April 2007 - Freeradius-Users - lists.freeradius.org

Accept users by NAS-IP-Address
by Svend Eriksen 26 Apr '07

26 Apr '07

It worked fine, thank you. Is it possible to reject users except when they have a valid NAS-IP-Address? For example if a user is not member of a group, or if they are only member of groups which doesnt contain the NAS-IP-Address? I found the 'notfound-reject' for request that doesnt contain NAS-IP-Address (in my case). reg Svend >>/ The problem occurs when I want a group to contain several NAS. How can I />>/ make freeradius accept the login if the NAS-IP-Address from the user, is />>/ one of several listed in a group that a user is member of? /> >==> read info about checkval module in radiusd.conf. > >checkval { > item-name = NAS-IP-Address > check-name = NAS-IP-Address > data-type = ipaddr >} > >* enable the module in section authorize > >and in your radgroupcheck you have to do something like this: > >mysql> select * from radgroupcheck where attribute like 'NAS-IP-Address'; >+----+---------------+----------------+----+-----------------+ >|/ id | GroupName | Attribute | op | Value | />+----+---------------+----------------+----+-----------------+ >|/ 83 | config_common | NAS-IP-Address | += | 1.2.3.4 | />|/ 84 | config_common | NAS-IP-Address | += | 1.2.3.5 | />+----+---------------+----------------+----+-----------------+ > >then if your your user will be in group called "config_common"(whatever >you choose) then checkval module will perform checking base on multiple >values found for NAS-IP-Address. Please mind the "op" field especially!

1 0

Re : mysql ms-chap
by Eshun Benjamin 26 Apr '07

26 Apr '07

Does anybody have import passwords into a mysql table. Is it possible or is it a bullshit ? yes it is possible ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Jean Frontin <frontin(a)irit.fr> À : freeradius-users(a)lists.freeradius.org Envoyé le : Jeudi, 26 Avril 2007, 10h53mn 51s Objet : mysql ms-chap Hello, I'm using 802.1X protocol and user passwords are stored in "smbpasswd" file. When I want to add a user I must restart radius. Does anybody have import passwords into a mysql table. Is it possible or is it a bullshit ? Regards Jean Frontin System team I R I T Université Paul-Sabatier 118, rte de Narbonne 31062 Toulouse cedex 9 France tel (33)(0)5 61 55 63 03 mail frontin(a)irit.fr - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

mysql ms-chap
by Jean Frontin 26 Apr '07

26 Apr '07

Hello, I'm using 802.1X protocol and user passwords are stored in "smbpasswd" file. When I want to add a user I must restart radius. Does anybody have import passwords into a mysql table. Is it possible or is it a bullshit ? Regards Jean Frontin System team I R I T Université Paul-Sabatier 118, rte de Narbonne 31062 Toulouse cedex 9 France tel (33)(0)5 61 55 63 03 mail frontin(a)irit.fr

2 1

Cryptocard .tok?
by Andreas Anderson 26 Apr '07

26 Apr '07

Hi Guys, can someone tell me how i can get the DES key from the .tok files? While searching i found numerous references to a utility from bugtrack, but the utility itself is nowhere to be found. If someone on the list still has it i would really appreciate a copy ;-) Is there any other way to use the Cryptocards in freeradius (installing their Java-Monster aside)? Regards, Andreas _________________________________________________________________ Live Search delivers results the way you like it. Try live.com now! http://www.live.com

1 0

typo in raddb/Makefile
by Milan Holub 26 Apr '07

26 Apr '07

Hi Alan, due to missing `;` and typo in variable in raddb/Makefile you can't build *deb package. Here is a patch: Index: raddb/Makefile =================================================================== RCS file: /source/radiusd/raddb/Makefile,v retrieving revision 1.17 diff -u -r1.17 Makefile --- raddb/Makefile 24 Apr 2007 15:35:12 -0000 1.17 +++ raddb/Makefile 25 Apr 2007 12:19:26 -0000 @@ -43,8 +43,8 @@ fi chmod 640 $(R)$(raddbdir)/naspasswd $(R)$(raddbdir)/clients.conf if [ ! -d $(R)$(raddbdir)/certs ]; then \ - $(INSTALL) -d -m 750 $(R)$(raddbdir)/certs \ - for x in Makefile README xpextensions ca.cnf server.cnf client.cnf; do \ + $(INSTALL) -d -m 750 $(R)$(raddbdir)/certs; \ + for i in Makefile README xpextensions ca.cnf server.cnf client.cnf; do \ $(INSTALL) -m 640 certs/$$i $(R)$(raddbdir)/certs; \ done; \ fi Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

3 7

RE: Freeradius-Users Digest, Vol 24, Issue 100
by Tamba Ben-Jusu 26 Apr '07

26 Apr '07

Hi All, I run freeradius on an Ubuntu platform and have been using it to deliver both authentication and bandwidth enforcing for its client. Now I want to deliver a dedicated bandwidth to a certain client, please help me with information on how to achieve this. Thanks Tamba

3 2

RES: Re: RES: Re: PEAP/EAP-TLS with client and server certificate
by Marcelo Augusto Rodrigues Pimentel 25 Apr '07

25 Apr '07

Marcelo Augusto Rodrigues Pimentel wrote: > OK. But I?m trying to use peap to make an encrypted tunnel validating the server certificate and then I want to authenticate the clients whith EAP-TLS using client/server certificate. The TLS tunnel is working fine, but the second part of EAP-TLS authentication not. > What second part of EAP-TLS? The server supports authenticating via client certificates, and nothing else. I said two parts, because those parts of my configuration uses TLS: The first part is making the encrypt tunnel using PEAP --> Only validates server certificate to create the tunnel. The second part is the authenticathion inner the tunnel with EAP-TLS --> Mutual validation of client and server certificate. This configuration is like Geroge Ou said below: ... PEAP-EAP-TLS is an improved version of the original EAP-TLS protocol that goes further to encrypt client digital certificate information. Both PEAP-EAP-TLS and EAP-TLS have the same server and client side digital certificate requirements. ... Reference: Wireless LAN security guide --> Level 3: Medium to large Enterprise WLAN security" http://www.lanarchitect.net/Articles/Wireless/SecurityRating/ Thank´s ! > So .... in the peap section in the eap.conf, what I?ve to configure for default eap type? Is tls ? > No. You can leave it alone. It's fine. > If I configure tls, I?ve to create a tls section in the peap section or the tls section of the eap.conf is enough. I?ve attached my eap.conf file. > If you want to use just TLS, you don't need the PEAP section. If you want to use PEAP, you need the TLS section. The comments in the "eap.conf" file explain this. "Mensagem protegida por sigilo profissional. Sua utilização indevida sujeita o infrator às penas da lei. Não sendo seu destinatário, por favor, elimine-a e informe o equívoco ao emitente." "This e-mail message and any attachment are intended exclusively for the named addressee. They may contain confidential information which may also be protected by professional secrecy. Unless you are the named addressee (or authorised to receive for the addressee) you may not copy or use this message or any attachment or disclose the contents to anyone else. If this e-mail was sent to you by mistake please notify the sender immediately and delete this e-mail."

4 6

Re: Win XP with 802.1x PEAP (EAP-MSCHAP V2)
by Marc Charbonneau 25 Apr '07

25 Apr '07

Ok, that's what I thought (about the root Certificate not being pleasing to XP). FYI: I'm using a version of Linux by Novell called SLES (SUSE Linux Enterprise Server) version 9 Service Pack 3 and the FreeRADIUS is from Novell's Web site (freeradius-1.0.2-0.i586.rpm, freeradius-devel-1.0.2-0.i586.rpm). I've done my Certificate work by using SLES' YaST, "Security and Users", "CA Management". I simply exported the root cert using this CA Management GUI. This worked great with Cisco's ADU configuration tool. If someone could give me the quickest and easiest way to creating a root certificate that's works with Windows XP, that would be great. I have another CA running on a Windows 2003 server, can I make use of this CA somehow? Thanks for any help. Marc >>> A.L.M.Buxey(a)lboro.ac.uk 4/25/2007 1:33:00 PM >>> hi, rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select okay. so thats the main issue. were your certificates generated with the XP extensions? how have you configured the native supplicant? it doesnt need much configuring.... just disable fast-connect, disable user guest account, use machine auth (if you're not doing machine) and click the MSCHPv2 stuff and deselect the 'use windows username/password' if you cannot use those. then its up to you to ensure the cert is in the store and you verify or dont verify your radius cert. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Win XP with 802.1x PEAP (EAP-MSCHAP V2)
by Marc Charbonneau 25 Apr '07

25 Apr '07

Gentlemen, I could use your help. I have a number of wireless devices that use FreeRADIUS to authenticate back to eDirectory with success while using Cisco's supplicant. The Cisco ADU (Aironet Desktop Utility) is configured with 802.1x PEAP (EAP-MSCHAP V2). For various reasons, I really need to make it work with the Microsoft supplicant. The Cisco docs indicate that it is possible to disable the use of their ADU to configure the WLAN card and use the Microsoft Wireless Configuration Manager in Windows XP. I would like to keep the same 802.1x authentication type, PEAP (EAP-MSCHAP V2). I have followed Cisco's detailed docs on this change of configuration and I am not getting any success. RADIUSD log is below. I have spent too much time on this issue, can someone please point me in the right direction. Thanks much, Marc *-----------------------------------------------------RADIUSD LOG*----------------------------------------------------- rad_recv: Access-Request packet from host 192.168.242.4:32768, id=222, length=184 User-Name = "UOHI-40628" Calling-Station-Id = "00-40-96-B1-43-BB" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x0209000f01554f48492d3430363238 Message-Authenticator = 0x8881c69556fbec1f966ab6b8081d75ec Processing the authorize section of radiusd.conf modcall: entering group authorize for request 38 modcall[authorize]: module "preprocess" returns ok for request 38 modcall[authorize]: module "chap" returns noop for request 38 modcall[authorize]: module "mschap" returns noop for request 38 rlm_realm: No '@' in User-Name = "UOHI-40628", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 38 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40628 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40628))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40628)) rlm_ldap: checking if remote access for UOHI-40628 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40628 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 38 rlm_eap: EAP packet type response id 9 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 38 modcall: group authorize returns updated for request 38 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 38 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 38 modcall: group authenticate returns handled for request 38 Sending Access-Challenge of id 222 to 192.168.242.4:32768 EAP-Message = 0x010a00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4dda1f635e420966fc8dbbcc69dda607 Finished request 38 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=223, length=267 User-Name = "UOHI-40628" Calling-Station-Id = "00-40-96-B1-43-BB" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x020a005019800000004616030100410100003d0301462f5a5fd08496fa6f73faf534b5d9dfc37bd2c6669a9574fa88e6335c8ad88a00001600040005000a000900640062000300060013001200630100 State = 0x4dda1f635e420966fc8dbbcc69dda607 Message-Authenticator = 0x9018d1e50a6f18bc6b57d69c25671a00 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 39 modcall[authorize]: module "preprocess" returns ok for request 39 modcall[authorize]: module "chap" returns noop for request 39 modcall[authorize]: module "mschap" returns noop for request 39 rlm_realm: No '@' in User-Name = "UOHI-40628", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 39 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40628 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40628))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40628)) rlm_ldap: checking if remote access for UOHI-40628 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40628 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 39 rlm_eap: EAP packet type response id 10 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 39 modcall: group authorize returns updated for request 39 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 39 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 098e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 39 modcall: group authenticate returns handled for request 39 Sending Access-Challenge of id 223 to 192.168.242.4:32768 EAP-Message = 0x010b040a19c0000009eb160301004a020000460301462eb1d736542a8a4df2f4f3a5844ef939143c291aee6778ea4f87a6236ebf88207d4d3e0a6f3cce6751337b109c3c125ed04ea100b962d594018546de179773b4000400160301098e0b00098a0009870004e5308204e1308203c9a003020102020102300d06092a864886f70d01010505003072310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761312d302b060355040a1324556e6976657273697479206f66204f747461776120486561727420496e737469747574653111300f060355040313086f6869736c657331301e EAP-Message = 0x170d3036313031303137343732365a170d3037313031303137343732365a3081a6310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761312d302b060355040a1324556e6976657273697479206f66204f747461776120486561727420496e737469747574653120301e060355040313176f6869736c6573312e6f747461776168656172742e63613123302106092a864886f70d010901161461646d696e406f747461776168656172742e636130820122300d06092a864886f70d01010105000382010f003082010a0282010100bd9e19cc9f7510ee7a3170729413a3724cdf9b4355 EAP-Message = 0x500a711649144df5caee883e099d4229e52a023ee71fbad5fa7c91cd8374529160801c6323e357e3a313610c4ed3266e7d305015f0686e4cab8e2839099d7a36f5412774232e115fdbbace6238601a88ec0eb12134da278895a504f479bfeee87aa2ac9c50a9e387ae89fdfb6b6b0dc01abe0ea4f77b2a3e606b60c9c6be6d8b688ab34989c93f27240c43ba7b4e0ae8f42ad6b179411de526fcafe7fc75f257fdb551ec16d23876010e4cb5c0ea83c37be6ddaca2c455ab7b89ded92786d7cd1cb4bcf851f78845a4bd923293b50c86d8ac54f316ac3cd9917aadc265881e2b5ae30a1220d0798d2944930203010001a382014b308201473009060355 EAP-Message = 0x1d1304023000303006096086480186f842010d04231621596153542047656e65726174656420536572766572204365727469666963617465301106096086480186f8420101040403020640300b0603551d0f040403020520301d0603551d0e0416041470bf34961e35fdf4aaf4dcaee9a7e137e2652ec030819c0603551d2304819430819180144998ca048e04b60db2fb700a2b3716b300fcb779a176a4743072310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761312d302b060355040a1324556e6976657273697479206f66204f747461776120486561727420496e73746974 EAP-Message = 0x7574653111300f060355040313086f6869736c657331 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0d45f794c16d885a70ce95b2f9482a78 Finished request 39 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=224, length=193 User-Name = "UOHI-40628" Calling-Station-Id = "00-40-96-B1-43-BB" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x020b00061900 State = 0x0d45f794c16d885a70ce95b2f9482a78 Message-Authenticator = 0x52561bab2e8c9afa9b6d07292146a53b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 40 modcall[authorize]: module "preprocess" returns ok for request 40 modcall[authorize]: module "chap" returns noop for request 40 modcall[authorize]: module "mschap" returns noop for request 40 rlm_realm: No '@' in User-Name = "UOHI-40628", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 40 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40628 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40628))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40628)) rlm_ldap: checking if remote access for UOHI-40628 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40628 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 40 rlm_eap: EAP packet type response id 11 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 40 modcall: group authorize returns updated for request 40 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 40 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 40 modcall: group authenticate returns handled for request 40 Sending Access-Challenge of id 224 to 192.168.242.4:32768 EAP-Message = 0x010c04061940820100301f0603551d1104183016811461646d696e406f747461776168656172742e636130090603551d1204023000300d06092a864886f70d01010505000382010100b2eb4b296d4d38a8f0eca582b092107e24976a83c5b6068922d3348769521e0a4b57f3e843d50c851db4ad541f6342beea24a6467e73a53fae3be20573bf824b87ce49a1dc946dfc2ecb2579136eff8464c5d5f4266cc9dbde9ad6766007960ed23c7a47cd05ddea1bbfcf494af0af491e273729a6f52aa172d7e7ba09741280098d4ce25d2c951733bf9a56647a247040d11781025175e1da1cc5b546e8deb8c71bbc52e521e0b38006447eee72c4d6c31192b2 EAP-Message = 0x47b9ef622eb5c5162e8f13fb856bf31e447f2a3ca9f32b77eb99ab60fad53474c452a8749d06fcce810f7855c5340edeb4b5f77ce880e780565c0b60fd3d2f60ca91b2ba676191090fc7e5f400049c3082049830820380a003020102020100300d06092a864886f70d01010505003072310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761312d302b060355040a1324556e6976657273697479206f66204f747461776120486561727420496e737469747574653111300f060355040313086f6869736c657331301e170d3036313030323139313331335a170d3136303932393139 EAP-Message = 0x313331335a3072310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761312d302b060355040a1324556e6976657273697479206f66204f747461776120486561727420496e737469747574653111300f060355040313086f6869736c65733130820122300d06092a864886f70d01010105000382010f003082010a0282010100e050a5f7f6204276dce3df6c20ddc3cf195f382301b3c374408ce528cd5ef3d4931ccaa304b9105b09377d3cf3b3489665496581c1c2b4b95ae785fe925f203eb266ac65e1d9a463cde7f7befe5f843d5cff41b4cea891cf8918cfd0634d2806e31a4f EAP-Message = 0x7b2d4e8dd26cae6b4ba5418df21a65073208af5afe60ff565d0616a37493a1cfc94899ccd85fed161653736d0addd1a4e267112f08f81506243ab63f9700a5529e22967dac11a2b8ffa1f3239f784ecc5299d8c31d6d159386aceb39b32f29d6cb784249f234baab3b1845e418bd2df18b71f801d80787f17fddfed27494885eda51d2c05e29a5ad33330920cdd040d13e2c54c432d29667a3ef2f9c4d0203010001a382013730820133300f0603551d130101ff040530030101ff302c06096086480186f842010d041f161d596153542047656e657261746564204341204365727469666963617465301106096086480186f842010104040302010630 EAP-Message = 0x0b0603551d0f040403020106301d0603551d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa69c23be214cea213ab71772ec162e3e Finished request 40 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=225, length=193 User-Name = "UOHI-40628" Calling-Station-Id = "00-40-96-B1-43-BB" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x020c00061900 State = 0xa69c23be214cea213ab71772ec162e3e Message-Authenticator = 0xaa8de108a0eecfcde92e4c62ed858be4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 41 modcall[authorize]: module "preprocess" returns ok for request 41 modcall[authorize]: module "chap" returns noop for request 41 modcall[authorize]: module "mschap" returns noop for request 41 rlm_realm: No '@' in User-Name = "UOHI-40628", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 41 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40628 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40628))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40628)) rlm_ldap: checking if remote access for UOHI-40628 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40628 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 41 rlm_eap: EAP packet type response id 12 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 41 modcall: group authorize returns updated for request 41 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 41 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 41 modcall: group authenticate returns handled for request 41 Sending Access-Challenge of id 225 to 192.168.242.4:32768 EAP-Message = 0x010d01f119000e041604144998ca048e04b60db2fb700a2b3716b300fcb77930819c0603551d2304819430819180144998ca048e04b60db2fb700a2b3716b300fcb779a176a4743072310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761312d302b060355040a1324556e6976657273697479206f66204f747461776120486561727420496e737469747574653111300f060355040313086f6869736c65733182010030090603551d110402300030090603551d1204023000300d06092a864886f70d010105050003820101009a6086c121e9b175d4b9c5e9406243685a58250199 EAP-Message = 0x513347d581ba358ed6c64ac14e2782da6d6e9b40df6221c2d25e1eb785004c49bb4bb8c8889c417db67e00082324108726a295dd3121c67ddd83d7453726ce22abd2887e7ab93f829566a259347004b581a21e96db42ee57c3f29ede27882370daf38a45c331dd3c7f37a3d8c3740dd5e3ff107bd9b50dd2a9c3f18b550962f9ce5d4dda747c13b135a888f7db26648c436102b4393b7ec907d1cfaa04fac70f244c677442ea413bddd490cf144e38604f9bacbe91b9b7eb23ecf768048d71d23976d9899db5267d4f6f0ea00897c1642c3a4f70d8e21f2f04285554faa174ce6971cc6986e7c87f56ce2016030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x66033bb93efe19bc2d9927ae35020a1c Finished request 41 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=226, length=509 User-Name = "UOHI-40628" Calling-Station-Id = "00-40-96-B1-43-BB" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x020d0140198000000136160301010610000102010086e0f9ad658ba724bdd476c7d85b8546179334b45eb22fbbdd454326aa5ac1d00e73314dd9f1d1062acb9cb6a7a52017d219aed52f301eecdd6cc9ecaa430687a8506d5133313796465869536c861713fc98b50c7e4fc4e2e049bae00a01c919f33a9992fdb17c6c01efcb6ecb9fdfa076a46cc353164b53da2794ed7629cfc550488076a11513bdb0ce38361b61159bf5c62a93c6f322ff0d7f10c11b42c76be143fa2d7ce697b917df9948758e41f0fde6fefc636a5174b0f7fed1133e911cad334551be4fed1a9e8a2ea891d53f2bb5480c36ab18f17e454edb9b363dca569106885aefc2f07b EAP-Message = 0x54693c4cc6fc46d497033ae13a2bd4232717955983f96bab1403010001011603010020855695767ea53d5e8315327a5db64cf94eecbd1e8dc21c668149e5249ab54709 State = 0x66033bb93efe19bc2d9927ae35020a1c Message-Authenticator = 0x780254fe75985fe63ca23fedb0cb7bbb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 42 modcall[authorize]: module "preprocess" returns ok for request 42 modcall[authorize]: module "chap" returns noop for request 42 modcall[authorize]: module "mschap" returns noop for request 42 rlm_realm: No '@' in User-Name = "UOHI-40628", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 42 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40628 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40628))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40628)) rlm_ldap: checking if remote access for UOHI-40628 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40628 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 42 rlm_eap: EAP packet type response id 13 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 42 modcall: group authorize returns updated for request 42 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 42 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 42 modcall: group authenticate returns handled for request 42 Sending Access-Challenge of id 226 to 192.168.242.4:32768 EAP-Message = 0x010e0031190014030100010116030100204c6f7e2f074eaf9fff787a15e29a6d0d4cca30295d1d5f9fde2ca041aa17f6b6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7b3a5e790f37b4700e491742dbc7cf95 Finished request 42 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=227, length=220 User-Name = "UOHI-40628" Calling-Station-Id = "00-40-96-B1-43-BB" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x020e00211980000000171503010012aab9a07fd9c55ae9bc2a0bd0e1128b5157f7 State = 0x7b3a5e790f37b4700e491742dbc7cf95 Message-Authenticator = 0xa502333e39b077923bc35b03b4aaec26 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 43 modcall[authorize]: module "preprocess" returns ok for request 43 modcall[authorize]: module "chap" returns noop for request 43 modcall[authorize]: module "mschap" returns noop for request 43 rlm_realm: No '@' in User-Name = "UOHI-40628", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 43 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40628 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40628))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40628)) rlm_ldap: checking if remote access for UOHI-40628 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40628 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 43 rlm_eap: EAP packet type response id 14 length 33 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 43 modcall: group authorize returns updated for request 43 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 43 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 43 modcall: group authenticate returns invalid for request 43 auth: Failed to validate the user. Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 43 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: eDirectory account policy check failed. rlm_ldap: NDS error: failed authentication (-669) rlm_ldap: ldap_release_conn: Release Id: 0 modcall[post-auth]: module "ldap" returns reject for request 43 modcall: group Post-Auth-Type returns reject for request 43 Delaying request 43 for 1 seconds Finished request 43 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=227, length=220 Sending Access-Reject of id 227 to 192.168.242.4:32768 EAP-Message = 0x040e0004 Message-Authenticator = 0x00000000000000000000000000000000 Reply-Message = "NDS error: failed authentication (-669)" --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 38 ID 222 with timestamp 462eb1d7 Cleaning up request 39 ID 223 with timestamp 462eb1d7 Cleaning up request 40 ID 224 with timestamp 462eb1d7 Cleaning up request 41 ID 225 with timestamp 462eb1d7 Cleaning up request 42 ID 226 with timestamp 462eb1d7 Cleaning up request 43 ID 227 with timestamp 462eb1d7 Nothing to do. Sleeping until we see a request.

2 1

radtest and Message-Authenticator
by Norbert Wegener 25 Apr '07

25 Apr '07

When I send radtest 000000000009 000000000009 brm 1812 secret xx 10.10.20.138 to a freeradiusserver, I get an access accept. Sending the same radtest command line to an IAS, that should proxy that request to a freeradiusserver, the IAS complains about a missing Message-Authenticator. What do I have to do to get a Message-Authenticator in such a radtest request? Thanks Norbert Wegener

2 1