July 2006 - Freeradius-Users - lists.freeradius.org

RE: Windows XP keeps "verifying identity"
by Klaas De Craemer 10 Jul '06

10 Jul '06

With all due respect, but I'm not that stupid that I would not even look into a configuration file. Take a look at the log I attached in a previous email and you'll see that EAP is enabled and also processes the user "KlaasDC". It only seems that the client does not respond to the access chalenge: Sending Access-Challenge of id 15 to 127.0.0.1:1027 EAP-Message = 0x0116000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1d1065c2554dce6ca1d156d938f7049a This is what happens when WInXP tries to associate (and begins to loop): (At the bottom is "radiusd -X -A" starting up) ========================= rad_recv: Access-Request packet from host 127.0.0.1:1027, id=0, length=159 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201000c014b6c6161734443 Message-Authenticator = 0xf26a1b4afcdfaf58003784904286014e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 0 to 127.0.0.1:1027 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xecd47882c04772432949c86821e23447 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1027, id=1, length=245 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200500d800000004616030100410100003d030144b249ff398dc35bbc9f32d603876f313d1cb0ff5bbcdd3c79b38f84c78a08d700001600040005000a000900640062000300060013001200630100 State = 0xecd47882c04772432949c86821e23447 Message-Authenticator = 0x72675c13c503b9f653fbaf49f92a1c7e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 057b], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 006d], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 1 to 127.0.0.1:1027 EAP-Message = 0x0103040a0dc000000641160301004a02000046030144b248eda44415e2b853c9772a1130637ea6b6a80733c192f1a2b71cff3c143f20fd26745d9e97554fa1bf0dba61e8d11ceb72fadc393ac548c297bc6be166248a000400160301057b0b00057700057400025930820255308201bea003020102020101300d06092a864886f70d0101040500305c310b3009060355040613024245310c300a0603550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d301e170d3036303730383039313133395a170d3037303730 EAP-Message = 0x383039313133395a306c310b3009060355040613024245310c300a0603550408130357564c310e300c060355040713055469656c74310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100af6bd5feb703ca2b30d6cecb02524a0fcb8bc364a2c2bc39400561629844d18a24c448656f1cf6964c9a064c82cc3616264e2419e073093ab7289e8688c656f652f8e4e63a9a54dd1492a5757df04bc0ecd4441868f158da2fdadcb4bd31a07243fe8bce413f7fbf85f0 EAP-Message = 0xd006ecbcd62019e26e8c58290e1fe1ccd2189e2c53450203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000381810052b4fd21f12d8d14ffd712d100fb12a3daa5e681a44b0e2dda3762829611171cfd8d5828a6f1db3216cce98190a1f6a110a66848e8b2846a2da6254a5a42ad21731004b858723fbf9651bdae4915d167ce8b8be8c9167ee7c78b1de730334035d321ceb8196873e73d8ae15c5e6d974d2cca62bff234a117561c16408e25bde9000315308203113082027aa003020102020100300d06092a864886f70d0101040500305c310b3009060355040613024245310c300a06 EAP-Message = 0x03550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d301e170d3036303730383039303733345a170d3039303730373039303733345a305c310b3009060355040613024245310c300a0603550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d0a45b7a7abbdc0330bec488c4e5e2fd56eb84f7066d6ce7 EAP-Message = 0xe6ef10a6f757b59a15da4694dc47dde72da145998c53 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6a5cabb694011c03b8fc460c9d76fb83 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1027, id=2, length=171 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300060d00 State = 0x6a5cabb694011c03b8fc460c9d76fb83 Message-Authenticator = 0xc614706a41c325fb9d8cf69c9000c0b7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 2 to 127.0.0.1:1027 EAP-Message = 0x0104024b0d8000000641a423ee3382420f826dd1bfb6cdba0e19a54627841829135284486abb171f2ead064a2b1d3f4261451d82ae9a04dd1b60d6339ec876e7347e33ed82ec712846ccc30bad864cfc8f6784de9ba4f08749a65f290203010001a381e23081df30090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041435ac18d86277eb69414cd999bf1b325fa98ea02d3081840603551d23047d307b801435ac18d86277eb69414cd999bf1b325fa98ea02da160a45e305c310b3009060355040613024245310c300a0603550408 EAP-Message = 0x130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d820100300d06092a864886f70d0101040500038181007127f79df3611d53c650b0ed7ee16008f75dc296a0e95db3d97cd80fc7328e1193408c582a40e9dd7b0bafad2dbc335f0be62f1c6e0cb604a686fe7114a8204986a4f93e91213c798add773cb9e2d2265991bef7d13b9c3f614e28a6c94b2f8ac412f1b3fbf5d29a1c771352cb430813a7c084797a1e98fbfb3c127794f38092160301006d0d0000650201020060005e305c310b3009060355040613024245310c EAP-Message = 0x300a0603550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe9ed44552d38720950c7fe3055463168 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1027, id=3, length=171 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400060d00 State = 0xe9ed44552d38720950c7fe3055463168 Message-Authenticator = 0xc276ffa3767a7f670e8d5bcd77b97f3e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 3 to 127.0.0.1:1027 EAP-Message = 0x0105000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xea1e68322139e30bccee339205586d29 Finished request 3 Going to the next request Waking up in 6 seconds... ============================= ============================= Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/server_key.pem" tls: certificate_file = "/etc/freeradius/certs/server_cert.pem" tls: CA_file = "/etc/freeradius/certs/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/etc/freeradius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. ========================== >make appropriate changes in radiusd.conf & eap.conf for the authentication >method you want to use > > >Pradeep > > >------------------------------ > >Message: 3 >Date: Sat, 8 Jul 2006 15:27:31 +0200 >From: "Klaas De Craemer" <klaasdc at gmail.com> >Subject: Re: Windows XP keeps "verifying identity" >To: freeradius-users at lists.freeradius.org >Message-ID: > <f59e60020607080627r344aad2bia7fc636a141fba6c at mail.gmail.com> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >Ow, I forgot to say that I'm trying to use EAP-TLS... > >2006/7/8, Klaas De Craemer <klaasdc at gmail.com> >...

1 0

accouting over more than one servers
by Fretz Marco 10 Jul '06

10 Jul '06

hello there ive got a problem. we are using 2 radius servers to auth our xDSL users quering from a CISCO PPPoE Router. how can i protect a user to dial in from a secound xdsl line if first radius is down and CISCO AAA useses the 2nd radius server? and btw: does anybody know how to setup up AAA on a CISCO IOS to send periodically accounting infos to the radius server? thanks and kind regards marco fretz

1 0

Re: Windows XP keeps "verifying identity"
by Pradeep Sengar 10 Jul '06

10 Jul '06

make appropriate changes in radiusd.conf & eap.conf for the authentication method you want to use Pradeep ------------------------------ Message: 3 Date: Sat, 8 Jul 2006 15:27:31 +0200 From: "Klaas De Craemer" <klaasdc(a)gmail.com> Subject: Re: Windows XP keeps "verifying identity" To: freeradius-users(a)lists.freeradius.org Message-ID: <f59e60020607080627r344aad2bia7fc636a141fba6c(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Ow, I forgot to say that I'm trying to use EAP-TLS... 2006/7/8, Klaas De Craemer <klaasdc(a)gmail.com> ... ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 15, Issue 23 ************************************************

1 0

Error: WARNING: Unresponsive child
by Farhan Karim 10 Jul '06

10 Jul '06

fellows, we are facing a continuous problems in free-radius server. It had been working fine but lately now an error that it generates as we enable forwarding packets from INFRANET Radius Server to FreeRadius server. freeradius ver 1.1.0 the error that it generates in radius.log file is: Wed Jul 5 17:45:20 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Jul 5 17:45:20 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Jul 5 17:45:20 2006 : Info: rlm_jradius: configuring jradius server 200.100.96.20:1825 Wed Jul 5 17:45:20 2006 : Info: Ready to process requests. Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 6) for request 16 Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 7) for request 17 Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 4) for request 19 Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 5) for request 20 Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 8) for request 21 Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 10) for request 22 Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 9) for request 24 Wed Jul 5 17:51:04 2006 : Error: WARNING: Unresponsive child (id 4) for request 25 Wed Jul 5 17:51:04 2006 : Error: WARNING: Unresponsive child (id 7) for request 26 Wed Jul 5 17:51:04 2006 : Error: WARNING: Unresponsive child (id 6) for request 28 Wed Jul 5 17:51:06 2006 : Error: WARNING: Unresponsive child (id 5) for request 35 Wed Jul 5 17:51:07 2006 : Error: WARNING: Unresponsive child (id 10) for request 39 Wed Jul 5 17:51:07 2006 : Error: WARNING: Unresponsive child (id 8) for request 38 Wed Jul 5 17:51:07 2006 : Error: WARNING: Unresponsive child (id 9) for request 42 Wed Jul 5 17:51:19 2006 : Error: WARNING: Unresponsive child (id 7) for request 44 Wed Jul 5 17:51:19 2006 : Error: WARNING: Unresponsive child (id 8) for request 46 Wed Jul 5 17:51:19 2006 : Error: WARNING: Unresponsive child (id 4) for request 48 Wed Jul 5 17:51:20 2006 : Error: WARNING: Unresponsive child (id 10) for request 50 Wed Jul 5 17:51:21 2006 : Error: WARNING: Unresponsive child (id 5) for request 52 Wed Jul 5 17:51:21 2006 : Error: WARNING: Unresponsive child (id 6) for request 56 Wed Jul 5 17:51:22 2006 : Error: WARNING: Unresponsive child (id 9) for request 57 Wed Jul 5 17:51:34 2006 : Error: WARNING: Unresponsive child (id 7) for request 58 Wed Jul 5 17:51:34 2006 : Error: WARNING: Unresponsive child (id 10) for request 59 Wed Jul 5 17:51:34 2006 : Error: WARNING: Unresponsive child (id 6) for request 63 Wed Jul 5 17:51:34 2006 : Error: WARNING: Unresponsive child (id 4) for request 66 Wed Jul 5 17:51:34 2006 : Error: WARNING: Unresponsive child (id 8) for request 68 Wed Jul 5 17:51:36 2006 : Error: WARNING: Unresponsive child (id 5) for request 75 Wed Jul 5 17:51:37 2006 : Error: WARNING: Unresponsive child (id 9) for request 79 Wed Jul 5 17:51:51 2006 : Error: WARNING: Unresponsive child (id 8) for request 81 Wed Jul 5 17:51:51 2006 : Error: WARNING: Unresponsive child (id 7) for request 83 Wed Jul 5 17:51:51 2006 : Error: WARNING: Unresponsive child (id 10) for request 86 Wed Jul 5 17:51:51 2006 : Error: WARNING: Unresponsive child (id 6) for request 88 Wed Jul 5 17:51:51 2006 : Error: WARNING: Unresponsive child (id 5) for request 89 Wed Jul 5 17:51:52 2006 : Error: WARNING: Unresponsive child (id 4) for request 92 Wed Jul 5 17:51:52 2006 : Error: WARNING: Unresponsive child (id 5) for request 90 Wed Jul 5 17:52:04 2006 : Error: WARNING: Unresponsive child (id 9) for request 95 Wed Jul 5 17:52:08 2006 : Error: WARNING: Unresponsive child (id 10) for request 96 Wed Jul 5 17:52:08 2006 : Error: WARNING: Unresponsive child (id 6) for request 98 Wed Jul 5 17:52:09 2006 : Error: WARNING: Unresponsive child (id 7) for request 105 Wed Jul 5 17:52:09 2006 : Error: WARNING: Unresponsive child (id 5) for request 106 Wed Jul 5 17:52:09 2006 : Error: WARNING: Unresponsive child (id 4) for request 111 Wed Jul 5 17:52:09 2006 : Error: WARNING: Unresponsive child (id 6) for request 101 Wed Jul 5 17:52:09 2006 : Error: WARNING: Unresponsive child (id 8) for request 102 Wed Jul 5 17:52:19 2006 : Error: WARNING: Unresponsive child (id 4) for request 113 Wed Jul 5 17:52:19 2006 : Error: WARNING: Unresponsive child (id 9) for request 114 Wed Jul 5 17:52:22 2006 : Error: Dropping conflicting packet from client 202.100.96.21:39779 - ID: 38 due to unfinished request 124 Wed Jul 5 17:52:35 2006 : Error: WARNING: Unresponsive child (id 7) for request 118 ................ we have no clue as what the problem has occured. the other question that i have to ask is that is there a way that the freeradius server acknowledge the main INFRANET radius server (which is forwarding the packets to freeradius server) with OK so that main radius server dont get stuck due to waiting of packets acknowldement from freeradius server? our freeradius server is acting as proxy server for the jradius server that process the interim-update packets. If i have left out any required thing, please do tell me. we request for the earliest response. Regards,

3 3

Can I run a shell scipt automatically after authorizing?
by Kun Niu 10 Jul '06

10 Jul '06

Dear all, Now I have a shell script to run after a authentication session. How can I implement this? >From the config file? Thanks for your attention and look forward to your reply. Sincerely, Kun

2 1

Get my SSHA ldap passwds?
by John Gray 09 Jul '06

09 Jul '06

Hi, I have plain-text passwords coming from a pix firewall for vpn authentication. I have SSHA hashed passwds stored in ldap. Can't I hash the passwds from the pix and compare 'em the SSHA passwds from ldap somehow? It works fine if I put plain text passwords in ldap. But I don't relish the thought of storing them plain text. Thanks, John

1 1

freeradius+WinXP-PEAP+PAM
by Muthu 09 Jul '06

09 Jul '06

Hi, I am trying to use PAM authentication with freeradius for Win XP client (PEAP). I am getting error in the tls section. Ver : FreeRADIUS 1.1.1 in Linux AP : Linksys Client : Windows XP I enabled the options in raidusd.conf and I have placed with prober entries in /etc/pam.d I ran the below command *radtest username "password" localhost 1 testing123 * Output: ======= sysnet-gateway25 ~ # radtest muthu "password" localhost 2 testing123 Sending Access-Request of id 130 to 127.0.0.1 port 1812 User-Name = "muthu" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=130, length=20 Client: ======== When I try to use from Windows XP client machine, it prompting for username and password. After I typed the username and password, it is not getting connected. It is keep saying "Trying to Authenticate". Client settings in XP : PEAP, validate certificate option is not enabled" If I look at the serverside logs, it is saying multiple error like, *rlm_eap_tls: Start returned 1, eaptls_verify returned 11, rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session.** * So I attached the full debug log in this mail. Pls help me on this. Server side debug log: ====================== rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=123 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a016d75746875 Message-Authenticator = 0xbca303874074727b4b65a69509bb731c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa866ca10b5f371e8e53fbfebe5307ce0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=211 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 State = 0xa866ca10b5f371e8e53fbfebe5307ce0 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005019800000004616030100410100003d030144b0dffdd8f693786422edf97c49f4343ecc13aad75093912d990b6bda25d40c00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xa99a675d8eba749010439b512eac06b8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 02d7], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x0102033a1900160301004a02000046030144b0d849e10e331db1eab13dfd51c3659279c6cea9cb802871cbb32c3dd270e5200421d74bc64b451bf65a807251eece64a76048cabe160e52af94cb7cebb74a8d00040016030102d70b0002d30002d00002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e7420636572746966 EAP-Message = 0x69636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030 EAP-Message = 0x818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09779afa3d EAP-Message = 0xd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e835036516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7dae0a8612eeb132ce408f8df394f3a0 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=323 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 State = 0x7dae0a8612eeb132ce408f8df394f3a0 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200c01980000000b61603010086100000820080542d7bb3645e47fc6feda7709e7145f048e741c81e299fe0f6373344aca4a7be3b64c745d9a47aec1e55e28411b74061185ffd6a5fee2fcc9d298f9a733ffa4fd0d2eed8577830ba403e8dc4afdb4ae473dec2cbe190028b5967be8483c617196db0fad02f9909b78b1df7d7063719207fcdf8d4b59ceb088b3daaeb47167e4614030100010116030100202112e387bb6cebe749727be7cdd0da3629ba181306e2c221b1fcce60089167d1 Message-Authenticator = 0x7ca279ee6b43a242fd409d6e475cad2c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x01030031190014030100010116030100207dcf757a63f78f532eedcb0253324c106b6b3803bc2afada89d2f058b67105d7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x98a8efaf81fde7503edad7e110b20404 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=137 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 State = 0x98a8efaf81fde7503edad7e110b20404 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0x9b90602709d935a5da18d0ed60e3bc6a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x01040020190017030100158dda0df9cdef5e3687b7d519fc47822fbbcc9813a0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x779974e1770813a7e8a6097539d59abf Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=164 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 State = 0x779974e1770813a7e8a6097539d59abf NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400211900170301001672ccf21456545dc224b4b4c1b6fbfc0071017a82faad Message-Authenticator = 0x7f0540a46bd8ccb3c5b13c7d5a13f88d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 33 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - muthu rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of muthu PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to muthu Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x010500361900170301002b2c22860183854f6a55c100c85d2c78be83f1afab3a40e49373bd7990d0d06d091922907022b7e48d597c29 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1d64eb1932f6e356c6890d53d9c3c4dd Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=218 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 State = 0x1d64eb1932f6e356c6890d53d9c3c4dd NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500571900170301004cf131dc1876143f35e3f376892adb80c72d7ae37d8fceef5573317cb4cc345c0eb7727a61b7beabdf5da381d5667f16ffbe72b23cb9e24ba9810c93fec8be45ec40ecb6ac4da2bcf409cedaba Message-Authenticator = 0x950bd18efdce7c7bc50baf9437f8d42a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 87 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to muthu PEAP: Adding old state with 3d 60 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 64 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 5 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for muthu with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 5 modcall: leaving group MS-CHAP (returns reject) for request 5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 5 modcall: leaving group authenticate (returns reject) for request 5 auth: Failed to validate the user. Login incorrect: [muthu/<no User-Password attribute>] (from client localhost port 0) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x010600261900170301001b88cd580851e3522b1a4516b384de6ea0f9c4e36944e068bd9b1fc0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c90bcf7478ad30a644a3f50c12b4611 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=169 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 State = 0x7c90bcf7478ad30a644a3f50c12b4611 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600261900170301001b59d1cd3753054b8b1797fd0beb904a25105f437a11e7ac8b21b8f4 Message-Authenticator = 0xc48fa3cd3df1609ff1ebbc19b3907780 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 6 modcall: leaving group authenticate (returns invalid) for request 6 auth: Failed to validate the user. Login incorrect: [muthu/<no User-Password attribute>] (from client private-network-1 port 45 cli 0012f0444aa3) Delaying request 6 for 1 seconds Finished request 6 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 6 ID 0 with timestamp 44b0d849 Nothing to do. Sleeping until we see a request. Thanks & Regards, Muthu.

3 2

Cisco, RADIUS , LDAP Authentication Problem
by Thato Molise 09 Jul '06

09 Jul '06

GlacierHi all, I'm currently running redhat linux 3 ES with kernel-2.4.21-27.EL openldap-2.0.27-17, and freeradius-1.0.1-1.RHEL3. I dont have a problem authenticating RADIUS against LDAP but the major problem is RADIUS is ignoring LDAP Expiration date for unix Accounts; what causes this?

1 0

Authentication by validating RADIUS attribute value
by HariHaran 08 Jul '06

08 Jul '06

Hi all, I am using FreeRADIUS1.1.1 and Fedora directory server7.2 as the LDAP backend to store all the user information. I configured RADIUS to contact LDAP server for authenticate the user request. I have to implement the following requirement, For each user in the LDAP server i will set some value to the RADIUS attribute , say for eg Filter-ID = 100 If an authentication request comes to the RADIUS server it will contact the LDAP server, if the user is present in the LDAP server the RADIUS will authenticate the user. What i want is, i want to authenticate the user by validating the value of the RADIUS attribute in LDAP server. For example if the Filter-ID is 100 for user 'jack' i have to authenticate. If 'jack' has Filter-ID as 123 i should not authenticate. Is i have to call a script before authenticating an user? If it is so how i can call and from which file i have to define the entries? What are the various methods by which i can achieve the above? Anyone pls help me to get rid of the problem. Thanks in advance. Pls give me the complete details. --- Regards, _______________________________________________ No banners. No pop-ups. No kidding. Make My Way your home on the Web - http://www.myway.com

2 1

RE: 802.1x authentication
by Pradeep Sengar 08 Jul '06

08 Jul '06

just do google everything is there Pradeep Date: Fri, 7 Jul 2006 09:32:17 -0500 > From: "Jin Fan" <jfan(a)cwlab.com> > Subject: RE: 802.1x authentication > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <F26421BAB0F1D146BABD4977D6159084012CA1B0(a)ctiexch.ctinet.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, all: > > To further describe my challenge, here is debugging output from > freeradius. One line says, "rlm_eap: Failed in EAP select". I must have > set up eap wrong. Could anyone help me out here? Btw, in the following > example, user "TRPZEDU\\jfan" tries to authenticate through 802.1x > . Thanks. > > Jin > > rad_recv: Access-Request packet from host 192.168.3.26:20000, id=89, > length=157 > NAS-Port-Id = "1/1" > Calling-Station-Id = "00-0B-BE-D4-50-46" > Called-Station-Id = "00-0B-0E-13-74-C0:hotspot" > Service-Type = Framed-User > User-Name = "TRPZEDU\\jfan" > State = 0xdcfe3f22dc8680c7b0e05b3d498b6090 > EAP-Message = 0x020200060319 > NAS-Identifier = "Trapeze" > NAS-Port-Type = Wireless-802.11 > NAS-IP-Address = 192.168.3.26 > Message-Authenticator = 0xc846da111c9f48b4a5570fff318767a2 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 6 > modcall[authorize]: module "preprocess" returns ok for request 6 > modcall[authorize]: module "chap" returns noop for request 6 > modcall[authorize]: module "mschap" returns noop for request 6 > rlm_realm: No '@' in User-Name = "TRPZEDU\jfan", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 6 > rlm_eap: EAP packet type response id 2 length 6 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 6 > users: Matched entry DEFAULT at line 152 > users: Matched entry DEFAULT at line 171 > users: Matched entry TRPZEDU\jfan at line 228 > modcall[authorize]: module "files" returns ok for request 6 > radius_xlat: 'TRPZEDU\\jfan' > rlm_sql (sql): sql_set_user escaped user --> 'TRPZEDU\\jfan' > radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE > Username = 'TRPZEDU=5C=5C=5C=5Cjfan' ORDER BY id' > rlm_sql (sql): Reserving sql socket id: 3 > rlm_sql (sql): User TRPZEDU\\jfan not found in radcheck > radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, > radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM > radgroupcheck,usergroup WHERE usergroup.Username = > 'TRPZEDU=5C=5C=5C=5Cjfan' AND usergroup.GroupName = > radgroupcheck.GroupName ORDER BY radgroupcheck.id' > radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, > radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM > radgroupreply,usergroup WHERE usergroup.Username = > 'TRPZEDU=5C=5C=5C=5Cjfan' AND usergroup.GroupName = > radgroupreply.GroupName ORDER BY radgroupreply.id' > rlm_sql (sql): User TRPZEDU\\jfan not found in radgroupcheck > rlm_sql (sql): User not found > rlm_sql (sql): Released sql socket id: 3 > modcall[authorize]: module "sql" returns notfound for request 6 > modcall: group authorize returns updated for request 6 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 6 > rlm_eap: Request found, released from the list > rlm_eap: EAP NAK > rlm_eap: EAP-NAK asked for EAP-Type/peap > rlm_eap: No such EAP type peap > rlm_eap: Failed in EAP select > modcall[authenticate]: module "eap" returns invalid for request 6 > modcall: group authenticate returns invalid for request 6 > auth: Failed to validate the user. > Delaying request 6 for 1 seconds > Finished request 6 > Going to the next request > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 89 to 192.168.3.26:20000 > EAP-Message = 0x04020004 > Message-Authenticator = 0x00000000000000000000000000000000 > Trapeze-VLAN-Name = "vlan10" > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 5 ID 88 with timestamp 44ae6d5d > Cleaning up request 6 ID 89 with timestamp 44ae6d5d > Nothing to do. Sleeping until we see a request. > > > ________________________________ > > From: freeradius-users-bounces+jfan=cwlab.com(a)lists.freeradius.org on > behalf of Jin Fan > Sent: Thu 7/6/2006 5:22 PM > To: FreeRadius users mailing list > Subject: 802.1x authentication > > > > Hi, All: > > I need some pointers on how to set up 802.1x (PEAP/MSCHAP v.2) > authentication in freeradius. Generating certificates? Modifying > configurations? > > Jin > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > >

1 0