February 2008 - Freeradius-Users - lists.freeradius.org

Re: WPA and EAP-TTLS oddity
by William Bulley 01 Feb '08

01 Feb '08

According to Thierry Chich <thierry.chich(a)ac-clermont.fr>: > > For me, you have to specify > Auth-Type LDAP { > ldap > } > in the authenticate section. Thank you. Much appreciated. Regards, web... -- William Bulley Email: web(a)umich.edu

1 0

Peap (inner eap-popt) issue
by Hangjun He 01 Feb '08

01 Feb '08

hi, I am using Odyssey Client Manager and freeRADIUS 1.1.6. When I set peap with inner eap-mschap-v2, It works well.When I change inner eap type to eap-popt, seems can not work. eap.conf: eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/server_keycert.pem certificate_file = ${raddbdir}/certs/server_keycert.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } mschapv2 { } } debug message: rad_recv: Access-Request packet from host 10.155.20.84:1028, id=97, length=310 User-Name = "hhe123" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "AH-000030" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-31:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0204008f198000000085160301004510000041003f90e19f0e9099ace6ec05fb17123a18280ef2aaabf14d2a6c632e502133afefc99bf3c3e8216dd91489e6c3e58622bacd148a5c4cd3dfecff8fe172ac0d0a19140301000101160301003095d558aeea1c6a30113c21922745a4584a82f81ed2aec13d206481d23805d67e8760d4b1cdca811a54e5ed9819fefc52 State = 0xe364c386672736607a0f8f7ce0f2896a Message-Authenticator = 0x0743c8bc02356a840f048e55b5b87143 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 143 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry hhe123 at line 95 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0045], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 97 to 10.155.20.84 port 1028 Reply-Message = "Hello" EAP-Message = 0x0105004119001403010001011603010030972d13c7c42d04d1e4749ae66d2232830dd90327e820cab5cd8d2733712e71315b05c41c9c6b934cae84a1b7f75804e1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x218ad259b8a94329f3d37b7ee6d7afad Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.155.20.84:1028, id=98, length=173 User-Name = "hhe123" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "AH-000030" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-31:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061900 State = 0x218ad259b8a94329f3d37b7ee6d7afad Message-Authenticator = 0x95efe7dde77c253e487f9cfd6065f838 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry hhe123 at line 95 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 98 to 10.155.20.84 port 1028 Reply-Message = "Hello" EAP-Message = 0x0106002b190017030100207f66e440788e3e4a186296309a4f1b5ebf1038927fa99eb61b7e63dfc7317b84 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x22cd9bd446d12f902e0ad6df5d148f89 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.155.20.84:1028, id=99, length=210 User-Name = "hhe123" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "AH-000030" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-31:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0206002b1900170301002062571e196c27b9966b1382edddbf0274e942305aff8893fc3cd152c500f726ea State = 0x22cd9bd446d12f902e0ad6df5d148f89 Message-Authenticator = 0x82ae47e2cb4faa273ac7b648e4ec8383 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 43 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry hhe123 at line 95 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - hhe123 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0206000b01686865313233 PEAP: Got tunneled identity of hhe123 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to hhe123 PEAP: Sending tunneled request EAP-Message = 0x0206000b01686865313233 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "hhe123" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry hhe123 at line 95 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled reply RADIUS code 11 Reply-Message = "Hello" EAP-Message = 0x010700201a0107001b10b91afa7dcc132d9d9a98ec6a4c1bdc97686865313233 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfdb9dcb8c4a516dcb41f8ad450b8600a PEAP: Processing from tunneled session code 0x81745d8 11 Reply-Message = "Hello" EAP-Message = 0x010700201a0107001b10b91afa7dcc132d9d9a98ec6a4c1bdc97686865313233 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfdb9dcb8c4a516dcb41f8ad450b8600a PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 99 to 10.155.20.84 port 1028 Reply-Message = "Hello" EAP-Message = 0x0107004b190017030100409b40ceb2c423ae86e9f356b82858738088fead594577936681b8946ca687752bc90e31c2a093d94c7dfcd476e209191266ed9a8704f39b60e60a9892329909ad Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf80de75dd97216787da75df59dc75cd1 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.155.20.84:1028, id=100, length=210 User-Name = "hhe123" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "AH-000030" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-31:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0207002b190017030100209775c3b3d2ccbe5e26098b568eecd9b52fbf38942c670989a3a473825f6088c7 State = 0xf80de75dd97216787da75df59dc75cd1 Message-Authenticator = 0xe8a7a3a8a613f72f9ae0b72243b3626a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 43 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry hhe123 at line 95 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type nak rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020700060320 PEAP: Setting User-Name to hhe123 PEAP: Adding old state with fd b9 PEAP: Sending tunneled request EAP-Message = 0x020700060320 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "hhe123" State = 0xfdb9dcb8c4a516dcb41f8ad450b8600a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry hhe123 at line 95 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: NAK asked for bad type 32 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 Reply-Message = "Hello" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x8163440 3 Reply-Message = "Hello" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 100 to 10.155.20.84 port 1028 Reply-Message = "Hello" EAP-Message = 0x0108002b190017030100201de3831a7f2125c2ec88dedc5dbee21a24e23e625e1371f27bdab38d63f4568e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe001231019ae6ca94a0f00f7fc2da77b Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.155.20.84:1028, id=101, length=210 User-Name = "hhe123" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "AH-000030" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-31:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0208002b19001703010020ca0014dd22e8f82e4820bb23d6b91f570d81a30691975f99827e71e2596d4145 State = 0xe001231019ae6ca94a0f00f7fc2da77b Message-Authenticator = 0x3fab705ee35081dfacb8bd2bc1cf65c2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_eap: EAP packet type response id 8 length 43 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry hhe123 at line 95 modcall[authorize]: module "files" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: leaving group authenticate (returns invalid) for request 8 auth: Failed to validate the user. Sending Access-Reject of id 101 to 10.155.20.84 port 1028 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Reply-Message = "Hello" Finished request 8 -John --------------------------------- 雅虎邮箱传递新年祝福，个性贺卡送亲朋！

2 3

Terminate EAP-PEAP client connection at FreeRadius Proxy and proxy (forward) request as PAP
by Joakim Lindgren 01 Feb '08

01 Feb '08

Hi all, thanks for your explanation earlier! I need your help with EAP-TTLS and PAP. I have earlier setup EAP-PEAP/EAP-TTLS and EAP-TLS working OK! I tried configuring the TTLS-PAP inner and outer tunnel but it will not work (and yes I have searched the forum, as always ;-) Here are my explanation of what I´m trying to do: A. If an incoming user conn. against the FreeRadius Server (Nr1) is belonging to "OTHER" (LOCAL) domain then the EAP-TTLS tunnel is ended and validated against the LDAP. (And yes, I didn´t name the server ;-) B. If an incoming user conn. against the FreeRadius Server (Nr1) is belonging to "SECURSERVER" domain then the EAP-TTLS tunnel is ended and PAP is proxied to other Radius (Nr 2). I have tried several different conf. and as best I see requests coming to Radius Nr2 but the´re encrypted (Wireshark). The config files looks like this (as for now, thanks in advance!): ================================================================================================ eap.conf ======== eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = password private_key_file = ${raddbdir}/certs/jaysCA2/osuse-freeradius/server_keycert.pem certificate_file = ${raddbdir}/certs/jaysCA2/osuse-freeradius/server_keycert.pem CA_file = ${raddbdir}/certs/jaysCA2/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } ttls { default_eap_type = md5 copy_request_to_tunnel = yes use_tunneled_reply = yes } peap { default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no } mschapv2 { } } ===END EAP====================================================================================== ================================================ users ======== DEFAULT FreeRADIUS-Proxied-To !* 127.0.0.1, Proxy-To-Realm := LOCAL DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := "SECURACCESS", Auth-Type := PAP DEFAULT Auth-Type != LDAP ================================================ ================================================ Proxy.conf ======== realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm SECURACCESS { type = radius authhost = 192.168.1.75:1812 accthost = 192.168.1.75:1813 secret = toor # nostrip } ================================================ ================================================================================================ radiusd.conf ======== ... modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { use_mppe = yes require_encryption = yes require_strong = yes } ldap { server = "192.168.1.71" identity = "cn=admin,o=Contonso" password = "toor" basedn = "o=Contonso" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_mode = no tls_cacertfile = /etc/raddb/certs/eDirCerts/edirectory_ROOT_Cert_DER.pem dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = nspmPassword tls_require_cert = "allow" timeout = 4 timelimit = 3 net_timeout = 1 port = 389 edir_account_policy_check=yes } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } ... authorize { preprocess chap mschap suffix ntdomain eap files ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } post-auth { ldap Post-Auth-Type REJECT { ldap } } ===END radiusd.conf================================================================================ ================================================ clients.conf ======== client 192.168.1.0/24 { secret = toor shortname = private-network-1 } ================================================

2 2