March 2006 - Freeradius-Users - lists.freeradius.org

auth-reject with attributes
by freeradius＠list.coretech.ro 01 Mar '06

01 Mar '06

hello, I have tried to upgrade to the latest cvs version and I have noted that reply attributes are no longer sent with auth-reject messages. is this correct ? is there a configuration option to re enable sending of reply attributes with auth-reject messages ? thanks, Razvan Radu

2 2

freeradius & ppp
by Felice.pizzurro 01 Mar '06

01 Mar '06

Hi, excuse me for my bad english. I use freeradius mysql to authenticate the users of my wireless hotspot. I nedd that the authentication is made with ppp. In the users file I have this: DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP It's correct or I need other directives? thanks, Felice -- Computers are like air conditioners: they stop work properly when you open Windows... -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: I migliori fun sound Jamba! Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=4843&d=20060301

1 0

freeradius & ppp
by Felice.pizzurro 01 Mar '06

01 Mar '06

Hi, excuse me for my bad english. I use freeradius mysql to authenticate the users of my wireless hotspot. I nedd that the authentication is made with ppp. In the users file I have this: DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP It's correct or I need other directives? thanks, Felice -- Computers are like air conditioners: they stop work properly when you open Windows... -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Sei in cerca dellamore? Non perdere tempo, iscriviti gratis a Meetic! Potrai chattare con migliaia di single in linea. Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=4052&d=20060301

1 0

No matching entry in the database for request from user...
by kno 01 Mar '06

01 Mar '06

Hi, I've just start "playing" with freeradius and I'm doing some test to learn. The authorization via files works: radtest kno1 kk 80.xx.xx.xx 1 testing123 Sending Access-Request of id 128 to 80.xx.xx.xx port 1812 User-Name = "kno1" User-Password = "kk" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 rad_recv: Access-Accept packet from host 80.xx.xx.xx:1812, id=128, length=33 Reply-Message = "Hello, kno1" But I want to do it via mysql, and here is the problem. I've try to follow the notes at http://www.frontios.com/freeradius.html I've an user in the DB: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'kno' ORDER BY id; +----+----------+-----------+-------+----+ | id | UserName | Attribute | Value | op | +----+----------+-----------+-------+----+ | 1 | kno | Password | kk | == | +----+----------+-----------+-------+----+ But the authorization fails: radtest kno kk 80.xx.xx.xx 1 testing123 Sending Access-Request of id 110 to 80.xx.xx.xx port 1812 User-Name = "kno" User-Password = "kk" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Re-sending Access-Request of id 110 to 80.xx.xx.xx port 1812 User-Name = "kno" User-Password = "kk" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 [re-sending 4 times] rad_recv: Access-Reject packet from host 80.xx.xx.xx:1812, id=110, length=20 The server side log: rad_recv: Access-Request packet from host 80.xx.xx.xx:59115, id=110, length=55 User-Name = "kno" User-Password = "kk" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'kno' ORDER BY id; rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'kno' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'kno' ORDER BY id; rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'kno' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; rlm_sql (sql): No matching entry in the database for request from user [kno] rlm_sql (sql): Released sql socket id: 4 Login incorrect (No password configured for the user): [kno/kk] (from client kno port 1) Login incorrect: [kno/kk] (from client kno port 1) rad_recv: Access-Request packet from host 80.xx.xx.xx:59115, id=110, length=55 Sending Access-Reject of id 110 to 80.xx.xx.xx:59115 I don't know where is the error, any ideas? Thanks, kNo

3 5

MS CHAP V2 authentication failure...
by Jon 01 Mar '06

01 Mar '06

here is [most] of the -X -A output rlm_eap: EAP packet type response id 4 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 0 to 127.0.0.1:1025 EAP-Message = 0x0105003119001403010001011603010020f640f17cc4d9b95c689f37535f0c167e7ef85920fa1a584ae45ca46e4e27be88 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89c31ab5692851c1b54665f205acfdb1 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=138 User-Name = "jboast" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "0014bf1c0216" Calling-Station-Id = "0090967ee1f9" NAS-Identifier = "0014bf1c0216" NAS-Port = 38 Framed-MTU = 1400 State = 0x89c31ab5692851c1b54665f205acfdb1 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0x86ad4528b700aed9bb049bed435eeb10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 0 to 127.0.0.1:1025 EAP-Message = 0x0106002019001703010015c0b9557e082a58271186f1038ce6579a67a52b2c30 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4641f1c68dfd842fbecaa2555be47878 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=166 User-Name = "jboast" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "0014bf1c0216" Calling-Station-Id = "0090967ee1f9" NAS-Identifier = "0014bf1c0216" NAS-Port = 38 Framed-MTU = 1400 State = 0x4641f1c68dfd842fbecaa2555be47878 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0206002219001703010017c6caefa5edac16bea7db9a9ee8f16dec3d5db28d1111ef Message-Authenticator = 0xceffd3aede7f9a429813aa64fde5fc65 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 rlm_eap: EAP packet type response id 6 length 34 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - jboast rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of jboast PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to jboast Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 rlm_eap: EAP packet type response id 6 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 0 to 127.0.0.1:1025 EAP-Message = 0x010700371900170301002c822385e6e9fb2b3f8f6155f76311e50bfbdb2a4d27557ae1de8893be311197d14003ff17cb0259d2b452ce2f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb931efb43a135bd61a8d7beedcd95701 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=220 User-Name = "jboast" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "0014bf1c0216" Calling-Station-Id = "0090967ee1f9" NAS-Identifier = "0014bf1c0216" NAS-Port = 38 Framed-MTU = 1400 State = 0xb931efb43a135bd61a8d7beedcd95701 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700581900170301004dcd9e19e4f8d3efb85c7af02264394c0effdc9df18751700ce7a51ddb927afa8d37e5e0a96c4dc4e54c62183f32aa2a9af1da58a06434e307bde2540bf10bc20fafbeefd8fbdc591c3a111133f1 Message-Authenticator = 0x72c9d318441ce6bedfb78bff20d6ef6a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 rlm_eap: EAP packet type response id 7 length 88 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to jboast PEAP: Adding old state with 07 73 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 rlm_eap: EAP packet type response id 7 length 65 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 0 to 127.0.0.1:1025 EAP-Message = 0x010800261900170301001bef481fb0682ffedaef80653a2b14e3ce38c357d2ac27693b8b5b7e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc1d1f811200e081feb3c7e131c64e96b Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=170 User-Name = "jboast" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "0014bf1c0216" Calling-Station-Id = "0090967ee1f9" NAS-Identifier = "0014bf1c0216" NAS-Port = 38 Framed-MTU = 1400 State = 0xc1d1f811200e081feb3c7e131c64e96b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800261900170301001b2e1b4f233395cb709a8d40be375a07c87f3d040c139b8989f41d4e Message-Authenticator = 0x8e4f17e45575d244747d1f0d76b2f772 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: group authenticate returns invalid for request 8 auth: Failed to validate the user. Delaying request 8 for 1 seconds Finished request 8 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 127.0.0.1:1025 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 8 ID 0 with timestamp 4404fa1e Nothing to do. Sleeping until we see a request. im sure it's something simple, i've been working at it all day, i need a break, hopefully someone can help. Thanks Jon

2 1