August 2008 - Freeradius-Users - lists.freeradius.org

Unable to authenticate to 10.5.4 open directory
by Thomas von Eyben 02 Sep '08

02 Sep '08

Hi there, I have been googling and searching the archives for help - no luck so far. I am trying to get Mac OS X 10.5.4 Server to authenticate against the Open Directory in order to provide "http://eduroam.org" service - so far with no luck. I AM able to authenticate against my hardcoded users in the /users file so I know that part (most?) of the setup is working (firewall, proxying etc). Running radiusd in debug mode: (sudo /usr/sbin/radiusd -X -f) gives this good debug info (please help me find my problem as I am not yet an expert within the RADIUS - yet :-) Testclient is also Mac OS X 10.5.4 though a Client - not a Server :) rad_recv: Access-Request packet from host 130.225.242.107:1814, id=26, length=201 Received packet from 130.225.242.107 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 130.225.242.107:1814, id=27, length=201 Received packet from 130.225.242.107 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 130.225.242.107:1814, id=28, length=201 Received packet from 130.225.242.107 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 26 with timestamp 48b8514f Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 27 with timestamp 48b85151 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 28 with timestamp 48b85153 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 130.225.242.106:1814, id=19, length=201 User-Name = "testuser(a)bric.dk" Calling-Station-Id = "00-14-51-7F-C3-A2" Called-Station-Id = "00-0B-85-84-19-E0:eduroam" NAS-Port = 29 NAS-IP-Address = 172.17.1.4 NAS-Identifier = "Cisco_ea:68:a3" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\000800" EAP-Message = 0x0203001501746573747573657240627269632e646b Message-Authenticator = 0x5216ae078ddb62a4e787498caba6c2f6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: Looking up realm "bric.dk" for User-Name = "testuser(a)bric.dk" rlm_realm: Found realm "bric.dk" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm bric.dk rlm_realm: Adding Realm = "bric.dk" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 3 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 130.225.242.106 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 19 to 130.225.242.106 port 1814 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010400061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6b55b82a65c27423545059bd72c3a1a3 Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 130.225.242.106:1814, id=20, length=310 User-Name = "testuser(a)bric.dk" Calling-Station-Id = "00-14-51-7F-C3-A2" Called-Station-Id = "00-0B-85-84-19-E0:eduroam" NAS-Port = 29 NAS-IP-Address = 172.17.1.4 NAS-Identifier = "Cisco_ea:68:a3" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\000800" EAP-Message = 0x0204007015800000006616030100610100005d030148b8515f5a170a84693976f3002d3d2f17b996dfb6a11461d76e12aa04c823b1000036002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a0017001900010100 State = 0x6b55b82a65c27423545059bd72c3a1a3 Message-Authenticator = 0x2290f9444384fa8a336e277b8f63f4a5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: Looking up realm "bric.dk" for User-Name = "testuser(a)bric.dk" rlm_realm: Found realm "bric.dk" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm bric.dk rlm_realm: Adding Realm = "bric.dk" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 112 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 4 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 130.225.242.106 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0205], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 20 to 130.225.242.106 port 1814 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0105026c158000000262160301004a02000046030148b8515fe87904cb4446203056b73fd1aa5ba41024828ee331b8ec32a39a1e5b20cef766ec6a5dce450efd2bb291ec7b40b0f4030813d956b6caf6653d6165e6f8002f0016030102050b0002010001fe0001fb308201f730820160a00302010202043d6c7d37300b06092a864886f70d0101053030310d300b06035504030c0474657374310d300b060355040a0c04427269633110300e060355040b0c07627269632e646b301e170d3037313232303030313935355a170d3038313131383231303734305a3030310d300b06035504030c0474657374310d300b060355040a0c0442726963311030 EAP-Message = 0x0e060355040b0c07627269632e646b30819f300d06092a864886f70d010101050003818d0030818902818100b528df96ddfa57a15ea58d4e10a91abaf7593617eb2678914c78a75f7a46f1871b1f6ed38cd1cfa5f6f98cb40d439d8b065dab0225408e6e5089b6bff5a5f8188d9ed6e48eb7890c1a05d38babe9d5f7e8824400e8d84713c1eb3bed51958cec1f2bffd25c58ee07f0c8c86ba191bdeae66859cde52751dc3679d4363a0e75170203010001a320301e300b0603551d0f0404030202b4300f0603551d130101ff04053003010100300d06092a864886f70d010105050003818100174fa69b358ee0e1e5334a00b51cbe7544cde878d7c81e EAP-Message = 0x8f7f6e4baf89af1d373dbfe40df55287642014d4918bec674b195de4d5ebcd57496fb21acffdcc4947db69f77a837ff8337c302cb8daef2c2273b33f92d0b5565939dc09fadd01e3bac3f88eb1a14e3d18aa2f66fedac03fda91cc14e9bc346acce1dc7295f117ef3316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa7a08498b7d8fd373619e637a6b9497f Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 130.225.242.106:1814, id=21, length=406 User-Name = "testuser(a)bric.dk" Calling-Station-Id = "00-14-51-7F-C3-A2" Called-Station-Id = "00-0B-85-84-19-E0:eduroam" NAS-Port = 29 NAS-IP-Address = 172.17.1.4 NAS-Identifier = "Cisco_ea:68:a3" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\000800" EAP-Message = 0x020500d01580000000c616030100861000008200809c6256be59d58444084217ef937e20ab4e9addb1d7a71164b4bdb4dd90f9c51cebc2c3d0f966d9ae13036119cf961595f38b28ea311c563f363836b99c0eff13b77e110076d212203447dcd9889852f9f8d2b00a161bebe33abca071a91f9020d16a4493c0f823809ad6c3f27235f881029ca6dbe15ccef1c1ee9fd8b7e01e5a14030100010116030100309904a5ef25e86c0ff9c272ad5540fc6e6c9cb1c478a821a9e403953262bd772da137dd3360670763c1b23de636783813 State = 0xa7a08498b7d8fd373619e637a6b9497f Message-Authenticator = 0xa300f3c74dfa418d42a8476478f7004f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: Looking up realm "bric.dk" for User-Name = "testuser(a)bric.dk" rlm_realm: Found realm "bric.dk" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm bric.dk rlm_realm: Adding Realm = "bric.dk" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 208 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 5 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 130.225.242.106 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 21 to 130.225.242.106 port 1814 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0106004515800000003b14030100010116030100307324aca9a0624587c31701d7b81b24d1e2c097d5ce09f15c0453da9c701026b1becb4154c55342e02d2ce85c2b40ea23 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfb62e9c7f0b887914d1f617cc70a339 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 130.225.242.106:1814, id=22, length=357 User-Name = "testuser(a)bric.dk" Calling-Station-Id = "00-14-51-7F-C3-A2" Called-Station-Id = "00-0B-85-84-19-E0:eduroam" NAS-Port = 29 NAS-IP-Address = 172.17.1.4 NAS-Identifier = "Cisco_ea:68:a3" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\000800" EAP-Message = 0x0206009f1580000000951703010090b7d3eb1b77b7775c8190cebfb411d21e6627e9821f86d356f60efbea7c6497dc66664ceb21febfbf59b80227b6cb777d2e4c6051e8af54229d35c254d796f4d6f0e1bfe716919511042be43818729094631ebcff50c771ffc2e6df73e0c709c28830d6b82db4df8110839e0c4b153b28030486f23d112d509b68e612d592eabf5f202b68c70ddfaf2da06d3e441a8eff State = 0xcfb62e9c7f0b887914d1f617cc70a339 Message-Authenticator = 0x4d0c9e4196d02fceeaf413d2586fefbf Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: Looking up realm "bric.dk" for User-Name = "testuser(a)bric.dk" rlm_realm: Found realm "bric.dk" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm bric.dk rlm_realm: Adding Realm = "bric.dk" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 159 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 6 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 130.225.242.106 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled request User-Name = "testuser(a)bric.dk" MS-CHAP-Challenge = 0x63a3c34cf7df7e1ce1847c548b4c01c7 MS-CHAP2-Response = 0xe1006877cd5e3a28368d5bf9531c77e811a700000000000000004016c5470ee27eb869fd7d9d0093ffa247bdb4e6a2b89fe4 FreeRADIUS-Proxied-To = 127.0.0.1 TTLS: Sending tunneled request User-Name = "testuser(a)bric.dk" MS-CHAP-Challenge = 0x63a3c34cf7df7e1ce1847c548b4c01c7 MS-CHAP2-Response = 0xe1006877cd5e3a28368d5bf9531c77e811a700000000000000004016c5470ee27eb869fd7d9d0093ffa247bdb4e6a2b89fe4 FreeRADIUS-Proxied-To = 127.0.0.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 6 rlm_realm: Looking up realm "bric.dk" for User-Name = "testuser(a)bric.dk" rlm_realm: Found realm "bric.dk" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm bric.dk rlm_realm: Adding Realm = "bric.dk" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 6 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 236 radius_xlat: 'testuser(a)bric.dk' modcall[authorize]: module "files" returns ok for request 6 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 127.0.0.1 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 6 modcall: leaving group authorize (returns ok) for request 6 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for testuser(a)bric.dk with NT-Password rlm_mschap: No NT-Password configured. Trying DirectoryService Authentication. rlm_mschap: getUserNodeRef(): dsGetRecordList() status = 0, recCount=0 rlm_osx_od: ds_mschap_auth: getUserNodeRef failed modcall[authenticate]: module "mschap" returns fail for request 6 modcall: leaving group MS-CHAP (returns fail) for request 6 auth: Failed to validate the user. Login incorrect: [testuser(a)bric.dk/<no User-Password attribute>] (from client localhost port 0) TTLS: Got tunneled reply RADIUS code 3 User-Name = "testuser(a)bric.dk" TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 6 modcall: leaving group authenticate (returns invalid) for request 6 auth: Failed to validate the user. Login incorrect: [testuser(a)bric.dk/<no User-Password attribute>] (from client tld-1 port 29 cli 00-14-51-7F-C3-A2) Delaying request 6 for 1 seconds Finished request 6 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 130.225.242.106:1814, id=23, length=357 User-Name = "testuser(a)bric.dk" Calling-Station-Id = "00-14-51-7F-C3-A2" Called-Station-Id = "00-0B-85-84-19-E0:eduroam" NAS-Port = 29 NAS-IP-Address = 172.17.1.4 NAS-Identifier = "Cisco_ea:68:a3" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\000800" EAP-Message = 0x0206009f1580000000951703010090b7d3eb1b77b7775c8190cebfb411d21e6627e9821f86d356f60efbea7c6497dc66664ceb21febfbf59b80227b6cb777d2e4c6051e8af54229d35c254d796f4d6f0e1bfe716919511042be43818729094631ebcff50c771ffc2e6df73e0c709c28830d6b82db4df8110839e0c4b153b28030486f23d112d509b68e612d592eabf5f202b68c70ddfaf2da06d3e441a8eff State = 0xcfb62e9c7f0b887914d1f617cc70a339 Message-Authenticator = 0x2535af39d3c8b25b89693657df5323ba Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: Looking up realm "bric.dk" for User-Name = "testuser(a)bric.dk" rlm_realm: Found realm "bric.dk" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm bric.dk rlm_realm: Adding Realm = "bric.dk" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 6 length 159 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 7 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 130.225.242.106 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Login incorrect: [testuser(a)bric.dk/<no User-Password attribute>] (from client tld-1 port 29 cli 00-14-51-7F-C3-A2) Delaying request 7 for 1 seconds Finished request 7 Going to the next request --- Walking the entire request list --- Sending Access-Reject of id 22 to 130.225.242.106 port 1814 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 19 with timestamp 48b8515f Cleaning up request 4 ID 20 with timestamp 48b8515f Cleaning up request 5 ID 21 with timestamp 48b8515f Sending Access-Reject of id 23 to 130.225.242.106 port 1814 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 6 ID 22 with timestamp 48b85161 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 7 ID 23 with timestamp 48b85163 Nothing to do. Sleeping until we see a request. Any suggestion are more than welcome(!) TvE

3 8

Radius --> Openldap auth: Failed to validate the user
by Laurence Mayer 01 Sep '08

01 Sep '08

4 14

Freeradius + Ldap + attributes
by Ivan . 01 Sep '08

01 Sep '08

Hi I have Freeradius configured with a backend of OpenLdap for user management. I would like to be able to pass attributes for Nortel and Juniper gear, which when statically defining users in user file is done via: user Auth-type:=Local, User-Password := "test" Juniper-Local-User-Name ="DEV", Service-Type = Administrative-User Is there a way to pass these attributes when using Ldap for user management? thanks Ivan

2 3

radclient problem
by Umar 01 Sep '08

01 Sep '08

Dear User! I have Freeradius running on FreeBSD. How i can kill or get a status of connected user?. I am trying radclient but its not working for me. echo "User-Name = umar" | radclient -x 127.0.0.1:1812 status <secret> the above command didn't work for me. Please help in this regards. Umar Draz -- View this message in context: http://www.nabble.com/radclient-problem-tp19239639p19239639.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

Simultaneous-Use ..
by Alexandre J. Correa - Onda Internet 31 Aug '08

31 Aug '08

Hello, how i can setup freeradius to disconnect previous session of user that has Simultaneous-Use = 1 ?! thanks -- Sds. Alexandre Jeronimo Correa Onda Internet - http://www.ondainternet.com.br OPinguim Hosting - http://www.opinguim.net Linux User ID #142329 UNOTEL S/A - http://www.unotel.com.br

2 1

Re: Fwd: MSCHAP module returns OK, authentication fails.. (SOLVED)
by James Yale 30 Aug '08

30 Aug '08

2008/8/29 James Yale <jim(a)thebiggame.org>: > 2008/8/28 <A.L.M.Buxey(a)lboro.ac.uk>: >> hi, >> >> whats wrong with that debug? looked fine here - that should >> end with a happy connection. ntlm_auth got the correct >> response. >> >> alan > > The problem is that when that log ends the WPA supplicant gets: > > -- EAP-MSCHAPV2: Invalid authenticator response in success request > > And the authentication fails. The full logs of the failure are at: > > http://jim.geezas.com/stuff/radius-debugging/eapol-ntlmuser-failure.log > for the supplicant and: > > http://jim.geezas.com/stuff/radius-debugging/radius-ntlmuser-failure.log > for radiusd. > > I'm going to try afew different distributions/versions of FreeRadius > and Samba, perhaps compile from source - presumably this configuration > is fairly common and working elsewhere, so it should work with some > combination (if I find one I'll post it up). > > Thanks, > > James > To update this, Alan DeKok was right about the issue being with Samba, but rather than using an newer version of Samba an older version was required. I compiled Samba 3.0.32 from source and EAP/MSCHAP authentication now works perfectly on FC9 with the packaged version of FreeRadius 2.0.5. Thanks to both Alans for the help :) James

1 0

compiling freeradius with oracle support
by Alexandre Chapellon 30 Aug '08

30 Aug '08

Hi I manage to compil freeradius (2.0.5) with oracle support and so i installed the oracle instantclient (11_1) and its sdk... all this in /opt/oracle When launching compilation (using the dpkg-builpackage wrapper and rules files modified to enable oracle) i get a problem: The rlm_sql_oracle driver compilation is silently skip whereas i did specify the appropriate (well i guess they are appropriate): --with-rlm-sql-oracle=yes --with-oracle-home-dir=/opt/oracle --with-oracle-lib-dir=/opt/oracle/instantclient_11_1/ --with-oracle-include-dir=/opt/oracle/instantclient_11_1/sdk/include It says headers (oci.h) are not found, but this file realy is in the specified include path. So i decided to start the dirty stuff and set $oracle_include_dir as an environment variable doing manual configure (don't know if i can do it with dpkg-buildpackage) oracle_include_dir=/opt/oracle/instantclient_11_1/sdk/include ./configure ..... this made the header test successfull but i can't still make it find libs which are in /opt/oracle/instantclient: ~$ ls /opt/oracle/instantclient_11_1/ adrci genezi libclntsh.so.11.1 libocci.so libociei.so ojdbc5.jar sdk BASIC_README libclntsh.so libnnz11.so libocci.so.11.1 libocijdbc11.so ojdbc6.jar Does anyone have a clue what i could do?

3 20

FreeRadius not sending access-deny
by Ryan Kramer 29 Aug '08

29 Aug '08

Hello, I recently discovered that my Freeradius 1.1.7 install is no longer sending access-deny messages for bad passwords. This causes the device to mark the radius server as down and move on to the next one, or just marks it as down. I know its probably something I did in the config, but for the life of me can't figure out how I managed to cause that. Everything else on the install works great, just for the exception of no access-deny packets ever move. Any ideas? Ryan

3 4

Compile problems
by David Blood 29 Aug '08

29 Aug '08

I am trying to install freeradius from source and cannot seem to get it to install correctly. 1. I am installing on a centos 4.5 box and would like freeradius to install the config file in the correct place (i.e. /etc/raddb) setting the prefix='' ( or sysconfdir='/etc/raddb') in the configure script does not tell the radiusd executable to look in /etc/raddb for its configuration files. It still looks in /usr/local/etc/raddb 2. The configure script cannot find the libgdbm library and thus cannot configure some of the rlm_modules. I have tried setting the --with-rlm-counter-lib-dir='/usr/lib' which is where the gdbm library is looked to get rlm_couter to configure but it still fails. 3. I says it can't locate check-radiusd-config . I wish I knew where it was looking. Here is the configure command I last used with the error output received. ./configure --prefix='' --exec-prefix='/usr' --includedir='/usr/include' --datadir='/usr/share' --libdir='/usr/lib' --sysconfdir='/etc/raddb' --with-rlm-counter-lib-dir='/usr/lib' -q appending configuration tag "CXX" to libtool appending configuration tag "F77" to libtool config.status: WARNING: ./Make.inc.in seems to ignore the --datarootdir setting config.status: WARNING: ./src/include/build-radpaths-h.in seems to ignore the --datarootdir setting chmod: cannot access `check-radiusd-config': No such file or directory configure: WARNING: silently not building rlm_counter. configure: WARNING: FAILURE: rlm_counter requires: libgdbm. configure: WARNING: FAILURE: rlm_dbm requires: (ndbm.h or gdbm/ndbm.h or gdbm-ndbm.h) (libndbm or libgdbm or libgdbm_compat). configure: WARNING: silently not building rlm_dbm. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: creating ./config.status config.status: creating Makefile checking for OpenSSL support... yes configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged configure: WARNING: silently not building rlm_ippool. configure: WARNING: FAILURE: rlm_ippool requires: libgdbm. configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap_r ldap.h. configure: WARNING: silently not building rlm_pam. configure: WARNING: FAILURE: rlm_pam requires: libpam. configure: WARNING: silently not building rlm_python. configure: WARNING: FAILURE: rlm_python requires: Python.h. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: sql.h. David

3 7

freeradius, proxy and packet loss
by Evgeniy Kozhuhovskiy 29 Aug '08

29 Aug '08

Hi all! I have a freeradius 2.0.5 installed and configured to authorize to realms (for example @a and @b) First realm - @a - authorizes locally (via rlm_sql) Second - @b - is proxying to remote server. The trouble looks so (we take this with with tcpdump): - my freeradius 2.0.5 server sends auth-req -- remote server gets it and process -- remote server sends answer -- it reach our server -- ~95% replyes goes to NAS'es, but sometimes my server says that "Rejecting request 4490 due to lack of any response from home server xx.xx.xx.xx port 1812" (but in fact this response arrives to the interface of the computer with freeradius installed - i see this with sniffer, but there is nothing in freeradius logs about this packet) -- With best regards, Evgeniy Kozhuhovskiy, Leader of Services team, Minsk State Phony Network, RUE Beltelecom.

4 6