inner identity 'bob'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
    EAP-Message = 0x0205000801626f62
server  {
  PEAP: Setting User-Name to bob
Sending tunneled request
    EAP-Message = 0x0205000801626f62
    FreeRADIUS-Proxied-To = 127.0.0.1
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[mschap] returns noop
++[control] returns noop
[eap] EAP packet type response id 5 length 8
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry bob at line 2
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    EAP-Message = 0x0106001d1a01060018108c07ae32db579d63fcf4472741c0140b626f62
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x60568bf16050917e540aa23de005f625
[peap] Got tunneled reply RADIUS code 11
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    EAP-Message = 0x0106001d1a01060018108c07ae32db579d63fcf4472741c0140b626f62
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x60568bf16050917e540aa23de005f625
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 4 to 172.33.0.10 port 3072
    EAP-Message = 0x0106004b19001703010040f117a5f66f93682e9fb81c06cbddebab20cc4c03aca97cc08ec525070a23f1ae05c106b04569d3999384b9543a3784bf479536f7821e4c0a28141bfa3fdcb47f
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64caaf941b3a000f615dd9d30c
Finished request 5.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=5, length=295
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0206008019001703010020866b63154d48e8e35432898f581536246ea847823f4eb07c2ab37e5874050a891703010050d197f8068a88905b0099ee1e0cc631ae74838be6057d44f3af88c9c41d1dc6c44ccfe59ae3b3105574be5e6640a2c82a9836fc487827ef9d8631eef74d33959bc0c3daa71d7f3002017dd2791be84f6a
    State = 0xcfa98d64caaf941b3a000f615dd9d30c
    Message-Authenticator = 0x0191348f460c43c33ed55b533b1a90b7
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 6 length 128
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
    EAP-Message = 0x0206003e1a02060039318155759d417f23ac9271f69f7ccf95e300000000000000004f84ccbc385b42702fd76241996d292a240baaaf359d817100626f62
server  {
  PEAP: Setting User-Name to bob
Sending tunneled request
    EAP-Message = 0x0206003e1a02060039318155759d417f23ac9271f69f7ccf95e300000000000000004f84ccbc385b42702fd76241996d292a240baaaf359d817100626f62
    FreeRADIUS-Proxied-To = 127.0.0.1
    User-Name = "bob"
    State = 0x60568bf16050917e540aa23de005f625
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[mschap] returns noop
++[control] returns noop
[eap] EAP packet type response id 6 length 62
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry bob at line 2
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
[mschapv2] +- entering group MS-CHAP {...}
[mschap] Creating challenge hash with username: bob
[mschap] Told to do MS-CHAPv2 for bob with NT-Password
[mschap] adding MS-CHAPv2 MPPE keys
++[mschap] returns ok
MSCHAP Success 
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    EAP-Message = 0x010700331a0306002e533d46313144384145393441333241444538393938464630454146314437343435424332453335373443
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x60568bf16151917e540aa23de005f625
[peap] Got tunneled reply RADIUS code 11
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    EAP-Message = 0x010700331a0306002e533d46313144384145393441333241444538393938464630454146314437343435424332453335373443
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x60568bf16151917e540aa23de005f625
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 5 to 172.33.0.10 port 3072
    EAP-Message = 0x0107005b190017030100507afeb639bf38be468307dcb5adf6527e591d05f53b4034eed399397e26d291b5ea945bbd3126bc774268c351e2ac81eb96d8e7e1a52b3f750a11607234acc2fed1d9499c841ebc89e2296b2d1fbb93b0
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64c9ae941b3a000f615dd9d30c
Finished request 6.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=6, length=247
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0207005019001703010020c0a6e754c365c558115e2c65e621bd655f7ef434f028e5bbfc1516ace3b4548e170301002082736822c120b58e8eec204bd8bbd7b7ea41d9392706e41f4f5a07a3dabe6f39
    State = 0xcfa98d64c9ae941b3a000f615dd9d30c
    Message-Authenticator = 0xcbe80472c4a7394313374ee26fde1319
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 7 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
    EAP-Message = 0x020700061a03
server  {
  PEAP: Setting User-Name to bob
Sending tunneled request
    EAP-Message = 0x020700061a03
    FreeRADIUS-Proxied-To = 127.0.0.1
    User-Name = "bob"
    State = 0x60568bf16151917e540aa23de005f625
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[mschap] returns noop
++[control] returns noop
[eap] EAP packet type response id 7 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry bob at line 2
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[eap] Freeing handler
++[eap] returns ok
  WARNING: Empty post-auth section.  Using default return values.
# Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel
} # server inner-tunnel
[peap] Got tunneled reply code 2
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    MS-MPPE-Encryption-Policy = 0x00000001
    MS-MPPE-Encryption-Types = 0x00000006
    MS-MPPE-Send-Key = 0xb977bd72d56cd5f93ac093254c30f1ff
    MS-MPPE-Recv-Key = 0x92e4a04b31522cfa6ccecd9a185cb6c8
    EAP-Message = 0x03070004
    Message-Authenticator = 0x00000000000000000000000000000000
    User-Name = "bob"
[peap] Got tunneled reply RADIUS code 2
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    MS-MPPE-Encryption-Policy = 0x00000001
    MS-MPPE-Encryption-Types = 0x00000006
    MS-MPPE-Send-Key = 0xb977bd72d56cd5f93ac093254c30f1ff
    MS-MPPE-Recv-Key = 0x92e4a04b31522cfa6ccecd9a185cb6c8
    EAP-Message = 0x03070004
    Message-Authenticator = 0x00000000000000000000000000000000
    User-Name = "bob"
[peap] Tunneled authentication was successful.
[peap] SUCCESS
[peap] Saving tunneled attributes for later
++[eap] returns handled
Sending Access-Challenge of id 6 to 172.33.0.10 port 3072
    EAP-Message = 0x0108003b1900170301003007ceca193ef1a187a79f79d1f8f7a63190408a631ec678e71bc4af071cd00ab7e28b7473d9b109ee30756eb88b7257a4
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64c8a1941b3a000f615dd9d30c
Finished request 7.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=7, length=263
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0208006019001703010020b28a4f39b5d7e99183468b06ae03505f866aaf7defe51bf86c9ba4982cf007d51703010030479d1054c468b9ea726b9422e3a66eed74d38b1eb63c3aa26fc969e36585a45e02d860217a6034ed757b04acc216b705
    State = 0xcfa98d64c8a1941b3a000f615dd9d30c
    Message-Authenticator = 0x4314a73187da3b0baf96f3a3fc903eb5
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 8 length 96
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state send tlv success
[peap] Received EAP-TLV response.
[peap] Success
[peap] Using saved attributes from the original Access-Accept
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    User-Name = "bob"
[eap] Freeing handler
++[eap] returns ok
# Executing section post-auth from file /etc/freeradius/sites-enabled/default
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 7 to 172.33.0.10 port 3072
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    User-Name = "bob"
    MS-MPPE-Recv-Key = 0xa8b116188719ee417d1ca4a1ae0cd2b880bf97345abbec801bd882b709ee4f6a
    MS-MPPE-Send-Key = 0xeacf0351be2305fa7216cdf2562ea5a506c579a7587a83c5cfdeac79fc34fc11
    EAP-Message = 0x03080004
    Message-Authenticator = 0x00000000000000000000000000000000
Finished request 8.
Going to the next request
Waking up in 4.8 seconds.
Cleaning up request 0 ID 255 with timestamp +7
Cleaning up request 1 ID 0 with timestamp +7
Cleaning up request 2 ID 1 with timestamp +7
Cleaning up request 3 ID 2 with timestamp +7
Cleaning up request 4 ID 3 with timestamp +7
Cleaning up request 5 ID 4 with timestamp +7
Cleaning up request 6 ID 5 with timestamp +7
Cleaning up request 7 ID 6 with timestamp +7
Cleaning up request 8 ID 7 with timestamp +7
Ready to process requests.

radiusd.conf

Kod:

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct
name = freeradius
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/${name}
db_dir = ${raddbdir}
libdir = /usr/lib/freeradius
pidfile = ${run_dir}/${name}.pid
user = freerad
group = freerad
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
listen {
    type = auth
    ipaddr = *
    port = 0
}
listen {
    ipaddr = *
    port = 0
    type = acct
}
hostname_lookups = no
allow_core_dumps = no
regular_expressions    = yes
extended_expressions    = yes
log {
    destination = files
    file = ${logdir}/radius.log
    syslog_facility = daemon
    stripped_names = no
    auth = no
    auth_badpass = no
    auth_goodpass = no
}
checkrad = ${sbindir}/checkrad
security {
    max_attributes = 200
    reject_delay = 1
    status_server = yes
}
proxy_requests  = yes
$INCLUDE proxy.conf
$INCLUDE clients.conf
thread pool {
    start_servers = 5
    max_servers = 32
    min_spare_servers = 3
    max_spare_servers = 10
    max_requests_per_server = 0
}
modules {
    $INCLUDE ${confdir}/modules/
    $INCLUDE eap.conf
}
instantiate {
    exec
    expr
    expiration
    logintime
}
$INCLUDE policy.conf
$INCLUDE sites-enabled/

eap.conf

Kod:

    eap {
        default_eap_type = peap
        timer_expire     = 60
        ignore_unknown_eap_types = no
        cisco_accounting_username_bug = no
        max_sessions = 4096
        md5 {
        }
        leap {
        }
        gtc {
            auth_type = PAP
        }
        tls {
            certdir = ${confdir}/certs
            cadir = ${confdir}/certs
            private_key_password = whatever
            private_key_file = ${certdir}/server.key
            certificate_file = ${certdir}/server.pem
            CA_file = ${cadir}/ca.pem
            dh_file = ${certdir}/dh
            random_file = /dev/urandom
            CA_path = ${cadir}
            cipher_list = "DEFAULT"
            make_cert_command = "${certdir}/bootstrap"
            cache {
                  enable = no
                  max_entries = 255
            }
            verify {
            }
        }
        ttls {
            default_eap_type = md5
            copy_request_to_tunnel = no
            use_tunneled_reply = no
            virtual_server = "inner-tunnel"
        }
        peap {
            default_eap_type = mschapv2
            copy_request_to_tunnel = yes
            use_tunneled_reply = yes
            virtual_server = "inner-tunnel"
        }
        mschapv2 {
        }
    }

sites-enabled/default

Kod:

authorize {
    preprocess
    chap
    mschap
    digest
    suffix
    eap {
        ok = return
    }
    files
    expiration
    logintime
    pap
}
authenticate {
    Auth-Type PAP {
        pap
    }
    Auth-Type CHAP {
        chap
    }
    Auth-Type MS-CHAP {
        mschap
    }
    digest
    unix
    eap
}
preacct {
    preprocess
    acct_unique
    suffix
    files
}
accounting {
    detail
    unix
    radutmp
    exec
    attr_filter.accounting_response
}
session {
    radutmp
}
post-auth {
    exec
    Post-Auth-Type REJECT {
        attr_filter.access_reject
    }
}
pre-proxy {
}
post-proxy {
    eap
}

sites-enabled/inner-tunel

Kod:

server inner-tunnel {
listen {
       ipaddr = 127.0.0.1
       port = 18120
       type = auth
}
authorize {
    mschap
    update control {
           Proxy-To-Realm := LOCAL
    }
    eap {
        ok = return
    }
    files
    expiration
    logintime
}
authenticate {
    Auth-Type MS-CHAP {
        mschap
    }
    eap
}
session {
    radutmp
}
post-auth {
    Post-Auth-Type REJECT {
        attr_filter.access_reject
    }
}
pre-proxy {
}
post-proxy {
    eap
}

Huk · 2011-02-16 12:36:09

Na jakiej sieciówice postawiłeś tego Radiusa? Chyba wymagana jest taka która no problem śmiga z hostapd, z doświadczenia mogę Ci powiedzieć - że błędy podobne do opisanych występowały u mnie, właśnie na kartach ze słabym wsparciem AP i zmąconymi sterownikami...

Nicram · 2011-02-16 12:52:27

[quote=Huk]Na jakiej sieciówice postawiłeś tego Radiusa? Chyba wymagana jest taka która no problem śmiga z hostapd, z doświadczenia mogę Ci powiedzieć - że błędy podobne do opisanych występowały u mnie, właśnie na kartach ze słabym wsparciem AP i zmąconymi sterownikami...[/quote]
tu nie chodzi o sieciówke. w ramach testów mam radiusa postawionego na virtualboxie (bardzo łatwo i szybko przywrócić system do początkowego stanu) ze zbridgeowaną sieciówką w laptopie. server radius bedzie tylko do tego. nie będzie, nie ma, na nim żadnych sieciówek wlanowych zeby stawiać hostapd.
zresztą sugerując się twoją podpowiedzią odnośnie sieciówki, na szybko postawiłem tego radiusa na stacjonarce (sieciówka Intelowska gigabit, serwerowa) i przypadek jest ten sam.

----

właśnie wyczytałem w dokumentacji, iż EAP nie obsługuje przydzielania adresów ip. jeśli radius ma przyznawać adresy to tym musi zajmować się autentykator lub "zewnętrzny" serwer DHCP :(

Ostatnio edytowany przez Nicram (2011-02-16 16:02:39)

tomczuk.info · 2011-03-09 09:58:05

Opisałem jakiś czas temu konfigurację FreeRadius, może Ci się to przyda:

http://www.tomczuk.info/2011/02/freeradius-eap-tls/

czeri · 2011-10-17 18:13:41

Rozwiązałeś może ten problem, u mnie autoryzacja wygląda podobnie.

Ostatnio edytowany przez czeri (2011-10-17 18:44:02)

Nicram · 2011-10-17 20:57:08

[quote=czeri]Rozwiązałeś może ten problem, u mnie autoryzacja wygląda podobnie.[/quote]
Jeśli wygląda podobnie to znaczy, że jest ok. Moja nie wiedza na temat radiusa spowodowała właśnie ten wątek. Jest to opisane na stronie producenta, że zanim nastąpi accept radius musi z suplikantem powymieniać troche informacji, z reguły jest to 8-10 :)

czeri · 2011-10-18 09:20:25

[quote=Nicram][quote=czeri]Rozwiązałeś może ten problem, u mnie autoryzacja wygląda podobnie.[/quote]
Jeśli wygląda podobnie to znaczy, że jest ok. Moja nie wiedza na temat radiusa spowodowała właśnie ten wątek. Jest to opisane na stronie producenta, że zanim nastąpi accept radius musi z suplikantem powymieniać troche informacji, z reguły jest to 8-10 :)[/quote]
Nie wiedziałem tego, dzięki wielkie za uświadomienie tego faktu, bo już myślałem, że mam skopaną konfigurację.

czeri · 2011-11-26 13:44:15

[quote=Nicram]właśnie wyczytałem w dokumentacji, iż EAP nie obsługuje przydzielania adresów ip. jeśli radius ma przyznawać adresy to tym musi zajmować się autentykator lub "zewnętrzny" serwer DHCP :([/quote]
Tylko teraz jak zmusić zewnętrzny serwer dhcp żeby przydzielał odpowiednie zakresy adresów dla odpowiednich grup użytkowników.

Chodzi mi tutaj o realizację uprawnień. Chyba, że istnieje jakaś inna metoda realizacji uprawnień np. do stron www.

przykładowo kierownik ma mieć dostęp do facebooka a kowalski juz nie.

czeri · 2012-01-22 13:45:17

A czy zewnętrzny serwer DHCP jest w stanie zwrócić Framed-Ip-Address ?
Chce mieć wszystko w logach, ale niestety brakuje mi adresu ip hosta.

Nicram · 2012-01-22 14:28:00

[quote=czeri]A czy zewnętrzny serwer DHCP jest w stanie zwrócić Framed-Ip-Address ?
Chce mieć wszystko w logach, ale niestety brakuje mi adresu ip hosta.[/quote]
Też mam/miałem ten problem. niestety nie znalazłem rozwiązania, żeby zewnętrzny serwer dhcp korzystał z radiusa :(
Ale freeradius ma zaimplementowaną usługę dhcp, co prawda jest w fazie rozwoju i producent nie zaleca jeszcze używać tego produkcyjnie, ale jest, można potestować.

mi na chwilę obecną w dhcp brakuje możliwości accountingu klienta. robię to poprzez pppoe, ale chętnie przerzuciłbym się na dhcp - mniej problematyczne dla klienta. Niestety w dhcp nie jestem w stanie stwierdzić czy klient jest "zalogowany" czy nie i ile już zassał/wysłał danych :(

Time (s)	Query
0.00009	SET CHARSET latin2
0.00004	SET NAMES latin2
0.00123	SELECT u., g., o.logged FROM punbb_users AS u INNER JOIN punbb_groups AS g ON u.group_id=g.g_id LEFT JOIN punbb_online AS o ON o.ident='3.144.115.125' WHERE u.id=1
0.00085	REPLACE INTO punbb_online (user_id, ident, logged) VALUES(1, '3.144.115.125', 1732792681)
0.00053	SELECT * FROM punbb_online WHERE logged<1732792381
0.00080	SELECT topic_id FROM punbb_posts WHERE id=186579
0.00237	SELECT id FROM punbb_posts WHERE topic_id=18344 ORDER BY posted
0.00131	SELECT t.subject, t.closed, t.num_replies, t.sticky, f.id AS forum_id, f.forum_name, f.moderators, fp.post_replies, 0 FROM punbb_topics AS t INNER JOIN punbb_forums AS f ON f.id=t.forum_id LEFT JOIN punbb_forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id=3) WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND t.id=18344 AND t.moved_to IS NULL
0.00006	SELECT search_for, replace_with FROM punbb_censoring
0.00289	SELECT u.email, u.title, u.url, u.location, u.use_avatar, u.signature, u.email_setting, u.num_posts, u.registered, u.admin_note, p.id, p.poster AS username, p.poster_id, p.poster_ip, p.poster_email, p.message, p.hide_smilies, p.posted, p.edited, p.edited_by, g.g_id, g.g_user_title, o.user_id AS is_online FROM punbb_posts AS p INNER JOIN punbb_users AS u ON u.id=p.poster_id INNER JOIN punbb_groups AS g ON g.g_id=u.group_id LEFT JOIN punbb_online AS o ON (o.user_id=u.id AND o.user_id!=1 AND o.idle=0) WHERE p.topic_id=18344 ORDER BY p.id LIMIT 0,25
0.00144	UPDATE punbb_topics SET num_views=num_views+1 WHERE id=18344
Total query time: 0.01161 s

Forum Debian Users Gang

Ogłoszenie

#1 2011-02-16 11:25:24

Nicram - Użytkownik

Freeradius EAP/PEAP

Kod:

Kod:

Kod:

Kod:

Kod:

#2 2011-02-16 12:36:09

Huk - Smoleńsk BULWA!

Re: Freeradius EAP/PEAP

#3 2011-02-16 12:52:27

Nicram - Użytkownik

Re: Freeradius EAP/PEAP

#4 2011-03-09 09:58:05

tomczuk.info - Gość

Re: Freeradius EAP/PEAP

#5 2011-10-17 18:13:41

czeri - Użytkownik

Re: Freeradius EAP/PEAP

#6 2011-10-17 20:57:08

Nicram - Użytkownik

Re: Freeradius EAP/PEAP

#7 2011-10-18 09:20:25

czeri - Użytkownik

Re: Freeradius EAP/PEAP

#8 2011-11-26 13:44:15

czeri - Użytkownik

Re: Freeradius EAP/PEAP

#9 2012-01-22 13:45:17

czeri - Użytkownik

Re: Freeradius EAP/PEAP

#10 2012-01-22 14:28:00

Nicram - Użytkownik

Re: Freeradius EAP/PEAP

Stopka forum

Informacje debugowania