Problem with EAP-TLS authentication in Freeradius

senthil kumar mailbsk at gmail.com
Tue Apr 26 07:38:34 CEST 2011


 Hi All,
      I am using Freeradius 2.1.0
      PEAP/TTLS is working fine and I am facing problem in TLS
authentication. I am able to generate certificate but while connecting it
throws Authentication error.
     Can some one send me client.cnf and server.cnf. Also let me
know whether installing only client is enough or do we need to install
ca.pem also in client side.
     Please let me know how to debug it.






rad_recv: Access-Request packet from host 192.168.1.1 port 4906, id=6,
length=147

User-Name = "maemo at nokia.com"

NAS-IP-Address = 192.168.1.1

Called-Station-Id = "0023692c6f74"

Calling-Station-Id = "0025d05b72ab"

NAS-Identifier = "0023692c6f74"

NAS-Port = 2

Framed-MTU = 1400

State = 0xc0ff35f8c1fd389f4e860dc8a76c03f8

NAS-Port-Type = Wireless-802.11

EAP-Message = 0x020200060d00

Message-Authenticator = 0xcf453c67c6fe4f7695dbba231da2ba1e

+- entering group authorize {...}

++[preprocess] returns ok

++[chap] returns noop

++[mschap] returns noop

[suffix] Looking up realm "nokia.com" for User-Name = "maemo at nokia.com"

[suffix] Found realm "DEFAULT"

[suffix] Adding Stripped-User-Name = "maemo"

[suffix] Adding Realm = "DEFAULT"

[suffix] Authentication realm is LOCAL.

++[suffix] returns ok

[eap] EAP packet type response id 2 length 6

[eap] No EAP Start, assuming it's an on-going EAP conversation

++[eap] returns updated

++[unix] returns updated

[files] users: Matched entry maemo at line 74

++[files] returns ok

++[expiration] returns noop

++[logintime] returns noop

[pap] Found existing Auth-Type, not changing it.

++[pap] returns noop

Found Auth-Type = EAP

+- entering group authenticate {...}

[eap] Request found, released from the list

[eap] EAP/tls

[eap] processing type tls

[tls] Authenticate

[tls] processing EAP-TLS

[tls] Received TLS ACK

[tls] ACK handshake fragment handler

[tls] eaptls_verify returned 1

[tls] eaptls_process returned 13

++[eap] returns handled

Sending Access-Challenge of id 6 to 192.168.1.1 port 4906

EAP-Message =
0x010304000dc00000085b310e300c060355040a13054e6f6b6961311e301c06092a864886f70d010901160f6d616d656f406e6f6b69612e636f6d310e300c060355040313054d6565676f301e170d3131303430373038333135345a170d3132303430363038333135345a306e310b300906035504061302494e310b3009060355040813024b413112301006035504071309536f6d657768657265310e300c060355040a13054e6f6b6961311e301c06092a864886f70d010901160f6d616d656f406e6f6b69612e636f6d310e300c060355040313054d6565676f30820122300d06092a864886f70d01010105000382010f003082010a0282010100ebdf

EAP-Message =
0xbd5045d1129f68d6354ecaf6d0b003ba682e0399145d83af7d3f7baeac7b70278682f26b7a6cf02cb0f70d06c27cd5666f6acd0a6e1a05f14cbca9ee2ca06038289d718635789b9378b41d5d89d98c09528e5d75a7ed1210ab639c80a82bb7f727a6641b4ead338d36c98e4910f69add0990c1838bf1dd67d3ef00190a8c50afa3d267b4721eb24c9297eac37244c2f09bf5db1e864ed3e71d7b2f1523f957d040b88bdfbb50ffa7a1fcb77fe8f692faeaf4f26539f93d4b16fefd22576b63425a3b106d4100a7e606110980202629a14f721f576e7b57e94182c695034f33cc5cf153c08074379ee285a4800d30fcc3eeb9618e95b3298852c0e050cc

EAP-Message =
0x370203010001a381d33081d0301d0603551d0e041604146495968035da2071580d6554ff37f49f34a6a4fc3081a00603551d2304819830819580146495968035da2071580d6554ff37f49f34a6a4fca172a470306e310b300906035504061302494e310b3009060355040813024b413112301006035504071309536f6d657768657265310e300c060355040a13054e6f6b6961311e301c06092a864886f70d010901160f6d616d656f406e6f6b69612e636f6d310e300c060355040313054d6565676f82090088f0548531fc31df300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100c60eb4fe9642b5cf1a479ddd03

EAP-Message =
0x31954bd3c5a8c13dac220146915074390da01b0cf44950935ca2fad0bbca312ad8d1ac38a0ad88e51bc7bfc4df349d238aa9dee95ccc333e46e422da2fd67073a5fc1d6109e623efdf7be334a6746b4d3eb012ddb331600471732e961861980a4d0a146e56ee383e1717a209476a34d2ad7153a00f0729976f4d73d4979dc992ab8cc4515787e68afd1979038963882c5f55ed1d038c137689ef3e0fa52d63eabe0466ef126564ff4627776f31dba8bd91b9c486ddf6e8399c755bd29456cfed9bda7890851bfb23d3c381e5176a6b6c86ea9cefc5b7428409e35a794775d27f1664c06aeb46842f61c6145a71a7a0fdea54e316030100800d00007803

EAP-Message = 0x01024000720070306e310b30

Message-Authenticator = 0x00000000000000000000000000000000

State = 0xc0ff35f8c2fc389f4e860dc8a76c03f8

Finished request 156.

Going to the next request

Waking up in 0.4 seconds.

rad_recv: Access-Request packet from host 192.168.1.1 port 4908, id=6,
length=147

User-Name = "maemo at nokia.com"

NAS-IP-Address = 192.168.1.1

Called-Station-Id = "0023692c6f74"

Calling-Station-Id = "0025d05b72ab"

NAS-Identifier = "0023692c6f74"

NAS-Port = 2

Framed-MTU = 1400

State = 0xc0ff35f8c2fc389f4e860dc8a76c03f8

NAS-Port-Type = Wireless-802.11

EAP-Message = 0x020300060d00

Message-Authenticator = 0xdeea6893aacbe253ed951368cec20746

+- entering group authorize {...}

++[preprocess] returns ok

++[chap] returns noop

++[mschap] returns noop

[suffix] Looking up realm "nokia.com" for User-Name = "maemo at nokia.com"

[suffix] Found realm "DEFAULT"

[suffix] Adding Stripped-User-Name = "maemo"

[suffix] Adding Realm = "DEFAULT"

[suffix] Authentication realm is LOCAL.

++[suffix] returns ok

[eap] EAP packet type response id 3 length 6

[eap] No EAP Start, assuming it's an on-going EAP conversation

++[eap] returns updated

++[unix] returns updated

[files] users: Matched entry maemo at line 74

++[files] returns ok

++[expiration] returns noop

++[logintime] returns noop

[pap] Found existing Auth-Type, not changing it.

++[pap] returns noop

Found Auth-Type = EAP

+- entering group authenticate {...}

[eap] Request found, released from the list

[eap] EAP/tls

[eap] processing type tls

[tls] Authenticate

[tls] processing EAP-TLS

[tls] Received TLS ACK

[tls] ACK handshake fragment handler

[tls] eaptls_verify returned 1

[tls] eaptls_process returned 13

++[eap] returns handled

Sending Access-Challenge of id 6 to 192.168.1.1 port 4908

EAP-Message =
0x010400790d800000085b0906035504061302494e310b3009060355040813024b413112301006035504071309536f6d657768657265310e300c060355040a13054e6f6b6961311e301c06092a864886f70d010901160f6d616d656f406e6f6b69612e636f6d310e300c060355040313054d6565676f0e000000

Message-Authenticator = 0x00000000000000000000000000000000

State = 0xc0ff35f8c3fb389f4e860dc8a76c03f8

Finished request 157.

Going to the next request

Waking up in 0.4 seconds.

rad_recv: Access-Request packet from host 192.168.1.1 port 4910, id=6,
length=154

User-Name = "maemo at nokia.com"

NAS-IP-Address = 192.168.1.1

Called-Station-Id = "0023692c6f74"

Calling-Station-Id = "0025d05b72ab"

NAS-Identifier = "0023692c6f74"

NAS-Port = 2

Framed-MTU = 1400

State = 0xc0ff35f8c3fb389f4e860dc8a76c03f8

NAS-Port-Type = Wireless-802.11

EAP-Message = 0x0204000d0d001503010002012a

Message-Authenticator = 0x782f15b2fce0fe49f406f1cb224b1ccf

+- entering group authorize {...}

++[preprocess] returns ok

++[chap] returns noop

++[mschap] returns noop

[suffix] Looking up realm "nokia.com" for User-Name = "maemo at nokia.com"

[suffix] Found realm "DEFAULT"

[suffix] Adding Stripped-User-Name = "maemo"

[suffix] Adding Realm = "DEFAULT"

[suffix] Authentication realm is LOCAL.

++[suffix] returns ok

[eap] EAP packet type response id 4 length 13

[eap] No EAP Start, assuming it's an on-going EAP conversation

++[eap] returns updated

++[unix] returns updated

[files] users: Matched entry maemo at line 74

++[files] returns ok

++[expiration] returns noop

++[logintime] returns noop

[pap] Found existing Auth-Type, not changing it.

++[pap] returns noop

Found Auth-Type = EAP

+- entering group authenticate {...}

[eap] Request found, released from the list

[eap] EAP/tls

[eap] processing type tls

[tls] Authenticate

[tls] processing EAP-TLS

[tls] eaptls_verify returned 7

[tls] Done initial handshake

[tls] <<< TLS 1.0 Alert [length 0002], warning bad_certificate

TLS Alert read:warning:bad certificate

[tls] TLS_accept: Need to read more data: SSLv3 read client certificate A

In SSL Handshake Phase

In SSL Accept mode

SSL Application Data

TLS failed during operation

[tls] eaptls_process returned 4

[eap] Handler failed in EAP/tls

[eap] Failed in EAP select

++[eap] returns invalid

Failed to authenticate the user.

Using Post-Auth-Type Reject

+- entering group REJECT {...}

expand: %{User-Name} -> maemo at nokia.com

attr_filter: Matched entry DEFAULT at line 11

++[attr_filter.access_reject] returns updated

Delaying reject of request 158 for 1 seconds

Going to the next request

Waking up in 0.4 seconds.

rad_recv: Access-Request packet from host 192.168.1.1 port 4912, id=6,
length=136

User-Name = "maemo at nokia.com"

NAS-IP-Address = 192.168.1.1

Called-Station-Id = "0023692c6f74"

Calling-Station-Id = "0025d05b72ab"

NAS-Identifier = "0023692c6f74"

NAS-Port = 2

Framed-MTU = 1400

NAS-Port-Type = Wireless-802.11

EAP-Message = 0x0204000d0d001503010002020a

Message-Authenticator = 0x542730d7c53937fe5e038692a71646ff

+- entering group authorize {...}

++[preprocess] returns ok

++[chap] returns noop

++[mschap] returns noop

[suffix] Looking up realm "nokia.com" for User-Name = "maemo at nokia.com"

[suffix] Found realm "DEFAULT"

[suffix] Adding Stripped-User-Name = "maemo"

[suffix] Adding Realm = "DEFAULT"

[suffix] Authentication realm is LOCAL.

++[suffix] returns ok

[eap] EAP packet type response id 4 length 13

[eap] No EAP Start, assuming it's an on-going EAP conversation

++[eap] returns updated

++[unix] returns updated

[files] users: Matched entry maemo at line 74

++[files] returns ok

++[expiration] returns noop

++[logintime] returns noop

[pap] Found existing Auth-Type, not changing it.

++[pap] returns noop

Found Auth-Type = EAP

+- entering group authenticate {...}

[eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request

[eap] Failed in handler

++[eap] returns invalid

Failed to authenticate the user.

Using Post-Auth-Type Reject

+- entering group REJECT {...}

expand: %{User-Name} -> maemo at nokia.com

attr_filter: Matched entry DEFAULT at line 11

++[attr_filter.access_reject] returns updated

Delaying reject of request 159 for 1 seconds

Going to the next request

Waking up in 0.4 seconds.

Cleaning up request 146 ID 6 with timestamp +2141

Cleaning up request 147 ID 6 with timestamp +2141

Waking up in 0.5 seconds.

Sending delayed reject for request 158

Sending Access-Reject of id 6 to 192.168.1.1 port 4910

EAP-Message = 0x04040004

Message-Authenticator = 0x00000000000000000000000000000000

Sending delayed reject for request 159

Sending Access-Reject of id 6 to 192.168.1.1 port 4912

Waking up in 1.1 seconds.

Cleaning up request 148 ID 6 with timestamp +2143

Cleaning up request 149 ID 6 with timestamp +2143

Cleaning up request 150 ID 6 with timestamp +2143

Cleaning up request 151 ID 6 with timestamp +2143

Waking up in 1.0 seconds.

Cleaning up request 152 ID 6 with timestamp +2143

Cleaning up request 153 ID 6 with timestamp +2143

Waking up in 1.7 seconds.

Cleaning up request 154 ID 6 with timestamp +2146

Cleaning up request 155 ID 6 with timestamp +2146

Cleaning up request 156 ID 6 with timestamp +2146

Cleaning up request 157 ID 6 with timestamp +2146

Waking up in 1.0 seconds.

Cleaning up request 158 ID 6 with timestamp +2146

Cleaning up request 159 ID 6 with timestamp +2146

Regards
Senthil
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20110426/77593d8a/attachment.html>


More information about the Freeradius-Users mailing list