May 2007 - Freeradius-Users - lists.freeradius.org

Re : User-Name and Clear Text Password configurations
by Eshun Benjamin 12 May '07

12 May '07

I want to send out Authentication Request message with only the "User-Name" and "Password". Moreover i want the password to be clear text. Is it possible to configure the free-radius server for just these requirements? YES I did configure the username and password in the "users" file but server seems to be looking for a encrypted password and is thus sending back a reject. Any way to configure a username and a clear text password? You can use CHAP to authenticate and ensure you send clear text from your access point but not EAP. You can see what you are receiving if you do radiusd -X ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Diameter K <diametera(a)gmail.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Samedi, 12 Mai 2007, 11h05mn 47s Objet : User-Name and Clear Text Password configurations Hi All, I want to send out Authentication Request message with only the "User-Name" and "Password". Moreover i want the password to be clear text. Is it possible to configure the free-radius server for just these requirements? I did configure the username and password in the "users" file but server seems to be looking for a encrypted password and is thus sending back a reject. Any way to configure a username and a clear text password? Thanks in advance, Shiv - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

Markus Wintruff istaußer Haus.
by markus.wintruff＠linde.com 11 May '07

11 May '07

Ich werde ab 12.05.2007 nicht im Büro sein. Ich kehre zurück am 21.05.2007. Bitte wenden sie sich an Michael Cochu michael.cochu(a)linde.com +49-40-7339-1432. I am not in the office. Please contact Michael Cochu michael.cochu(a)linde.com +49-40-7339-1432.

1 0

3Com Total Control not logging
by Roberto Greiner 11 May '07

11 May '07

Hi, I just migrated my old GNU-Radius to freeradius 1.1.6 in a Debian Etch box. So far, everything is working, but one odd thing is happening. I'm authenticating users from tree differente types of NAS: One Monowall Box, one pptp box (running PopTop), and one dialup box based on 3Com's Total Control. All three are working fine and authenticating properly, but with one catch. The users from the Total Control box do authenticate properly, but they are not registered in the logs. No entry in the radacct table in MySQL, nothing in radwho nor in radlast. The users are connecting (I've confirmed that), and no error message is generated for the the Total Control users, but no log is generated. Sample entries from the radius.log file: Wed May 9 14:33:27 2007 : Auth: Login OK: [TCuser] (from client totalcontrol port 3604 cli ) Wed May 9 14:33:27 2007 : Auth: Login OK: [Monowalluser] (from client monowall port 112 cli 00:19:7d:4f:ea:52) The only diference I've noticed is that the Total Control entries do not have an address (MAC or IP) at the, which both the Monowall and the pptp users get. Could it be related? All NAS are configured exactly the same way, and their config is stored in the nas table in MySQL. Any ideas of what could be wrong? In GNU-Radius the Total Control box was logging properly. Thank you in advance, Marcos Roberto Greiner -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------

2 1

Must set auth-type - but why?
by John Horne 11 May '07

11 May '07

Hi, I am in the process of upgrading a couple of servers from using FreeRadius 1.0.1 (on FC3), to FreeRadius 1.1.6 (on CentOS 5). In our 'users' file we have a few entries such as: bob Auth-Type = Local,User-Password := "abc",Proxy-To-Realm := LOCAL This works fine with FR 1.0.1. By default we proxy all requests with the NULL realm, so the 'Proxy-To-Realm' had to be included. These users (listed in the 'users' file) connect from Windows XP clients using MS-CHAPv2. However, with FR 1.1.6, this type of user entry failed. After some investigating of the list archives, I saw that the use of Auth-Type generally seemed not to be required. FreeRadius would work out what to do. It didn't. I removed the Auth-Type and still got login failures. The following however, setting the Auth-Type, did work: bob Auth-Type = MSCHAP,User-Password := "abc",Proxy-To-Realm := LOCAL Whilst trying to sort this out, I noted Alan DeKok's comments (in the list archives) that generally Auth-Type does not need to be set (or indeed should *not* be set), and that FR will do the right thing. I am, therefore, a bit concerned that in this instance it seems that Auth-Type must be set for FR to work. I am wondering if this is because I have perhaps made some other error in the radiusd.conf file. Using FR 1.1.6, and running 'radiusd -X', I see failures when not using Auth-Type, and this is in fact exactly the same as if I used 'Auth-Type = Local': ================================================================== rad_recv: Access-Request packet from host 127.0.0.1:33137, id=20, length=149 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "bob" MS-CHAP-Challenge = 0xb3b1f660b5ea874b1c876ca0c058e629 MS-CHAP2-Response = 0xe0008a5ba595d775a04d4169716641ae087e0000000000000000da72659a62c6a221bd42a1079c1114f714f46bc286ab4047 Calling-Station-Id = "141.163.60.7" NAS-IP-Address = 141.163.199.250 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry bob at line 8 modcall[authorize]: module "files" returns ok for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "bob", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "bob" rlm_realm: Proxying request from user bob to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 WARNING: You set Proxy-To-Realm = LOCAL, but it is a LOCAL realm! Cancelling invalid proxy request. rad_check_password: Found Auth-Type auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [bob] (from client localhost port 0 cli 141.163.60.7) Cancelling proxy as request was already rejected Request 0 rejected in proxy_send. Server rejecting request 0. Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 127.0.0.1:33137, id=20, length=149 Sending Access-Reject of id 20 to 127.0.0.1 port 33137 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 20 with timestamp 464449e2 Nothing to do. Sleeping until we see a request. ================================================================== As can be seen it says that rlm_mschap sees it is an MS-CHAP request and sets the Auth-Type. But it then later says: rad_check_password: Found Auth-Type auth: type Local and then fails because of no User-Password or CHAP-Password attribute. If I set the Auth-Type in the 'users' file, then I get: ===================================================================== rad_recv: Access-Request packet from host 127.0.0.1:33137, id=21, length=149 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "bob" MS-CHAP-Challenge = 0xdc450c11091700477a0d759da792a0a7 MS-CHAP2-Response = 0x8f007bdfb77f958d304d40526eabbcb6cfdf0000000000000000d16a13d382097bbc5cfb8d41468f6422ee9eff3f038f9eab Calling-Station-Id = "141.163.60.7" NAS-IP-Address = 141.163.199.250 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry bob at line 8 modcall[authorize]: module "files" returns ok for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "bob", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "bob" rlm_realm: Proxying request from user bob to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 WARNING: You set Proxy-To-Realm = LOCAL, but it is a LOCAL realm! Cancelling invalid proxy request. rad_check_password: Found Auth-Type MSCHAP auth: type "mschap" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_mschap: Told to do MS-CHAPv2 for bob with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 0 modcall: leaving group authenticate (returns ok) for request 0 Login OK: [bob] (from client localhost port 0 cli 141.163.60.7) WARNING: Cancelling proxy to Realm LOCAL, as the realm is local. Sending Access-Accept of id 21 to 127.0.0.1 port 33137 MS-CHAP2-Success = 0x8f533d31334430304342353844313130454643343131313043333241424237434145394236454443454531 MS-MPPE-Recv-Key = 0x273434105c0ed9fc6e57a499d5abffee MS-MPPE-Send-Key = 0x98eed82e84689dc22315e6d3d83733f8 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 Finished request 0 ===================================================================== As can be seen the Auth-Type in the users file is seen and rlm_mschap now does the right thing: rlm_mschap: Told to do MS-CHAPv2 for bob with NT-Password In the radiusd.conf file, which is basically the same from FR 1.0.1 to 1.1.6, the relevant (I hope) sections are: ===================================================================== modules { pap { auto_header = yes } $INCLUDE ${confdir}/eap.conf mschap { # - this line used in FR 1.0.1 authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } [ rest of modules section snipped ] authorize { preprocess eap files mschap suffix } authenticate { Auth-Type PAP { pap } mschap eap } ===================================================================== So my question is, does anyone have an explanation for this behaviour? Obviously it is great that our 'users' files entries work under FreeRadius 1.1.6 with only a minor change. However, since generally Auth-Type should not be required, it is a worry that we *have* to set it to get FR to work. Since the radiusd output shows that FR sees this is an MS-CHAP request, I would have thought it would handle it correctly. It doesn't, but instead treats it as a 'Local' type request. Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

4 8

ttls problem
by tevfik 11 May '07

11 May '07

Hi. I have problems with performing authentication with freeradius. When I use the command: radtest tkiziloren password ldap.anaadolu.edu 10 testing123 i get the message below: rad_recv: Access-accepted... However when i try to perform same task by using securew2 on XP client, it always shows "attempting to authenticate", I pasted the debug results or radiusd below: I am new to freeradius. Could anybody help me where the problem is?. Is there a problem with certificate? (I use cisco aironet 1200 AP) Thanks in advance. Tevfik Kızılören. rad_recv: Access-Request packet from host 10.10.7.203:1645, id=0, length=148 User-Name = "tkiziloren" Framed-MTU = 1400 Called-Station-Id = "0017.0e85.f190" Calling-Station-Id = "0011.2fb9.d08b" Service-Type = Login-User Message-Authenticator = 0xfcbf4e4b477d844b3826ae784cd6977e EAP-Message = 0x020400061500 NAS-Port-Type = Wireless-802.11 NAS-Port = 675 State = 0x74d2bac8b603cafd625c55c0992b70ba NAS-IP-Address = 10.10.7.203 NAS-Identifier = "testbum" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 0 to 10.10.7.203 port 1645 EAP-Message = 0x0105024e1580000006445504061302545231123010060355040813095452416e61646f6c75311b3019060355040a1312416e61646f6c7520556e6976657273697479310d300b060355040b13044241554d311c301a060355040313136c6461702e616e61646f6c752e6564752e74723122302006092a864886f70d01090116136c64617040616e61646f6c752e6564752e747230819f300d06092a864886f70d010101050003818d0030818902818100f87fe052d754f4586d4e311ea15bb54cd7bbe1e505e648171bfa44c6a1523906cc31d776e4a8113dd3f002e7ddd43868af03076e0f4c57c6791845adc2f7732d909e58267dc127244ebe656f95 EAP-Message = 0xf53a09222a4a3451369f97a04391610dc4b77848268d41b7f9bc37f04654d00abdc0ee376c8aad064e5ac5a5a1595bffeea9b30203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041450fd81eacea4e2d3d18547e154bc515d08630096301f0603551d2304183016801450fd81eacea4e2d3d18547e154bc515d08630096300d06092a864886f70d01010505000381810092f44ed2dade447e098f90432e2a2b58d93139471c0b41d3bbdebf1c2d09e321b43bbe2faad7d8c60e6642f5b6c2746fbb4be07033 EAP-Message = 0x4b77db5093871b2203bf2271cb97b98cc169c03f4f67d7a01261d971dfddc176cce3a42e1dd1e37037060a528db7e8481722e222549b882a93cfa582a29df0f1b401a28e197772410a1f1016030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9d3c9b53656089b1510d55b3a1f50a33 Finished request 6 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 6 ID 0 with timestamp 46421b1a Cleaning up request 4 ID 254 with timestamp 46421b1a Cleaning up request 5 ID 255 with timestamp 46421b1a Nothing to do. Sleeping until we see a request. -- View this message in context: http://www.nabble.com/ttls-problem-tf3717596.html#a10400374 Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 21

LDAP/RACF authentication error
by Marc Giuliani 11 May '07

11 May '07

Hello, I am try to set up authentication for Oracle 10g (on Solaris) --> Radius (on Solaris)--> LDAP (on Z/os) --> Racf (on z/os)... i was able to get past my last error however now I am getting a "no authentication method found" type of error. Can anyone assist me? I have checked that the secret password matches on the LDAP server, radius server and Oracle... rad_recv: Access-Request packet from host 10.71.175.19:37544, id=178, length=47 User-Name = "NBCTST1" User-Password = "/\265P\251R\344>%P\2022\0144\0165p" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/opt/local/var/log/radius/radacct/10.71.175.19/auth-detail-20070511' rlm_detail: /opt/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /opt/local/var/log/radius/radacct/10.71.175.19/auth-detail-20070511 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "NBCTST1", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [NBCTST1//\265P\251R\344>%P\2022\0144\0165p] (from client test1 port 0) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 1 for 1 seconds

1 0

TTLS working. Is it secure?
by tevfik 11 May '07

11 May '07

Hi, I was able to configure radius server, users can connect after entering user credentials. However I am not sure whether the configuration fully correct or not. In below, I pasted my radius daemon logs for only one authentication process. Entered username was true and password was false. Why there are 4 request for only one authentication process? What is wrong with it? What does "rlm_ldap: user tkiziloren authorized to use remote access" mean? The password is not true how can a user authorized although his/her password is false. Thanks in advance. Tevfik. rad_recv: Access-Request packet from host 10.10.7.203:1645, id=11, length=139 User-Name = "tkiziloren" Framed-MTU = 1400 Called-Station-Id = "0017.0e85.f190" Calling-Station-Id = "0011.2fb9.d08b" Service-Type = Login-User Message-Authenticator = 0x46e9a61e176eb2fad26f1f689c9edc79 EAP-Message = 0x0202000f01746b697a696c6f72656e NAS-Port-Type = Wireless-802.11 NAS-Port = 260 NAS-IP-Address = 10.10.7.203 NAS-Identifier = "testbaum" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.anadolu.edu.tr:389, authentication 0 rlm_ldap: bind as / to ldap.anadolu.edu.tr:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 11 to 10.10.7.203 port 1645 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbe88ae73ff01db2d490c7144a376c659 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.7.203:1645, id=12, length=202 User-Name = "tkiziloren" Framed-MTU = 1400 Called-Station-Id = "0017.0e85.f190" Calling-Station-Id = "0011.2fb9.d08b" Service-Type = Login-User Message-Authenticator = 0x1c053c94b8fa5bc90c998ed9517b8a7c EAP-Message = 0x0203003c158000000032160301002d0100002903014a5bc504f836fec860348fb73185a7cc772a9bdf5f440445d0eaedbc8e8ffa77000002000a0100 NAS-Port-Type = Wireless-802.11 NAS-Port = 260 State = 0xbe88ae73ff01db2d490c7144a376c659 NAS-IP-Address = 10.10.7.203 NAS-Identifier = "testbaum" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 60 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 002d], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 05e7], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 12 to 10.10.7.203 port 1645 EAP-Message = 0x0104040a15c000000644160301004a02000046030146446335adedcee21b0f7d388612e4511b161a05d7f60d50d05c530f0fbb556120d89b7e2fff61268e1088096ae7e5496aa5a0fc9da67f65c7f65e1d792a44f208000a0016030105e70b0005e30005e00002c5308202c13082022aa003020102020101300d06092a864886f70d010105050030818f310b300906035504061302545231123010060355040813095452416e61646f6c75311b3019060355040a1312416e61646f6c7520556e6976657273697479310d300b060355040b13044241554d311c301a060355040313136c6461702e616e61646f6c752e6564752e74723122302006092a86 EAP-Message = 0x4886f70d01090116136c64617040616e61646f6c752e6564752e7472301e170d3037303530383130333833325a170d3038303530373130333833325a3081a3310b300906035504061302545231123010060355040813095452416e61646f6c75311230100603550407130945736b697365686972311b3019060355040a1312416e61646f6c7520556e6976657273697479310d300b060355040b13044241554d311c301a060355040313136c6461702e616e61646f6c752e6564752e74723122302006092a864886f70d01090116136c64617040616e61646f6c752e6564752e747230819f300d06092a864886f70d010101050003818d003081890281 EAP-Message = 0x8100aa7e832714838afb5c85df7c60afaf107142a9e077659f216e0b0cee26180413d2ce23bd4551cb0e7243dbae482db8757502159b52b08f8776b1fef8110ea8798dc7bd0db591296d73e37cad9a07ad8b1c1db6360104861ae0405cab03544b1ae33633df6a5403c79bdde9ab57ed2dcfe191f5f34418b555c953351acc461ce70203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181003c0a0c3e188348ce41725b4c062f8a8570a1bf407bb6ee3504b9df6a18e935fe2f8792c914c2eabadd85e6ea701ec99443a06e436152b7b9fd413cf44fbd09db68cdf3879c76ea673153 EAP-Message = 0xb8adc112064df7b8369c796d37251577569523b465b686408649adbb9f9006148c9e8df035dec411681b9365b9d317f44efd89b9b42b000315308203113082027aa003020102020100300d06092a864886f70d010105050030818f310b300906035504061302545231123010060355040813095452416e61646f6c75311b3019060355040a1312416e61646f6c7520556e6976657273697479310d300b060355040b13044241554d311c301a060355040313136c6461702e616e61646f6c752e6564752e74723122302006092a864886f70d01090116136c64617040616e61646f6c752e6564752e7472301e170d3037303530383130333734345a170d EAP-Message = 0x3130303530373130333734345a30818f310b30090603 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdc75d5eda4e0cae9d79bba28bc969a70 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.7.203:1645, id=13, length=148 User-Name = "tkiziloren" Framed-MTU = 1400 Called-Station-Id = "0017.0e85.f190" Calling-Station-Id = "0011.2fb9.d08b" Service-Type = Login-User Message-Authenticator = 0x94a629eda2e1b020387e4292f0195afb EAP-Message = 0x020400061500 NAS-Port-Type = Wireless-802.11 NAS-Port = 260 State = 0xdc75d5eda4e0cae9d79bba28bc969a70 NAS-IP-Address = 10.10.7.203 NAS-Identifier = "testbaum" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 13 to 10.10.7.203 port 1645 EAP-Message = 0x0105024e1580000006445504061302545231123010060355040813095452416e61646f6c75311b3019060355040a1312416e61646f6c7520556e6976657273697479310d300b060355040b13044241554d311c301a060355040313136c6461702e616e61646f6c752e6564752e74723122302006092a864886f70d01090116136c64617040616e61646f6c752e6564752e747230819f300d06092a864886f70d010101050003818d0030818902818100f87fe052d754f4586d4e311ea15bb54cd7bbe1e505e648171bfa44c6a1523906cc31d776e4a8113dd3f002e7ddd43868af03076e0f4c57c6791845adc2f7732d909e58267dc127244ebe656f95 EAP-Message = 0xf53a09222a4a3451369f97a04391610dc4b77848268d41b7f9bc37f04654d00abdc0ee376c8aad064e5ac5a5a1595bffeea9b30203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041450fd81eacea4e2d3d18547e154bc515d08630096301f0603551d2304183016801450fd81eacea4e2d3d18547e154bc515d08630096300d06092a864886f70d01010505000381810092f44ed2dade447e098f90432e2a2b58d93139471c0b41d3bbdebf1c2d09e321b43bbe2faad7d8c60e6642f5b6c2746fbb4be07033 EAP-Message = 0x4b77db5093871b2203bf2271cb97b98cc169c03f4f67d7a01261d971dfddc176cce3a42e1dd1e37037060a528db7e8481722e222549b882a93cfa582a29df0f1b401a28e197772410a1f1016030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x601d05b1669ab2bed2334dbb4dbe4d93 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.7.203:1645, id=14, length=342 User-Name = "tkiziloren" Framed-MTU = 1400 Called-Station-Id = "0017.0e85.f190" Calling-Station-Id = "0011.2fb9.d08b" Service-Type = Login-User Message-Authenticator = 0xd740350b53fca08d4001aed5cb55bdd5 EAP-Message = 0x020500c81580000000be1603010086100000820080989a4f4fef1e07bdc30e36fef2b9fa53649b34891e3af4981558eff851af2c16e31edfadd788ed4caa1d9dd75fec547af24d81a30e3322652f9b3c6cf57c9e5638979da52036cc0d84e3671e2cd0e60c20c322c485f9d4893ed9a3202c3af09dae9c0f79d2a2a4a28838920c2a20dcfe9080af2e72ae3e3d4bab2353ca2dd2321403010001011603010028e030b00731ce0c04645a08c8b19879ac634ccc7264530fe9242eefa8c94c712d7f2b1f6194a2b777 NAS-Port-Type = Wireless-802.11 NAS-Port = 260 State = 0x601d05b1669ab2bed2334dbb4dbe4d93 NAS-IP-Address = 10.10.7.203 NAS-Identifier = "testbaum" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 200 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 14 to 10.10.7.203 port 1645 EAP-Message = 0x0106003d15800000003314030100010116030100281527d07e80080ef64fd3fc412609c08d94edb977645467e3ffb76ef7f04fc2cca1a0f8d6834de619 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x596d167bc9c74853ae5bd540423f3b81 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.7.203:1645, id=15, length=221 User-Name = "tkiziloren" Framed-MTU = 1400 Called-Station-Id = "0017.0e85.f190" Calling-Station-Id = "0011.2fb9.d08b" Service-Type = Login-User Message-Authenticator = 0x853240c191a67fa8675d6ccc5cd4abc3 EAP-Message = 0x0206004f1580000000451703010040cf6a442a8eef8f67c64a243cfc035a468d8b995f900af8238341332e934fc5adf057972e7723fdb6baa8a96d50184bc4ac3397ddd2963033bd8dd2ef5d184328 NAS-Port-Type = Wireless-802.11 NAS-Port = 260 State = 0x596d167bc9c74853ae5bd540423f3b81 NAS-IP-Address = 10.10.7.203 NAS-Identifier = "testbaum" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 79 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 4 modcall: leaving group authorize (returns ok) for request 4 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 4 rlm_ldap: - authenticate rlm_ldap: login attempt by "tkiziloren" with password "egermen" rlm_ldap: user DN: uid=tkiziloren,ou=people,dc=anadolu,dc=edu,dc=tr rlm_ldap: (re)connect to ldap.anadolu.edu.tr:389, authentication 1 rlm_ldap: bind as uid=tkiziloren,ou=people,dc=anadolu,dc=edu,dc=tr/egermen to ldap.anadolu.edu.tr:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials rlm_ldap: modcall[authenticate]: module "ldap_1x" returns reject for request 4 modcall: leaving group LDAP (returns reject) for request 4 auth: Failed to validate the user. TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 4 modcall: leaving group authenticate (returns invalid) for request 4 auth: Failed to validate the user. Delaying request 4 for 1 seconds Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 15 to 10.10.7.203 port 1645 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 11 with timestamp 46446335 Cleaning up request 1 ID 12 with timestamp 46446335 Cleaning up request 2 ID 13 with timestamp 46446335 Cleaning up request 3 ID 14 with timestamp 46446335 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 15 with timestamp 46446336 Nothing to do. Sleeping until we see a request. -- View this message in context: http://www.nabble.com/TTLS-working.-Is-it-secure--tf3727367.html#a10431721 Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 4

Re: free radius 1.1.6 -eap-tls authentication
by anoop_c＠sifycorp.com 11 May '07

11 May '07

Dear all Thank you for the responses I am using openssl tool for certificate generation.I have inclided the file xpextensions while generating certificates.The same certificates worked well with Navis radius server and windows xp as client.So this may not be the problem here Anoop hi, how did you generate your certificates? alan They also say this: \"The most common problem with PEAP is that the client sends a series of Access-Request messages, the server sends an series of Access-Challenge responses, and then... nothing happens. After a little wait, it all starts again. If you see this happening STOP! The RAIDUS server certificate has to have special OID\'s in it, or else the Microsoft clients will silently fail. etc.\" There we messages yesterday on this list describing this exact problem, and how to fix it. The file \"eap.conf\" describes this problem and how to fix it. The FAQ says what to do when PEAP or EAP-TLS doesn\'t work with a Windows client. Regards Anoop

2 1

Re: free radius 1.1.6 -eap-tls authentication
by anoop_c＠sifycorp.com 11 May '07

11 May '07

>>>>> The FAQ, README, INSTALL, etc. all say to run the server in debugging mode to see what\'s going on. >>>>> Dear all I run the radius server in debug mode and the output is as follows. I didn;t get any clue for the problem. [root@anoop raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = \"/usr/local\" main: localstatedir = \"/usr/local/var\" main: logdir = \"/usr/local/var/log/radius\" main: libdir = \"/usr/local/lib\" main: radacctdir = \"/usr/local/var/log/radius/radacct\" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = \"/usr/local/var/log/radius/radius.log\" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = \"/usr/local/var/run/radiusd/radiusd.pid\" main: user = \"(null)\" main: group = \"(null)\" main: usercollide = no main: lower_user = \"no\" main: lower_pass = \"no\" main: nospace_user = \"no\" main: nospace_pass = \"no\" main: checkrad = \"/usr/local/sbin/checkrad\" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = \"(null)\" mschap: ntlm_auth = \"(null)\" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = \"tls\" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = \"(null)\" tls: pem_file_type = yes tls: private_key_file = \"/etc/raddb/certs/07xwifi.pem\" tls: certificate_file = \"/etc/raddb/certs/07xwifi.pem\" tls: CA_file = \"/etc/raddb/certs/root.pem\" tls: private_key_password = \"password\" tls: dh_file = \"/etc/raddb/certs/dh\" tls: random_file = \"/etc/raddb/certs/random\" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = \"(null)\" tls: cipher_list = \"(null)\" tls: check_cert_issuer = \"(null)\" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = \"tls\" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = \"/etc/raddb/huntgroups\" preprocess: hints = \"/etc/raddb/hints\" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = \"/etc/raddb/users\" files: acctusersfile = \"/etc/raddb/acct_users\" files: preproxy_usersfile = \"/etc/raddb/preproxy_users\" files: compat = \"no\" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = \"User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port\" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = \"suffix\" realm: delimiter = \"@\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = \"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d\" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = \"(null)\" unix: shadow = \"(null)\" unix: group = \"(null)\" unix: radwtmp = \"/usr/local/var/log/radius/radwtmp\" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = \"/usr/local/var/log/radius/radutmp\" radutmp: username = \"%{User-Name}\" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.50:1031, id=0, length=197 Message-Authenticator = 0xc7b1d7b5ec22e8aeb3d3c2a37c3b3a57 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x0200000c01616e6f6f703037 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module \"preprocess\" returns ok for request 0 modcall[authorize]: module \"mschap\" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module \"files\" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module \"eap\" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.0.50 port 1031 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x002d8b408269eb13be9fe51557152e71 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1031, id=2, length=197 Message-Authenticator = 0xd4ad8d1460fc72220a6f4977f5267e73 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x0202000c01616e6f6f703037 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module \"preprocess\" returns ok for request 1 modcall[authorize]: module \"mschap\" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 1 users: Matched entry DEFAULT at line 153 modcall[authorize]: module \"files\" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module \"eap\" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 2 to 192.168.0.50 port 1031 EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x317c46c3f86f28005a91c1f1980ab3ab Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1031, id=3, length=283 Message-Authenticator = 0x701e18b26592377cb69381a32d9b7549 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x317c46c3f86f28005a91c1f1980ab3ab Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020300500d800000004616030100410100003d0301464433995ca90757d734f0075c780c8f33eb9fdc362a96a9a3eee9d37cb4c71700001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module \"preprocess\" returns ok for request 2 modcall[authorize]: module \"mschap\" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 2 users: Matched entry DEFAULT at line 153 modcall[authorize]: module \"files\" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04bf], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004c], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 3 to 192.168.0.50 port 1031 EAP-Message = 0x0104040a0dc000000564160301004a0200004603014644339a2a93e1117f8dc62c68b0c2051f4cb05aa4ee8bf4060d2e103cad32312021dad64d5e809b5721688753c3fa8c1a57936fe7e37a42293229abde363dc93100040016030104bf0b0004bb0004b800022c3082022830820191a003020102020101300d06092a864886f70d0101040500303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603550403130730377877696669301e170d3037303131323135333533305a170d3038303131323135333533305a3060310b300906035504061302494e310b3009060355040813 EAP-Message = 0x02544e310d300b060355040a1304536966793110300e06035504031307303778776966693123302106092a864886f70d0109011614616e6f6f705f634073696679636f72702e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d2bbbe35bc8a47709632284aff484695385e69c3522f63da46834f9586a420bda380889693fa77fedd9ed4290e6f9ff4436721775294fc65a38fea098f18975b34b5063de27220e18a07d433cbb6e19aeb3f84b012f7c20071dd280457a932634bbe50f438cc2ee6f4d65fa395a10bdecc4bf9087979ec45af000940e186ed290203010001a317301530130603551d25040c300a06082b EAP-Message = 0x06010505070301300d06092a864886f70d0101040500038181000afea7f2a8a9cffe60baa8f779353c523457f8237faeff81ba5f2c22664c70b6b2fb58c8967ca4a4c847b80e1d5a6cc4558ffa1d161614f374d8b5efd565aa66045b192b3ac3da82c81c4a99fc10cfe473f9ac258ef99b16cbd335004677694a05addae48c6a9dcdb26b86ddb56c635266c33c7de7586543532692e5220d30b100028630820282308201eba003020102020100300d06092a864886f70d0101040500303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603550403130730377877696669301e170d EAP-Message = 0x3037303131323135333435305a170d3038303131323135333435305a303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e060355040313073037787769666930819f300d06092a864886f70d010101050003818d0030818902818100ba8b07a479bb6ce9adf2d8bc6ac9cf214506dfc039cb10c3b4d27d1bbc082caff0bb77424819728977f04b32e231a3c4755a65823b366f1a604f15ce6c499883ab7d2757a5a2c07a11e75b7a00d6c55a8fb7443b202a25a3cdaad39579b2d8f4c09c974056f0c8666fff754d574836fcaf105200fcd5df5158e2b387310c4ed90203010001a381 EAP-Message = 0x95308192301d0603551d0e041604149eda6f69065423 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x19754bedc30572111832212fcc84191e Finished request 2 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1031, id=4, length=209 Message-Authenticator = 0xcb2030e901c7f1526ddac51af57e4dba Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x19754bedc30572111832212fcc84191e Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020400060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module \"preprocess\" returns ok for request 3 modcall[authorize]: module \"mschap\" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 3 users: Matched entry DEFAULT at line 153 modcall[authorize]: module \"files\" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 4 to 192.168.0.50 port 1031 EAP-Message = 0x0105016e0d80000005647ec1c9e4d07a608e0e6dcd730f30630603551d23045c305a80149eda6f690654237ec1c9e4d07a608e0e6dcd730fa13fa43d303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603550403130730377877696669820100300c0603551d13040530030101ff300d06092a864886f70d0101040500038181006b514f008b6a77757fc73ddbe9d54e4ea925a1ab9ce80ad7895d6d19661d8b8558d0e359876aac023aa52d4273e00407b9b588b30dbc35c5911bc89d2d99677e0ec8dea17fece35d0b4dfab8775ba73eaeb0a0998bcdf1437cff0a1031f6a5b1 EAP-Message = 0x7e8bcdc01e2e964cb256f49d947eea2cfd42989aef397fa438be294fa3dc7a3d160301004c0d000044020102003f003d303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e06035504031307303778776966690e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdc59784c151c5f91316f8ad08591688c Finished request 3 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1031, id=5, length=209 Message-Authenticator = 0x25ded394258af7d7d4a0822acf32fbf7 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0xdc59784c151c5f91316f8ad08591688c Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020500060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module \"preprocess\" returns ok for request 4 modcall[authorize]: module \"mschap\" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 4 users: Matched entry DEFAULT at line 153 modcall[authorize]: module \"files\" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 5 to 192.168.0.50 port 1031 EAP-Message = 0x0106000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfc4dda99d8ba977e9954c938dac93595 Finished request 4 Going to the next request Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 46443398 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 2 with timestamp 4644339a Cleaning up request 2 ID 3 with timestamp 4644339a Cleaning up request 3 ID 4 with timestamp 4644339a Cleaning up request 4 ID 5 with timestamp 4644339a Nothing to do. Sleeping until we see a request. Anoop

4 3

1.1.6: PAP and MySQL-stored NT-Password don't work
by Stefan Winter 11 May '07

11 May '07

Hi, I try to get rid of cleartext passwords stored in a MySQL db, and replace them by NT hashes. I set up a test environment and first tried with an entry in users: swinter NT-Password := "...", Auth-Type := Accept which worked okay. Storing the same password in MySQL did NOT work, with a quite spurious error, see below: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:52635, id=148, length=59 User-Name = "swinter" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 1234 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "swinter", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 radius_xlat: 'swinter' rlm_sql (sql): sql_set_user escaped user --> 'swinter' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'swinter' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'swinter' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'swinter' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'swinter' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 rlm_pap: Normalizing NT-Password from hex encoding modcall[authorize]: module "pap" returns updated for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 1 rlm_pap: login attempt with password test rlm_pap: Using NT encryption. radius_xlat: Running registered xlat function of module mschap for string 'NT-Hash test' rlm_mschap: Unknown expansion string "NT-Hash test" radius_xlat: '' rlm_pap: mschap xlat failed rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 1 modcall: leaving group PAP (returns reject) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Especially the lines radius_xlat: Running registered xlat function of module mschap for string 'NT-Hash test' rlm_mschap: Unknown expansion string "NT-Hash test" radius_xlat: '' rlm_pap: mschap xlat failed appear suspicious ("test" is the password"). Maybe there's some xlat escaping wrong? The configuration in use is almost as shipped, only added sql config. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

4 9