April 2006 - Freeradius-Users - lists.freeradius.org

ldap authentication failure
by Abey Thomas 21 Apr '06

21 Apr '06

Thanks Alan . I did EAP and telnet works fine! I have set up the freeradius and using lotus notes LDAP I am able to get authenticated for a TELNET session with CISCO 2950. However in the same setup when I try to get the port authenticated for the WinXP client using EAP-MD5 it is being rejected Help Requested **************************************************************************************************** TEST PLATFORM **************************************************************************************************** LDAP : Lotus Notes Directory Radius : Freeradius 1.0.1 Switch : Cisco 2950 OS : Windows XP with SP2 **************************************************************************************************** Successfull telnet authentication using radius to Cisco 2950 **************************************************************************************************** Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 172.16.1.1:1812, id=56, length=78 NAS-IP-Address = 172.16.1.1 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "abey" Calling-Station-Id = "172.16.2.1" User-Password = "abeypass" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for abey radius_xlat: '(uid=abey)' radius_xlat: 'o=example' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.1.1:389, authentication 0 rlm_ldap: bind as / to 192.168.1.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=example, with filter (uid=abey) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user abey authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "abey" with password "abeypass" rlm_ldap: user DN: CN=Abey Thomas,O=example rlm_ldap: (re)connect to 192.168.1.1:389, authentication 1 rlm_ldap: bind as CN=Abey Thomas,O=example/abeypass to 192.168.1.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user abey authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 56 to 172.16.1.1:1812 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 56 with timestamp 44481b5d Nothing to do. Sleeping until we see a request. **************************************************************************************************** Unsuccessful authentication using WinXP EAP-MD5 with LDAP **************************************************************************************************** rad_recv: Access-Request packet from host 172.16.1.1:1812, id=65, length=162 NAS-IP-Address = 172.16.1.1 NAS-Port = 50035 NAS-Port-Type = Ethernet User-Name = "abey" Called-Station-Id = "00-14-69-B1-DE-63" Calling-Station-Id = "00-16-17-29-73-6A" Service-Type = Framed-User Framed-MTU = 1500 State = 0x20e0298dbd677f901ed08b90898c8919 EAP-Message = 0x0201001c0410cbc40efb162c0ae53832615a88e73548616265796274 Message-Authenticator = 0xae7f4801c3431879926a3ec72e5bcc5b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for abey radius_xlat: '(uid=abey)' radius_xlat: 'o=example' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=example, with filter (uid=abey) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user abey authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 rlm_eap: EAP packet type response id 1 length 28 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "files" returns notfound for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type LDAP rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'abey' auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: group authenticate returns invalid for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 65 to 172.16.1.1:1812 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 64 with timestamp 44483e3e Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 65 with timestamp 44483e3f Nothing to do. Sleeping until we see a request. **************************************************************************************************** radiusd.conf **************************************************************************************************** prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } $INCLUDE ${confdir}/clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { eap { default_eap_type = md5 timer_expire = 120 md5 { } leap { } } ldap { server = "10.1.1.111" basedn = "o=slashsupport" filter = "(uid=%u)" } preprocess { } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } } authorize { ldap eap files } authenticate { eap Auth-Type LDAP { ldap } } **************************************************************************************************** users **************************************************************************************************** userone User-Password == "userpass" # DEFAULT Auth-Type := LDAP # Fall-Through = 1 # ************************************************************************* Regards, Abey Babu Thomas

2 1

PostgreSQL tables in a schema
by Milen A. Radev 21 Apr '06

21 Apr '06

Is it possible to place the necessary tables in a separate schema? We need to cross-reference some tables and it would be very convenient if we could place the tables inside the same database together with our other schemas. I saw that same table names are specified in the configuration file (postgresql.conf). Probably it would be easy to prepend the schema name. But I saw some other tables in the DB that are not mentioned in the conf file. -- Milen A. Radev

2 1

EAP-TLS + LDAP
by sukhvinder kumar 21 Apr '06

21 Apr '06

Hi, I'm using RHEL AS release 3 , openldap-2.2.13-2 , FreeRADIUS Version 1.1.1. When i'm authenticating the users locally its working fine, but when i'm using EAP-TLS it gives the below error. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/freeradius/etc/raddb/clients.conf Config: including file: /usr/local/freeradius/etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/freeradius/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 60 main: cleanup_delay = 6 main: max_requests = 2048 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 10.31.18.15 IP address [10.31.18.15] main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/freeradius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded LDAP ldap: server = "10.31.16.32" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=PwC-Saket" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "providian" ldap: basedn = "dc=PwC-Saket" ldap: filter = "(uid=%u)" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "{clear}" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/freeradius/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 8 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/freeradius/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x811aca0 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/openssl/misc/demoCA/private/cakey.pem" tls: certificate_file = "/usr/local/openssl/misc/demoCA/newcerts/A5E6ED1687D6A72A.pem" tls: CA_file = "/usr/local/openssl/misc/demoCA/cacert.pem" tls: private_key_password = "secret" tls: dh_file = "/usr/local/freeradius/etc/raddb/certs/dh" tls: random_file = "/usr/local/openssl/misc/demoCA/private/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/freeradius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/freeradius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/freeradius/etc/raddb/users" files: acctusersfile = "/usr/local/freeradius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/freeradius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = no radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 10.31.18.15:1645 Listening on accounting 10.31.18.15:1646 Ready to process requests. rad_recv: Access-Request packet from host 10.31.17.248:1116, id=0, length=200 Message-Authenticator = 0x256b1d89be3ce1e22d71fecbf6022589 Service-Type = Framed-User User-Name = "cgarg" Framed-MTU = 1488 Called-Station-Id = "00-80-48-35-3B-3B:test" Calling-Station-Id = "00-12-F0-02-FB-68" NAS-Identifier = "Wireless-G Access Point (SMA)" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000a016367617267 NAS-IP-Address = 10.31.17.248 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/10.31.17.248/auth-detail-20060419' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.31.17.248/auth-detail-20060419 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cgarg", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: leaving group LDAP (returns invalid) for request 0 auth: Failed to validate the user. Login incorrect: [cgarg/<no User-Password attribute>] (from client TESTING-BDC port 1 cli 00-12-F0-02-FB-68) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 10.31.17.248 port 1116 Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 4445e06f Nothing to do. Sleeping until we see a request. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Pls avdice me where i'm going wrong. Regards, sukhvinder __________________________________________________________ Yahoo! India Matrimony: Find your partner now. Go to http://yahoo.shaadi.com __________________________________________________________ Yahoo! India Matrimony: Find your partner now. Go to http://yahoo.shaadi.com

5 6

integration with edirectory
by Doyle Collings 21 Apr '06

21 Apr '06

Has anybody successfully used the Integrating Novell eDirectory with FreeRadius document that is available on the Novell Web site?

3 2

freeradius and 802.1x troubleshooting
by Vincent Chen 21 Apr '06

21 Apr '06

Hi, all I recently changed my firewall and move my dns server to the same host running freeradius. The 802.1x connection between windows xp and my AP which works perfectly now stop working. How can I troubleshooting this? 802.1x may be secure, but definitely pain in the ass. Here is what I see in radius log. BTW: Hardware, freeradius, certificates are all the same. --- --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.2.5:1024, id=67, length=166 User-Name = "Vincent Chen" NAS-IP-Address = 10.1.2.5 NAS-Identifier = "AWL500" State = 0xf6d7edea4e31a89cdd1e573b8e7f619c EAP-Message = 0x021500500d800000004616030100410100003d030144482d535841e9b32d4e67beba62b2534c19d5a49d7a9f56d591282a9597af8600001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xf6f1d2620cddb7f2b187f79e91dff8dc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 16 rlm_eap: EAP packet type response id 21 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 16 users: Matched entry Vincent Chen at line 19 modcall[authorize]: module "files" returns ok for request 16 modcall: leaving group authorize (returns updated) for request 16 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 16 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0ee9], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 008b], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 16 modcall: leaving group authenticate (returns handled) for request 16 Sending Access-Challenge of id 67 to 10.1.2.5 port 1024 Termination-Action = RADIUS-Request Session-Timeout = 1200 EAP-Message = 0x0116040a0dc000000fcd160301004a02000046030144482d544fab626b96135973511a6d2c7a3ca4375ecf30af715f751166aca50d20338a07507a2423dec32483c2c11d54669ffba33d3f829a3f7f27ea56047a96240004001603010ee90b000ee5000ee20006fa308206f6308204dea003020102020101300d06092a864886f70d0101050500307a310b300906035504061302545731163014060355040a130d416d4a6574204469676974616c310b3009060355040b130249543119301706035504031310416d4a6574204469676974616c204341312b302906092a864886f70d010901161c76696e63656e744069736f6c7574696f6e2e64796e64 EAP-Message = 0x6e732e62697a301e170d3036303330333131313233315a170d3131303330323131313233315a3057310b300906035504061302545731163014060355040a130d416d4a6574204469676974616c310b3009060355040b13024954311730150603550403130e76657264692e686f6d652e6e6574310a3008060355040513013130820122300d06092a864886f70d01010105000382010f003082010a0282010100d8819383482d847fda6b0d13bbc5dc6e6880d3b692076a19b3c1c9487505798e113454d8a8ed2c378c0743029eece31c989826592bafc121c43784d9b835105fdc89cc8e3df125573e76d56c2283e7803f2660a70e095d051ef4e2191c EAP-Message = 0x997d0d69051c1383d82f5abba1a451ca886b0271a7ffd88b63da0b41c3aab3faf6b0a96584924466a11e0e13a19fb6fa7e31ff9f2edd01a7f8298b30152f7af49004860d8dfbf320f593fb1b4634bba64d558a75b851149007c21dbd665f81ee57c414a118b2697acfd5d5418a4e5d9dd7ce6f5356829d20bc0859c53cf9a09a444c278c85bd8a972e05b4e65da8db7ab1ae3c445d902ede58efea886cf0b16a7ec4dd0203010001a38202a8308202a430090603551d130402300030480603551d200441303f300606042a030304300606042a030305302d06042a0303063025302306082b060105050702011617687474703a2f2f736f6d652e75726c EAP-Message = 0x2e6f72672f637073301106096086480186f8420101040403020640300b0603551d0f0404030204f030130603551d25040c300a06082b06010505070301302a06096086480186f842010d041d161b5757572d536572766572206f6620416d4a6574204469676974616c301d0603551d0e04160414a37a030823f727fd625ea3b2e772b37295f8acfc3081ac0603551d230481a43081a180148c3fd1b0c717607c67d8d845ece8741f4ff8ed60a17ea47c307a310b300906035504061302545731163014060355040a130d416d4a6574204469676974616c310b3009060355040b130249543119301706035504031310416d4a6574204469676974616c20 EAP-Message = 0x4341312b302906092a864886f70d010901161c76696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4016d74af2be5576af501ab3faf576f1 Finished request 16 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 10.1.2.5:1024, id=68, length=92 User-Name = "Vincent Chen" NAS-IP-Address = 10.1.2.5 NAS-Identifier = "AWL500" State = 0x4016d74af2be5576af501ab3faf576f1 EAP-Message = 0x021600060d00 Message-Authenticator = 0x5a66fb7be4afdcbc9547bcfb1f6f906e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 17 rlm_eap: EAP packet type response id 22 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 17 users: Matched entry Vincent Chen at line 19 modcall[authorize]: module "files" returns ok for request 17 modcall: leaving group authorize (returns updated) for request 17 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 17 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 17 modcall: leaving group authenticate (returns handled) for request 17 Sending Access-Challenge of id 68 to 10.1.2.5 port 1024 Termination-Action = RADIUS-Request Session-Timeout = 1200 EAP-Message = 0x0117040a0dc000000fcd63656e744069736f6c7574696f6e2e64796e646e732e62697a820900f3bd792c9c40ec4c30270603551d110420301e811c76696e63656e744069736f6c7574696f6e2e64796e646e732e62697a30270603551d120420301e811c76696e63656e744069736f6c7574696f6e2e64796e646e732e62697a304206096086480186f842010404351633687474703a2f2f69736572766963652e64796e646e732e62697a2f6f70656e63612f7075622f63726c2f636163726c2e63726c304206096086480186f842010304351633687474703a2f2f69736572766963652e64796e646e732e62697a2f6f70656e63612f7075622f6372 EAP-Message = 0x6c2f636163726c2e63726c30440603551d1f043d303b3039a037a0358633687474703a2f2f69736572766963652e64796e646e732e62697a2f6f70656e63612f7075622f63726c2f636163726c2e63726c300d06092a864886f70d01010505000382020100a55af54cb3ad70b6d429de93b37b49e161f7975473a3727c1209267f59512eedd04741b77231661d8e45c1479955536ef14648a504ad00252e2d9c8315a60ba9f2604491e965e3c47f00c3355b06d7b6da6cf06ec622b40765f6e6da3390a09ffb5f6dd3cd790cf479b21d504e0be8e135cfeda486dd2febb632a3796f4ae94d949ecb64677b50aa1e754d3158e2738df2fbd94d4837ce6d EAP-Message = 0xb719302a99ad583e26ac0f231ab772db7cbef0a4aecebd056f2d333322d94565217603b022e08043c999eecb9d9543771e4beffc7d0a17fee3706b76dde92da5acf134d8f4795ca72864fc39b71cb9cdf1867bcffca3b195206636ce3e6c714951cbb323cd38e9b876c3668c8a5ba6d3b1201a54bd98d44d77e8e308ddc60a4a8cbebbb87454a31ec031edc09100bf2fc9060950ba6e2da98f8bfbb58ee1a14e89808e773bf6075c0c153ba0a76552957e515a6461fbda579090c57eba1a58d303d40b384fc39b8f7fafd72991a00352d3e0ed144ba679d92117784a18d734530c33d453453908039860106acdb00cfeb8a76b2da25ff0b032e7e9a8b3 EAP-Message = 0x3a57b0787ceb145d8a3a2c82477944d2159d8d3614095e5b618a6e86b69dbac307867c5ffe2e719d90b918260eb685cb3ce1e112a31fa2c234af91fda883b26ad1e60c0d57efc2b2cdc1c129f19e9129a40543fcdd4ee0c9a12b9abfdf46c88aac46ecce3b0ff12d6d3fd20007e2308207de308205c6a003020102020900f3bd792c9c40ec4c300d06092a864886f70d0101050500307a310b300906035504061302545731163014060355040a130d416d4a6574204469676974616c310b3009060355040b130249543119301706035504031310416d4a6574204469676974616c204341312b302906092a864886f70d010901161c76696e63656e7440 EAP-Message = 0x69736f6c7574696f6e2e64796e646e732e62697a301e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf0f9b620b8316abaee0c3ccac9df0bc4 Finished request 17 Going to the next request --- ___________________________________________________ 最新版 Yahoo!奇摩即時通訊 7.0，免費網路電話任你打！ http://messenger.yahoo.com.tw/ ___________________________________________________ 最新版 Yahoo!奇摩即時通訊 7.0，免費網路電話任你打！ http://messenger.yahoo.com.tw/

1 0

callingstationid filter and regexp
by Miguel 20 Apr '06

20 Apr '06

Hi, im trying to configure a check that 1315 username will be allowed to connect only from a particular list of callinstationids, so i added a Calling-Station-Id attribute to the radcheck table, this are my filter's details username: 1315 list of callingstationids: - from 22662100 to 22662199 (this is a pbx) - 22793045 - 22934240 the attribute was entered like this: username: 1315 attribute: Calling-Station-Id Op: ~= Value: ^226621[0-9][0-9]$|^22793045$|^22934240$ But i always get acces denied: Tue Apr 18 15:38:04 2006 : Auth: Login incorrect: [1315/1315] (from client private-network port 0 cli 50322793045) Tue Apr 18 15:38:20 2006 : Info: rlm_sql (sql): No matching entry in the database for request from user [1315] Tue Apr 18 15:38:20 2006 : Auth: Login incorrect: [1315/1315] (from client private-network port 0 cli 50322793045) Tue Apr 18 15:39:09 2006 : Info: rlm_sql (sql): No matching entry in the database for request from user [1315] Tue Apr 18 15:39:09 2006 : Auth: Login incorrect: [1315/1315] (from client private-network port 0 cli 50322793045) Tue Apr 18 15:39:24 2006 : Info: rlm_sql (sql): No matching entry in the database for request from user [1315] Tue Apr 18 15:39:24 2006 : Auth: Login incorrect: [1315/1315] (from client private-network port 0 cli 50322793045) Is my regexp mistyped? or am i using the wrong op? thanks

3 6

Default user in sql
by Antonio Matera 20 Apr '06

20 Apr '06

Hi, I have this user file: TLS1 Cisco-AVPair == "ssid=VLAN3" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 3, Tunnel-Type = VLAN TLS2 Cisco-AVPair == "ssid=cn-test" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2, Tunnel-Type = VLAN peap1 Cisco-AVPair == "ssid=VLAN3", User-Password == "ciao1" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 3, Tunnel-Type = VLAN peap2 Cisco-AVPair == "ssid=cn-test", User-Password := "ciao2" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2, Tunnel-Type = VLAN DEFAULT Auth-Type := Reject TLS1 and TLS2 are used for the EAP-TLS authentication with certificate. I want that TLS1 is authentucate only with the ssid=vlan3 and TLS2 with ssid=cn-test. The same for the users peap1 and peap2 but here I have a peap authentication with user and password. Without the DEFAULT user in the bottom of the user file with auth-type:=reject, if I try to authenticate TLS1 with a bad ssid, my user is authenticated without the attribute, but I don't want that this user is authenticate in this case. With DEFAULT user all works fine and the user is reject. The problem is to set a default user if I want to use the sql database. How can I do it? I need a default user that is matched only if the user that asks the authentication isn't in the sql database. I tried with the DEFAULT user in the sql.conf file but this is different because it is always the first user tested, and in my case I have always a reject authentication. Thanks a lot. Bye Antonio

1 0

Alcatel Dictionary Files
by Anitha Vijayakumar 19 Apr '06

19 Apr '06

Hi, The dictionary files that come with Freeradius for Alcatel is old and incompatible. What is the procedure to submit a new dictionary file ? Thanks and Regards, Anitha

2 1

New CRL, need to killall -HUP radiusd?
by Jason Carr 19 Apr '06

19 Apr '06

Our freeradius server is having a problem with CRL's expiring, however we have a new CRL copying over every 5 minutes. We have a 4 hour expire on our CRL's and I'm wondering if I need to killall -HUP radiusd in order for the new CRL to be picked up. I was looking through the code and it seems like the only thing that the freeradius code does with CRL's is to tell the X509 store to look for the CRL, but that seems about it. When I copy my CRL over I do the following... wget -q http://somesite.com/crl/crlfile.dem -O /tmp/crlfile.dem.new mv /tmp/crlfile.dem.new /home/freeradius/etc/certs/crlfile.dem openssl crl -inform dem -outform pem -in /home/freeradius/etc/certs/crlfile.dem -out /home/freeradius/etc/certs/crlfile.pem c_rehash /home/freeradius/etc/certs/ So, do I need to do something or these CRL's to be updated while radiusd is running? Any other helpful hints would be greatly appreciated.

1 0

Help on specify MAC auth in 'users' file
by Gordon Yuen 19 Apr '06

19 Apr '06

Dear all, I'm new to RADIUS but forced to enable wireless access in a hurry. So far I had made EAP-PEAP work with the following line in 'users' file: john Auth-Type := EAP, User-Password == "hello" Now I want to add a condition based on MAC address, but I find: john Calling-Station-Id == "00AABB00AABB", Auth-Type := EAP, User-Password == "hello" not working. I ran the radiusd in debug mode, and it told the Access-Request packet contain the 'Calling-Station-Id' attribute and the correct value, but at the end it said it cannot validate the user. Any idea!? Thanks, Gordon

3 2