eap-tls authentication with free radius 1.1.5
anoop_c at sifycorp.com
anoop_c at sifycorp.com
Tue May 8 06:47:05 CEST 2007
Hi list
I am tryinmg to do EAP_TLS certificate based authentication with free radius 1.1.5.The setup worked well with freeradius-snapshot-20021028.But as Windows vista is not supporting the same.So i am trying to do the authentication with 1.1.5 version
Pls find the debug message.
ot at anoop raddb]# radiusd -X -A
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /etc/raddb/proxy.conf
Config: including file: /etc/raddb/clients.conf
Config: including file: /etc/raddb/snmp.conf
Config: including file: /etc/raddb/eap.conf
Config: including file: /etc/raddb/sql.conf
main: prefix = \"/usr/local\"
main: localstatedir = \"/usr/local/var\"
main: logdir = \"/usr/local/var/log/radius\"
main: libdir = \"/usr/local/lib\"
main: radacctdir = \"/usr/local/var/log/radius/radacct\"
main: hostname_lookups = no
main: snmp = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file = \"/usr/local/var/log/radius/radius.log\"
main: log_auth = no
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile = \"/usr/local/var/run/radiusd/radiusd.pid\"
main: user = \"(null)\"
main: group = \"(null)\"
main: usercollide = no
main: lower_user = \"no\"
main: lower_pass = \"no\"
main: nospace_user = \"no\"
main: nospace_pass = \"no\"
main: checkrad = \"/usr/local/sbin/checkrad\"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
proxy: post_proxy_authorize = no
proxy: wake_all_if_all_dead = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
Using deprecated naslist file. Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded exec
exec: wait = yes
exec: program = \"(null)\"
exec: input_pairs = \"request\"
exec: output_pairs = \"(null)\"
exec: packet_type = \"(null)\"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
pap: encryption_scheme = \"crypt\"
pap: auto_header = yes
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = no
mschap: require_strong = no
mschap: with_ntdomain_hack = no
mschap: passwd = \"(null)\"
mschap: ntlm_auth = \"(null)\"
Module: Instantiated mschap (mschap)
Module: Loaded System
unix: cache = no
unix: passwd = \"(null)\"
unix: shadow = \"(null)\"
unix: group = \"(null)\"
unix: radwtmp = \"/usr/local/var/log/radius/radwtmp\"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
eap: default_eap_type = \"tls\"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug = no
tls: rsa_key_exchange = no
tls: dh_key_exchange = yes
tls: rsa_key_length = 512
tls: dh_key_length = 512
tls: verify_depth = 0
tls: CA_path = \"(null)\"
tls: pem_file_type = yes
tls: private_key_file = \"/etc/1x/07xwifi.pem\"
tls: certificate_file = \"/etc/1x/07xwifi.pem\"
tls: CA_file = \"/etc/1x/root.pem\"
tls: private_key_password = \"password\"
tls: dh_file = \"/etc/1x/DH\"
tls: random_file = \"/etc/1x/random\"
tls: fragment_size = 1024
tls: include_length = yes
tls: check_crl = no
tls: check_cert_cn = \"(null)\"
tls: cipher_list = \"(null)\"
tls: check_cert_issuer = \"(null)\"
rlm_eap_tls: Loading the certificate file as a chain
rlm_eap: Loaded and initialized type tls
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = \"/etc/raddb/huntgroups\"
preprocess: hints = \"/etc/raddb/hints\"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
realm: format = \"suffix\"
realm: delimiter = \"@\"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = \"/etc/raddb/users\"
files: acctusersfile = \"/etc/raddb/acct_users\"
files: preproxy_usersfile = \"/etc/raddb/preproxy_users\"
files: compat = \"no\"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = \"User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addre ss, NAS-Port\"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile = \"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/de tail-%Y%m%d\"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = \"/usr/local/var/log/radius/radutmp\"
radutmp: username = \"%{User-Name}\"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.0.50:1027, id=0, length=197
Message-Authenticator = 0x6e5c5bee98e478bb919a0a4779945e06
Service-Type = Framed-User
User-Name = \"anoop07\"
Framed-MTU = 1488
Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\"
Calling-Station-Id = \"00-0E-35-F3-A1-67\"
NAS-Identifier = \"D-Link Access Point\"
NAS-Port-Type = Wireless-802.11
Connect-Info = \"CONNECT 54Mbps 802.11g\"
EAP-Message = 0x0200000c01616e6f6f703037
NAS-IP-Address = 192.168.0.50
NAS-Port = 1
NAS-Port-Id = \"STA port # 1\"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module \"preprocess\" returns ok for request 0
modcall[authorize]: module \"chap\" returns noop for request 0
modcall[authorize]: module \"mschap\" returns noop for request 0
rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL
rlm_realm: No such realm \"NULL\"
modcall[authorize]: module \"suffix\" returns noop for request 0
rlm_eap: EAP packet type response id 0 length 12
rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation
modcall[authorize]: module \"eap\" returns updated for request 0
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 172
users: Matched entry anoop07 at line 216
modcall[authorize]: module \"files\" returns ok for request 0
rlm_pap: WARNING! No \"known good\" password found for the user. Authentication m ay fail because of this.
modcall[authorize]: module \"pap\" returns noop for request 0
modcall: leaving group authorize (returns updated) for request 0
rad_check_password: Found Auth-Type EAP
auth: type \"EAP\"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: EAP Identity
rlm_eap: processing type tls
rlm_eap_tls: Requiring client certificate
rlm_eap_tls: Initiate
rlm_eap_tls: Start returned 1
modcall[authenticate]: module \"eap\" returns handled for request 0
modcall: leaving group authenticate (returns handled) for request 0
Sending Access-Challenge of id 0 to 192.168.0.50 port 1027
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x010100060d20
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3957d24037304516214893f00a023efe
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.0.50:1027, id=1, length=299
Message-Authenticator = 0xe5ccf77d7f2a7d5bda0a2665725fae25
Service-Type = Framed-User
User-Name = \"anoop07\"
Framed-MTU = 1488
State = 0x3957d24037304516214893f00a023efe
Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\"
Calling-Station-Id = \"00-0E-35-F3-A1-67\"
NAS-Identifier = \"D-Link Access Point\"
NAS-Port-Type = Wireless-802.11
Connect-Info = \"CONNECT 54Mbps 802.11g\"
EAP-Message = 0x020100600d800000005616030100510100004d0301463f12ed420bc1 a3110cd23ccfe6e0215058e72b53ff50e5459ca7dead7b55ec105817a39fe5ba38d7d5235bd73179 a4a7001600040005000a000900640062000300060013001200630100
NAS-IP-Address = 192.168.0.50
NAS-Port = 1
NAS-Port-Id = \"STA port # 1\"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
modcall[authorize]: module \"preprocess\" returns ok for request 1
modcall[authorize]: module \"chap\" returns noop for request 1
modcall[authorize]: module \"mschap\" returns noop for request 1
rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL
rlm_realm: No such realm \"NULL\"
modcall[authorize]: module \"suffix\" returns noop for request 1
rlm_eap: EAP packet type response id 1 length 96
rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation
modcall[authorize]: module \"eap\" returns updated for request 1
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 172
users: Matched entry anoop07 at line 216
modcall[authorize]: module \"files\" returns ok for request 1
rlm_pap: WARNING! No \"known good\" password found for the user. Authentication m ay fail because of this.
modcall[authorize]: module \"pap\" returns noop for request 1
modcall: leaving group authorize (returns updated) for request 1
rad_check_password: Found Auth-Type EAP
auth: type \"EAP\"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 1
rlm_eap: Request found, released from the list
rlm_eap: EAP/tls
rlm_eap: processing type tls
rlm_eap_tls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
(other): before/accept initialization
TLS_accept: before/accept initialization
rlm_eap_tls: <<< TLS 1.0 Handshake [length 0051], ClientHello
TLS_accept: SSLv3 read client hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello
TLS_accept: SSLv3 write server hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 04bf], Certificate
TLS_accept: SSLv3 write certificate A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 004c], CertificateRequest
TLS_accept: SSLv3 write certificate request A
TLS_accept: SSLv3 flush data
TLS_accept:error in SSLv3 read client certificate A
rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0)
In SSL Handshake Phase
In SSL Accept mode
eaptls_process returned 13
modcall[authenticate]: module \"eap\" returns handled for request 1
modcall: leaving group authenticate (returns handled) for request 1
Sending Access-Challenge of id 1 to 192.168.0.50 port 1027
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x0102040a0dc000000564160301004a020000460301463f12e8d54cc3 719cd6999605c885dc3423a304826384417e2c404a7c15cf8d20358795671f2005a10e6e59ed4499 f218aa670ff33e7f13d2139860164d3b7e7f00040016030104bf0b0004bb0004b800022c30820228 30820191a003020102020101300d06092a864886f70d0101040500303b310b300906035504061302 494e310b300906035504081302544e310d300b060355040a1304536966793110300e060355040313 0730377877696669301e170d3037303131323135333533305a170d3038303131323135333533305a 3060310b300906035504061302494e310b3009060355040813
EAP-Message = 0x02544e310d300b060355040a1304536966793110300e060355040313 07303778776966693123302106092a864886f70d0109011614616e6f6f705f634073696679636f72 702e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d2bbbe35bc8a 47709632284aff484695385e69c3522f63da46834f9586a420bda380889693fa77fedd9ed4290e6f 9ff4436721775294fc65a38fea098f18975b34b5063de27220e18a07d433cbb6e19aeb3f84b012f7 c20071dd280457a932634bbe50f438cc2ee6f4d65fa395a10bdecc4bf9087979ec45af000940e186 ed290203010001a317301530130603551d25040c300a06082b
EAP-Message = 0x06010505070301300d06092a864886f70d0101040500038181000afe a7f2a8a9cffe60baa8f779353c523457f8237faeff81ba5f2c22664c70b6b2fb58c8967ca4a4c847 b80e1d5a6cc4558ffa1d161614f374d8b5efd565aa66045b192b3ac3da82c81c4a99fc10cfe473f9 ac258ef99b16cbd335004677694a05addae48c6a9dcdb26b86ddb56c635266c33c7de75865435326 92e5220d30b100028630820282308201eba003020102020100300d06092a864886f70d0101040500 303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453 6966793110300e0603550403130730377877696669301e170d
EAP-Message = 0x3037303131323135333435305a170d3038303131323135333435305a 303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453 6966793110300e060355040313073037787769666930819f300d06092a864886f70d010101050003 818d0030818902818100ba8b07a479bb6ce9adf2d8bc6ac9cf214506dfc039cb10c3b4d27d1bbc08 2caff0bb77424819728977f04b32e231a3c4755a65823b366f1a604f15ce6c499883ab7d2757a5a2 c07a11e75b7a00d6c55a8fb7443b202a25a3cdaad39579b2d8f4c09c974056f0c8666fff754d5748 36fcaf105200fcd5df5158e2b387310c4ed90203010001a381
EAP-Message = 0x95308192301d0603551d0e041604149eda6f69065423
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8328be193d596d8f0b13c977aaaf5cbc
Finished request 1
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.0.50:1027, id=2, length=209
Message-Authenticator = 0xb1f2bd76ec8b4badf29ea01180d76374
Service-Type = Framed-User
User-Name = \"anoop07\"
Framed-MTU = 1488
State = 0x8328be193d596d8f0b13c977aaaf5cbc
Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\"
Calling-Station-Id = \"00-0E-35-F3-A1-67\"
NAS-Identifier = \"D-Link Access Point\"
NAS-Port-Type = Wireless-802.11
Connect-Info = \"CONNECT 54Mbps 802.11g\"
EAP-Message = 0x020200060d00
NAS-IP-Address = 192.168.0.50
NAS-Port = 1
NAS-Port-Id = \"STA port # 1\"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
modcall[authorize]: module \"preprocess\" returns ok for request 2
modcall[authorize]: module \"chap\" returns noop for request 2
modcall[authorize]: module \"mschap\" returns noop for request 2
rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL
rlm_realm: No such realm \"NULL\"
modcall[authorize]: module \"suffix\" returns noop for request 2
rlm_eap: EAP packet type response id 2 length 6
rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation
modcall[authorize]: module \"eap\" returns updated for request 2
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 172
users: Matched entry anoop07 at line 216
modcall[authorize]: module \"files\" returns ok for request 2
rlm_pap: WARNING! No \"known good\" password found for the user. Authentication m ay fail because of this.
modcall[authorize]: module \"pap\" returns noop for request 2
modcall: leaving group authorize (returns updated) for request 2
rad_check_password: Found Auth-Type EAP
auth: type \"EAP\"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 2
rlm_eap: Request found, released from the list
rlm_eap: EAP/tls
rlm_eap: processing type tls
rlm_eap_tls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake fragment handler
eaptls_verify returned 1
eaptls_process returned 13
modcall[authenticate]: module \"eap\" returns handled for request 2
modcall: leaving group authenticate (returns handled) for request 2
Sending Access-Challenge of id 2 to 192.168.0.50 port 1027
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x0103016e0d80000005647ec1c9e4d07a608e0e6dcd730f3063060355 1d23045c305a80149eda6f690654237ec1c9e4d07a608e0e6dcd730fa13fa43d303b310b30090603 5504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e06 03550403130730377877696669820100300c0603551d13040530030101ff300d06092a864886f70d 0101040500038181006b514f008b6a77757fc73ddbe9d54e4ea925a1ab9ce80ad7895d6d19661d8b 8558d0e359876aac023aa52d4273e00407b9b588b30dbc35c5911bc89d2d99677e0ec8dea17fece3 5d0b4dfab8775ba73eaeb0a0998bcdf1437cff0a1031f6a5b1
EAP-Message = 0x7e8bcdc01e2e964cb256f49d947eea2cfd42989aef397fa438be294f a3dc7a3d160301004c0d000044020102003f003d303b310b300906035504061302494e310b300906 035504081302544e310d300b060355040a1304536966793110300e06035504031307303778776966 690e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xdbfcbbd6812a2502176f76dd96d6e645
Finished request 2
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.0.50:1027, id=3, length=209
Message-Authenticator = 0xc2de18c894d86c7bb8dff575c8db658b
Service-Type = Framed-User
User-Name = \"anoop07\"
Framed-MTU = 1488
State = 0xdbfcbbd6812a2502176f76dd96d6e645
Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\"
Calling-Station-Id = \"00-0E-35-F3-A1-67\"
NAS-Identifier = \"D-Link Access Point\"
NAS-Port-Type = Wireless-802.11
Connect-Info = \"CONNECT 54Mbps 802.11g\"
EAP-Message = 0x020300060d00
NAS-IP-Address = 192.168.0.50
NAS-Port = 1
NAS-Port-Id = \"STA port # 1\"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
modcall[authorize]: module \"preprocess\" returns ok for request 3
modcall[authorize]: module \"chap\" returns noop for request 3
modcall[authorize]: module \"mschap\" returns noop for request 3
rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL
rlm_realm: No such realm \"NULL\"
modcall[authorize]: module \"suffix\" returns noop for request 3
rlm_eap: EAP packet type response id 3 length 6
rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation
modcall[authorize]: module \"eap\" returns updated for request 3
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 172
users: Matched entry anoop07 at line 216
modcall[authorize]: module \"files\" returns ok for request 3
rlm_pap: WARNING! No \"known good\" password found for the user. Authentication m ay fail because of this.
modcall[authorize]: module \"pap\" returns noop for request 3
modcall: leaving group authorize (returns updated) for request 3
rad_check_password: Found Auth-Type EAP
auth: type \"EAP\"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 3
rlm_eap: Request found, released from the list
rlm_eap: EAP/tls
rlm_eap: processing type tls
rlm_eap_tls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake fragment handler
eaptls_verify returned 1
eaptls_process returned 13
modcall[authenticate]: module \"eap\" returns handled for request 3
modcall: leaving group authenticate (returns handled) for request 3
Sending Access-Challenge of id 3 to 192.168.0.50 port 1027
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x0104000a0d8000000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xed801abad54d9d77e26d58fe30c791cc
Finished request 3
Going to the next request
Waking up in 6 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 0 with timestamp 463f12e8
Cleaning up request 1 ID 1 with timestamp 463f12e8
Cleaning up request 2 ID 2 with timestamp 463f12e8
Cleaning up request 3 ID 3 with timestamp 463f12e8
Nothing to do. Sleeping until we see a request.
Pls suggest
Regards
Anoop
-------------- next part --------------
A non-text attachment was scrubbed...
Name: debug_freeradius
Type: application/octet-stream
Size: 20070 bytes
Desc: not available
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20070508/3c8d638c/attachment.obj>
More information about the Freeradius-Users
mailing list