eap-tls authentication with free radius 1.1.6

anoop_c at sifycorp.com anoop_c at sifycorp.com
Thu May 10 13:32:56 CEST 2007


Hi all
        I am trying to do eap-tls authentication with 1.1.6.My xp client is saying attempting to authenticate.
 So in the output i got when i tried to connect in debug mode is 

Starting - reading configuration files ...
reread_config:  reading radiusd.conf
Config:   including file: /etc/raddb/proxy.conf
Config:   including file: /etc/raddb/clients.conf
Config:   including file: /etc/raddb/snmp.conf
Config:   including file: /etc/raddb/eap.conf
Config:   including file: /etc/raddb/sql.conf
 main: prefix = \\\"/usr/local\\\"
 main: localstatedir = \\\"/usr/local/var\\\"
 main: logdir = \\\"/usr/local/var/log/radius\\\"
 main: libdir = \\\"/usr/local/lib\\\"
 main: radacctdir = \\\"/usr/local/var/log/radius/radacct\\\"
 main: hostname_lookups = no
 main: snmp = no
 main: max_request_time = 30
 main: cleanup_delay = 5
 main: max_requests = 1024
 main: delete_blocked_requests = 0
 main: port = 0
 main: allow_core_dumps = no
 main: log_stripped_names = no
 main: log_file = \\\"/usr/local/var/log/radius/radius.log\\\"
 main: log_auth = no
 main: log_auth_badpass = no
 main: log_auth_goodpass = no
 main: pidfile = \\\"/usr/local/var/run/radiusd/radiusd.pid\\\"
 main: user = \\\"(null)\\\"
 main: group = \\\"(null)\\\"
 main: usercollide = no
 main: lower_user = \\\"no\\\"
 main: lower_pass = \\\"no\\\"
 main: nospace_user = \\\"no\\\"
 main: nospace_pass = \\\"no\\\"
 main: checkrad = \\\"/usr/local/sbin/checkrad\\\"
 main: proxy_requests = yes
 proxy: retry_delay = 5
 proxy: retry_count = 3
 proxy: synchronous = no
 proxy: default_fallback = yes
 proxy: dead_time = 120
 proxy: post_proxy_authorize = no
 proxy: wake_all_if_all_dead = no
 security: max_attributes = 200
 security: reject_delay = 1
 security: status_server = no
 main: debug_level = 0
read_config_files:  reading dictionary
read_config_files:  reading naslist
Using deprecated naslist file.  Support for this will go away soon.
read_config_files:  reading clients
read_config_files:  reading realms
radiusd:  entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded exec
 exec: wait = yes
 exec: program = \\\"(null)\\\"
 exec: input_pairs = \\\"request\\\"
 exec: output_pairs = \\\"(null)\\\"
 exec: packet_type = \\\"(null)\\\"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded System
 unix: cache = no
 unix: passwd = \\\"(null)\\\"
 unix: shadow = \\\"(null)\\\"
 unix: group = \\\"(null)\\\"
 unix: radwtmp = \\\"/usr/local/var/log/radius/radwtmp\\\"
 unix: usegroup = no
 unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
 eap: default_eap_type = \\\"tls\\\"
 eap: timer_expire = 60
 eap: ignore_unknown_eap_types = no
 eap: cisco_accounting_username_bug = no
 tls: rsa_key_exchange = no
 tls: dh_key_exchange = yes
 tls: rsa_key_length = 512
 tls: dh_key_length = 512
 tls: verify_depth = 0
 tls: CA_path = \\\"(null)\\\"
 tls: pem_file_type = yes
 tls: private_key_file = \\\"/etc/1x/07xwifi.pem\\\"
 tls: certificate_file = \\\"/etc/1x/07xwifi.pem\\\"
 tls: CA_file = \\\"/etc/1x/root.pem\\\"
 tls: private_key_password = \\\"password\\\"
 tls: dh_file = \\\"/etc/1x/DH\\\"
 tls: random_file = \\\"/etc/1x/random\\\"
 tls: fragment_size = 1024
 tls: include_length = yes
 tls: check_crl = no
 tls: check_cert_cn = \\\"(null)\\\"
 tls: cipher_list = \\\"(null)\\\"
 tls: check_cert_issuer = \\\"(null)\\\"
rlm_eap_tls: Loading the certificate file as a chain
rlm_eap: Loaded and initialized type tls
Module: Instantiated eap (eap)
Module: Loaded preprocess
 preprocess: huntgroups = \\\"/etc/raddb/huntgroups\\\"
 preprocess: hints = \\\"/etc/raddb/hints\\\"
 preprocess: with_ascend_hack = no
 preprocess: ascend_channels_per_line = 23
 preprocess: with_ntdomain_hack = no
 preprocess: with_specialix_jetstream_hack = no
 preprocess: with_cisco_vsa_hack = no
 preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
 realm: format = \\\"suffix\\\"
 realm: delimiter = \\\"@\\\"
 realm: ignore_default = no
 realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
 files: usersfile = \\\"/etc/raddb/users\\\"
 files: acctusersfile = \\\"/etc/raddb/acct_users\\\"
 files: preproxy_usersfile = \\\"/etc/raddb/preproxy_users\\\"
 files: compat = \\\"no\\\"
Module: Instantiated files (files)
Module: Loaded PAP
 pap: encryption_scheme = \\\"crypt\\\"
 pap: auto_header = yes
Module: Instantiated pap (pap)
Module: Loaded Acct-Unique-Session-Id
 acct_unique: key = \\\"User-Name, Acct-Session-Id, NAS-IP-Address,
Client-IP-Addre ss, NAS-Port\\\"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
 detail: detailfile =
\\\"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/de
tail-%Y%m%d\\\"
 detail: detailperm = 384
 detail: dirperm = 493
 detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
 radutmp: filename = \\\"/usr/local/var/log/radius/radutmp\\\"
 radutmp: username = \\\"%{User-Name}\\\"
 radutmp: case_sensitive = yes
 radutmp: check_with_nas = yes
 radutmp: perm = 384
 radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.0.50:1026, id=0, length=197
        Message-Authenticator = 0x58682b62b2334fb6e661df414bc30e61
        Service-Type = Framed-User
        User-Name = \\\"anoop07\\\"
        Framed-MTU = 1488
        Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\"
        Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\"
        NAS-Identifier = \\\"D-Link Access Point\\\"
        NAS-Port-Type = Wireless-802.11
        Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\"
        EAP-Message = 0x0200000c01616e6f6f703037
        NAS-IP-Address = 192.168.0.50
        NAS-Port = 1
        NAS-Port-Id = \\\"STA port # 1\\\"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
  modcall[authorize]: module \\\"preprocess\\\" returns ok for request 0
    rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm
NULL
    rlm_realm: No such realm \\\"NULL\\\"
  modcall[authorize]: module \\\"suffix\\\" returns noop for request 0
  rlm_eap: EAP packet type response id 0 length 12
  rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation
  modcall[authorize]: module \\\"eap\\\" returns updated for request 0
    users: Matched entry DEFAULT at line 153
    users: Matched entry DEFAULT at line 172
  modcall[authorize]: module \\\"files\\\" returns ok for request 0
rlm_pap: WARNING! No \\\"known good\\\" password found for the user. 
Authentication m ay fail because of this.
  modcall[authorize]: module \\\"pap\\\" returns noop for request 0
modcall: leaving group authorize (returns updated) for request 0
  rad_check_password:  Found Auth-Type EAP
auth: type \\\"EAP\\\"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
  rlm_eap: EAP Identity
  rlm_eap: processing type tls
 rlm_eap_tls: Requiring client certificate
  rlm_eap_tls: Initiate
  rlm_eap_tls: Start returned 1
  modcall[authenticate]: module \\\"eap\\\" returns handled for request 0
modcall: leaving group authenticate (returns handled) for request 0
Sending Access-Challenge of id 0 to 192.168.0.50 port 1026
        Framed-IP-Address = 255.255.255.254
        Framed-MTU = 576
        Service-Type = Framed-User
        EAP-Message = 0x010100060d20
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0xf149907fc590a6e39f01cbbd9619107b
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.0.50:1026, id=1, length=299
        Message-Authenticator = 0x4fd5a9fe11d848f8f7a1324997be4a8e
        Service-Type = Framed-User
        User-Name = \\\"anoop07\\\"
        Framed-MTU = 1488
        State = 0xf149907fc590a6e39f01cbbd9619107b
        Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\"
        Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\"
        NAS-Identifier = \\\"D-Link Access Point\\\"
        NAS-Port-Type = Wireless-802.11
        Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\"
        EAP-Message = 0x020100600d800000005616030100510100004d03014642cb0590f008
20866efd284d568c69cde48b6530bced71bd7a674a2a46e36e103102d6b9e079cbcf0242e2192803
fe40001600040005000a000900640062000300060013001200630100
        NAS-IP-Address = 192.168.0.50
        NAS-Port = 1
        NAS-Port-Id = \\\"STA port # 1\\\"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
  modcall[authorize]: module \\\"preprocess\\\" returns ok for request 1
    rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm
NULL
    rlm_realm: No such realm \\\"NULL\\\"
  modcall[authorize]: module \\\"suffix\\\" returns noop for request 1
  rlm_eap: EAP packet type response id 1 length 96
  rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation
  modcall[authorize]: module \\\"eap\\\" returns updated for request 1
    users: Matched entry DEFAULT at line 153
    users: Matched entry DEFAULT at line 172
  modcall[authorize]: module \\\"files\\\" returns ok for request 1
rlm_pap: WARNING! No \\\"known good\\\" password found for the user. 
Authentication m ay fail because of this.
  modcall[authorize]: module \\\"pap\\\" returns noop for request 1
modcall: leaving group authorize (returns updated) for request 1
  rad_check_password:  Found Auth-Type EAP
auth: type \\\"EAP\\\"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 1
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/tls
  rlm_eap: processing type tls
  rlm_eap_tls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls:  Length Included
  eaptls_verify returned 11
    (other): before/accept initialization
    TLS_accept: before/accept initialization
  rlm_eap_tls: <<< TLS 1.0 Handshake [length 0051], ClientHello
    TLS_accept: SSLv3 read client hello A
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello
    TLS_accept: SSLv3 write server hello A
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 04bf], Certificate
    TLS_accept: SSLv3 write certificate A
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 004c], CertificateRequest
    TLS_accept: SSLv3 write certificate request A
    TLS_accept: SSLv3 flush data
    TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
  eaptls_process returned 13
  modcall[authenticate]: module \\\"eap\\\" returns handled for request 1
modcall: leaving group authenticate (returns handled) for request 1
Sending Access-Challenge of id 1 to 192.168.0.50 port 1026
        Framed-IP-Address = 255.255.255.254
        Framed-MTU = 576
        Service-Type = Framed-User
        EAP-Message = 0x0102040a0dc000000564160301004a0200004603014642cb066051eb
4f14285a58bcd1249829d97ad27f846524d57f7a25b0a3981720143a0cfecdd12ac8ec78c09d87f3
05ba498dcfe95c07b2b76e9b8510cfc644fd00040016030104bf0b0004bb0004b800022c30820228
30820191a003020102020101300d06092a864886f70d0101040500303b310b300906035504061302
494e310b300906035504081302544e310d300b060355040a1304536966793110300e060355040313
0730377877696669301e170d3037303131323135333533305a170d3038303131323135333533305a
3060310b300906035504061302494e310b3009060355040813
        EAP-Message = 0x02544e310d300b060355040a1304536966793110300e060355040313
07303778776966693123302106092a864886f70d0109011614616e6f6f705f634073696679636f72
702e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d2bbbe35bc8a
47709632284aff484695385e69c3522f63da46834f9586a420bda380889693fa77fedd9ed4290e6f
9ff4436721775294fc65a38fea098f18975b34b5063de27220e18a07d433cbb6e19aeb3f84b012f7
c20071dd280457a932634bbe50f438cc2ee6f4d65fa395a10bdecc4bf9087979ec45af000940e186
ed290203010001a317301530130603551d25040c300a06082b
        EAP-Message = 0x06010505070301300d06092a864886f70d0101040500038181000afe
a7f2a8a9cffe60baa8f779353c523457f8237faeff81ba5f2c22664c70b6b2fb58c8967ca4a4c847
b80e1d5a6cc4558ffa1d161614f374d8b5efd565aa66045b192b3ac3da82c81c4a99fc10cfe473f9
ac258ef99b16cbd335004677694a05addae48c6a9dcdb26b86ddb56c635266c33c7de75865435326
92e5220d30b100028630820282308201eba003020102020100300d06092a864886f70d0101040500
303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453
6966793110300e0603550403130730377877696669301e170d
        EAP-Message = 0x3037303131323135333435305a170d3038303131323135333435305a
303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453
6966793110300e060355040313073037787769666930819f300d06092a864886f70d010101050003
818d0030818902818100ba8b07a479bb6ce9adf2d8bc6ac9cf214506dfc039cb10c3b4d27d1bbc08
2caff0bb77424819728977f04b32e231a3c4755a65823b366f1a604f15ce6c499883ab7d2757a5a2
c07a11e75b7a00d6c55a8fb7443b202a25a3cdaad39579b2d8f4c09c974056f0c8666fff754d5748
36fcaf105200fcd5df5158e2b387310c4ed90203010001a381
        EAP-Message = 0x95308192301d0603551d0e041604149eda6f69065423
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x2fdcf333629491d0e1c1ee647458de64
Finished request 1
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.0.50:1026, id=2, length=209
        Message-Authenticator = 0x4ad9312009d92ce8a0efb591a5179928
        Service-Type = Framed-User
        User-Name = \\\"anoop07\\\"
        Framed-MTU = 1488
        State = 0x2fdcf333629491d0e1c1ee647458de64
        Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\"
        Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\"
        NAS-Identifier = \\\"D-Link Access Point\\\"
        NAS-Port-Type = Wireless-802.11
        Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\"
        EAP-Message = 0x020200060d00
        NAS-IP-Address = 192.168.0.50
        NAS-Port = 1
        NAS-Port-Id = \\\"STA port # 1\\\"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
  modcall[authorize]: module \\\"preprocess\\\" returns ok for request 2
    rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm
NULL
    rlm_realm: No such realm \\\"NULL\\\"
  modcall[authorize]: module \\\"suffix\\\" returns noop for request 2
  rlm_eap: EAP packet type response id 2 length 6
  rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation
  modcall[authorize]: module \\\"eap\\\" returns updated for request 2
    users: Matched entry DEFAULT at line 153
    users: Matched entry DEFAULT at line 172
  modcall[authorize]: module \\\"files\\\" returns ok for request 2
rlm_pap: WARNING! No \\\"known good\\\" password found for the user. 
Authentication m ay fail because of this.
  modcall[authorize]: module \\\"pap\\\" returns noop for request 2
modcall: leaving group authorize (returns updated) for request 2
  rad_check_password:  Found Auth-Type EAP
auth: type \\\"EAP\\\"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 2
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/tls
  rlm_eap: processing type tls
  rlm_eap_tls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
  rlm_eap_tls: ack handshake fragment handler
  eaptls_verify returned 1
  eaptls_process returned 13
  modcall[authenticate]: module \\\"eap\\\" returns handled for request 2
modcall: leaving group authenticate (returns handled) for request 2
Sending Access-Challenge of id 2 to 192.168.0.50 port 1026
        Framed-IP-Address = 255.255.255.254
        Framed-MTU = 576
        Service-Type = Framed-User
        EAP-Message = 0x0103016e0d80000005647ec1c9e4d07a608e0e6dcd730f3063060355
1d23045c305a80149eda6f690654237ec1c9e4d07a608e0e6dcd730fa13fa43d303b310b30090603
5504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e06
03550403130730377877696669820100300c0603551d13040530030101ff300d06092a864886f70d
0101040500038181006b514f008b6a77757fc73ddbe9d54e4ea925a1ab9ce80ad7895d6d19661d8b
8558d0e359876aac023aa52d4273e00407b9b588b30dbc35c5911bc89d2d99677e0ec8dea17fece3
5d0b4dfab8775ba73eaeb0a0998bcdf1437cff0a1031f6a5b1
        EAP-Message = 0x7e8bcdc01e2e964cb256f49d947eea2cfd42989aef397fa438be294f
a3dc7a3d160301004c0d000044020102003f003d303b310b300906035504061302494e310b300906
035504081302544e310d300b060355040a1304536966793110300e06035504031307303778776966
690e000000
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x8312be86097e0bba014e67facd670e26
Finished request 2
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.0.50:1026, id=3, length=209
        Message-Authenticator = 0xd1d028ef0c35ada1104dae076b233114
        Service-Type = Framed-User
        User-Name = \\\"anoop07\\\"
        Framed-MTU = 1488
        State = 0x8312be86097e0bba014e67facd670e26
        Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\"
        Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\"
        NAS-Identifier = \\\"D-Link Access Point\\\"
        NAS-Port-Type = Wireless-802.11
        Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\"
        EAP-Message = 0x020300060d00
        NAS-IP-Address = 192.168.0.50
        NAS-Port = 1
        NAS-Port-Id = \\\"STA port # 1\\\"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
  modcall[authorize]: module \\\"preprocess\\\" returns ok for request 3
    rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm
NULL
    rlm_realm: No such realm \\\"NULL\\\"
  modcall[authorize]: module \\\"suffix\\\" returns noop for request 3
  rlm_eap: EAP packet type response id 3 length 6
  rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation
  modcall[authorize]: module \\\"eap\\\" returns updated for request 3
    users: Matched entry DEFAULT at line 153
    users: Matched entry DEFAULT at line 172
  modcall[authorize]: module \\\"files\\\" returns ok for request 3
rlm_pap: WARNING! No \\\"known good\\\" password found for the user. 
Authentication m ay fail because of this.
  modcall[authorize]: module \\\"pap\\\" returns noop for request 3
modcall: leaving group authorize (returns updated) for request 3
  rad_check_password:  Found Auth-Type EAP
auth: type \\\"EAP\\\"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 3
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/tls
  rlm_eap: processing type tls
  rlm_eap_tls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
  rlm_eap_tls: ack handshake fragment handler
  eaptls_verify returned 1
  eaptls_process returned 13
  modcall[authenticate]: module \\\"eap\\\" returns handled for request 3
modcall: leaving group authenticate (returns handled) for request 3
Sending Access-Challenge of id 3 to 192.168.0.50 port 1026
        Framed-IP-Address = 255.255.255.254
        Framed-MTU = 576
        Service-Type = Framed-User
        EAP-Message = 0x0104000a0d8000000000
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0xc08d54ac02795c8e31c2f7865a609bd5
Finished request 3
Going to the next request
Waking up in 6 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 0 with timestamp 4642cb06
Cleaning up request 1 ID 1 with timestamp 4642cb06
Cleaning up request 2 ID 2 with timestamp 4642cb06
Cleaning up request 3 ID 3 with timestamp 4642cb06
Nothing to do.  Sleeping until we see a request.
 
[root at anoop raddb]#
Regards
Anoop

 

essage: 3
Date: Thu, 10 May 2007 11:45:42 +0200
From: inverse <inverse at ngi.it>
Subject: Re: eap-tls authentication with free radius 1.1.5
To: \"FreeRadius users mailing list\"
	<freeradius-users at lists.freeradius.org>
Message-ID:
	<32deb3e30705100245t4c9ff9cay66d7c99ea0e34a44 at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

On 5/10/07, anoop_c at sifycorp.com <anoop_c at sifycorp.com> wrote:


anoop, please fix your quoting.

Configurations are not interchangeable between the snapshot tree,
1.1.5 and 1.1.6






More information about the Freeradius-Users mailing list