February 2008 - Freeradius-Users - lists.freeradius.org

radsqlrelay - and default config
by A.L.M.Buxey＠lboro.ac.uk 08 Feb '08

08 Feb '08

hi, I've been looking at the current state of the default (commented out ready for use) radsqlrelay commands in radiusd.conf . for a quick reminder they look like this: # sql_log { # path = "${radacctdir}/sql-relay" # acct_table = "radacct" # postauth_table = "radpostauth" # sql_user_name = "%{%{User-Name}:-DEFAULT}" # # Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '%S', '0', '0', '');" # Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ # '%{Acct-Terminate-Cause}');" # Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" # # Post-Auth = "INSERT INTO ${postauth_table} \ # (username, pass, reply, authdate) VALUES \ # ('%{User-Name}', '%{User-Password:-Chap-Password}', \ # '%{reply:Packet-Type}', '%S');" # } now - whilst radsqlrelay is recommended for those whose accounting DB systems cannot keep up with the real flow of packets - and we recommend it - its not productive to have imho a broken default config. the issues which i can see from this are the following 1) with a default postgres install, those '0' dates are not going to work with the supplied schema for PGSQL - in fact it takes a bit of breaking postgres for such values to work. the simple change is to have a null entry. 2) likewise for MySQL - '0000-00-00 00:00:00' is iirc the correct way of doing it 3) BOTH mysql and postgres (i havent done any looking into oracle) will have issues with the radacct entries - for each of them has another index in the radacct table which cannot be null and must be unique - mysql acctuniqueid varchar(32) NOT NULL default '' KEY acctuniqueid (acctuniqueid) postgres AcctUniqueId VARCHAR(32) NOT NULL such a value is not being provided in the field. which means when the user finally runs radsqlrelay they will be faced with issues. as far as i can see, radpostauth will work fine. so what I'd propose is we get a few folk who are successfully using this function, get their radiusd.conf entries, and have 2 sections for uncommenting - one for postgres and one for mysql. alan

2 2

Newslists
by Keith Dovale - HostworX.co.za 08 Feb '08

08 Feb '08

My Honest opinion of this news list / user group is that it is not helpful at all, it seems if you are not in the click, no one helps, does anyone moderate this or not ? I have posted twice now and no one replies. Regards Keith From: Keith Dovale - HostworX.co.za [mailto:keith@HostworX.co.za] Sent: Thursday, February 07, 2008 9:08 PM To: ' Subject: attr rewrite issue Hi Guys, some help please . I am trying to do a attr rewrite to change an Attribute value then do a check based on the attribute that is changed, if the check fails do another attrib rewrite to the next value and do another check, until either the check fails or passes. There is basically only 4 checks in the group statement in the authorise section which do Attrib rewrite Do check (If it fails do) Attrib rewrite Do check (If it fails do) Attrib check Do rewrite (If it fails do) Attrib check Do rewrite Reject Pass When it runs it checks the reply packet for an attribute Configuration-Token which is defined in the radgroupreply for the users but it seems it cannot find it and gives an error. As below rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user keith, check_item=0, counter=0 modcall[authorize]: module "MonthlyUnShaped" returns reject for request 2 radius_xlat: 'UNSHAPED_NORMAL' rlm_attr_rewrite: No match found for attribute Configuration-Token with value 'SHAPED_NORMAL' radius_xlat: 'UNSHAPED_NORMAL' radius_xlat: 'SHAPED_NORMAL' rlm_attr_rewrite: Changed value for attribute Configuration-Token from 'UNSHAPED_NORMAL' to 'SHAPED_NORMAL' rlm_attr_rewrite: Could not find value pair for attribute Configuration-Token modcall[authorize]: module "AttrRewrite_MonthlyBlendedShaped" returns ok for request 2 can anyone help

3 5

Unlang in auth-type sections
by Arran Cudbard-Bell 08 Feb '08

08 Feb '08

Hi, EAP type module in autz sets Auth-Type to be EAP, allowing : Auth-Type { eap ... unlang } But it appears the eap module releases the tunneled reply into the current reply list, then everything skips to post-auth. # # Allow EAP authentication. Auth-Type EAP { eap # Parse User-Name sent back from EAP-Tunnel if(ok && "%{reply:User-Name}"){ update request { User-Name := "%{reply:User-Name}" } $INCLUDE ${unlangdir}/uidrewrite.conf } } auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler ++[eap] returns ok Login OK: [anonymous/<via Auth-Type = EAP>] (from client hp-e-its-dev8021x-sw1 port 1 cli 001b63a3a8dd) +- entering group post-auth ++[reply] returns noop Is this intentional ? This is to do with logging with User-Names returned from the inner tunnel. It almost seems like this is something that belongs in the EAP module with an option to copy the User-Name from the tunnelled request to the outer request at the point the tunnelled reply is released. But i'm not sure, still trying to reason out the best way to deal with inner/outer identities. Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 1

Problems using EAP-TLS with freeradius version 2
by Stefan Puch 08 Feb '08

08 Feb '08

Hello again, @Alan DeKok > But I would first suggest trying to use the test certificates that come with > 2.0.1. If those work, then the issue isn't 2.0.0 versus 1.1.7, it's that > there is something special about the certificates you're using. I tried to generate some test certificates using the README file provided in the source-code under "freeradius-server-2.0.1/raddb/certs/" Therefore the Makefile is used in the same directory. I'm not really sure, but in Line 93 where the "client.pem" is created it must be -passin pass:$(PASSWORD_CLIENT) instead of -passin pass:$(PASSWORD_SERVER) Most of the time you will not recognize, because in server.cnf and client.cnf all the passwords are set to "whatever" so they are identical, but when you set them, you will get an error (like me). It would also be helpful to integrate the following command into the ca section, when generating a self-signed CA certificate, because using Windows you need the CA in DER-format: openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der This evening I will try to test if this certificates are working. @Reimer Karlsen-Masur > We know of problems with EE certificates in PDAs containing the > "non-repudiation" flag. > Additionally Windows build-in supplicants don't like EE certificates with > the extendedKeyUsage "Microsoft Smartcard Logon" (1.3.6.1.4.1.311.20.2.2) > when doing EAP-TLS. > Apparently the latter issue can also be solved by just disabling the valid > certificate usage of Microsoft Smartcard Logon in the issuing CAs trusted > usages properties on the system. I'm not sure if understand correctly what you want to say to me (I'm stupid :-)) First I've used TinyCA to generate my certificates, now I will try the Makefile provided in the source-code of freeradius. I think the extendedKeyUsage "Microsoft Smartcard Logon" should not be set in both variants. Or do you mean that the extendedKeyUsage "Microsoft Smartcard Logon" must be disabled on the PDA? Best regards and thanks in advance Stefan Puch

7 16

Problem when removing Auth-Type := Ldap in users file
by cxu 08 Feb '08

08 Feb '08

Hi, I am testing the freeradius server, and try to clarify rules applied in freeradius. In the following trials, I could not figure out how to make Autz-Type Ldap1 in authorize section to correctly set Auth-Type used in authentication without the help from "Auth-Type := Ldap1". With the following entry in users file, ************** DEFAULT Called-Station-Id =~ ".*Guest@myu", Autz-Type := Ldap1, Auth-Type := Ldap1 ************** the user authentication worked fine. Below is the debug output. ************** rad_recv: Access-Request packet from host 192.168.1.113 port 20000, id=19, length=98 User-Name = "tester" Called-Station-Id = "00-1B-BA-A5-45-40:Guest@myu" NAS-Port = 189 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "nortel" NAS-IP-Address = 192.168.1.113 User-Password = "testing" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest@myu expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest@myu users: Matched entry DEFAULT at line 70 ++[files] returns ok rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Autz-Type Ldap1 +- entering group Ldap1 ++- entering redundant-load-balance group redundant-load-balance rlm_ldap: - authorize rlm_ldap: performing user authorization for tester WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=tester) expand: ou=people,dc=myu,dc=ca -> ou=people,dc=myu,dc=ca rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.myu.ca:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/unbCA.crt rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as uid=radius,dc=myu,dc=ca/PWD12345678 to ldap.myu.ca:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=myu,dc=ca, with filter (uid=tester) rlm_ldap: Added User-Password = {SSHA}jSTYFonbXmIE6pReKdYUvq0RhxuhLUAT6FYcG== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tester authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[myldap2] returns ok ++- redundant-load-balance group redundant-load-balance returns ok rad_check_password: Found Auth-Type Ldap1 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! auth: type "Ldap1" +- entering group Ldap1 ++- entering redundant-load-balance group redundant-load-balance rlm_ldap: - authenticate rlm_ldap: login attempt by "tester" with password "testing" rlm_ldap: user DN: uid=tester,ou=people,dc=myu,dc=ca rlm_ldap: (re)connect to ldap.myu.ca:389, authentication 1 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/myuCA.crt rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as uid=tester,ou=people,dc=myu,dc=ca/testing to ldap.myu.ca:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user tester authenticated succesfully +++[myldap2] returns ok ++- redundant-load-balance group redundant-load-balance returns ok Login OK: [tester] (from client unbsj113 port 189) Sending Access-Accept of id 19 to 192.168.1.113 port 20000 Finished request 0. Going to the next request Waking up in 0.8 seconds. Waking up in 4.1 seconds. Cleaning up request 0 ID 19 with timestamp +99 Ready to process requests. ************** However when I removed Auth-Type := Ldap1 in the entry, ************** DEFAULT Called-Station-Id =~ ".*Guest@myu", Autz-Type := Ldap1 ************** the user authentication failed. The Auth Type is set to Local instead of Ldap. Below is the debug output. ************** rad_recv: Access-Request packet from host 192.168.1.113 port 20000, id=20, length=98 User-Name = "tester" Called-Station-Id = "00-1B-BA-A5-45-40:Guest@myu" NAS-Port = 192 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "nortel" NAS-IP-Address = 192.168.1.113 User-Password = "testing" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest@myu expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest@myu users: Matched entry DEFAULT at line 71 ++[files] returns ok rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Autz-Type Ldap1 +- entering group Ldap1 ++- entering redundant-load-balance group redundant-load-balance rlm_ldap: - authorize rlm_ldap: performing user authorization for tester WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=tester) expand: ou=people,dc=myu,dc=ca -> ou=people,dc=myu,dc=ca rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap2.myu.ca:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/myuCA.crt rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as uid=radius,dc=myu,dc=ca/PWD12345678 to ldap2.myu.ca:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=myu,dc=ca, with filter (uid=tester) rlm_ldap: Added User-Password = {SSHA}jSTYFonbXmIE6pReKdYUvq0RhxuhLUAT6FYcG== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tester authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[myldap] returns ok ++- redundant-load-balance group redundant-load-balance returns ok !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [tester] (from client unbsj113 port 192) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 20 to 192.168.1.113 port 20000 Waking up in 4.9 seconds. Cleaning up request 0 ID 20 with timestamp +111 Ready to process requests. ************** In radiusd.conf, ldap myldap { server = "ldap2.myu.ca" identity = "uid=radius,dc=myu,dc=ca" password = PWD12345678 basedn = "ou=people,dc=myu,dc=ca" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/ca/dir/ # certfile = /path/to/radius.crt cacertfile = /usr/local/etc/raddb/certs/myuCA.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd require_cert = "never" } # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # access_attr = "dialupAccess" dictionary_mapping = ${confdir}/ldap.attrmap password_attribute = userPassword # password_header = "{clear}" edir_account_policy_check = no # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName groupmembership_attribute = eduPersonPrimaryAffiliation # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes set_auth_type = yes #ldap_debug = 0x0028 } ldap myldap2 { ... } authorize { ... Autz-Type Ldap1 { redundant-load-balance{ myldap myldap2 } } ... } authenticate { ... Auth-Type Ldap1 { redundant-load-balance{ myldap myldap2 } } ... } Thanks for your help! Andrew

3 5

How can I start the freeradius server with user privileges other than root?
by Deepak Panigrahy 07 Feb '08

07 Feb '08

I need the instructions to start the freeradius server from any user account of the linux machine other than root. Can anyone help me out? Thanks, Deepak

2 1

RE: FreeRadius deployment
by pablo.cuesta＠bt.com 07 Feb '08

07 Feb '08

Me again. I feel pretty stupid now as the listen section was documented on the radiusd.conf file but i read over it.Anyway,I had checked the 1.1.7 i got installed and it has the "listen" section which seems to allow to use the same FreeRADIUS server to listen at different IPs and ports. However, would the radius listen to auth and acct packets or only to auth packets? I mean, *******************start config********************** listen { ipaddr = IP1.IP1.IP1.IP1 port = PORT1 type = auth } listen { ipaddr = IP1.IP1.IP1.IP1 port = PORT1+1 type = acct } listen { ipaddr = IP2.IP2.IP2.IP2 port = PORT2 type = auth } listen { ipaddr = IP2.IP2.IP2.IP2 port = PORT2+1 type = acct } *********************end config*********** Will work, listening to auth and acct packets? Anyway I will upgrade to version 2 but 1.1.7 is installed in our test machine right now. Thank you in advanced, Pablo Cuesta -----Mensaje original----- De: Cuesta Fernandez,P,Pablo,JPW32 R Enviado el: jueves, 07 de febrero de 2008 20:44 Para: 'ac221(a)sussex.ac.uk'; 'FreeRadius users mailing list' Asunto: RE: FreeRadius deployment > Has anyone try this? Use FreeRadius 2 , yo can instantiate two virtual servers and bind them to different ip addresses. Downloading it right now. Thanks. Pablo Cuesta

1 0

FreeRADIUS and RSA RADIUS Server
by Jakub Morávek 07 Feb '08

07 Feb '08

Hello, I have not many experiences with radius, so my question may be stupid. Has anybody experience with using freeradius (Version 1.1.3 in Debian Sarge) as proxy for RSA RADIUS Server included in RSA Authentication Manager 6.1? I need to solve following problem with the "Agent host" i.e. host which send authenticate request to RSA Auth Manager. When authentication request goest through freeradius proxy, RSA Manager thinks that Agent host is my freeradius proxy instead of original host which sent authenticate request. Below is pasted part of pre-proxy detail log and debug log. part of output from: freeradius -X: Sending Access-Request of id 0 to 10.100.25.2 port 1812 User-Name = "jakub" User-Password = "1234628665" NAS-IP-Address = 127.0.1.1 NAS-Identifier = "ssh" NAS-Port = 21704 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.5.0.39" Proxy-State = 0x313039 output of /var/log/freeradius/radacct/10.5.0.31/pre-proxy-detail-20080204: Packet-Type = Access-Request Mon Feb 4 23:55:50 2008 User-Name = "jakub" User-Password = "1234628665" NAS-IP-Address = 127.0.1.1 NAS-Identifier = "ssh" NAS-Port = 21704 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.5.0.39" Client-IP-Address = 10.5.0.31 Stripped-User-Name = "jakub" Realm = "NULL" Realm = "NULL" Proxy-State = 0x313039 Does this mean, that freeradius process all attributes from pre-proxy-detail-20080204 log, but sends only attributes, which are shown in extended debug mode? If so, can anybody give me any advice how can I configure freeradius to send more attributes? Jakub

5 9

attr rewrite issue
by Keith Dovale - HostworX.co.za 07 Feb '08

07 Feb '08

Hi Guys, some help please . I am trying to do a attr rewrite to change an Attribute value then do a check based on the attribute that is changed, if the check fails do another attrib rewrite to the next value and do another check, until either the check fails or passes. There is basically only 4 checks in the group statement in the authorise section which do Attrib rewrite Do check (If it fails do) Attrib rewrite Do check (If it fails do) Attrib check Do rewrite (If it fails do) Attrib check Do rewrite Reject Pass When it runs it checks the reply packet for an attribute Configuration-Token which is defined in the radgroupreply for the users but it seems it cannot find it and gives an error. As below rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user keith, check_item=0, counter=0 modcall[authorize]: module "MonthlyUnShaped" returns reject for request 2 radius_xlat: 'UNSHAPED_NORMAL' rlm_attr_rewrite: No match found for attribute Configuration-Token with value 'SHAPED_NORMAL' radius_xlat: 'UNSHAPED_NORMAL' radius_xlat: 'SHAPED_NORMAL' rlm_attr_rewrite: Changed value for attribute Configuration-Token from 'UNSHAPED_NORMAL' to 'SHAPED_NORMAL' rlm_attr_rewrite: Could not find value pair for attribute Configuration-Token modcall[authorize]: module "AttrRewrite_MonthlyBlendedShaped" returns ok for request 2 can anyone help

1 0

PEAP mschapv2 Proxy not working.
by Andrew Olson 07 Feb '08

07 Feb '08

Hello, I'm having trouble getting freeradius-1.1.7 to proxy PEAP-mshcapv2 to another RADIUS server. My other server doesn't do EAP, so I'm just sending mschapv2 achieved with proxy_tunneled_request_as_eap = no in eap.conf. When I proxy to my other server, I get back an Access-Accept packet. Then, freeradius sends an Access Challenge to the client, receives a response and then things appear to break. I am able to successfully authenticate users with PEAP by defining them locally in the users file. Additionally, I have gotten TTLS to work by proxying to another server, it's just PEAP that I'm having problems with. The differing line in the debug seems to be: <proxied> eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 -vs- <non-proxied> eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. I'm running a pretty standard config, I think. I can send copies of it, if that would help. Thanks, Andrew Olson The complete proxied debug starting with the Access-Request is as follows: Sending Access-Request of id 0 to 198.82.247.36 port 1812 User-Name = "anolson" NAS-IP-Address := 198.82.245.57 MS-CHAP-Challenge = 0x85feba9cbed9e9191bf72a29f0f82312 MS-CHAP2-Response = 0x0700b776d1433b4d6dab43d5bde9163e8b450000000000000000ee7fcb070f3766e7e7b0f198b72754b44a9ef0255d712db1 Proxy-State = 0x3136 Service-Type := Framed-User Waking up in 6 seconds... rad_recv: Access-Accept packet from host 198.82.247.36:1812, id=0, length=189 Filter-Id = "CNS_NET1" MS-CHAP2-Success = 0x07533d43433041424443323542333046453444414131394238363737413941334136454631364134454634 MS-MPPE-Send-Key = 0x7b5fcacde0c3798261894df701a5cdd5 MS-MPPE-Recv-Key = 0x3900c03d5b5851da66e8fb27d90077f9 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x0000000e Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 6 PEAP: Passing reply from proxy back into the tunnel. PEAP: Passing reply back for EAP-MS-CHAP-V2 0x8170500 2 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 6 rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x8170500 2. rlm_eap_mschapv2: Authentication succeeded. MSCHAP Success modcall[post-proxy]: module "eap" returns ok for request 6 modcall: leaving group post-proxy (returns ok) for request 6 POST-PROXY 2 POST-AUTH 2 PEAP: Got reply 11 PEAP: Got tunneled Access-Challenge PEAP: Reply was handled modcall[post-proxy]: module "eap" returns ok for request 6 modcall: leaving group post-proxy (returns ok) for request 6 Sending Access-Challenge of id 16 to 128.173.10.131 port 56945 EAP-Message = 0x0107005b190017030100502c303c60e1337bcb4c17a281f71910d23777fd5f4a4d5aefab92a23ff28a993aa17ebc2d6bd7567b9386fec7c4e6f2f7ae4c4655a8492000e0e473fc7e8be63a1bf372449cba9f795dc6535b04648cdb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x23a96486ec5dbd008e1eddcee31dfa93 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 128.173.10.131:56945, id=17, length=151 User-Name = "anolson" State = 0x23a96486ec5dbd008e1eddcee31dfa93 EAP-Message = 0x0207005419800000004e170301002050f4490743b89308d9bb84f411a1629e7b6f06dd6c02c2525747560f657f63d117030100209d0c853d82e17d05938ab49201447c135a90d068d1641a23db5fc04cfcc0dd08 Message-Authenticator = 0x3c828120c544cde1b5d4366b7e735350 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "anolson", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 84 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall[authorize]: module "files" returns notfound for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to anolson PEAP: Adding old state with dc 84 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "anolson", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 57 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 PEAP: Calling authenticate in order to initiate tunneled EAP session. Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 PEAP: Can't handle the return code 4 rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 10 with timestamp 47a8d136 Cleaning up request 1 ID 11 with timestamp 47a8d136 Cleaning up request 2 ID 12 with timestamp 47a8d136 Cleaning up request 3 ID 13 with timestamp 47a8d136 Cleaning up request 4 ID 14 with timestamp 47a8d136 Cleaning up request 5 ID 15 with timestamp 47a8d136 Cleaning up request 6 ID 16 with timestamp 47a8d136 Sending Access-Reject of id 17 to 128.173.10.131 port 56945 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 7 ID 17 with timestamp 47a8d136 Nothing to do. Sleeping until we see a request. The complete non-proxied debug starting with the final Access-Challenge is as follows: Sending Access-Challenge of id 18 to 128.173.10.131 port 56939 EAP-Message = 0x0108002b190017030100206ae9bd54b7c0124979401818f662bec45aea2853b277e8dda897e8a645571887 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x00e512dd6dbcc968bffd9f8b8dc13bc4 Finished request 40 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 128.173.10.131:56939, id=19, length=166 User-Name = "andrew" State = 0x00e512dd6dbcc968bffd9f8b8dc13bc4 EAP-Message = 0x0208006419800000005e1703010020a0257f0df72e93adb495d9ab98f8e65ee4b526e563dd80bcdd464a3735f1d83417030100304c5de1fa016827d3181b8a26a7a31091f8f4474167c5424e0b51913e0ede50c14e04ec233670bd9888b1ea89ed510131 Message-Authenticator = 0xf3079323771a635bac1bdaa00b2e850f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 41 modcall[authorize]: module "preprocess" returns ok for request 41 modcall[authorize]: module "chap" returns noop for request 41 modcall[authorize]: module "mschap" returns noop for request 41 rlm_realm: No '@' in User-Name = "andrew", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 41 rlm_eap: EAP packet type response id 8 length 100 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 41 users: Matched entry andrew at line 53 modcall[authorize]: module "files" returns ok for request 41 modcall: leaving group authorize (returns updated) for request 41 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 41 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 41 modcall: leaving group authenticate (returns ok) for request 41 Sending Access-Accept of id 19 to 128.173.10.131 port 56939 MS-MPPE-Recv-Key = 0x1aa22f77848e2c89b4a6681bd67b45483d25b05232dd9e37748bba578fff2700 MS-MPPE-Send-Key = 0x62d67197e6bfbce385f1b6e2ccd03c183281bca70e810a79cd85e7d2a38d654d EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "andrew" Finished request 41 Going to the next request Waking up in 6 seconds...

3 5