<html>
<head>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-text-html" lang="x-western"> <br>
Hi All,<br>
<br>
I'm using Freeradius server2.1.12 on x86 fedora14. My client is
using (armel ubuntu 10.04 lucid) IMX53 board. When I try
connecting to radius server I am receiving the following errors.<br>
Do we require different certificates for arm boards, as I was able
to run without any issues on x86 with same certificates.<br>
<br>
openssl version is 0.98g (on arm board)<br>
openssl version is 1.0.0a-fips (on x86 free radius server 2.1.12)<br>
<br>
<br>
<i><b>ERROR:<br>
-----------<br>
</b></i><br>
rad_recv: Access-Request packet from host 10.0.0.70 port 2050,
id=8, length=166<br>
User-Name = "testuser"<br>
NAS-IP-Address = 127.0.0.1<br>
NAS-Port = 0<br>
Called-Station-Id = "68-7F-74-64-0A-AA:linksys"<br>
Calling-Station-Id = "00-23-A7-3B-29-2C"<br>
Framed-MTU = 1400<br>
NAS-Port-Type = Wireless-802.11<br>
Connect-Info = "CONNECT 0Mbps 802.11"<br>
EAP-Message = 0x020300060d00<br>
State = 0xba89e950b88ae454eff4b9964b6ca194<br>
Message-Authenticator = 0x3f69e77da835e1450b33224899e816b2<br>
Tue Nov 20 16:48:05 2012 : Info: # Executing section authorize
from file /usr/local/etc/raddb/radiusd.conf<br>
Tue Nov 20 16:48:05 2012 : Info: +- entering group authorize {...}<br>
Tue Nov 20 16:48:05 2012 : Info: ++[preprocess] returns ok<br>
Tue Nov 20 16:48:05 2012 : Info: ++[chap] returns noop<br>
Tue Nov 20 16:48:05 2012 : Info: ++[mschap] returns noop<br>
Tue Nov 20 16:48:05 2012 : Info: [suffix] No '@' in User-Name =
"testuser", looking up realm NULL<br>
Tue Nov 20 16:48:05 2012 : Info: [suffix] No such realm "NULL"<br>
Tue Nov 20 16:48:05 2012 : Info: ++[suffix] returns noop<br>
Tue Nov 20 16:48:05 2012 : Info: [eap] EAP packet type response id
3 length 6<br>
Tue Nov 20 16:48:05 2012 : Info: [eap] No EAP Start, assuming it's
an on-going EAP conversation<br>
Tue Nov 20 16:48:05 2012 : Info: ++[eap] returns updated<br>
Tue Nov 20 16:48:05 2012 : Info: [files] users: Matched entry
testuser at line 131<br>
Tue Nov 20 16:48:05 2012 : Info: ++[files] returns ok<br>
Tue Nov 20 16:48:05 2012 : Info: Found Auth-Type = EAP<br>
Tue Nov 20 16:48:05 2012 : Info: # Executing group from file
/usr/local/etc/raddb/radiusd.conf<br>
Tue Nov 20 16:48:05 2012 : Info: +- entering group authenticate
{...}<br>
Tue Nov 20 16:48:05 2012 : Info: [eap] Request found, released
from the list<br>
Tue Nov 20 16:48:05 2012 : Info: [eap] EAP/tls<br>
Tue Nov 20 16:48:05 2012 : Info: [eap] processing type tls<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] Authenticate<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] processing EAP-TLS<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] Received TLS ACK<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] ACK handshake fragment
handler<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] eaptls_verify returned 1 <br>
Tue Nov 20 16:48:05 2012 : Info: [tls] eaptls_process returned 13
<br>
Tue Nov 20 16:48:05 2012 : Info: ++[eap] returns handled<br>
Sending Access-Challenge of id 8 to 10.0.0.70 port 2050<br>
EAP-Message =
0x0104020d0d80000005f9bd300c0603551d13040530030101ff301d0603551d0e04160414b3807b965fdd9f8fee8fca751d47bf2aebac11fd30818d0603551d230481853081828014b3807b965fdd9f8fee8fca751d47bf2aebac11fda15fa45d305b310a3008060355040a130161310a3008060355040b1301613110300e06092a864886f70d010901160161310a30080603550407130161310a30080603550408130161310b3009060355040613026161310a30080603550403130161820900958dbc5fc22a1e39300d06092a864886f70d010104050003818100a8e4f602c2235087e8a8e93f610ce12e5e3e6a54103b1dccc56529aab99cc32649af<br>
EAP-Message =
0x88b6fb15bdb71452ca8657933581fd72e30615d551ba01f76475e2809c53ca6c798138de31621f62e3644e3f847199de6a1a00ce71c631e200b4cf2747a9714a7bb778fec35669dd1c63102371576fc66ec5bbdf2c9f4fd956782216a10b16030100ad0d0000a502010200a0003f303d310b3009060355040613026161310a30080603550408130161310a3008060355040a130161310a3008060355040b130161310a30080603550403130161005d305b310a3008060355040a130161310a3008060355040b1301613110300e06092a864886f70d010901160161310a30080603550407130161310a30080603550408130161310b3009060355040613<br>
EAP-Message = 0x026161310a300806035504031301610e000000<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0xba89e950b98de454eff4b9964b6ca194<br>
Tue Nov 20 16:48:05 2012 : Info: Finished request 8.<br>
Tue Nov 20 16:48:05 2012 : Debug: Going to the next request<br>
Tue Nov 20 16:48:05 2012 : Debug: Waking up in 0.5 seconds.<br>
rad_recv: Access-Request packet from host 10.0.0.70 port 2050,
id=9, length=1287<br>
User-Name = "testuser"<br>
NAS-IP-Address = 127.0.0.1<br>
NAS-Port = 0<br>
Called-Station-Id = "68-7F-74-64-0A-AA:linksys"<br>
Calling-Station-Id = "00-23-A7-3B-29-2C"<br>
Framed-MTU = 1400<br>
NAS-Port-Type = Wireless-802.11<br>
Connect-Info = "CONNECT 0Mbps 802.11"<br>
EAP-Message =
0x0204045f0d0016030103030b0002ff0002fc0002f9308202f53082025ea003020102020900958dbc5fc22a1e39300d06092a864886f70d0101040500305b310a3008060355040a130161310a3008060355040b1301613110300e06092a864886f70d010901160161310a30080603550407130161310a30080603550408130161310b3009060355040613026161310a30080603550403130161301e170d3132313132303037323635345a170d3133313132303037323635345a305b310a3008060355040a130161310a3008060355040b1301613110300e06092a864886f70d010901160161310a30080603550407130161310a30080603550408130161<br>
EAP-Message =
0x310b3009060355040613026161310a3008060355040313016130819f300d06092a864886f70d010101050003818d0030818902818100c540ed9194e10dff976f8c5633f0a189b4fd92029fd865cb7d955134b15f837c2000b6a3637d3305d93c9bc78808b351d4639c51f4b4a4e10210fd9bb5b598af417e2eda12167a653844b7b84429ae3b60908553113a9c654ee2e4df1357c096e731713d5737f82a374c3ca853596e44504f907fea3920d343ca7904e7fef8190203010001a381c03081bd300c0603551d13040530030101ff301d0603551d0e04160414b3807b965fdd9f8fee8fca751d47bf2aebac11fd30818d0603551d2304818530818280<br>
EAP-Message =
0x14b3807b965fdd9f8fee8fca751d47bf2aebac11fda15fa45d305b310a3008060355040a130161310a3008060355040b1301613110300e06092a864886f70d010901160161310a30080603550407130161310a30080603550408130161310b3009060355040613026161310a30080603550403130161820900958dbc5fc22a1e39300d06092a864886f70d010104050003818100a8e4f602c2235087e8a8e93f610ce12e5e3e6a54103b1dccc56529aab99cc32649af88b6fb15bdb71452ca8657933581fd72e30615d551ba01f76475e2809c53ca6c798138de31621f62e3644e3f847199de6a1a00ce71c631e200b4cf2747a9714a7bb778fec35669<br>
EAP-Message =
0xdd1c63102371576fc66ec5bbdf2c9f4fd956782216a10b16030100861000008200808f6734075327889217defd03c1462e4298d446341f95825d3d31df536c87ed3aa4959c0e34841d5e733c27c4b106529a8c6dc2f0ae48b83d1c83c2bc57731bd41a0716eac597d5b6e7143ca8e7b1036c3d7d84463a80c575b3a37ad37053a389a8f30a94a395105a62b18ac8f263fbe48f8e050533c1f77fa8e2467c25a606e216030100860f00008200803d2ea04829dfd6dccbec15de9fdcae6f0fffb862e69a110d172eda2d8c69baaf4e4b9627f4c88abd8875e7d54b0eb8d66f597f290d1bf381c1ca0a2a7e8fb430a74fcaf0dae9b23537a41d1ab9bff2fb<br>
EAP-Message =
0x1849da1f7906027ca97729405b53eda8680767a719962059a67cd451dc8f1bd30d4cec89234ea9c408d13fb4c2c0c6bc1403010001011603010030b8b9b7a2f1fcb703eca33336508b26fa17344530ab8cc6f48edbf0210a6ddad56fcc0d9b9e7ebed01f532216f6dda1e7<br>
State = 0xba89e950b98de454eff4b9964b6ca194<br>
Message-Authenticator = 0x07338a39dd069d06794136bf8f63b62f<br>
Tue Nov 20 16:48:05 2012 : Info: # Executing section authorize
from file /usr/local/etc/raddb/radiusd.conf<br>
Tue Nov 20 16:48:05 2012 : Info: +- entering group authorize {...}<br>
Tue Nov 20 16:48:05 2012 : Info: ++[preprocess] returns ok<br>
Tue Nov 20 16:48:05 2012 : Info: ++[chap] returns noop<br>
Tue Nov 20 16:48:05 2012 : Info: ++[mschap] returns noop<br>
Tue Nov 20 16:48:05 2012 : Info: [suffix] No '@' in User-Name =
"testuser", looking up realm NULL<br>
Tue Nov 20 16:48:05 2012 : Info: [suffix] No such realm "NULL"<br>
Tue Nov 20 16:48:05 2012 : Info: ++[suffix] returns noop<br>
Tue Nov 20 16:48:05 2012 : Info: [eap] EAP packet type response id
4 length 253<br>
Tue Nov 20 16:48:05 2012 : Info: [eap] No EAP Start, assuming it's
an on-going EAP conversation<br>
Tue Nov 20 16:48:05 2012 : Info: ++[eap] returns updated<br>
Tue Nov 20 16:48:05 2012 : Info: [files] users: Matched entry
testuser at line 131<br>
Tue Nov 20 16:48:05 2012 : Info: ++[files] returns ok<br>
Tue Nov 20 16:48:05 2012 : Info: Found Auth-Type = EAP<br>
Tue Nov 20 16:48:05 2012 : Info: # Executing group from file
/usr/local/etc/raddb/radiusd.conf<br>
Tue Nov 20 16:48:05 2012 : Info: +- entering group authenticate
{...}<br>
Tue Nov 20 16:48:05 2012 : Info: [eap] Request found, released
from the list<br>
Tue Nov 20 16:48:05 2012 : Info: [eap] EAP/tls<br>
Tue Nov 20 16:48:05 2012 : Info: [eap] processing type tls<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] Authenticate<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] processing EAP-TLS<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] eaptls_verify returned 7 <br>
Tue Nov 20 16:48:05 2012 : Info: [tls] Done initial handshake<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] <<< TLS 1.0
Handshake [length 0303], Certificate <br>
Tue Nov 20 16:48:05 2012 : Info: [tls] chain-depth=0, <br>
Tue Nov 20 16:48:05 2012 : Info: [tls] error=0<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] --> User-Name = testuser<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] --> BUF-Name = a<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] --> subject =
/O=a/OU=a/emailAddress=a/L=a/ST=a/C=aa/CN=a<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] --> issuer =
/O=a/OU=a/emailAddress=a/L=a/ST=a/C=aa/CN=a<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] --> verify return:1<br>
<i><b>Tue Nov 20 16:48:05 2012 : Info: [tls] TLS_accept: SSLv3
read client certificate A<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] <<< TLS 1.0
Handshake [length 0086], ClientKeyExchange <br>
Tue Nov 20 16:48:05 2012 : Info: [tls] TLS_accept: SSLv3
read client key exchange A<br>
Tue Nov 20 16:48:05 2012 : Info: [tls] <<< TLS 1.0
Handshake [length 0086], CertificateVerify <br>
Tue Nov 20 16:48:05 2012 : Info: [tls] >>> TLS 1.0
Alert [length 0002], fatal decrypt_error <br>
Tue Nov 20 16:48:05 2012 : Error: TLS Alert
write:fatal:decrypt error<br>
Tue Nov 20 16:48:05 2012 : Error: TLS_accept: failed in
SSLv3 read certificate verify B<br>
Tue Nov 20 16:48:05 2012 : Error: rlm_eap: SSL error
error:0407006A:rsa
routines:RSA_padding_check_PKCS1_type_1:block type is not 01<br>
Tue Nov 20 16:48:05 2012 : Error: SSL: SSL_read failed inside
of TLS (-1), TLS session fails.<br>
Tue Nov 20 16:48:05 2012 : Debug: TLS receive handshake failed
during operation<br>
</b></i>Tue Nov 20 16:48:05 2012 : Info: [tls] eaptls_process
returned 4 <br>
Tue Nov 20 16:48:05 2012 : Info: [eap] Handler failed in EAP/tls<br>
Tue Nov 20 16:48:05 2012 : Info: [eap] Failed in EAP select<br>
Tue Nov 20 16:48:05 2012 : Info: ++[eap] returns invalid<br>
Tue Nov 20 16:48:05 2012 : Info: Failed to authenticate the user.<br>
Tue Nov 20 16:48:05 2012 : Info: Delaying reject of request 9 for
1 seconds<br>
Tue Nov 20 16:48:05 2012 : Debug: Going to the next request<br>
Tue Nov 20 16:48:05 2012 : Debug: Waking up in 0.3 seconds.<br>
Tue Nov 20 16:48:05 2012 : Info: Cleaning up request 4 ID 4 with
timestamp +1948<br>
Tue Nov 20 16:48:05 2012 : Debug: Waking up in 0.6 seconds.<br>
Tue Nov 20 16:48:06 2012 : Info: Sending delayed reject for
request 9<br>
Sending Access-Reject of id 9 to 10.0.0.70 port 2050<br>
EAP-Message = 0x04040004<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
Tue Nov 20 16:48:06 2012 : Debug: Waking up in 3.7 seconds.<br>
Tue Nov 20 16:48:10 2012 : Info: Cleaning up request 5 ID 5 with
timestamp +1954<br>
<br>
<br>
<br>
I created certificates with the following commands:<br>
--------------------------------------------------------------------<br>
<br>
/* CA root */<br>
<b><i>openssl req -new -x509 -extensions v3_ca -keyout
private/cakey.pem -out cacert.pem -days 365 -config
./openssl.cnf<br>
</i></b><br>
/* Certificates Request */<br>
<i><b>openssl req -new -nodes -out redpine-req.pem -keyout
private/redpine-key.pem -days 365 -config ./openssl.cnf<br>
</b></i><br>
/* Signing the certificates with ca root certificate generated in
section CA root */<br>
<i><b>openssl ca -out redpine-cert.pem -days 365 -config
./openssl.cnf -infiles redpine-req.pem<br>
</b></i><br>
<i>Concatenating all certificates:<br>
<b><br>
cat redpine-key.pem redpine-cert.pem cacert.pem > imx53.pem<br>
<br>
<br>
</b></i>Thanks & Regards,<br>
Swaraj <br>
<i><b><br>
<br>
</b></i><br>
<br>
<br>
<br>
<br>
<br>
</div>
</body>
</html>