November 2006 - Freeradius-Users - lists.freeradius.org

RE: freeRADIUS on Solaris 10 - x86
by Ramm-Ericson, Johannes 03 Nov '06

03 Nov '06

-----Original Message----- > Date: Thu, 2 Nov 2006 15:24:13 +0100 (CET) > From: "Michael Messner" <michael.messner_edv(a)inode.at> > Subject: freeRADIUS on Solaris 10 - x86 > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <141.201.70.172.1162477453.wm(a)webmail.inode.at> > Content-Type: text/plain; charset=iso-8859-1 > > hey freeRADIUS users, > > next step ... testing freeRADIUS on a Solaris 10 box and I'm completely new to solaris! :-( I've started > with the configure again but there are so much things missing: > > snip... < > > thanks mIke ------------------------------ Hello Mike, Seeing as you are new to Solaris I'd say you can save yourself a lot of time and hard work by re-installing your x86 server with a standard Linux distribution. Even if you've never touched Linux before most distributions will have all the necessary prerequisites installed and if you choose to do so you won't even need to compile freeradius, you can install the vendor-supplied package for freeradius. Of course, YMMV, but I "grew up" with Solaris (and enjoyed it) but these days it's just simply a pain to install many free/open source packages on Solaris. Save yourself the trouble and go with Linux. Seeing as you are from Austria I suspect Suse will be your best option as you will probably find most local support around that distribution. Viele grüsse, Johannes

1 0

Need help setting up FreeRadius using PEAP/MSChapV2
by Graham, Robert 02 Nov '06

02 Nov '06

A year ago I tried to set up 802.1x on our network using PEAP/MSChapV2 without any luck, but wanted to try again so here I am. I followed the document titled, "FreeRADIUS Active Directory Integration HOWTO" on the FreeRadius Wiki site and I am still not able to authenicate against AD. I hope someone out there can provide some assistance and HELP me out. I have included the debug out below. Any help would GREATLY be appreciated... [root@mem-co-radius3 raddb]# /usr/local/sbin/radiusd -XA Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 172.16.1.243:1645, id=166, length=112 User-Name = "MEM\\rgraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.243 NAS-Port = 13 Calling-Station-Id = "00-15-58-32-95-BB" EAP-Message = 0x02010010014d454d5c7267726168616d Message-Authenticator = 0x129b48f31fd82471f30cc7fb9f2b16c0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "MEM\rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 166 to 172.16.1.243 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe5c2ae6e98091f71681bce0ece77b661 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.16.1.243:1645, id=167, length=95 User-Name = "0015583295bb" User-Password = "0015583295bb" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.243 NAS-Port = 13 Calling-Station-Id = "00-15-58-32-95-BB" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "0015583295bb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.16.1.243:1645, id=168, length=236 User-Name = "MEM\\rgraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.243 NAS-Port = 13 Calling-Station-Id = "00-15-58-32-95-BB" State = 0xe5c2ae6e98091f71681bce0ece77b661 EAP-Message = 0x0202007a198000000070160301006b010000670301454aa65119092ed15cac0bf2dd1cfa4ae4ba44f4f6fb75edb0d148540e065a03000018002f00350005000ac009c00ac013c01400320038001300040100002600000010000e00000b6d656d5c7267726168616d000a00080006001700180019000b00020100 Message-Authenticator = 0xd1271dca6c660ae3adf19b38556b5d25 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "MEM\rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 122 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 006b], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0681], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 168 to 172.16.1.243 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103040a19c0000006de160301004a020000460301454aa6514b766eafc2fdf25fd35176661a0d197b10cea78e4064392cb2769bef20e4728653cfbf97ede5bad97ef290087837f33cc737c0304c51f65488dfa815f6002f0016030106810b00067d00067a0002de308202da30820243a003020102020102300d06092a864886f70d0101040500308193310b30090603550406130255533111300f060355040813084d6973736f7572693111300f06035504071308436f6c756d626961312c302a060355040a13234d6973736f75726920456d706c6f79657273204d757475616c20496e737572616e6365310b3009060355040b130249543123302106 EAP-Message = 0x092a864886f70d01090116147365637572697479406d656d2d696e732e636f6d301e170d3036313130323233313034305a170d3037313130323233313034305a3081b8310b30090603550406130255533111300f060355040813084d6973736f7572693111300f06035504071308436f6c756d626961312c302a060355040a13234d6973736f75726920456d706c6f79657273204d757475616c20496e737572616e6365310b3009060355040b13024954312330210603550403131a6d656d2d636f2d726164697573332e6d656d2d696e732e636f6d3123302106092a864886f70d01090116147365637572697479406d656d2d696e732e636f6d3081 EAP-Message = 0x9f300d06092a864886f70d010101050003818d0030818902818100bf04a465438fd6b2b9680b7db35b104621e27cd1cd32f050467ee2b804d113d999e2b8c69b0e6e6f735b6638b6dbf774d1fc7b7cb8256a3038211e650e4e2e029d83f6f649dec345dadb86ba2529f736475a67c106b5d74773abdb8ac1074745e181a4b5fce41fd1f9855cb5356ab1a613dd63903ebd4141877cc6f4176111c90203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181000e18c5fc89fd6bf6829bedd85e5fe53d0424fd79edc87c136e199895f10742c78d3f6a3d39128917d7bc6d3b66e4953016 EAP-Message = 0x0e5216a179547e2d1679c45745a5d2b6833dcd6ab5cae91dd82caa3a5d81cabde7904fb35d62d5c381704cfef893d16f5afd2ab8ecf9ec619033bd833e3a04d659a757355aa76422d22746562d637000039630820392308202fba003020102020100300d06092a864886f70d0101040500308193310b30090603550406130255533111300f060355040813084d6973736f7572693111300f06035504071308436f6c756d626961312c302a060355040a13234d6973736f75726920456d706c6f79657273204d757475616c20496e737572616e6365310b3009060355040b130249543123302106092a864886f70d01090116147365637572697479406d EAP-Message = 0x656d2d696e732e636f6d301e170d3036313130323233 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4722dd921ba28f05b6a3ce4dd0c63ff5 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.16.1.243:1645, id=169, length=120 User-Name = "MEM\\rgraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.243 NAS-Port = 13 Calling-Station-Id = "00-15-58-32-95-BB" State = 0x4722dd921ba28f05b6a3ce4dd0c63ff5 EAP-Message = 0x020300061900 Message-Authenticator = 0x2fe4ba89411ecaaf30d4b0fcc21e009c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "MEM\rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 169 to 172.16.1.243 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010402e41900303933375a170d3038313130313233303933375a308193310b30090603550406130255533111300f060355040813084d6973736f7572693111300f06035504071308436f6c756d626961312c302a060355040a13234d6973736f75726920456d706c6f79657273204d757475616c20496e737572616e6365310b3009060355040b130249543123302106092a864886f70d01090116147365637572697479406d656d2d696e732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100a8dd3475b1809a8cb2c6c94466179b05472486a197db9c387a0c9963f23fda351942db60e5f537c3b76abb8cbd6c2060 EAP-Message = 0xf0de117453969dec0c34d1e98dd26c2aa373780a37f793d1b912d74676b7bf9a33b99ba2299250bfa23c18bec11204512cdc9e438ee4ccb646f643ce57a7075cd0b6950be4b5893dfa0357f3e6f44f7b0203010001a381f33081f0301d0603551d0e04160414692e5a16ee8618311365cdae5af4f78c2f31a4a73081c00603551d230481b83081b58014692e5a16ee8618311365cdae5af4f78c2f31a4a7a18199a48196308193310b30090603550406130255533111300f060355040813084d6973736f7572693111300f06035504071308436f6c756d626961312c302a060355040a13234d6973736f75726920456d706c6f79657273204d75747561 EAP-Message = 0x6c20496e737572616e6365310b3009060355040b130249543123302106092a864886f70d01090116147365637572697479406d656d2d696e732e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810079c9916ca05fde402cf2e85befa2ae87244447523a09a922320183d8694faa74dd7d5addf7164ef96350a24df5da75050a54ea796738036a65be17fcd71521fe61b0f3e69e635f93c24887d88be2fc45c7c4a5dbb9cfb745852c476c7a439ceaf3e1348232bece52c82f453a8ace4319cdc35f41593c22f04acf76515acf898f16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ce86c1c3a38aed8bcb14c9da3a5743f Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.16.1.243:1645, id=170, length=322 User-Name = "MEM\\rgraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.243 NAS-Port = 13 Calling-Station-Id = "00-15-58-32-95-BB" State = 0x8ce86c1c3a38aed8bcb14c9da3a5743f EAP-Message = 0x020400d01980000000c61603010086100000820080b77d0443340fa7e3b42f8318960f944f15a0a73271046b0d214a6c34fb25a701ae2c03fd2c21dd496240b1c8238f72a3a527151715148068e72feb05b580156d320cce3657cd8e5ff327981c1ba0021ce8bb23c94243d18d03c083fef43c2928a2d903ee759cc6b97c8be550b65e5c0cadf681e16f40688363093327061599671403010001011603010030cb59268377c2f35bbb5ed04112bb5d080c903154fe75ba0e9353913f943962405da3b30e5931e143ddb32a0715ce32a3 Message-Authenticator = 0x32568f629d463150d30fcdcb1f4a9221 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "MEM\rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 208 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 170 to 172.16.1.243 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x01050041190014030100010116030100304af5b337b3cda8be50cdfb95d5d40e0d5edf65aaf35d6103df543a82b1df2c90676adf32b1277e7837bce039fd169873 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3fa55aa771536d2480fa32bd3214f790 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.16.1.243:1645, id=171, length=120 User-Name = "MEM\\rgraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.243 NAS-Port = 13 Calling-Station-Id = "00-15-58-32-95-BB" State = 0x3fa55aa771536d2480fa32bd3214f790 EAP-Message = 0x020500061900 Message-Authenticator = 0x5681e2ac70ffdfed2a265d2beeb405de Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "MEM\rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 171 to 172.16.1.243 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0106005019001703010020d08cd78b8085bb7e97b9adbe129e47fa17a094ff284ec4df5b954f625a749c1e1703010020e4aaebed0bf703160bb667600586ff0fdc1a75d6264db7a51ffe165cca8e943d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83dac1e77347d020ee17ac371330f05e Finished request 5 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 166 with timestamp 454aa651 Sending Access-Reject of id 167 to 172.16.1.243 port 1645 Cleaning up request 1 ID 167 with timestamp 454aa651 Cleaning up request 2 ID 168 with timestamp 454aa651 Cleaning up request 3 ID 169 with timestamp 454aa651 Cleaning up request 4 ID 170 with timestamp 454aa651 Cleaning up request 5 ID 171 with timestamp 454aa651 Nothing to do. Sleeping until we see a request.

2 1

LDAP + AD username length
by duckeo 02 Nov '06

02 Nov '06

Is it possible to trim down the length of the username used to query AD with ldap? For names longer than 20 characters I am getting "rlm_ldap: object not found or got ambiguous search result" returned. Thanks

1 0

Dialup authentication says it works, but doesn't.
by Ernie Dunbar 02 Nov '06

02 Nov '06

We have a Cisco AS5300 for our dialup pool. It is able to log into our new FreeRadius server and make authentication requests, but users are not able to authenticate. It's very strange, because FreeRadius produces logs like this: Thu Nov 2 11:06:24 2006 : Auth: Login OK: [XXXXXX/XXXXXX] (from client dialup port 8) But the client gets "Error 691: Your username or password are incorrect". I can tell that it's authenticating properly, because when a user gets their password wrong, I see this instead: Thu Nov 2 11:02:20 2006 : Auth: Login incorrect: [user1/somepass] (from client dialup port 13) Thu Nov 2 11:02:20 2006 : Auth: Login incorrect: [user1/somepass] (from client dialup port 13) We're using FreeRadius' mysql support for authentication, and I'm absolutely positive that part is working fine. It even creates accounting data in the database. Something else that might be interesting is what happens when I try to set up a user in /etc/freeradius/users. The relevent stanza in the users file is this: foobar Auth-Type := Local, User-Password == "asdf1234" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Fall-Through = No The logs FreeRadius produces say this: Thu Nov 2 12:09:09 2006 : Auth: Login incorrect (No password configured for the user): [foobar/asdf1234] (from client dialup port 85) Thu Nov 2 12:09:09 2006 : Auth: Login incorrect: [foobar/asdf1234] (from client dialup port 85) Thu Nov 2 12:09:09 2006 : Auth: Login incorrect (No password configured for the user): [foobar/asdf1234] (from client dialup port 85) Thu Nov 2 12:09:09 2006 : Auth: Login incorrect: [foobar/asdf1234] (from client dialup port 85)

1 0

Re: Freeradius hangs
by Karthik R 02 Nov '06

02 Nov '06

Alan, yes, the RADIUS server returned Access-accept for the session requested from NAS. But it again receives the access-request from NAS and sending duplicate reply. Does it mean NAS unable to process the response received from Freeradius. Below is the reponse snap where i see access-accept and access-request happened several time at same instant. On the NAS end, its pretty plain configuration (configured radius ip and secret passwd) and no logging is available. The NAS documentation doesnt talk about radius error codes. Sending Access-Accept of id 219 to 192.168.0.1 port 4754 MS-CHAP2-Success = 0x9f533d41443033433538413845303733454132373045303043444441364531383431433344383938383938 MS-MPPE-Recv-Key = 0xdc882e2dfa10109679e37fe4bafba95d MS-MPPE-Send-Key = 0xf3e3e6a91f2d6e4b64b8b2e5add4bdad MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 Finished request 12 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.1:4754 , id=219, length=151 Sending duplicate reply to client dlink:4754 - ID: 219 Re-sending Access-Accept of id 219 to 192.168.0.1 port 4754 Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.1:4754, id=219, length=151 Sending duplicate reply to client dlink:4754 - ID: 219 Re-sending Access-Accept of id 219 to 192.168.0.1 port 4754 Waking up in 6 seconds... so when i have this log message at radius srv end, at the client dialer interface i get this error message as "access was denied because username\password invalid on the domain". But am sure the logon credentials are correct. Also freeradius service hangs sometime during authentication process while processing request which came from NAS box. sorry about vague reply. Kartthik

2 1

Re: Freeradius hangs
by Karthik R 02 Nov '06

02 Nov '06

Karthik R" <kartthikr(a)gmail.com> wrote: > When I was observing the radius log, i was typing correct username and > password sometime it says "access was denied because username\password > invalid on the domain". I didnt see anything going wrong in the log message > but i didnt understand why i got the above error message. > > bash3.0#radiusd -X -A Which doesn't show that "access denied" message, and doesn't show the server hanging. I don't understand why posting this debug log would help solve the problem. It does NOT show the problem, and therefore is NOT useful. Alan DeKok Alan, Sorry i missed this part. I mean when i try to connect to remote vpn gateway using MS-VPN dialer interface, on the dialer interface i get this error message ie. "access was denied because username\password invalid on the domain". But when i checked the radius log i didnt find anything weird as attached before. Sometimes it hangs in btw authentication process, so i couldnt caputre the data of it and helpless here. can you help me now...

2 1

RADIUS MAC Authentication
by Van Der Westhuizen, Eldridge (Mr) (Summerstrand Campus North) 02 Nov '06

02 Nov '06

Hi All Need some advice please. Using Mikrotik as a NAS. Wireless clients connect to Mikrotik and i've got RADIUS MAC authentication setup on the Mikrotik. So all the clients MAC addresses are sent to the FreeRadius box in format 00:00:00:00:00:00 (which is the username) and blank password. So in the freeradius mysql db, i've got the following: In the radcheck table, i've got the mac as the username and blank password. In usergroup, i link the mac username to a group called Wireless. In Radgroupcheck i've got an entry for the Wireless group and telling it Auth-Type := Local. In Radgroupreply i only pass a service-type attribute for the wireless group with framed-user as value. Authentication seems to happen okay. In the radpostauth, i get an entry for the username, chap password authentication and access-accept message. The wireless client connect and get a DCHP ip from a pool in the Mikrotik NAS. Question: Is it possible to see which mac addresses/usernames got access-reject messages? I did take my mac out of the list and couldn't connect, but didn't get any messages in the radpostauth table. Also, i'm not getting any accounting in the accounting table. Do you only get accounting from making a PPP connection? Or is it possible to do RADIUS MAC authentication and get accounting detail from the session? Any help would be appreciated. Eldridge NOTICE: Please note that this eMail, and the contents thereof, is subject to the standard NMMU eMail disclaimer which may be found at: <http://www.nmmu.ac.za/disclaimer/email.htm>>

2 1

freeRADIUS on Solaris 10 - x86
by Michael Messner 02 Nov '06

02 Nov '06

hey freeRADIUS users, next step ... testing freeRADIUS on a Solaris 10 box and I'm completely new to solaris! :-( I've started with the configure again but there are so much things missing: aclocal autoconf autoheader locate libgdbm sys/security.h sys/prctl.h prot.h sia.h siad.h krb5.h gawk mawk ar ramlib strip argz.h libldap dl.h dld.h mach-o/dyld.h gdbm.h pam/pam_appl.h oci.h sql.h Where can I get all these things, do I need everything? We are trying to get freeradius working with 802.1x authentication to Microsoft Active directory with LDAP-groups and huntgroups: users-example: DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", Huntgroup-Name == "enterasys", Realm == ISALAB.local Filter-ID == "Enterasys:version=1:mgmt=su:policy=adminrole", Reply-Message = "Welcome %{Stripped-User-Name:-%{User-Name:-None}} in the %{Realm} - Domain, there are no restrictions for you in this network", Fall-Through = No I hope someone can help me a bit to find the right way! thanks mIke

3 2

Two sql queries in counter module
by Bishal 02 Nov '06

02 Nov '06

Hello all Is it possible to make two queries in sql counter module? like sqlcounter noresetcounter { driver = "rlm_sqlcounter" counter-name = Max-All-Session-Time check-name = Max-All-Session sqlmod-inst = sql key = User-Name reset = never query1=SELECT activedate from radacct where username='%{%k}"' query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}' AND ActiveDate='$query1'" }

2 1

Database query failed: Table 'radius.radcheck' doesn't exist
by Dusan Djordjevic Liste 02 Nov '06

02 Nov '06

Hi all, I am trying to install dialup admin. I followed HOWTO located in doc/ directory. I created all tables in radius database using provided .sql files in sql/ dir. Now i have 4 tables in radius database: badusers, mtotacct, totacct, userinfo. When I connect to dialup admin and try to create new user, it gives me following error: Database query failed: Table 'radius.radcheck' doesn't exist (after bunch of error messages that some queries and inserts are not valid). I am not good with databases, but AFAIK this means that there is no radcheck table in radius database. Also, if i understand admin.conf properly, there is part that sayst following: sql_database: radius sql_accounting_table: radacct sql_badusers_table: badusers sql_check_table: radcheck sql_reply_table: radreply sql_user_info_table: userinfo sql_groupcheck_table: radgroupcheck sql_groupreply_table: radgroupreply sql_usergroup_table: usergroup sql_total_accounting_table: totacct sql_nas_table: nas Also lot of tables mentioned here do not exist. Did I missed something or ? TIA Dusan http://dj-dule.blogspot.com

3 6