EAP/TTLS Auth problem
Steve Hopps
steve.hopps at gmail.com
Mon May 14 21:22:55 CEST 2012
Well I've been trying to follow the advice here and also what I've
found online and in the configs. I attempted to revert to the
'default' config files for sites-enabled, as this project was dropped
in my lap after months of another guy working on it and being
frustrated, and I wasn't sure what kinds of changes he made.
So I restored the files, and attempted some authorizing via the AP
we're trying to set up, and here is the log result:
FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov
14 2010 at 21:12:30
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License v2.
Starting - reading configuration files ...
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/clients.conf
including configuration file /etc/freeradius/snmp.conf
including configuration file /etc/freeradius/eap.conf
including configuration file /etc/freeradius/policy.conf
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/inner-tunnel
including configuration file /etc/freeradius/sites-enabled/default
main {
user = "freerad"
group = "freerad"
allow_core_dumps = no
}
including dictionary file /etc/freeradius/dictionary
main {
prefix = "/usr"
localstatedir = "/var"
logdir = "/var/log/freeradius"
libdir = "/usr/lib/freeradius"
radacctdir = "/var/log/freeradius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
pidfile = "/var/run/freeradius/freeradius.pid"
checkrad = "/usr/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = yes
auth_badpass = no
auth_goodpass = no
}
security {
max_attributes = 200
reject_delay = 1
status_server = yes
}
}
radiusd: #### Loading Realms and Home Servers ####
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = "-removed-"
shortname = "localhost"
}
client 6.6.6.6 {
ipaddr = 6.6.6.6
require_message_authenticator = no
secret = "testing123"
}
radiusd: #### Instantiating modules ####
instantiate {
Module: Linked to module rlm_exec
Module: Instantiating module "exec" from file /etc/freeradius/radiusd.conf
exec {
wait = yes
input_pairs = "request"
shell_escape = yes
}
Module: Linked to module rlm_expr
Module: Instantiating module "expr" from file /etc/freeradius/radiusd.conf
Module: Linked to module rlm_expiration
Module: Instantiating module "expiration" from file
/etc/freeradius/radiusd.conf
expiration {
reply-message = "Password Has Expired "
}
Module: Linked to module rlm_logintime
Module: Instantiating module "logintime" from file /etc/freeradius/radiusd.conf
logintime {
reply-message = "You are calling outside your allowed timespan "
minimum-timeout = 60
}
}
radiusd: #### Loading Virtual Servers ####
server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel
modules {
Module: Checking authenticate {...} for more modules to load
Module: Linked to module rlm_eap
Module: Instantiating module "eap" from file /etc/freeradius/eap.conf
eap {
default_eap_type = "ttls"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 4096
}
Module: Linked to sub-module rlm_eap_md5
Module: Instantiating eap-md5
Module: Linked to sub-module rlm_eap_leap
Module: Instantiating eap-leap
Module: Linked to sub-module rlm_eap_gtc
Module: Instantiating eap-gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
Module: Linked to sub-module rlm_eap_tls
Module: Instantiating eap-tls
tls {
rsa_key_exchange = no
dh_key_exchange = yes
rsa_key_length = 512
dh_key_length = 512
verify_depth = 0
pem_file_type = yes
private_key_file = "/etc/freeradius/certs/-company-.key"
certificate_file = "/etc/freeradius/certs/-company-.crt"
CA_file = "/etc/ssl/certs/-company-_ca.crt"
private_key_password = "-removed-"
dh_file = "/etc/freeradius/certs/dh"
random_file = "/dev/urandom"
fragment_size = 1024
include_length = yes
check_crl = no
cipher_list = "DEFAULT"
make_cert_command = "/etc/freeradius/certs/bootstrap"
cache {
enable = no
lifetime = 24
max_entries = 255
}
}
Module: Linked to sub-module rlm_eap_ttls
Module: Instantiating eap-ttls
ttls {
default_eap_type = "md5"
copy_request_to_tunnel = no
use_tunneled_reply = no
virtual_server = "inner-tunnel"
include_length = yes
}
Module: Linked to sub-module rlm_eap_peap
Module: Instantiating eap-peap
peap {
default_eap_type = "mschapv2"
copy_request_to_tunnel = no
use_tunneled_reply = no
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
}
Module: Linked to sub-module rlm_eap_mschapv2
Module: Instantiating eap-mschapv2
mschapv2 {
with_ntdomain_hack = no
}
Module: Checking authorize {...} for more modules to load
Module: Linked to module rlm_chap
Module: Instantiating module "chap" from file /etc/freeradius/radiusd.conf
Module: Linked to module rlm_mschap
Module: Instantiating module "mschap" from file /etc/freeradius/radiusd.conf
mschap {
use_mppe = yes
require_encryption = yes
require_strong = yes
with_ntdomain_hack = no
}
Module: Linked to module rlm_realm
Module: Instantiating module "suffix" from file /etc/freeradius/radiusd.conf
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
Module: Linked to module rlm_files
Module: Instantiating module "files" from file /etc/freeradius/radiusd.conf
files {
usersfile = "/etc/freeradius/users"
acctusersfile = "/etc/freeradius/acct_users"
preproxy_usersfile = "/etc/freeradius/preproxy_users"
compat = "no"
}
Module: Linked to module rlm_ldap
Module: Instantiating module "ldap" from file /etc/freeradius/radiusd.conf
ldap {
server = "localhost"
port = 389
password = "-removed-"
identity = "cn=mailnet,dc=-company-,dc=com"
net_timeout = 1
timeout = 4
timelimit = 3
tls_mode = no
start_tls = no
tls_require_cert = "allow"
tls {
start_tls = no
require_cert = "allow"
}
basedn = "ou=People,dc=-company-,dc=com"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
base_filter = "(objectclass=posixAccount)"
password_attribute = "userPassword"
auto_header = no
access_attr_used_for_allow = yes
groupname_attribute = "cn"
groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
dictionary_mapping = "/etc/freeradius/ldap.attrmap"
ldap_debug = 0
ldap_connections_number = 5
compare_check_items = no
do_xlat = yes
edir_account_policy_check = no
set_auth_type = no
}
rlm_ldap: Registering ldap_groupcmp for Ldap-Group
rlm_ldap: Registering ldap_xlat with xlat_name ldap
rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address
rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type
rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type
rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS
Tunnel-Private-Group-Id
rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
rlm_ldap: LDAP radiusClass mapped to RADIUS Class
rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link
rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS
Framed-AppleTalk-Network
rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone
rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message
conns: 0x2433ad0
Module: Linked to module rlm_pap
Module: Instantiating module "pap" from file /etc/freeradius/radiusd.conf
pap {
encryption_scheme = "auto"
auto_header = no
}
Module: Checking session {...} for more modules to load
Module: Linked to module rlm_radutmp
Module: Instantiating module "radutmp" from file /etc/freeradius/radiusd.conf
radutmp {
filename = "/var/log/freeradius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
perm = 384
callerid = yes
}
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
Module: Linked to module rlm_attr_filter
Module: Instantiating module "attr_filter.access_reject" from file
/etc/freeradius/radiusd.conf
attr_filter attr_filter.access_reject {
attrsfile = "/etc/freeradius/attrs.access_reject"
key = "%{User-Name}"
}
} # modules
} # server
server { # from file /etc/freeradius/radiusd.conf
modules {
Module: Checking authenticate {...} for more modules to load
Module: Linked to module rlm_digest
Module: Instantiating module "digest" from file /etc/freeradius/radiusd.conf
Module: Linked to module rlm_unix
Module: Instantiating module "unix" from file /etc/freeradius/radiusd.conf
unix {
radwtmp = "/var/log/freeradius/radwtmp"
}
Module: Checking authorize {...} for more modules to load
Module: Linked to module rlm_preprocess
Module: Instantiating module "preprocess" from file
/etc/freeradius/radiusd.conf
preprocess {
huntgroups = "/etc/freeradius/huntgroups"
hints = "/etc/freeradius/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
Module: Checking preacct {...} for more modules to load
Module: Linked to module rlm_acct_unique
Module: Instantiating module "acct_unique" from file
/etc/freeradius/radiusd.conf
acct_unique {
key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
}
Module: Checking accounting {...} for more modules to load
Module: Linked to module rlm_detail
Module: Instantiating module "detail" from file /etc/freeradius/radiusd.conf
detail {
detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
header = "%t"
detailperm = 384
dirperm = 493
locking = no
log_packet_header = no
}
Module: Instantiating module "attr_filter.accounting_response" from
file /etc/freeradius/radiusd.conf
attr_filter attr_filter.accounting_response {
attrsfile = "/etc/freeradius/attrs.accounting_response"
key = "%{User-Name}"
}
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
} # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = *
port = 0
}
listen {
type = "acct"
ipaddr = *
port = 0
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 66.146.192.5 port 2048,
id=162, length=153
User-Name = "test.account"
NAS-Port = 0
Called-Station-Id = "00-27-22-12-59-1F:Helio"
Calling-Station-Id = "00-22-FA-47-BF-FC"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message = 0x029400100173746576652e686f707073
Message-Authenticator = 0x81f873df341d9673d57990eec5fcc8ca
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "test.account", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 148 length 16
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.
Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 162 to 66.146.192.5 port 2048
EAP-Message = 0x019500061520
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xbaa14185ba34547fb710ae7f68f390ce
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 66.146.192.5 port 2048,
id=163, length=369
User-Name = "test.account"
NAS-Port = 0
Called-Station-Id = "00-27-22-12-59-1F:Helio"
Calling-Station-Id = "00-22-FA-47-BF-FC"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message = 0x029500d6150016030100cb010000c703014fb158a423a9accba00b561fc886eb029ec41f0c00eede9e3e3c00470038275900005ac014c00a0039003800880087c00fc00500350084c012c00800160013c00dc003000ac013c00900330032009a009900450044c00ec004002f00960041c011c007c00cc002000500040015001200090014001100080006000300ff01000044000b000403000102000a00340032000100020003000400050006000700080009000a000b000c000d000e000f001000110012001300140015001600170018001900230000
State = 0xbaa14185ba34547fb710ae7f68f390ce
Message-Authenticator = 0xa19b4694e4af7c852f135c3ebbd8d8b5
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "test.account", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 149 length 214
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/ttls
[eap] processing type ttls
[ttls] Authenticate
[ttls] processing EAP-TLS
[ttls] eaptls_verify returned 7
[ttls] Done initial handshake
[ttls] (other): before/accept initialization
[ttls] TLS_accept: before/accept initialization
[ttls] <<< TLS 1.0 Handshake [length 00cb], ClientHello
[ttls] TLS_accept: SSLv3 read client hello A
[ttls] >>> TLS 1.0 Handshake [length 0031], ServerHello
[ttls] TLS_accept: SSLv3 write server hello A
[ttls] >>> TLS 1.0 Handshake [length 04bc], Certificate
[ttls] TLS_accept: SSLv3 write certificate A
[ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange
[ttls] TLS_accept: SSLv3 write key exchange A
[ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
[ttls] TLS_accept: SSLv3 write server done A
[ttls] TLS_accept: SSLv3 flush data
[ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
[ttls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 163 to 66.146.192.5 port 2048
EAP-Message = 0x0196040015c00000071216030100310200002d03014fb158a58c3d363c28bf774f98fdc796ff1b432548e5d9d240c0428e55546afc000039000005ff0100010016030104bc0b0004b80004b50004b2308204ae3082029602011a300d06092a864886f70d01010505003081a5310b30090603550406130255533111300f06035504081308496c6c696e6f69733110300e060355040713074368696361676f31193017060355040a13106f6e53686f7265204e6574776f726b73310c300a060355040b13034e4f43312830260603550403131f6f6e53686f726520436572746966696361746520417574686f726974792032311e301c06092a864886f70d
EAP-Message = 0x010901160f6e6f63406f6e73686f72652e636f6d301e170d3130303531303136353130365a170d3132303530393136353130365a308193310b30090603550406130255533111300f06035504081308496c6c696e6f69733110300e060355040713074368696361676f31193017060355040a13106f6e53686f7265204e6574776f726b73310c300a060355040b13034e4f43311630140603550403140d2a2e6f6e73686f72652e636f6d311e301c06092a864886f70d010901160f6e6f63406f6e73686f72652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100bb0fbe4d48432f2a6c5755c5110fb093aed4
EAP-Message = 0x1cfe3addf51e7759210a2595039824736d6964b4d927ca7deb7e3e2076143b6c1b0f599f6cc5d16c9bb2b6dab7e4b5b4566cea345d352739b0b40f41a82e17ab1438f996984d75baa4c812287eb171e9debbe5c996a325486ac26184b8b26e2e9930f6f8ecf691631eb1e3739bd95145846d8784b0131a78ab002509d47030da9359d99650613fa1e5d3f27511451b7e47c52e72a2d76d18f274f9c6f54531eb9d3bc34d73ed7daa178ba5e8460076b6e59ae33c32445d142930b5a97a6705ea95b5137e86c5a3f3f5420c527879963d9c2389ac3d4e28e6f1ec5e19b6e265d1142e495eca99fe8f1504fd76558b0203010001300d06092a864886f70d
EAP-Message = 0x0101050500038202010073d7768d817f3ea27e24f66ab7aa9d4432029343faddb79d4f7065e11b3f357f51398d4025cb897e771440b0296d7371f29157ccff12fa31a318e4804a128fd960867a0fde30e29eb679127a390625f8720243cf555128d58ff7790c510ad3a28322eb6940e73106b97553cb89efeaa0259892347bcddcaf3a679f1f29db9c861da5c0ca9080fd01f62a5198419fafa0c1f0cdb02348a06c00ae2f08d465a81f11824763806c2bb106e9b8ff5ffc9bee5da6d7b312c9d64845b24dc18546a5eae4aa7d32fdf0116aa4fea5bbbfdc61e30231867d85c5d93400f6d3d392cda0bdee6d496b6ad338f8d1df209344d96767015d1a
EAP-Message = 0xeaf0f565d1fb31d4aa0effb5
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xbaa14185bb37547fb710ae7f68f390ce
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 66.146.192.5 port 2048,
id=164, length=161
User-Name = "test.account"
NAS-Port = 0
Called-Station-Id = "00-27-22-12-59-1F:Helio"
Calling-Station-Id = "00-22-FA-47-BF-FC"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message = 0x029600061500
State = 0xbaa14185bb37547fb710ae7f68f390ce
Message-Authenticator = 0x46e54dc8b4f72ceff6ac06465a4cd207
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "test.account", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 150 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/ttls
[eap] processing type ttls
[ttls] Authenticate
[ttls] processing EAP-TLS
[ttls] Received TLS ACK
[ttls] ACK handshake fragment handler
[ttls] eaptls_verify returned 1
[ttls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 164 to 66.146.192.5 port 2048
EAP-Message = 0x019703261580000007125cbe1d1d0855e52217e0f200669ddc9ff4b9381a2b5f6f8e8d6d7c58da01b3e66eaae9ccafc14091bf368b555a6303480bd438d2ff9f134ca9e022694b8bb6af556f028cc2be02147af1cc1687503624fe5c3e387fb1f8486e5543cdd61408927ff51a8ec5ee7ad44f28d1e738daea7038e507885af3c1fb47c4d6ddbcf86a0e0d72d71f24084daf305d6b7f778882527d79956aef5d2543ddbf99c50983439fdca0c4fe19d6d30d6fbd6a96688937fafb76904f982929c65e90cb918cdaf032f90d4ec38e266af9528fb919c533c18c3a1a406a1e6b36f9329ea3cd5ab99a162f5a2d5b6a1837335673a9619212dd18518e64
EAP-Message = 0xe7d6fed9c1a3ed7dbc9870af7595160301020d0c0002090080b52fb0019c41b4ded3d72c6a9619520bd617f8cd4ed4538f0042d9315427d64fb7eb73a2711a2bad495619fbeffe34a97115a8a879068961db66e311d54f7dcf99af511a270e842640696c0a81bb8dc30e820c65f56c405c5223e5fd3cde3fff6026a788d22069dd08990ddef39b51bf9ef7ca58b8a3e3177107fceeaaf61e0b00010200808b95619654cc7cad72e6d860b563488e93e799b169851dff161f99ffada74c0b5caa01fe654231dd9b806af7b5ce03a2d5a86d42eb0ab131bf2dec93af82d875f4912b2db6709a82950278a349b78f1347ea79e3d389e99b31db5a0209d765
EAP-Message = 0x3c8a10ba52ed1fb2c8df0772de0b0a78ebf0c060ad6817dda1ed879f70377bdbe40100479f0778c90f0c80e039bf4304abcf1f563e073fd83adb0ec48e51ed81a52792c8af1192eb5177a88848171122653c8bed30c34001184551b029a908d141433afe00d4d68700393aab57d4f7a189218cda4cf40820bbe5b4ec107d960861a1cf26d4f24e8eec93e907d1db1fe951e3d213caa777402a4e138ef57ba31c60b0964b319c67a63717bbd18e1d4ffabe1f5169b15b89b55ff8cca70e9706f1b5435ad7fea8b3440c9a7d5e2b22cb6ba9d14ebf0a5db35f769329f7d0cb6d46b8631a004da9347b3ad34ce189b1c22761bfbb601f02228aa8e5887db7
EAP-Message = 0x8504ce4234a11267748e3dbc3e9c6975998c90dc1bcbb795c92196e0350a1fbde5630162b26316030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xbaa14185b836547fb710ae7f68f390ce
Finished request 2.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 66.146.192.5 port 2048,
id=165, length=359
User-Name = "test.account"
NAS-Port = 0
Called-Station-Id = "00-27-22-12-59-1F:Helio"
Calling-Station-Id = "00-22-FA-47-BF-FC"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message = 0x029700cc150016030100861000008200807ff5c09b6278ba0b8eac6c30dd440a8beb12921c8b11a0f2caefe3f9d170cd2368207701e8e93f15bf7a56d8e0581203395eca3943a7468eb01d09a40264eb81b3b07496bdf6c7acccd3ffab4896dfee1eac7e0124f1aa1f3edd3a514a730e15d1a242e27f9441fff25d1a551de4ff9113d5213cfca5b5fd5baedf09f412291b140301000101160301003000b2be90745e592a791f83f06315ba2ad530e33d9847a7dc21c14b267990d2d91a03f5520194c34ab6a2e31b668105b7
State = 0xbaa14185b836547fb710ae7f68f390ce
Message-Authenticator = 0x25485d5a38c48bc1ab386904cfd96c88
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "test.account", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 151 length 204
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/ttls
[eap] processing type ttls
[ttls] Authenticate
[ttls] processing EAP-TLS
[ttls] eaptls_verify returned 7
[ttls] Done initial handshake
[ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange
[ttls] TLS_accept: SSLv3 read client key exchange A
[ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001]
[ttls] <<< TLS 1.0 Handshake [length 0010], Finished
[ttls] TLS_accept: SSLv3 read finished A
[ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001]
[ttls] TLS_accept: SSLv3 write change cipher spec A
[ttls] >>> TLS 1.0 Handshake [length 0010], Finished
[ttls] TLS_accept: SSLv3 write finished A
[ttls] TLS_accept: SSLv3 flush data
[ttls] (other): SSL negotiation finished successfully
SSL Connection Established
[ttls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 165 to 66.146.192.5 port 2048
EAP-Message = 0x0198004515800000003b1403010001011603010030617c9c272d9b82e4fa9285e960b2d9f725fb060f58a9a81474c4319da7a81fd37979f8660a5766e28ecb247ec66fc470
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xbaa14185b939547fb710ae7f68f390ce
Finished request 3.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 66.146.192.5 port 2048,
id=166, length=299
User-Name = "test.account"
NAS-Port = 0
Called-Station-Id = "00-27-22-12-59-1F:Helio"
Calling-Station-Id = "00-22-FA-47-BF-FC"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message = 0x0298009015001703010020bf7b81f2d9d284fb074760c712c39dc39c23a6895dea13ec8b17c0c988ac61381703010060151d4e77c4a8ac62fcae21cc233bacc6f60d2f27be9f44cf7016ac9fbaf267f9079eaa3709ffc7772445abb958c426c391fd29239bda404025a697793c803305b7246dd2c00cd97334416440be22057e1e8b8eb782dfce6603f09f943ff98a94
State = 0xbaa14185b939547fb710ae7f68f390ce
Message-Authenticator = 0xee653bae0651c140d860abd2356b8f25
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "test.account", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 152 length 144
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/ttls
[eap] processing type ttls
[ttls] Authenticate
[ttls] processing EAP-TLS
[ttls] eaptls_verify returned 7
[ttls] Done initial handshake
[ttls] eaptls_process returned 7
[ttls] Session established. Proceeding to decode tunneled attributes.
[ttls] Got tunneled request
User-Name = "test.account"
User-Password = "-removed-"
FreeRADIUS-Proxied-To = 127.0.0.1
[ttls] Sending tunneled request
User-Name = "test.account"
User-Password = "-removed-"
FreeRADIUS-Proxied-To = 127.0.0.1
server inner-tunnel {
# Executing section authorize from file
/etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[control] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "test.account", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
[ldap] performing user authorization for test.account
[ldap] WARNING: Deprecated conditional expansion ":-". See "man
unlang" for details
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> test.account
[ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=test.account)
[ldap] expand: ou=People,dc=-company-,dc=com -> ou=People,dc=-company-,dc=com
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] attempting LDAP reconnection
[ldap] (re)connect to localhost:389, authentication 0
[ldap] bind as cn=mailnet,dc=-company-,dc=com/-removed- to localhost:389
[ldap] waiting for bind result ...
[ldap] Bind was successful
[ldap] performing search in ou=People,dc=-company-,dc=com, with
filter (uid=test.account)
[ldap] No default NMAS login sequence
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP. Are you sure
that the user is configured correctly?
[ldap] user test.account authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist!
Cancelling invalid proxy request.
ERROR: No authenticate method (Auth-Type) found for the request:
Rejecting the user
Failed to authenticate the user.
Login incorrect: [test.account] (from client 66.146.192.5 port 0 via TLS tunnel)
} # server inner-tunnel
[ttls] Got tunneled reply code 3
[ttls] Got tunneled Access-Reject
[eap] Handler failed in EAP/ttls
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Login incorrect: [test.account] (from client 66.146.192.5 port 0 cli
00-22-FA-47-BF-FC)
Using Post-Auth-Type Reject
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> test.account
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 4 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 4
Sending Access-Reject of id 166 to 66.146.192.5 port 2048
EAP-Message = 0x04980004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.9 seconds.
Cleaning up request 0 ID 162 with timestamp +12
Cleaning up request 1 ID 163 with timestamp +12
Cleaning up request 2 ID 164 with timestamp +12
Cleaning up request 3 ID 165 with timestamp +12
Waking up in 1.0 seconds.
Cleaning up request 4 ID 166 with timestamp +12
Ready to process requests.
----------------------
It seems to me it is working all the way up until
"ERROR: No authenticate method (Auth-Type) found for the request:
Rejecting the user" but perhaps I'm overlooking something. I
appreciate any further assistance anyone can offer.
On Mon, May 14, 2012 at 10:22 AM, Phil Mayers <p.mayers at imperial.ac.uk> wrote:
> On 14/05/12 15:58, Steve Hopps wrote:
>>
>> I'll post the full log. It should be pulling from OpenLDAP. I had to
>
>
> It's not. You haven't configured it to do that.
>
>
>> Module: Instantiating module "ldap" from file
>> /etc/freeradius/radiusd.conf
>> ldap {
>> server = "localhost"
>> port = 389
>
>
> Ok, you have LDAP configured
>
>
>> rad_recv: Access-Request packet from host 6.6.6.6 port 37880, id=0,
>> length=119
>> User-Name = "test"
>> NAS-IP-Address = 127.0.0.1
>> Calling-Station-Id = "70-6F-6C-69-73-68"
>> Framed-MTU = 1400
>> NAS-Port-Type = Wireless-802.11
>> Connect-Info = "rad_eap_test + eapol_test"
>> EAP-Message = 0x020000090174657374
>> Message-Authenticator = 0xcfdd7846ad5afe2989a9f95268623b3a
>> # Executing section authorize from file
>> /etc/freeradius/sites-enabled/default
>> +- entering group authorize {...}
>> ++[preprocess] returns ok
>> ++[chap] returns noop
>> ++[mschap] returns noop
>> [suffix] No '@' in User-Name = "test", looking up realm NULL
>> [suffix] No such realm "NULL"
>> ++[suffix] returns noop
>> [eap] EAP packet type response id 0 length 9
>> [eap] No EAP Start, assuming it's an on-going EAP conversation
>> ++[eap] returns updated
>> ++[unix] returns updated
>> ++[files] returns noop
>> [ldap] performing user authorization for test
>
>
> "ldap" is running in the "outer" tunnel; that's probably not where you want
> it. You need to put it in the "inner" tunnel.
>
> Compare and contrast sites-enabled/default and sites-enabled/inner-tunnel.
>
>> /etc/freeradius/sites-enabled/inner-tunnel
>
>
> Note above, once the EAP outer tunnel has succeeded, further processing
> happens in the "sites-enabled/inner-tunnel" virtual server.
>
>
>> +- entering group authorize {...}
>> ++[chap] returns noop
>> ++[control] returns noop
>> ++[mschap] returns noop
>> ++[unix] returns updated
>
>
> ^^^ this is the problem; the "unix" module is running inside the tunnel and
> extracting the password for the user "test" from the local /etc/passwd file
>
> Comment this line out. Then replace it with "ldap"
>
>
>
>> [suffix] No '@' in User-Name = "test", looking up realm NULL
>> [suffix] No such realm "NULL"
>> ++[suffix] returns noop
>> ++[control] returns noop
>> [eap] No EAP-Message, not doing EAP
>> ++[eap] returns noop
>> ++[files] returns noop
>> ++[expiration] returns noop
>> ++[logintime] returns noop
>> ++[pap] returns updated
>> WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist!
>> Cancelling invalid proxy request.
>> Found Auth-Type = PAP
>> # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
>> +- entering group PAP {...}
>> [pap] login attempt with password "test123"
>> [pap] Using CRYPT password "*"
>> [pap] Passwords don't match
>> ++[pap] returns reject
>
>
> ...and it fails.
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
More information about the Freeradius-Users
mailing list