June 2008 - Freeradius-Users - lists.freeradius.org

Regarding certificates
by pallavi dharmadhikari 27 Jun '08

27 Jun '08

HI , I am using Freeradius 1.1.6 version on Fedora. When I checked the /etc/raddb/certs directory, the certificates for testing EAP-TLS method are expired. So I am trying to create my own certificates using Openssl for EAP-TLS. My question is , Do we need to give separate commands for creating client and server certificates OR we can follow the same method for creating both ? I googled the query regarding certificates but I did not find any good site for creating client and server certificates Can anybody suggest some links for this?? -- Regards Pallavi

2 1

Use of libtool-2.2.4 causes install error
by D C 27 Jun '08

27 Jun '08

Hello, I have successfully compiled FreeRadius 2.0.5 from source onto a fresh FreeBSD 7.0 box, but have run into an install glitch. The glitch appears to have been caused by the addition of `--with-system-libtool` to work around a bug ( http://bugs.gentoo.org/show_bug.cgi?format=multiple&id=225725) created by the presence of libtool-2.2.4 on the system. Make completes with only a few minor warnings. However, make install fails with: ...snip make[6]: Leaving directory `/var/tmp/freeradius-server-2 .0.5/src/modules/rlm_eap' Making install in rlm_mschap... make[6]: Entering directory `/var/tmp/freeradius-server-2.0.5/src/modules/rlm_mschap' make[7]: Entering directory `/var/tmp/freeradius-server-2.0.5/src/modules/rlm_mschap' /var/tmp/freeradius-server-2.0.5/install-sh -c -d -m 755 /var/tmp/freeradius-BUILD/bin /usr/bin/libtool --mode=install /var/tmp/freeradius-server-2.0.5/install-sh -c -m 755 \ smbencrypt /var/tmp/freeradius-BUILD/bin libtool: install: invalid libtool wrapper script `smbencrypt' make[7]: *** [smbencrypt-install] Error 1 make[7]: Leaving directory `/var/tmp/freeradius-server-2.0.5/src/modules/rlm_mschap' make[6]: *** [install] Error 2 make[6]: Leaving directory `/var/tmp/freeradius-server-2.0.5/src/modules/rlm_mschap' make[5]: *** [common] Error 2 make[5]: Leaving directory `/var/tmp/freeradius-server-2.0.5/src/modules' make[4]: *** [install] Error 2 make[4]: Leaving directory `/var/tmp/freeradius-server-2.0.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/var/tmp/freeradius-server-2.0.5/src' make[2]: *** [install] Error 2 make[2]: Leaving directory `/var/tmp/freeradius-server-2.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/var/tmp/freeradius-server-2.0.5' make: *** [install] Error 2 It's apparent that the `smbencrypt` script is incompatible with libtool-2.2.4, but I'm unsure how to proceed. Searches turn up nothing useful. Configure options are included below. ./configure --prefix=/var/tmp/freeradius-BUILD --enable-strict-dependencies --with-system-libtool --with-modules="rlm_acctlog rlm_attr_rewrite rlm_checkval rlm_eap rlm_mschap rlm_pam rlm_passwd rlm_unix" --without-rlm_counter --without-rlm_dbm --without-rlm_ippool --without-rlm_krb5 --without-rlm_ldap --without-rlm_otp --without-rlm_perl --without-rlm_python --without-rlm_sql --without-rlm_unixodbc --without-rlm_sql_iodbc --without-rlm_sql_mysql --without-rlm_sql_postgresql --without-rlm_sql_oracle --without-rlm_sqlcounter --without-rlm_sqlippool --without-rlm_eap_tnc Any help would be appreciated. Thanks, D Cox

2 2

oracle server->freeradius->ssl->ldap
by Ray Stell 27 Jun '08

27 Jun '08

Oracle advanced security product supports external radius authentication. I would like to use this external auth for oracle clients connecting to an oracle db server. The radius server would need to talk to an external ldap over ssl. I've installed freeradius on the db server, but have no idea how to configure this. Can you please get me going. I am a complete novice. I'm sorry to ask such a uninformed question. Thanks.

2 1

Re : Re : Re : Re : Authorization?? pb Authentication against AD
by Reveal MAP 27 Jun '08

27 Jun '08

Oh!! Lol, I read it but didn't find so ovious to understood (in chinese ) it works very well! thanks to Ivan Ivan and Alan for helping, and um ... brb for the next episode ! ----- Message d'origine ---- De : Ivan Kalik <tnt(a)kalik.net> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Vendredi, 27 Juin 2008, 16h18mn 32s Objet : Re: Re : Re : Re : Authorization?? pb Authentication against AD > # You can also try setting the user name as: > # > # ... --username=%{mschap:User-Name} ... > # Did you read what you copied? Replace username bit in ntml_auth with that. Your problem is that you are sending DOMAIN\username and not just username. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

Re : Re : Re : Authorization?? pb Authentication against AD
by Reveal MAP 27 Jun '08

27 Jun '08

I am Sorry, I have a little problem with english, and i know it might be annoying for you! but i am not sure to understand what you are adcing me right now. 1- um.. using "mschap:User-Name" (how can i do that? in radiusd.conf, mschap section? or in ntlm_ath configuration files?) 2- using Stripped-User-Name * activating the ntdomain hack is needed in this case, OR * enabling prefix domain module (I repeat to be sure that you get what i understood). I am not yet so familiar with that parameters of FR althouht it is not so magic. so here is a part of my Radiusd.conf: (section mschap) and i think i did well but worries about the ntlm_command (commented) on there. could you just put me on the lane? *************************************************** mschap { # if use_mppe is not set to no mschap will # add MS-CHAP-MPPE-Keys for MS-CHAPv1 and # MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2 # use_mppe = no # if mppe is enabled require_encryption makes # encryption moderate # require_encryption = yes # require_strong always requires 128 bit key # encryption # require_strong = yes # Windows sends us a username in the form of # DOMAIN\user, but sends the challenge response # based on only the user portion. This hack # corrects for that incorrect behavior. # with_ntdomain_hack = yes # The module can perform authentication itself, OR # use a Windows Domain Controller. This configuration # directive tells the module to call the ntlm_auth # program, which will do the authentication, and return # the NT-Key. Note that you MUST have "winbindd" and # "nmbd" running on the local machine for ntlm_auth # to work. See the ntlm_auth program documentation # for details. # # Be VERY careful when editing the following line! # # You can also try setting the user name as: # # ... --username=%{mschap:User-Name} ... # # In that case, the mschap module will look at the User-Name # attribute, and do prefix/suffix checks in order to obtain # the "best" user name for the request. # #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" *************************************************** but that command (above) is not what you're telling freeradius to do. look at the output from FR and note the differences. as Iven has stated, you will need to use EITHER mschap:User-Name, OR carry on using Stripped-User-Name but activate the ntdomain hack and enable prefix doamin module - or stripped-user-name will still be wrong! alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Re : Re : Authorization?? pb Authentication against AD
by Reveal MAP 27 Jun '08

27 Jun '08

the result of ntlm_auth in command line: -------------------------------------------------------------- aaa:/var/lib/samba #ntlm_auth --username glouglou --domain pluton password: NT_STATUS_OK: Success (0x0) aaa:/var/lib/samba # -------------------------------------------------------------- username is glouglou, password is glouglou!! and it works with ntlm_auth! any idea?? thank you ---- >i think the point error in the log is (see below), and i wonder (if i understood well) how to fix that : > > > rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. > rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. No, ntlm_auth is doing authentication. > >Exec-Program output: Logon failure (0xc000006d) And it fails. Password is wrong. Get ntlm_auth working from the command line first. You might need to use mschap:User-Name for username to expand without the domain. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Re : Authorization?? pb Authentication against AD
by Reveal MAP 27 Jun '08

27 Jun '08

Thanx Ivan for your answer! this is what i did: - chmod -R 777 winbindd_privileged/ to correct the authorization problem. but now i stil can't connect with my AD account! i think the point error in the log is (see below), and i wonder (if i understood well) how to fix that : rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. part of log: ************************ +[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for glouglou with NT-Password WARNING: Deprecated conditional expansion ":-". See "man unlang" for details WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=PLUTON\glouglou mschap2: dd expand: --challenge=%{mschap:Challenge:-00} -> --challenge=8a4a4b83990e4987 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=e7fa2ba6a80c3513d1fa84f8e9e82812a614da53389bd4e1 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. ************************ here is the full Radiusd -X log: -------------------------------------------- ********************************** rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=89, length=168 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200001401504c55544f4e5c676c6f75676c6f75 Message-Authenticator = 0x9ebfe1a5041bdfc82326c9206a93abd5 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 0 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 89 to 10.10.44.246 port 1027 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4a7e79354a7f60270e99037df0484ac9 Finished request 8. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=90, length=246 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201005019800000004616030100410100003d0301486503e681a67eed063268830121a79a24e45bda7665664681dba7d7eba4bea500001600040005000a000900640062000300060013001200630100 State = 0x4a7e79354a7f60270e99037df0484ac9 Message-Authenticator = 0x223f490c057b41f7858dda23683c7eb0 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 1 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0641], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 90 to 10.10.44.246 port 1027 EAP-Message = 0x0102040019c00000069e160301004a020000460301486502c1e8b6ddf3525b9c3d598d0753171dd5f6d41c120e1b62759ed985c431206398c6d6b7b7dc9d220eafd7c7243f37186e3212258e213979b1e6909268997e00040016030106410b00063d00063a0002a6308202a23082020ba003020102020101300d06092a864886f70d010105050030818b310b3009060355040613024d41310e300c060355040813055261626174310e300c06035504071305416764616c310f300d060355040a1306454e5349415331143012060355040b130b43656e74726520496e666f3112301006035504031409454e534941535f43413121301f06092a864886f7 EAP-Message = 0x0d01090116126d62615f6f796f6e65407961686f6f2e6672301e170d3038303530363134323832385a170d3039303530363134323832385a308188310b3009060355040613024d41310e300c060355040813055261626174310f300d060355040a1306454e5349415331143012060355040b130b43656e74726520496e666f311c301a06035504031413454e534941535f5365727665725261646975733124302206092a864886f70d01090116156d62616f796f6e6540636172616d61696c2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100bb95115e0a9b09647fcc2cc822240624842ae80bd3b8d5fd51bb9b9d0e EAP-Message = 0xfc65f768a58d0fd976268b8cb576905b2ae47089e70356e3b6a539f8debc381b98ae9b242ca42e3d7d85b08a66dcc5b7268c10911676e6a4517dc3e2130ce9eaee01388f6fe3696ea193320635c4c677009c17e4f0c40e00c8fc2f969e8e20a53112b90203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181005b553acadf73c7b78ba5f4a1700cb2326eb6e26c93b948d763705b44812933f1df17131e87744577c1c01a6d4ade88fe6ce1133fac1dedcf14f2490070301fa3e9ddd96ff4fa143f0aa853e5e15a055c45f34c7e18b8c3fc135e3e7f22e49d6007287911a4806494e4 EAP-Message = 0xf548d12f4a8fcfbc11d49ec1a035f4013de94243c014b600038e3082038a308202f3a003020102020900bed8f7f713ad2741300d06092a864886f70d010105050030818b310b3009060355040613024d41310e300c060355040813055261626174310e300c06035504071305416764616c310f300d060355040a1306454e5349415331143012060355040b130b43656e74726520496e666f3112301006035504031409454e534941535f43413121301f06092a864886f70d01090116126d62615f6f796f6e65407961686f6f2e6672301e170d3038303530363134313134375a170d3138303530343134313134375a30818b310b300906035504061302 EAP-Message = 0x4d41310e300c060355040813 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4a7e79354b7c60270e99037df0484ac9 Finished request 9. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=91, length=172 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 State = 0x4a7e79354b7c60270e99037df0484ac9 Message-Authenticator = 0x21139e5efd5f286d64627bfa24887316 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 91 to 10.10.44.246 port 1027 EAP-Message = 0x010302ae1900055261626174310e300c06035504071305416764616c310f300d060355040a1306454e5349415331143012060355040b130b43656e74726520496e666f3112301006035504031409454e534941535f43413121301f06092a864886f70d01090116126d62615f6f796f6e65407961686f6f2e667230819f300d06092a864886f70d010101050003818d0030818902818100bf61b0669592b605195963d5382583d0e5115ccbdfe0f1c4ff9fcad9171f017d41eb27cf1d1a7a52db1c88665ce519c4f4bbb4ead5426825149fef16c52418fbdb933af73a051ebdd28373fa4879977d441d473f3dfd3ccd17874a1572cc1d4287290161798b EAP-Message = 0xc364ee28de1c671daa5f172ccdabb34b3d03f5da76857ff454950203010001a381f33081f0301d0603551d0e041604147526799856863b751619010ffc74602c7ab7565d3081c00603551d230481b83081b580147526799856863b751619010ffc74602c7ab7565da18191a4818e30818b310b3009060355040613024d41310e300c060355040813055261626174310e300c06035504071305416764616c310f300d060355040a1306454e5349415331143012060355040b130b43656e74726520496e666f3112301006035504031409454e534941535f43413121301f06092a864886f70d01090116126d62615f6f796f6e65407961686f6f2e667282 EAP-Message = 0x0900bed8f7f713ad2741300c0603551d13040530030101ff300d06092a864886f70d010105050003818100ab43dca4037042bca22b306a18b60eb9c28743208bc80727147bc80283ebe81cf182aaab8a9ffe8def8d30713c87d1135689ad72660efb61b0fcb8971dc37c36eb18ed6d32544026fe57b34bcbe819193341e0cebaa9b9c6d58d99a5af37557d1e9cb093a27658e7430cdc39fb2a3f331404807e4969fdc4f30a9963a997af1616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4a7e7935487d60270e99037df0484ac9 Finished request 10. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=92, length=358 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300c01980000000b61603010086100000820080684c8b818181e1c78ca3ae7cdc36af46e1ac47643273813a062f8195897bb98fa8e4c52a9b19a0bc65fd1a13ca88e4cddc1372db088ef2677f8f80c0a3a88beb8e58fdb69c023ecb0fadf2b48e3cf38bac69646a64b32bebb9ad023269b75f5ae1214b1a702ddbc9e1468e72c0b3985ef89595ace37aef296d7c6925b9199bc81403010001011603010020d1a91b4572cf7aefe2fbb4aea214ca889fb94ad60f7a3dc589d85e8b2301fd45 State = 0x4a7e7935487d60270e99037df0484ac9 Message-Authenticator = 0x7b41ee869bc6f8e72fb31a08ae28b46b +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 3 length 192 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 182 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 92 to 10.10.44.246 port 1027 EAP-Message = 0x0104003119001403010001011603010020c137a7067dbbb4836bc2df50b50ddc8a7d67883f4d82822e3fcbaac6b1e11cf6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4a7e7935497a60270e99037df0484ac9 Finished request 11. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=93, length=172 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400061900 State = 0x4a7e7935497a60270e99037df0484ac9 Message-Authenticator = 0x7fd4dc60b7911222609b9dbed4dbb80c +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 93 to 10.10.44.246 port 1027 EAP-Message = 0x010500201900170301001514e1f32add9b0fc2423696f7bee7e8c3ef39f7e6b6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4a7e79354e7b60270e99037df0484ac9 Finished request 12. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=94, length=209 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0205002b19001703010020b08154710e7e190514cf420c9f9baa28ae3ee7401976ba321bbf6f0bacf3a1b9 State = 0x4a7e79354e7b60270e99037df0484ac9 Message-Authenticator = 0x3029405858d0caaee49d5b508193416f +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 5 length 43 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - PLUTON\glouglou PEAP: Got tunneled EAP-Message EAP-Message = 0x0205001401504c55544f4e5c676c6f75676c6f75 PEAP: Got tunneled identity of PLUTON\glouglou PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to PLUTON\glouglou PEAP: Sending tunneled request EAP-Message = 0x0205001401504c55544f4e5c676c6f75676c6f75 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" server (null) { +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 5 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server (null) PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010600291a0106002410ddcb2820e3a0b40c20a2f16430f47a8d504c55544f4e5c676c6f75676c6f75 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x72782974727e330259647bcf732d666c PEAP: Processing from tunneled session code 0x81a3f88 11 EAP-Message = 0x010600291a0106002410ddcb2820e3a0b40c20a2f16430f47a8d504c55544f4e5c676c6f75676c6f75 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x72782974727e330259647bcf732d666c PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 94 to 10.10.44.246 port 1027 EAP-Message = 0x010600401900170301003505357406d973df73adc02bb4b8d8650c7a453230b5ace988d5d48d699dcb8ec2fe3dd3b328c7a79987a93a7fe95621d4a0c39fd90f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4a7e79354f7860270e99037df0484ac9 Finished request 13. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=95, length=263 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0206006119001703010056a9d45263e8153a09870ca02962350323de2d324811ff319eb7f1b58f7025c9793c3a3c18d74c0ef1ee1e2b886182e051a19e5f75750d77bd2b4e065a7526ebb99a58327299077c3d1232548ab2550bea9fef33e917f9 State = 0x4a7e79354f7860270e99037df0484ac9 Message-Authenticator = 0xb86e59f303d0eec59279405ce1264d51 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 6 length 97 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x0206004a1a02060045312e63457a35d1a5fea716396a5a0a4a910000000000000000e7fa2ba6a80c3513d1fa84f8e9e82812a614da53389bd4e100504c55544f4e5c676c6f75676c6f75 PEAP: Setting User-Name to PLUTON\glouglou PEAP: Sending tunneled request EAP-Message = 0x0206004a1a02060045312e63457a35d1a5fea716396a5a0a4a910000000000000000e7fa2ba6a80c3513d1fa84f8e9e82812a614da53389bd4e100504c55544f4e5c676c6f75676c6f75 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "PLUTON\\glouglou" State = 0x72782974727e330259647bcf732d666c NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" server (null) { +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 6 length 74 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for glouglou with NT-Password WARNING: Deprecated conditional expansion ":-". See "man unlang" for details WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=PLUTON\glouglou mschap2: dd expand: --challenge=%{mschap:Challenge:-00} -> --challenge=8a4a4b83990e4987 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=e7fa2ba6a80c3513d1fa84f8e9e82812a614da53389bd4e1 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [PLUTON\\glouglou/<via Auth-Type = EAP>] (from client Access_Point_DWL-8500AP+_A1_L1 port 1 cli 00-12-F0-0C-97-61) } # server (null) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x8192dc8 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled Sending Access-Challenge of id 95 to 10.10.44.246 port 1027 EAP-Message = 0x010700261900170301001baaabb4abfb1a055187edff9419e6ab6e1d08f660a50dc5aa64e726 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4a7e79354c7960270e99037df0484ac9 Finished request 14. Going to the next request Waking up in 0.6 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=96, length=204 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020700261900170301001bd5c7266b8b5196ccf36ee4164d39e4756e9afb04a82a055515fb04 State = 0x4a7e79354c7960270e99037df0484ac9 Message-Authenticator = 0xb3f59854b9685827e1e7da1f2356b8d7 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 7 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [PLUTON\\glouglou/<via Auth-Type = EAP>] (from client Access_Point_DWL-8500AP+_A1_L1 port 1 cli 00-12-F0-0C-97-61) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> PLUTON\glouglou ++[attr_filter.access_reject] returns noop Delaying reject of request 15 for 1 seconds Going to the next request Waking up in 0.6 seconds. Waking up in 0.2 seconds. Sending delayed reject for request 15 Sending Access-Reject of id 96 to 10.10.44.246 port 1027 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.6 seconds. Cleaning up request 8 ID 89 with timestamp +407 Cleaning up request 9 ID 90 with timestamp +407 Cleaning up request 10 ID 91 with timestamp +407 Cleaning up request 11 ID 92 with timestamp +407 Cleaning up request 12 ID 93 with timestamp +407 Cleaning up request 13 ID 94 with timestamp +407 Waking up in 0.1 seconds. Cleaning up request 14 ID 95 with timestamp +407 Waking up in 1.0 seconds. Cleaning up request 15 ID 96 with timestamp +407 Ready to process requests. ********************************** _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Authorization?? pb Authentication against AD
by Reveal MAP 27 Jun '08

27 Jun '08

Hello, trying to authenticate wireless users against Active Directory using freeradius 2.0.2-3. I can authenticate users using EAP-PEAP or EAP-TLS. First question: is EAP system mandatory to authenticate against Active Directory? - i follow the this HOWTO (http://wiki.freeradius.org/Syslog_HOWTO) so "wbinfo" and "Ntlm_Auth" function properly like the HOWTO says - user "glouglou" with password "glouglou" exists in AD. On authentication attempt against AD, i have thoses messages that i don't undertand so well: 1. Part of Log of Radiusd -X //////////////////////////////////////////////////////////////////////////////////////////////////// +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for glouglou with NT-Password WARNING: Deprecated conditional expansion ":-". See "man unlang" for details WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=PLUTON\glouglou mschap2: ca expand: --challenge=%{mschap:Challenge:-00} -> --challenge=b7b4f66d1ed49fa6 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=1f96c63c6a98e87af339d1226e5feef41e327666f3ccd175 Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/lib/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/lib/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [PLUTON\\glouglou/<via Auth-Type = EAP>] (from client Access_Point_DWL-8500AP+_A1_L1 port 1 cli 00-12-F0-0C-97-61) } # server (null) //////////////////////////////////////////////////////////////////////////////////////////////////// 2. "Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/lib/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/lib/samba/winbindd_privileged are set correctly. (0xc0000022)" //////////////////////////////////////////////////////////////////////////////////////////////////// Part of /var/lib/samba files: ------------------------------------ # aaa:/var/lib/samba # ls win* # winbindd_cache.tdb winbindd_cache.tdb.bak.old # winbindd_cache.tdb.bak winbindd_idmap.tdb # winbindd_privileged: # pipe # aaa:/var/lib/samba # ------------------------ # aaa:/var/lib/samba # ll winbindd_privileged/ # total 0 # srwxrwxrwx 1 root root 0 Jun 25 16:17 pipe aaa:/var/lib/samba # I am not so expert at Linux stuff. but i think it could just be an authorization problem. and i really don't know if some other stuffs are needed to authenticate against AD. may i have some advices? thank you all for your responses ************************************************************************** ENTIRE LOG BELOW: ---------------------------------------- rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=49, length=168 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020a001401504c55544f4e5c676c6f75676c6f75 Message-Authenticator = 0xf46afa6cebe1a6532bda4720c452b684 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 10 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 49 to 10.10.44.246 port 1027 EAP-Message = 0x010b00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x56748010567f99f247f2f989f1c443b2 Finished request 50. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=50, length=246 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020b005019800000004616030100410100003d03014864e9ca6f5373caeef782f84ee725f6fd57b421fde7913f318d1f6ff0aac6c800001600040005000a000900640062000300060013001200630100 State = 0x56748010567f99f247f2f989f1c443b2 Message-Authenticator = 0x71516277d5597dd13b90fa56bfc8a9e0 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 11 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0641], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 50 to 10.10.44.246 port 1027 EAP-Message = 0x010c040019c00000069e160301004a0200004603014864e8a53e27f6d97c706cd17f4501780c540984d8cc3a25921b0547b9042c75203997dfd8b795b86fac5393d5a7e5e95536f63ac703698b68336f4b1239ad13b300040016030106410b00063d00063a0002a6308202a23082020ba003020102020101300d06092a864886f70d010105050030818b310b3009060355040613024d41310e300c060355040813055261626174310e300c06035504071305416764616c310f300d060355040a1306454e5349415331143012060355040b130b43656e74726520496e666f3112301006035504031409454e534941535f43413121301f06092a864886f7 EAP-Message = 0x0d01090116126d62615f6f796f6e65407961686f6f2e6672301e170d3038303530363134323832385a170d3039303530363134323832385a308188310b3009060355040613024d41310e300c060355040813055261626174310f300d060355040a1306454e5349415331143012060355040b130b43656e74726520496e666f311c301a06035504031413454e534941535f5365727665725261646975733124302206092a864886f70d01090116156d62616f796f6e6540636172616d61696c2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100bb95115e0a9b09647fcc2cc822240624842ae80bd3b8d5fd51bb9b9d0e EAP-Message = 0xfc65f768a58d0fd976268b8cb576905b2ae47089e70356e3b6a539f8debc381b98ae9b242ca42e3d7d85b08a66dcc5b7268c10911676e6a4517dc3e2130ce9eaee01388f6fe3696ea193320635c4c677009c17e4f0c40e00c8fc2f969e8e20a53112b90203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181005b553acadf73c7b78ba5f4a1700cb2326eb6e26c93b948d763705b44812933f1df17131e87744577c1c01a6d4ade88fe6ce1133fac1dedcf14f2490070301fa3e9ddd96ff4fa143f0aa853e5e15a055c45f34c7e18b8c3fc135e3e7f22e49d6007287911a4806494e4 EAP-Message = 0xf548d12f4a8fcfbc11d49ec1a035f4013de94243c014b600038e3082038a308202f3a003020102020900bed8f7f713ad2741300d06092a864886f70d010105050030818b310b3009060355040613024d41310e300c060355040813055261626174310e300c06035504071305416764616c310f300d060355040a1306454e5349415331143012060355040b130b43656e74726520496e666f3112301006035504031409454e534941535f43413121301f06092a864886f70d01090116126d62615f6f796f6e65407961686f6f2e6672301e170d3038303530363134313134375a170d3138303530343134313134375a30818b310b300906035504061302 EAP-Message = 0x4d41310e300c060355040813 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x56748010577899f247f2f989f1c443b2 Finished request 51. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=51, length=172 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020c00061900 State = 0x56748010577899f247f2f989f1c443b2 Message-Authenticator = 0x66d1a8307eaffc06f9a08c946ceaec4e +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 12 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 51 to 10.10.44.246 port 1027 EAP-Message = 0x010d02ae1900055261626174310e300c06035504071305416764616c310f300d060355040a1306454e5349415331143012060355040b130b43656e74726520496e666f3112301006035504031409454e534941535f43413121301f06092a864886f70d01090116126d62615f6f796f6e65407961686f6f2e667230819f300d06092a864886f70d010101050003818d0030818902818100bf61b0669592b605195963d5382583d0e5115ccbdfe0f1c4ff9fcad9171f017d41eb27cf1d1a7a52db1c88665ce519c4f4bbb4ead5426825149fef16c52418fbdb933af73a051ebdd28373fa4879977d441d473f3dfd3ccd17874a1572cc1d4287290161798b EAP-Message = 0xc364ee28de1c671daa5f172ccdabb34b3d03f5da76857ff454950203010001a381f33081f0301d0603551d0e041604147526799856863b751619010ffc74602c7ab7565d3081c00603551d230481b83081b580147526799856863b751619010ffc74602c7ab7565da18191a4818e30818b310b3009060355040613024d41310e300c060355040813055261626174310e300c06035504071305416764616c310f300d060355040a1306454e5349415331143012060355040b130b43656e74726520496e666f3112301006035504031409454e534941535f43413121301f06092a864886f70d01090116126d62615f6f796f6e65407961686f6f2e667282 EAP-Message = 0x0900bed8f7f713ad2741300c0603551d13040530030101ff300d06092a864886f70d010105050003818100ab43dca4037042bca22b306a18b60eb9c28743208bc80727147bc80283ebe81cf182aaab8a9ffe8def8d30713c87d1135689ad72660efb61b0fcb8971dc37c36eb18ed6d32544026fe57b34bcbe819193341e0cebaa9b9c6d58d99a5af37557d1e9cb093a27658e7430cdc39fb2a3f331404807e4969fdc4f30a9963a997af1616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x56748010547999f247f2f989f1c443b2 Finished request 52. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=52, length=358 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020d00c01980000000b61603010086100000820080a09d13c7c124673a58b5dde71c8223571f9cd3414359c7818a4d8f95d7fdc04a4aeb3841ceaf9b6d39bab24619660043acc7277cc744ff6b020c4040f7f1ca7a50179053ee27dd5b5fbd8f8b373012f6bf0ee90b4fc1964de222bd63263efe014c0b6941347e5bc538d79ae23c8c99bc3440e6cf723969ab37c671db6715c0c614030100010116030100207ba294a9552ee15c39fb55bf3e8656293c7dab2a757dcf5b22f9c695fb33ab05 State = 0x56748010547999f247f2f989f1c443b2 Message-Authenticator = 0xea20985ef156f3ca1d289460bd9d2be1 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 13 length 192 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 182 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 52 to 10.10.44.246 port 1027 EAP-Message = 0x010e003119001403010001011603010020c345278c8df213925709e6088b0f731aab25a0d8385798c0a2c4db729262c8a6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x56748010557a99f247f2f989f1c443b2 Finished request 53. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=53, length=172 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020e00061900 State = 0x56748010557a99f247f2f989f1c443b2 Message-Authenticator = 0x2b8d1b169bbee8ce550ca9e214df3c94 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 14 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 53 to 10.10.44.246 port 1027 EAP-Message = 0x010f0020190017030100151d867f83da3241029a7114e888c7cf60babf0e02d0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x56748010527b99f247f2f989f1c443b2 Finished request 54. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=54, length=209 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020f002b190017030100206fe05a76b2fae56696fffa2228ce92c191ee66a85461f6090415af436ac843ca State = 0x56748010527b99f247f2f989f1c443b2 Message-Authenticator = 0xd09d1d3774b211590555be066a70a8d5 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 15 length 43 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - PLUTON\glouglou PEAP: Got tunneled EAP-Message EAP-Message = 0x020f001401504c55544f4e5c676c6f75676c6f75 PEAP: Got tunneled identity of PLUTON\glouglou PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to PLUTON\glouglou PEAP: Sending tunneled request EAP-Message = 0x020f001401504c55544f4e5c676c6f75676c6f75 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" server (null) { +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 15 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server (null) PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x011000291a0110002410ca599c00d22c084762ea6a53c13a5d2b504c55544f4e5c676c6f75676c6f75 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x18e71c2c18f706a7a1507180b3671108 PEAP: Processing from tunneled session code 0x8193750 11 EAP-Message = 0x011000291a0110002410ca599c00d22c084762ea6a53c13a5d2b504c55544f4e5c676c6f75676c6f75 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x18e71c2c18f706a7a1507180b3671108 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 54 to 10.10.44.246 port 1027 EAP-Message = 0x0110004019001703010035956c4cf08a6ab0bfe1df4631b8fd06250693f7860a05c35348bd0b12064b45bc7dacfeccc8db66434df13655cdb562cecc68ed1886 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x56748010536499f247f2f989f1c443b2 Finished request 55. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=55, length=263 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02100061190017030100566d4d35418ad77fca42e9b02823f08213269331fae81fc0fc8c7c8d32df6d8353777e01f72461069c6b8ff46b8af9ae103b3652ba4a3a8cab3024aef70b6f5178fd21d6c680ab940da848bc70986816005ecde4d32124 State = 0x56748010536499f247f2f989f1c443b2 Message-Authenticator = 0x457d4f556b9681c25a43b1cbf68fa24c +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 16 length 97 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x0210004a1a0210004531574a3bb95c0c018b05e6c2ef8940230c00000000000000001f96c63c6a98e87af339d1226e5feef41e327666f3ccd17500504c55544f4e5c676c6f75676c6f75 PEAP: Setting User-Name to PLUTON\glouglou PEAP: Sending tunneled request EAP-Message = 0x0210004a1a0210004531574a3bb95c0c018b05e6c2ef8940230c00000000000000001f96c63c6a98e87af339d1226e5feef41e327666f3ccd17500504c55544f4e5c676c6f75676c6f75 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "PLUTON\\glouglou" State = 0x18e71c2c18f706a7a1507180b3671108 NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" server (null) { +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 16 length 74 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for glouglou with NT-Password WARNING: Deprecated conditional expansion ":-". See "man unlang" for details WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=PLUTON\glouglou mschap2: ca expand: --challenge=%{mschap:Challenge:-00} -> --challenge=b7b4f66d1ed49fa6 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=1f96c63c6a98e87af339d1226e5feef41e327666f3ccd175 Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/lib/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/lib/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [PLUTON\\glouglou/<via Auth-Type = EAP>] (from client Access_Point_DWL-8500AP+_A1_L1 port 1 cli 00-12-F0-0C-97-61) } # server (null) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\020E=691 R=1" EAP-Message = 0x04100004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x81930e0 3 MS-CHAP-Error = "\020E=691 R=1" EAP-Message = 0x04100004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled Sending Access-Challenge of id 55 to 10.10.44.246 port 1027 EAP-Message = 0x011100261900170301001b1471747ad76849d8dbd00fc980acdd80e3ecab794abb3f1be839db Message-Authenticator = 0x00000000000000000000000000000000 State = 0x56748010506599f247f2f989f1c443b2 Finished request 56. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=56, length=204 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x021100261900170301001bfa6d913e5662305d0263ee856da52043e1b236e5ffc5423828edc4 State = 0x56748010506599f247f2f989f1c443b2 Message-Authenticator = 0x84c6191562a7454ae511824190170812 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 17 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [PLUTON\\glouglou/<via Auth-Type = EAP>] (from client Access_Point_DWL-8500AP+_A1_L1 port 1 cli 00-12-F0-0C-97-61) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> PLUTON\glouglou ++[attr_filter.access_reject] returns noop Delaying reject of request 57 for 1 seconds Going to the next request Waking up in 0.8 seconds. Sending delayed reject for request 57 Sending Access-Reject of id 56 to 10.10.44.246 port 1027 EAP-Message = 0x04110004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 50 ID 49 with timestamp +160171 Cleaning up request 51 ID 50 with timestamp +160171 Cleaning up request 52 ID 51 with timestamp +160171 Cleaning up request 53 ID 52 with timestamp +160171 Cleaning up request 54 ID 53 with timestamp +160171 Cleaning up request 55 ID 54 with timestamp +160171 Cleaning up request 56 ID 55 with timestamp +160171 Waking up in 1.0 seconds. Cleaning up request 57 ID 56 with timestamp +160171 Ready to process requests. ---------------------------------------- _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

FreeRADIUS PostgreSQL schema.sql: 'now' => now()
by Jos Vos 27 Jun '08

27 Jun '08

Hi, I think the 'now' (*with* quotes) in postgresql/schema.sql (table radpostauth, field authdate) should become now() (*without* quotes). In the old way the default date will be the fixed date from the time the table was created, which is not the intention I presume. In the new way the default date is the date the row is added. This is in FreeRADIUS 2.0.3, I didn't check if newer versions have corrected this. It may also apply to schemas for other databases, but I only have the PostgreSQL files installed here. -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204

1 0

pam_radius_auth accounting configuration
by Brook Wondu 26 Jun '08

26 Jun '08

I am using pam_radius_auth 1.3.17 and I am having difficulty getting accounting to work. I have defined a service called openvpn in /etc/pam.d and the config lines are below auth required /lib/security/pam_radius_auth.so debug session required /lib/security/pam_radius_auth.so debug account required /lib/security/pam_radius_auth.so debug I have also created /etc/raddb/server and put in radius_server_ip:port secret time_out. The authentication piece works fine, but we don't see any accounting packets being forwarded to the radius server (Microsoft IAS 2003). Thanks, BW

1 0