October 2005 - Freeradius-Users - lists.freeradius.org

Not-really-a-bug issue with rlm_unix and maybe other modules
by Martin.Ward＠uk.neceur.com 17 Oct '05

17 Oct '05

Hi, I had a problem with the Radius server where I was using the rlm_unix module to authenticate users against the passwd and shadow files, but even when the correct login and password was being used the user was not being authenticated. There was nothing reported in the log files at all apart from "Authentication refused". After much digging around and scrabbling through the source code I eventually found out that the permissions on the /etc/shadow file were incorrect. The permissions were 0400 with a group ownership of "sys" instead of being 0440 with a group ownership of "shadow" (or any other group of which the freerad user was a member), Changing the permissions and group membership fixed the problem. To make other people's lives easier I would like to request an update to the rlm_unix module to report a permissions error, or simply to report the output of strerror() to the log file, when such file errors occur. In the rlm_unix source file files are opened using the code: function_name(function defs) { FILE *file = fopen(fname, "ro"); struct passwd *pwd = NULL; if(file == NULL) return NULL; ... I would suggest replacing the last line above with: if(file == NULL) {radlog(L_ERR, strerror(errno)); return NULL; } or whatever equivalent is required. I don't know about the portability of the strerror() function though, nor of all the details required when calling the radlog function. |\/|artin -- Senior Network Administrator, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356 ***************************************************************** IMPORTANT: The information contained in this e-mail and attachment (if any) is intended for the person to whom it is addressed and may contain confidential and/or privileged information. The contents of this message may contain personal views which are not the views of NEC Europe Ltd or its subsidiaries, unless specifically stated. You should not copy, retain, forward or disclose its contents to anyone else, or take any action based upon it, if it is not addressed to you personally. If you have received this e-mail in error please contact the sender immediately. Any legally binding agreement resulting from its content must be made separately in a printed medium. *****************************************************************

2 1

unsubscribe
by Dudley Atkinson 17 Oct '05

17 Oct '05

Unsubscribe > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of freeradius-users-request(a)lists.freeradius.org > Sent: Monday, October 17, 2005 5:11 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 6, Issue 58 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more > specific than "Re: Contents of Freeradius-Users digest..." >

1 0

How to authenticate 3com switch and cisco switch at the same time.
by 陈锐 17 Oct '05

17 Oct '05

hello, I am a newbie of freeradius. these days, we are planning to implement radius server for aaa. Our NAS devices are 3com SuperStack 4400/4900 and cisco 2950/3725/1721. we encounter a problem. I have been installed freeradius on debian successfully. We have four guys to administrative our network device they are aaa,bbb,ccc,ddd. first of all, aaa and bbb are admin, ccc and ddd are helpdesk. admin should be granted the read/write privilege of the net device helpdesk should only be granted the read privilege. I divided them into four group within linux system. 3com_admin, 3com_monitor, cisco_admin, cisco_monitor aaa and bbb belongs to 3com_admin and cisco_admin ccc and ddd belongs to 3com_monitor and cisco_monitor the /etc/freeradius/users config: DEFAULT Group == "3com_admin", Auth-Type := System Login-Service = Telnet, 3Com-User-Access-Level = 3, DEFAULT Group == "3com_monitor", Auth-Type := System Login-Service = Telnet, 3Com-User-Access-Level = 1, this config work fine for me. and now, I added another two groups, so the /etc/freeradius/users look like this: DEFAULT Group == "cisco_admin", Auth-Type := System Login-Service = Telnet, Service-Type = Administrative-User, Cisco-AVPair = "shell:priv-lvl=15" DEFAULT Group == "cisco_monitor", Auth-Type :=System Login-Service = Telnet, Service-Type = Administrative-User, Cisco-AVPair = "shell:priv-lvl=5" DEFAULT Group == "3com_admin", Auth-Type := System Login-Service = Telnet, 3Com-User-Access-Level = 3 DEFAULT Group == "3com_monitor", Auth-Type := System Login-Service = Telnet, 3Com-User-Access-Level = 1 The problem occured. When I login cisco switch with "aaa", it works, but when I use "aaa" to login 3com's switch, it failed. because of the reply message were come from the first DEFAULT segment attributes. that is: Sending Access-Accept of id 22 to 192.168.100.20:2049 Login-Service = Telnet Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=15" so, 3com switch can not parse the cisco-avpair, then failed. the following is freeradius -X ..... radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.100.20:2049, id=22, length=87 User-Name = "aaa" User-Password = "aaa" NAS-Port-Type = Virtual NAS-IP-Address = 192.168.100.20 Service-Type = Administrative-User Framed-MTU = 1024 Message-Authenticator = 0xe52d4010d86eb2cb0f00fefaa251006c rad_rmspace_pair: User-Password now 'aaa' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 75 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns ok for request 0 modcall: group authenticate returns ok for request 0 Sending Access-Accept of id 22 to 192.168.100.20:2049 Login-Service = Telnet Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=15" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 7 seconds... ..... any suggestion will be welcome. thanks in advance.

1 0

Logging - auth failure reason
by james 17 Oct '05

17 Oct '05

I'm having trouble with logging: I am trying to expose the reason authentication failed to a script called via mod_exec I tried using Module-Failure-Message but it appears to be blank, even though running -X shows what I am trying to get out. i'm using radiusd version 1.0.5 from source. Thanks for your help, James

1 0

radwho
by Madhvi Gokool 17 Oct '05

17 Oct '05

Hello When first testing the freeradius server, radwho still showed users as connected when infact they had disconnected. radwho with no users dialled in is as follows :- terrabackup# radwho Login Name What TTY When From Location jumbort jumbort PPP S16 Mon 18:51 10.5.0.10 10.5.5.4 steve steve PPP S242 Tue 16:38 10.5.0.2 10.5.1.37 I managed to have the server up and running properly but the above entries are causing problems when I restrict Simultaneous use for user steve. What should I do to remove those entries.? Kind Regards Madhvi

2 2

Simultaneous-Use check MySQL
by David M. 17 Oct '05

17 Oct '05

Hi, I'm experiencing problems with Simultaneous-Use and MySQL. Due I have two freeradius servers, I cannot use for accounting radutmp because if a radius gets a stop packet and the start one went to the other radius the driver fails, so all accounting is based on MySQL. The MySQL queries that the radius perform are the followings (using standard sql.conf file with simul_count_query uncommented, the file is attached) 1- authorize_check_query (gets the Simultaneous-Use := 1) 2- authorize_group_check_query 3- authorize_reply_query 4- authorize_group_reply_query 5- simul_count_query 6- postauth_query 7- accounting_start_query 8- accounting_update_query (updates the radacct table with the IP address from the pool) If I try to connect with the same user and the previous conection still established, this is the sequence of queries: 1- authorize_check_query 2- authorize_group_check_query 3- authorize_reply_query 4- authorize_group_reply_query 5- simul_count_query **returns 1** 6- simul_verify_query 7- accounting stop query **performs a stop in the previously established session** 8- postauth_query 9- accounting_start_query 10- accounting_update_query (updates the radacct table with the IP address from the pool) I think either simul_verify_query is wrong or there is something wrong with sql.conf. I've attached it. If I change Simultaneous-Use := 0 the user cannot connect as I should behave and the logs reports "Auth: Multiple logins (max 0)" Freeradius and freeradius-mysql are etch/testing packages Debian official packages (version 1.0.4-2) Any help would be appreciated, thanks in advance -- David

3 5

Wireless Provisioning Service Protocol
by King, Michael 17 Oct '05

17 Oct '05

Has any thought been given on adding the WPS (Wireless Provisioning Service) Protocol to FreeRADIUS? http://msdn.microsoft.com/library/default.asp?url=/library/en-us/randz/p rotocol/portal_wireless_provisioning_service_protocol.asp It sounds really cool in theory. From: http://www.microsoft.com/downloads/details.aspx?FamilyId=9ADF7496-0D50-4 138-848E-9BC810B83C01&displaylang=en With WPS technology, new and existing customers can connect to your Wi-Fi network without manual configuration of the computer or network connection.

6 9

Still problems with cert authentication XP
by Thuis Algemeen 16 Oct '05

16 Oct '05

Hi everybody, Ik still have a problem with validating the server certificate. See the RASTLS log below: ---------------------------- [1280] 17:19:40:078: EapTlsInvokeIdentityUI [1280] 17:19:40:078: GetCertInfo [1280] 17:19:40:156: FCheckSCardCertAndCanOpenSilentContext [1280] 17:19:40:156: FGetEKUUsage [1280] 17:19:40:156: Acquiring Context for Container Name: {226FADA0-66DE-4423-BFBF-448D710E1BF2}, ProvName: Microsoft Base Cryptographic Provider v1.0, ProvType 0x1 [1280] 17:19:40:156: FCheckTimeValidity [1280] 17:19:40:156: Add Selected Cert to List [1280] 17:19:40:156: FCheckSCardCertAndCanOpenSilentContext [1280] 17:19:40:156: FGetEKUUsage [1280] 17:19:40:156: Acquiring Context for Container Name: {F4FC41A8-ECDF-4B9A-A613-A457D74DDFF8}, ProvName: Microsoft Enhanced Cryptographic Provider v1.0, ProvType 0x1 [1280] 17:19:40:156: FCheckTimeValidity [1280] 17:19:40:171: Add Selected Cert to List [1280] 17:19:40:171: GroupCertificates [1280] 17:19:46:750: [1280] 17:19:46:750: EapTlsBegin(Jurgen Tessers) [1280] 17:19:46:750: State change to Initial [1280] 17:19:46:750: EapTlsBegin: Detected 8021X authentication [1280] 17:19:46:750: MaxTLSMessageLength is now 16384 [1280] 17:19:46:750: [1280] 17:19:46:750: EapTlsMakeMessage(jurgen tessers) [1280] 17:19:46:750: >> Received Request (Code: 1) packet: Id: 1, Length: 6, Type: 13, TLS blob length: 0. Flags: S [1280] 17:19:46:750: EapTlsCMakeMessage [1280] 17:19:46:750: EapTlsReset [1280] 17:19:46:750: State change to Initial [1280] 17:19:46:750: GetCredentials [1280] 17:19:46:750: Flag is Client and Store is Current User [1280] 17:19:46:750: GetCachedCredentials [1280] 17:19:46:750: FreeCachedCredentials [1280] 17:19:46:750: AssociatePinWithCertificate [1280] 17:19:46:750: The name in the certificate is: Jurgen Tessers [1280] 17:19:46:750: Will validate server cert [1280] 17:19:46:796: MakeReplyMessage [1280] 17:19:46:796: SecurityContextFunction [1280] 17:19:46:796: InitializeSecurityContext returned 0x90312 [1280] 17:19:46:796: State change to SentHello [1280] 17:19:46:796: BuildPacket [1280] 17:19:46:796: << Sending Response (Code: 2) packet: Id: 1, Length: 80, Type: 13, TLS blob length: 70. Flags: L [2408] 17:19:46:812: [2408] 17:19:46:812: EapTlsMakeMessage(jurgen tessers) [2408] 17:19:46:812: >> Received Request (Code: 1) packet: Id: 2, Length: 1030, Type: 13, TLS blob length: 1020. Flags: L [2408] 17:19:46:812: EapTlsCMakeMessage [2408] 17:19:46:812: MakeReplyMessage [2408] 17:19:46:812: Reallocating input TLS blob buffer [2408] 17:19:46:812: SecurityContextFunction [2408] 17:19:46:968: InitializeSecurityContext returned 0x80096004 [2408] 17:19:46:968: State change to RecdFinished. Error: 0x80096004 [2408] 17:19:46:968: BuildPacket [2408] 17:19:46:968: << Sending Response (Code: 2) packet: Id: 2, Length: 6, Type: 13, TLS blob length: 0. Flags: [2408] 17:19:46:968: [2408] 17:19:46:968: EapTlsMakeMessage(jurgen tessers) [2408] 17:19:46:968: >> Received Request (Code: 1) packet: Id: 3, Length: 10, Type: 13, TLS blob length: 0. Flags: L [2408] 17:19:46:968: EapTlsCMakeMessage [2408] 17:19:46:968: Unexpected code: 1 in state RecdFinished [3744] 17:20:17:015: EapTlsEnd [3744] 17:20:17:015: EapTlsEnd(jurgen tessers) [3744] 17:20:17:015: Auth failed so freeing cached creds. [3744] 17:20:17:015: FreeCachedCredentials [3744] 17:20:17:015: [3744] 17:20:17:015: EapTlsBegin(Jurgen Tessers) [3744] 17:20:17:015: State change to Initial [3744] 17:20:17:015: EapTlsBegin: Detected 8021X authentication [3744] 17:20:17:015: MaxTLSMessageLength is now 16384 [3744] 17:20:17:015: [3744] 17:20:17:015: EapTlsMakeMessage(jurgen tessers) [3744] 17:20:17:015: >> Received Request (Code: 1) packet: Id: 2, Length: 6, Type: 13, TLS blob length: 0. Flags: S [3744] 17:20:17:015: EapTlsCMakeMessage [3744] 17:20:17:015: EapTlsReset [3744] 17:20:17:015: State change to Initial [3744] 17:20:17:015: GetCredentials [3744] 17:20:17:015: Flag is Client and Store is Current User [3744] 17:20:17:015: GetCachedCredentials [3744] 17:20:17:015: FreeCachedCredentials [3744] 17:20:17:015: AssociatePinWithCertificate [3744] 17:20:17:031: The name in the certificate is: Jurgen Tessers [3744] 17:20:17:031: Will validate server cert [3744] 17:20:17:031: MakeReplyMessage [3744] 17:20:17:031: SecurityContextFunction [3744] 17:20:17:031: InitializeSecurityContext returned 0x90312 [3744] 17:20:17:031: State change to SentHello [3744] 17:20:17:031: BuildPacket [3744] 17:20:17:031: << Sending Response (Code: 2) packet: Id: 2, Length: 80, Type: 13, TLS blob length: 70. Flags: L [1904] 17:20:17:046: [1904] 17:20:17:046: EapTlsMakeMessage(jurgen tessers) [1904] 17:20:17:046: >> Received Request (Code: 1) packet: Id: 3, Length: 1030, Type: 13, TLS blob length: 1020. Flags: L [1904] 17:20:17:046: EapTlsCMakeMessage [1904] 17:20:17:046: MakeReplyMessage [1904] 17:20:17:046: Reallocating input TLS blob buffer [1904] 17:20:17:046: SecurityContextFunction [1904] 17:20:17:062: InitializeSecurityContext returned 0x80096004 [1904] 17:20:17:062: State change to RecdFinished. Error: 0x80096004 [1904] 17:20:17:062: BuildPacket [1904] 17:20:17:062: << Sending Response (Code: 2) packet: Id: 3, Length: 6, Type: 13, TLS blob length: 0. Flags: [1904] 17:20:17:062: [1904] 17:20:17:062: EapTlsMakeMessage(jurgen tessers) [1904] 17:20:17:062: >> Received Request (Code: 1) packet: Id: 4, Length: 10, Type: 13, TLS blob length: 0. Flags: L [1904] 17:20:17:062: EapTlsCMakeMessage [1904] 17:20:17:062: Unexpected code: 1 in state RecdFinished [1904] 17:20:47:171: EapTlsEnd [1904] 17:20:47:171: EapTlsEnd(jurgen tessers) [1904] 17:20:47:171: Auth failed so freeing cached creds. [1904] 17:20:47:171: FreeCachedCredentials [1904] 17:20:47:171: [1904] 17:20:47:171: EapTlsBegin(Jurgen Tessers) [1904] 17:20:47:171: State change to Initial [1904] 17:20:47:171: EapTlsBegin: Detected 8021X authentication [1904] 17:20:47:171: MaxTLSMessageLength is now 16384 [1904] 17:20:47:171: [1904] 17:20:47:171: EapTlsMakeMessage(jurgen tessers) [1904] 17:20:47:171: >> Received Request (Code: 1) packet: Id: 2, Length: 6, Type: 13, TLS blob length: 0. Flags: S [1904] 17:20:47:171: EapTlsCMakeMessage [1904] 17:20:47:171: EapTlsReset [1904] 17:20:47:171: State change to Initial [1904] 17:20:47:171: GetCredentials [1904] 17:20:47:171: Flag is Client and Store is Current User [1904] 17:20:47:171: GetCachedCredentials [1904] 17:20:47:171: FreeCachedCredentials [1904] 17:20:47:187: AssociatePinWithCertificate [1904] 17:20:47:187: The name in the certificate is: Jurgen Tessers [1904] 17:20:47:187: Will validate server cert [1904] 17:20:47:187: MakeReplyMessage [1904] 17:20:47:187: SecurityContextFunction [1904] 17:20:47:187: InitializeSecurityContext returned 0x90312 [1904] 17:20:47:187: State change to SentHello [1904] 17:20:47:187: BuildPacket [1904] 17:20:47:187: << Sending Response (Code: 2) packet: Id: 2, Length: 80, Type: 13, TLS blob length: 70. Flags: L [1904] 17:20:47:203: [1904] 17:20:47:203: EapTlsMakeMessage(jurgen tessers) [1904] 17:20:47:203: >> Received Request (Code: 1) packet: Id: 3, Length: 1030, Type: 13, TLS blob length: 1020. Flags: L [1904] 17:20:47:203: EapTlsCMakeMessage [1904] 17:20:47:203: MakeReplyMessage [1904] 17:20:47:203: Reallocating input TLS blob buffer [1904] 17:20:47:203: SecurityContextFunction [1904] 17:20:47:203: InitializeSecurityContext returned 0x80096004 [1904] 17:20:47:203: State change to RecdFinished. Error: 0x80096004 [1904] 17:20:47:203: BuildPacket [1904] 17:20:47:203: << Sending Response (Code: 2) packet: Id: 3, Length: 6, Type: 13, TLS blob length: 0. Flags: [1904] 17:20:47:218: [1904] 17:20:47:218: EapTlsMakeMessage(jurgen tessers) [1904] 17:20:47:218: >> Received Request (Code: 1) packet: Id: 4, Length: 10, Type: 13, TLS blob length: 0. Flags: L [1904] 17:20:47:218: EapTlsCMakeMessage [1904] 17:20:47:218: Unexpected code: 1 in state RecdFinished [1904] 17:21:17:375: EapTlsEnd [1904] 17:21:17:375: EapTlsEnd(jurgen tessers) [1904] 17:21:17:375: Auth failed so freeing cached creds. [1904] 17:21:17:375: FreeCachedCredentials [1904] 17:21:17:375: [1904] 17:21:17:375: EapTlsBegin(Jurgen Tessers) [1904] 17:21:17:375: State change to Initial [1904] 17:21:17:375: EapTlsBegin: Detected 8021X authentication [1904] 17:21:17:375: MaxTLSMessageLength is now 16384 [1904] 17:21:17:375: [1904] 17:21:17:375: EapTlsMakeMessage(jurgen tessers) [1904] 17:21:17:375: >> Received Request (Code: 1) packet: Id: 2, Length: 6, Type: 13, TLS blob length: 0. Flags: S [1904] 17:21:17:375: EapTlsCMakeMessage [1904] 17:21:17:375: EapTlsReset [1904] 17:21:17:375: State change to Initial [1904] 17:21:17:375: GetCredentials [1904] 17:21:17:375: Flag is Client and Store is Current User [1904] 17:21:17:375: GetCachedCredentials [1904] 17:21:17:375: FreeCachedCredentials [1904] 17:21:17:390: AssociatePinWithCertificate [1904] 17:21:17:390: The name in the certificate is: Jurgen Tessers [1904] 17:21:17:390: Will validate server cert [1904] 17:21:17:390: MakeReplyMessage [1904] 17:21:17:390: SecurityContextFunction [1904] 17:21:17:390: InitializeSecurityContext returned 0x90312 [1904] 17:21:17:390: State change to SentHello [1904] 17:21:17:390: BuildPacket [1904] 17:21:17:390: << Sending Response (Code: 2) packet: Id: 2, Length: 80, Type: 13, TLS blob length: 70. Flags: L [1904] 17:21:17:406: [1904] 17:21:17:406: EapTlsMakeMessage(jurgen tessers) [1904] 17:21:17:406: >> Received Request (Code: 1) packet: Id: 3, Length: 1030, Type: 13, TLS blob length: 1020. Flags: L [1904] 17:21:17:406: EapTlsCMakeMessage [1904] 17:21:17:406: MakeReplyMessage [1904] 17:21:17:406: Reallocating input TLS blob buffer [1904] 17:21:17:406: SecurityContextFunction [1904] 17:21:17:406: InitializeSecurityContext returned 0x80096004 [1904] 17:21:17:406: State change to RecdFinished. Error: 0x80096004 [1904] 17:21:17:406: BuildPacket [1904] 17:21:17:406: << Sending Response (Code: 2) packet: Id: 3, Length: 6, Type: 13, TLS blob length: 0. Flags: [1904] 17:21:17:421: [1904] 17:21:17:421: EapTlsMakeMessage(jurgen tessers) [1904] 17:21:17:421: >> Received Request (Code: 1) packet: Id: 4, Length: 10, Type: 13, TLS blob length: 0. Flags: L [1904] 17:21:17:421: EapTlsCMakeMessage [1904] 17:21:17:421: Unexpected code: 1 in state RecdFinished [1904] 17:21:47:546: EapTlsEnd [1904] 17:21:47:546: EapTlsEnd(jurgen tessers) [1904] 17:21:47:546: Auth failed so freeing cached creds. [1904] 17:21:47:546: FreeCachedCredentials [1904] 17:21:47:546: [1904] 17:21:47:546: EapTlsBegin(Jurgen Tessers) [1904] 17:21:47:546: State change to Initial [1904] 17:21:47:546: EapTlsBegin: Detected 8021X authentication [1904] 17:21:47:546: MaxTLSMessageLength is now 16384 [1904] 17:21:47:546: [1904] 17:21:47:546: EapTlsMakeMessage(jurgen tessers) [1904] 17:21:47:546: >> Received Request (Code: 1) packet: Id: 2, Length: 6, Type: 13, TLS blob length: 0. Flags: S [1904] 17:21:47:546: EapTlsCMakeMessage [1904] 17:21:47:546: EapTlsReset [1904] 17:21:47:546: State change to Initial [1904] 17:21:47:546: GetCredentials [1904] 17:21:47:546: Flag is Client and Store is Current User [1904] 17:21:47:546: GetCachedCredentials [1904] 17:21:47:546: FreeCachedCredentials [1904] 17:21:47:562: AssociatePinWithCertificate [1904] 17:21:47:562: The name in the certificate is: Jurgen Tessers [1904] 17:21:47:562: Will validate server cert [1904] 17:21:47:562: MakeReplyMessage [1904] 17:21:47:562: SecurityContextFunction [1904] 17:21:47:562: InitializeSecurityContext returned 0x90312 [1904] 17:21:47:562: State change to SentHello [1904] 17:21:47:562: BuildPacket [1904] 17:21:47:562: << Sending Response (Code: 2) packet: Id: 2, Length: 80, Type: 13, TLS blob length: 70. Flags: L [1904] 17:21:47:578: [1904] 17:21:47:578: EapTlsMakeMessage(jurgen tessers) [1904] 17:21:47:578: >> Received Request (Code: 1) packet: Id: 3, Length: 1030, Type: 13, TLS blob length: 1020. Flags: L [1904] 17:21:47:578: EapTlsCMakeMessage [1904] 17:21:47:578: MakeReplyMessage [1904] 17:21:47:578: Reallocating input TLS blob buffer [1904] 17:21:47:578: SecurityContextFunction [1904] 17:21:47:578: InitializeSecurityContext returned 0x80096004 [1904] 17:21:47:578: State change to RecdFinished. Error: 0x80096004 [1904] 17:21:47:578: BuildPacket [1904] 17:21:47:578: << Sending Response (Code: 2) packet: Id: 3, Length: 6, Type: 13, TLS blob length: 0. Flags: [1904] 17:21:47:593: [1904] 17:21:47:593: EapTlsMakeMessage(jurgen tessers) [1904] 17:21:47:593: >> Received Request (Code: 1) packet: Id: 4, Length: 10, Type: 13, TLS blob length: 0. Flags: L [1904] 17:21:47:593: EapTlsCMakeMessage [1904] 17:21:47:593: Unexpected code: 1 in state RecdFinished [1904] 17:22:17:593: EapTlsEnd [1904] 17:22:17:593: EapTlsEnd(jurgen tessers) [1904] 17:22:17:593: Auth failed so freeing cached creds. [1904] 17:22:17:593: FreeCachedCredentials [1904] 17:22:17:593: [1904] 17:22:17:593: EapTlsBegin(Jurgen Tessers) [1904] 17:22:17:593: State change to Initial [1904] 17:22:17:593: EapTlsBegin: Detected 8021X authentication [1904] 17:22:17:593: MaxTLSMessageLength is now 16384 [1904] 17:22:17:593: [1904] 17:22:17:593: EapTlsMakeMessage(jurgen tessers) [1904] 17:22:17:593: >> Received Request (Code: 1) packet: Id: 2, Length: 6, Type: 13, TLS blob length: 0. Flags: S [1904] 17:22:17:593: EapTlsCMakeMessage [1904] 17:22:17:593: EapTlsReset [1904] 17:22:17:593: State change to Initial [1904] 17:22:17:593: GetCredentials [1904] 17:22:17:593: Flag is Client and Store is Current User [1904] 17:22:17:593: GetCachedCredentials [1904] 17:22:17:593: FreeCachedCredentials [1904] 17:22:17:609: AssociatePinWithCertificate [1904] 17:22:17:609: The name in the certificate is: Jurgen Tessers [1904] 17:22:17:609: Will validate server cert [1904] 17:22:17:609: MakeReplyMessage [1904] 17:22:17:609: SecurityContextFunction [1904] 17:22:17:609: InitializeSecurityContext returned 0x90312 [1904] 17:22:17:609: State change to SentHello [1904] 17:22:17:609: BuildPacket [1904] 17:22:17:609: << Sending Response (Code: 2) packet: Id: 2, Length: 80, Type: 13, TLS blob length: 70. Flags: L [1904] 17:22:17:625: [1904] 17:22:17:625: EapTlsMakeMessage(jurgen tessers) [1904] 17:22:17:625: >> Received Request (Code: 1) packet: Id: 3, Length: 1030, Type: 13, TLS blob length: 1020. Flags: L [1904] 17:22:17:625: EapTlsCMakeMessage [1904] 17:22:17:625: MakeReplyMessage [1904] 17:22:17:625: Reallocating input TLS blob buffer [1904] 17:22:17:625: SecurityContextFunction [1904] 17:22:17:625: InitializeSecurityContext returned 0x80096004 [1904] 17:22:17:625: State change to RecdFinished. Error: 0x80096004 [1904] 17:22:17:625: BuildPacket [1904] 17:22:17:625: << Sending Response (Code: 2) packet: Id: 3, Length: 6, Type: 13, TLS blob length: 0. Flags: [1904] 17:22:17:640: [1904] 17:22:17:640: EapTlsMakeMessage(jurgen tessers) [1904] 17:22:17:640: >> Received Request (Code: 1) packet: Id: 4, Length: 10, Type: 13, TLS blob length: 0. Flags: L [1904] 17:22:17:640: EapTlsCMakeMessage [1904] 17:22:17:640: Unexpected code: 1 in state RecdFinished

1 0

Re: undefined reference 'md4_calc' compile error...
by Andrew Teixeira 16 Oct '05

16 Oct '05

I came across error while trying to compile freeradius-1.0.5 today and was looking for a solution. I found a message on the list from September 12 that no one responded to, so I looked into the problem a little further and found a solution (at least for that section of the compile). The problem is in the Makefile for rlm_mschap in that it doesn't include the md4.o object file when it compiles smbencrypt.c. Therefore, I created the following patch to solve this problem: --- src/modules/rlm_mschap/Makefile 2004-06-02 12:17:07.000000000 -0400 +++ src/modules/rlm_mschap/Makefile.new 2005-10-14 10:47:53.000000000 -0400 @@ -14,7 +14,7 @@ $(DYNAMIC_OBJS): $(HEADERS) smbencrypt: smbencrypt.o smbdes.o $(HEADERS) - $(CC) -I../../include $(LDFLAGS) -o smbencrypt smbencrypt.o smbdes.o ..\ /../lib/libradius.a + $(CC) -I../../include $(LDFLAGS) -o smbencrypt smbencrypt.o smbdes.o ..\ /../lib/libradius.a ../../lib/md4.o smbencrypt-install: $(INSTALL) -d -m 755 $(R)$(bindir) I still have some further problems compiling, but this stopped the 'md4_calc' compile error.

2 3

Re: Login incorrect
by Andrea Bencini 16 Oct '05

16 Oct '05

> > In the Colubris I put "andreabencini" password. > > Did you tell the server that was the correct password? > > > Sat Oct 15 17:10:10 2005 : Info: rlm_eap_md5: User-Password is required for > > EAP-MD5 authentication > > Sat Oct 15 17:10:10 2005 : Debug: rlm_eap: Handler failed in EAP/md5 > > Nope. > > Alan DeKok. Alan I don't understand what you are saying. Could you explain to me with more detail? Thank Andrea

2 1