January 2009 - Freeradius-Users - lists.freeradius.org

Authentication Problem with PEAP and openldap
by Michael Poser 11 Jan '09

11 Jan '09

Hello, native wired xp 802.1X client with PEAP (mschapv2) tries to authenticate via freeradius against openldap with an md4 encoded utf-16e password hash. The authentication fails. If we use the hash instead of the clear-text password with the xp client, the authentication works fine. There must be some problems with the encryption of the password. How do we fix the problem? Any help is appreciated. Here are the radiusd.conf file and the debug output aof radiusd -X: Best Regards, Michael <radiusd.conf> prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes } ldap { server = "ldaps://XXXXXXXXXX.XX" identity = "uid=XXX,o=XXX,dc=XXX,dc=de" password = XXXXXXX basedn = "ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no tls_cacertfile = /etc/openldap/cacerts/ca-bundle.crt dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailfile = ${radacctdir}/sammeldir/detail detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap files ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } </radiusd.conf> <radiusd -X> rad_recv: Access-Request packet from host 141.2.252.203:62849, id=206, length=86 User-Name = "plisch01" EAP-Message = 0x0200000d01706c697363683031 Message-Authenticator = 0xf0812bbe8b0e990ff9c6206d353405de NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldaps://XXX.XE, authentication 0 rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/ca-bundle.crt rlm_ldap: bind as uid=XXX,o=XXX,dc=XXX,dc=de/XXXX to ldaps://XXX rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 206 to 141.2.252.203:62849 EAP-Message = 0x010100160410c412f76e7e655747b06f3e294c7fed9a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbda20678cb572e52f1a93c3ce8de3099 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=229, length=97 User-Name = "plisch01" State = 0xbda20678cb572e52f1a93c3ce8de3099 EAP-Message = 0x020100060319 Message-Authenticator = 0xa2b38e829929b3245f489b88fef80135 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "files" returns notfound for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183..... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 229 to 141.2.252.203:62849 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x48a99a491f1506a34ab971b65e1e9eed Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=131, length=171 User-Name = "plisch01" State = 0x48a99a491f1506a34ab971b65e1e9eed EAP-Message = 0x0202005019800000004616030100410100003d0301496755f6f21ae795ee2b9dbe7e24064c e03e31795d9a4a18607059f3614c6afe00001600040005000a00090064006200030006001300 1200630100 Message-Authenticator = 0x99aced399bcbe6e1af0c51ee3c8f01d1 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall[authorize]: module "files" returns notfound for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 131 to 141.2.252.203:62849 EAP-Message = 0x0103040a19c0000006f1160301004a020000460301496755f3badec494486cf4bae34461c0 6b0505d69a956ae2d5a803f146feb962202cb7719a8ffcc825336c500975192cfb8a5e653a69 77d938ccde5707711b5eaa00040016030106940b00069000068d0002cd308202c930820232a0 03020102020102300d06092a864886f70d010104050030819f310b3009060355040613024341 3111300f0603550408130850726f76696e63653112301006035504071309536f6d6520436974 7931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63 616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d 706c652e636f6d301e170d3034303132353133323631305a170d303530313234313332363130 5a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112 301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174 696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74 206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d 706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a78 2098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014 a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f8 1ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603 551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d 921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd70845370834 96fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f 295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003 020102020100300d06092a864886f70d010104050030819f310b300906035504061302434131 11300f0603550408130850726f76696e63653112301006035504071309536f6d652043697479 31153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f6361 6c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f 06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4d941206f16d48604e5278275172f5d9 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=12, length=97 User-Name = "plisch01" State = 0x4d941206f16d48604e5278275172f5d9 EAP-Message = 0x020300061900 Message-Authenticator = 0x36256183de48f93989f06e14bc11f188 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 modcall[authorize]: module "files" returns notfound for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 12 to 141.2.252.203:62849 EAP-Message = 0x010402f71900170d3036303132343133323630375a30819f310b3009060355040613024341 3111300f0603550408130850726f76696e63653112301006035504071309536f6d6520436974 7931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63 616c686f7374311b301906035504031312436c69656e74206365727469666963617465312130 1f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06 092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8f bff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249e dd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229 963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e 1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7 bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111 300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931 153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e7420636572 74696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c 652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d010104050003 81810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc27 43fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00 163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d437 3354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x39f344cd69a2f35503a380fcc8ea4a83 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=45, length=283 User-Name = "plisch01" State = 0x39f344cd69a2f35503a380fcc8ea4a83 EAP-Message = 0x020400c01980000000b616030100861000008200805cf4ad6f145c089dc932b32a4c8c29f6 6f8ba762b19ca5e49d7fdcc56064623b8de51dc9f8eb186709c4c529f4c35dffc2c4d0868331 97659aea363231b79ef93008c66bc525ee5f83937f4a581566f4af250c15e7b9b4a931b04630 a359e665ac4f9497f9a60527d49ce0428e6b8005e2e2c44ce6617f35bf73370396429b641403 0100010116030100204729c2b650ffc91ec681e46eefe199e7405708a6fa89699d1e5d729b37 323e02 Message-Authenticator = 0xe4a3fc40c382c15a35606865a372fc0c NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall[authorize]: module "files" returns notfound for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 45 to 141.2.252.203:62849 EAP-Message = 0x01050031190014030100010116030100204b6baa9082446a5e5d949733bcd61cd97e71147f 4b7b0ede2fdf227003f80d63 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x283e48785e8097412f97fd724e4a6e25 Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=57, length=97 User-Name = "plisch01" State = 0x283e48785e8097412f97fd724e4a6e25 EAP-Message = 0x020500061900 Message-Authenticator = 0x322cc75005e5f7d756741b6b9db14083 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall[authorize]: module "files" returns notfound for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 57 to 141.2.252.203:62849 EAP-Message = 0x010600201900170301001515b983ce613f1d101b1b0c3e9f632bc2bdd92bf0ef Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3ee625007e53c68d653aa899c99579c1 Finished request 5 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=147, length=127 User-Name = "plisch01" State = 0x3ee625007e53c68d653aa899c99579c1 EAP-Message = 0x020600241900170301001920ce664e444ad38f8d09783ae8c77e4e6891969c2973856cff Message-Authenticator = 0xe7234912513e897b42b52724e518927e NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 36 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall[authorize]: module "files" returns notfound for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - plisch01 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0206000d01706c697363683031 PEAP: Got tunneled identity of plisch01 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to plisch01 PEAP: Sending tunneled request EAP-Message = 0x0206000d01706c697363683031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "plisch01" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched DEFAULT at 244 radius_xlat: 'plisch01' modcall[authorize]: module "files" returns ok for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 PEAP: Got tunneled reply RADIUS code 11 User-Name = "plisch01" EAP-Message = 0x010700221a0107001d105fe75feb133da90be571a2ab66b56b41706c697363683031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5d10815c41541ad37a91292eea4550b6 PEAP: Processing from tunneled session code 0x90f6918 11 User-Name = "plisch01" EAP-Message = 0x010700221a0107001d105fe75feb133da90be571a2ab66b56b41706c697363683031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5d10815c41541ad37a91292eea4550b6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 147 to 141.2.252.203:62849 EAP-Message = 0x010700391900170301002ec95e5e434f311c9c7cbd1b8eeea7bd19d9078f4cffcfd930a088 ad9a6318e723477696e13974f1fc1101894571e4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf75459f95978ea5dee485ccbf6b9ad9a Finished request 6 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=70, length=181 User-Name = "plisch01" State = 0xf75459f95978ea5dee485ccbf6b9ad9a EAP-Message = 0x0207005a1900170301004f491c7ee6409ec5ae6769e0c33d4f7062f03a24ef9c951fc1b00b 7204a7e10e2cc5d9a1ff9c3b8f6dbb71d8f4b3d69bf7a710d6019376d6a370b59671d11de1cb 9cf688c434a68ad7d5281e6cfd8d46 Message-Authenticator = 0x0a9cf79ba8ea337330e56aa8b0785547 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 90 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall[authorize]: module "files" returns notfound for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=raduser,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020700431a0207003e3168e3bcd95cb641bff66d420b10b07cd80000000000000000307384 bc22ffe588803cf80f47635e7c4d43fe726c920d6700706c697363683031 PEAP: Setting User-Name to plisch01 PEAP: Adding old state with 5d 10 PEAP: Sending tunneled request EAP-Message = 0x020700431a0207003e3168e3bcd95cb641bff66d420b10b07cd80000000000000000307384 bc22ffe588803cf80f47635e7c4d43fe726c920d6700706c697363683031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "plisch01" State = 0x5d10815c41541ad37a91292eea4550b6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 67 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched DEFAULT at 244 radius_xlat: 'plisch01' modcall[authorize]: module "files" returns ok for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 7 rlm_mschap: Told to do MS-CHAPv2 for plisch01 with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: group Auth-Type returns reject for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. Login incorrect: [plisch01] (from client localhost port 0) PEAP: Got tunneled reply RADIUS code 3 User-Name = "plisch01" MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x90f60d0 3 User-Name = "plisch01" MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 70 to 141.2.252.203:62849 EAP-Message = 0x010800261900170301001b1aaec581089b9d3dbc54fb36761fbe248d25e2663ca7476b4971 b5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0826aec91672e96341cd1b93cca166c5 Finished request 7 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=1, length=129 User-Name = "plisch01" State = 0x0826aec91672e96341cd1b93cca166c5 EAP-Message = 0x020800261900170301001bc8df9767d6720bbf4aa9ba81c8c6749d20979bf65f4d20e3a862 59 Message-Authenticator = 0x78b71176e4eccdb35ecb960b32ec0a0a NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "plisch01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 modcall[authorize]: module "files" returns notfound for request 8 rlm_ldap: - authorize rlm_ldap: performing user authorization for plisch01 radius_xlat: '(uid=plisch01)' radius_xlat: 'ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user plisch01 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: group authenticate returns invalid for request 8 auth: Failed to validate the user. Login incorrect: [plisch01] (from client Juniper-EX port 0) Delaying request 8 for 1 seconds Finished request 8 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 141.2.252.203:62849, id=1, length=129 Sending Access-Reject of id 1 to 141.2.252.203:62849 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 12 with timestamp 496755f3 Cleaning up request 2 ID 131 with timestamp 496755f3 Cleaning up request 0 ID 206 with timestamp 496755f3 Cleaning up request 1 ID 229 with timestamp 496755f3 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 8 ID 1 with timestamp 496755f4 Cleaning up request 4 ID 45 with timestamp 496755f4 Cleaning up request 5 ID 57 with timestamp 496755f4 Cleaning up request 7 ID 70 with timestamp 496755f4 Cleaning up request 6 ID 147 with timestamp 496755f4 Nothing to do. Sleeping until we see a request. </radiusd -X>

3 2

Re:freeradius doesn't sent information to mysql
by Eric 11 Jan '09

11 Jan '09

I had sent an instance of accounting request from my vpn server to radius server. you send me that I haven't got anything configured in the accounting section. do you mean that vpn server frame is correct but accounting section in radius server doesn't work? >rad_recv: Accounting-Request packet from host 10.10.10.3:11858, id=133, >length=260 > Acct-Status-Type = Start > Acct-Delay-Time = 0 > NAS-IP-Address = 10.10.10.3 > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 4 > MS-RAS-Vendor = 311 > MS-RAS-Version = "MSRASV5.20" > NAS-Port-Type = Virtual > Tunnel-Type:0 = PPTP > Tunnel-Medium-Type:0 = IP > Calling-Station-Id = "192.168.201.59" > Tunnel-Client-Endpoint:0 = "192.168.201.59" > Microsoft-Attr-35 = 0x4d5352415356352e3130 > Microsoft-Attr-34 = 0x4d535241532d302d312d34304432 454332364243374334 > Acct-Session-Id = "118382" > User-Name = "school" > Framed-IP-Address = 10.10.10.4 > Framed-MTU = 1400 > Session-Timeout = 389554 > Idle-Timeout = 1200 > Acct-Multi-Session-Id = "953" > Acct-Link-Count = 1 > Event-Timestamp = "Dec 31 2008 15:45:03 IRST" > Acct-Authentic = RADIUS > MS-MPPE-Encryption-Types = 0x00000000 >Sending Accounting-Response of id 133 to 10.10.10.3 port 11858

2 1

Regular expressions on module 'files' (possible bug?)
by Flamur Rogova 10 Jan '09

10 Jan '09

Hi, On 'users' file I have this entry; b2 User-Password := "b2", Calling-Station-ID =~ "(00:10:B5:7A:13:BD)", Expiration := "28 Feb 2009 23:00:00" this entry should match only if Calling-Station-Id equals to "00:10:B5:7A:13:BD". on my case, it matches always, no matter what I send as Calling-Station-ID. if I dont set Calling-Station-Id on access request, then 'files' module returns with noop, which is correct. this is a snippet of debug output, rad_recv: Access-Request packet from host 10.241.21.202 port 1538, id=67, length=68 User-Name = "b2" User-Password = "b2" NAS-Port = 212 NAS-IP-Address = 192.168.10.113 Calling-Station-Id = "asdfasdfadsf" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "b2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] expand: %{Calling-Station-Id} -> asdfasdfadsf [files] users: Matched entry b2 at line 1 ++[files] returns ok [expiration] Checking Expiration time: '28 Feb 2009 23:00:00' ++[expiration] returns ok ++[logintime] returns noop I am testing this on latest version taken from git repositories, but I tried it also on older versions down to 2.1.1, they behave the same. on version 2.0.5 I get correct behavior. Thanks,

2 1

Error in SQL statement expansion? And how to correct it?
by Hanno Schupp 09 Jan '09

09 Jan '09

Dear All, I found the following in my freeradius 2.1.0 debug on Ubuntu 8.10 for my simultaneous use check: ... Sat Jan 10 10:21:47 2009 : Debug: expand: SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL AND callingstationid <> '{%Calling-Station-Id}' -> SELECT COUNT(*) FROM radacct WHERE username = 'yubvef23' AND acctstoptime IS NULL AND callingstationid <> '{anyonealling-Station-Id}' ... It appears that after expansion of {%Calling-Station-Id} the looked for value is {anyonealling-Station-Id}. The {} suggest this si a value that should have been expanded/replaced further. The spelling - {anyonealling-Station-Id} as opposed to {anyonecalling-Station-Id} as one might expect - suggested the expansion/replacement fails due to a syntax error. I have looked in the sql.conf and includes where the SQL statements are defined. The SQL statement looks OK but I cannot find any definition of or reference to {anyonealling-Station-Id}. I would like to confirm firstly that this is indeed a syntax error and secondly, where the value of {anyonealling-Station-Id} may be defined, so I can fix this. Thanks

3 2

RE: Authentication Problem with PEAP and openldap
by Michael Poser 09 Jan '09

09 Jan '09

Hello Thiabault, >> native wired xp 802.1X client with PEAP (mschapv2) tries to authenticate >> via freeradius against openldap with an md4 encoded utf-16e password hash. > This is just not possible. > PEAP (mschapv2) requires you can read the user password either as a > cleartext password or as a NTLM-hashed password in your DB. it was a bit ambiguous. The term "md4 encoded utf-16e password hash" should express, that it is an NTLM Hash. Sorry for the confusion. Best Regards, Michael

2 1

server selection
by Norbert Wegener 09 Jan '09

09 Jan '09

freeradius 2.1.1, configured to use multiple virtual servers, seems to select the server to use depending on the host sending the request, not depending on the NAS-IP-Address in the request. When using radtest I get: norbert@suse:~$ radtest 000000000002 000000000002 psucoll 0 secret dummy 1.1.1.1 Sending Access-Request of id 227 to 123.25.153.210 port 1812 User-Name = "000000000002" User-Password = "000000000002" NAS-IP-Address = 1.1.1.1 NAS-Port = 0 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 123.25.153.210 port 1812, id=227, length=20 while radiusd -X shows ..... Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 149.246.185.169 port 54115, id=244, length=70 User-Name = "000000000001" User-Password = "000000000001" NAS-IP-Address = 1.1.1.1 NAS-Port = 0 Framed-Protocol = PPP server enterasys { .... 1.1.1.1 is a nas belonging to the server cisco, 149.246.185.169 belongs to the server enterasys. I would have expected, the server is choosen because of the NAS-IP-Address. Thanks Norbert Wegener

3 6

freeradius not start after upgrade from 1.1.7 to 2.1.0
by Fabio 09 Jan '09

09 Jan '09

Hi all, i'm new on this ML. I've problem after upgrading from v1 to v2 ---------- # /etc/init.d/freeradius start * Starting FreeRADIUS daemon freeradius radiusd: Error: No log destination specified. ---------- In radiusd.conf the parameter of log are right with all permess: ---------- prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log ---------- I've search on the ML archive and i've found another thread with this problem but seems different. In my case freeradius not start with -X option and exit with error ---------- # freeradius -X ... ... ... Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } /etc/freeradius/radiusd.conf[1860]: Entry is not a reference to a module /etc/freeradius/radiusd.conf[1789]: Errors parsing authorize section. ---------- The two line in radiusd.conf: ---------- ... 1787 # Make *sure* that 'preprocess' comes before any realm if you 1788 # need to setup hints for the remote radius server 1789 authorize { ... 1856 # Look in an SQL database. The schema of the database 1857 # is meant to mirror the "users" file. 1858 # 1859 # See "Authorization Queries" in sql.conf 1860 sql # Edited ... ---------- Any ideas? Thanks

2 1

EAP-TLS without client authentication
by Christopher Byrd 08 Jan '09

08 Jan '09

This may sound like a strange request, but I'd like to know if it is possible to use FreeRADIUS to perform EAP-TLS without asking for a client certificate. The purpose is to allow for a secure connection to an access point without client authentication. I think this might be useful to replace "open wireless" for public wireless access with something more secure. According to the EAP-TLS RFC (rfc2716), it sounds like it might be possible: "The certificate_request message is included when the server desires the client to authenticate itself via public key. While the EAP server SHOULD require client authentication, this is not a requirement, since it may be possible that the server will require that the peer authenticate via some other means." I tried this with FreeRADIUS and eapol_test (from wpa_supplicant) with the following result: [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. The only change I've made from the default eap.conf is to try disabling the CA_file setting (I've tried it both ways). Does it sound like this is something that should be possible, or am I off base? Thanks! Christopher

4 5

Freeradius and Cisco ASA => Accounting and IP Static
by Phibee Network Operation Center 08 Jan '09

08 Jan '09

Hi I use FreeRadius for authenticate my IPSEC VPN User on a Cisco ASA. I search to know if it's possible: - Get Accounting for know: Login connection Start Login stop and time connected and if possible the number of Ko used - Use FreeRadius for IP Pool: Actually, it's the Asa that attribute IP Adresse with a IP Pool Do you know if it's possible that it's Freeradius sent the IP Adresse for use IP Static based on the login ? I Use a Perl Script in auth Thanks jerome

2 1

Some help with etc_smbpasswd auth and eap ttls
by Josh Hiner 08 Jan '09

08 Jan '09

Trying to configure eap ttls with mschapv2 using Freeradius version Version 1.1.3 in Redhat enterprise Linux 5. I have configured everything and gotten free radius to authenticate off /etc/samba/smbpasswd via the etc_smbpasswd module. The problem I have run into is when I switch the securew2 windows xp eap-ttls client to use the current logged on user credentials. Then, SecureW2 sends the username in the format of DOMAIN/user (which in this case is HTN/josh). Authentication then fails because of this extra domain part in the user. Ok fine, I first enable the nt_domain_hack in the mschap module then I configured realm ntdomain and simply set a default realm in proxy.conf to strip off the domain part. Nope, that fails (output will be included below). I also tried nostrip but that also fails obviously. Also tried silently stripping the domain in pre-process in radiusd.conf. Auth is successful but finally rejected because the user doesnt match the original HTN/josh user sent. Finally I simply added the username and password I was testing to the users file. It works there. My default realm strips the domain, proxies it back to localhost, authenticates of the users file and is successful. Arrg what Im I doing wrong. I really need to use the etc_smbpasswd module as I cant get ntlm_auth to work. It says no logon servers found. I think its because I am running it on the actual samba server I want to auth off of. Anyways, anyone know of how to get etc_smbpasswd module to work. I dont want to use the users file (blech) even though it does work when I put the user in there, and again, if I just supply the username and password (and leave the domain part blank in SecureW2 ttls client) authentication does work of /etc/samba/smbpasswd. Here is the /usr/sbin/radiusd -X output. Sorry its long. Below that I will put the relevant lines of config. Thanks a ton for any help. -Josh [root@file raddb]# /usr/sbin/radiusd -s -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server_key.pem" tls: certificate_file = "/etc/raddb/certs/server_cert.pem" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "serverH08ght0n23kip" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = yes Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = yes Module: Instantiated realm (ntdomain) Module: Loaded passwd passwd: filename = "/etc/samba/smbpasswd" passwd: format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" passwd: authtype = "MS-CHAP" passwd: delimiter = ":" passwd: ignorenislike = no passwd: ignoreempty = yes passwd: allowmultiplekeys = no passwd: hashsize = 100 rlm_passwd: nfields: 7 keyfield 0(User-Name) listable: no Module: Instantiated passwd (etc_smbpasswd) passwd: filename = "/etc/group" passwd: format = "=Group-Name:::*,User-Name" passwd: authtype = "(null)" passwd: delimiter = ":" passwd: ignorenislike = yes passwd: ignoreempty = yes passwd: allowmultiplekeys = yes passwd: hashsize = 50 rlm_passwd: nfields: 4 keyfield 3(User-Name) listable: yes Module: Instantiated passwd (etc_group) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.100.13.12:19527, id=104, length=202 User-Name = "HTN\\josh" Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff" Calling-Station-Id = "00-0E-35-B6-74-AF" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.100.13.12 NAS-Identifier = "Houghton Wireless Services" NAS-Port-Id = "HTNStaff" Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201000d0148544e5c6a6f7368 Message-Authenticator = 0xdf195f238143503d49244d6203620b10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 0 modcall[authorize]: module "etc_group" returns notfound for request 0 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 104 to 10.100.13.12 port 19527 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x61bf2476da0a8dbee700d7b52748377c Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.100.13.12:19527, id=105, length=263 User-Name = "HTN\\josh" Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff" Calling-Station-Id = "00-0E-35-B6-74-AF" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.100.13.12 NAS-Identifier = "Houghton Wireless Services" NAS-Port-Id = "HTNStaff" Connect-Info = "CONNECT 54Mbps 802.11g" State = 0x61bf2476da0a8dbee700d7b52748377c EAP-Message = 0x020200381500160301002d010000290301e9a07acc81410bcdf08077330d07ad8f018e56a6641624ec64a66da3f79bd121000002000a0100 Message-Authenticator = 0x0334fb063e9a6d53bd8682ba37d0620e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 56 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 1 modcall[authorize]: module "etc_group" returns notfound for request 1 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 002d], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 03d2], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 105 to 10.100.13.12 port 19527 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103040a15c00000042f160301004a02000046030149642f7ba9e448ca30ab30a9b6ed817c8aff8c408e4023e6940c762c1f36a6de20e1a7c54190eaf152b7593b2b138e0c050f4d101a4e1791b3f21981bd0acbe EAP-Message = 0x092a864886f70d010901161972656d637374616666406c697374732e72656d63312e6e6574301e170d3038313231353230323332365a170d3138313231333230323332365a308198310b300906035504061302555 EAP-Message = 0x82010100a721638f80275c7d8c29f90e3669da66da29a4dcb0e6d18b17c9349bd6eb88e205da76218efdf67065ee07977b86ccfbc278e1c229e5f9f32340cc2a04dc418528588e667ccb783bc13133bc15a0a0936 EAP-Message = 0xd5652a17fa2f1b0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038201010064900d552e6d98d35cde88dc41403c05fb45c2a2bdb2f5d6f9f0fdc EAP-Message = 0x21eaab40c755b46a6e7892ae526d055d6da3c8c3190a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x60ab04b8fd2e304f5d42050b620e1513 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.100.13.12:19527, id=106, length=213 User-Name = "HTN\\josh" Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff" Calling-Station-Id = "00-0E-35-B6-74-AF" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.100.13.12 NAS-Identifier = "Houghton Wireless Services" NAS-Port-Id = "HTNStaff" Connect-Info = "CONNECT 54Mbps 802.11g" State = 0x60ab04b8fd2e304f5d42050b620e1513 EAP-Message = 0x020300061500 Message-Authenticator = 0x85c0f98d60c740ec669de9a9c7da4986 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 2 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 2 modcall[authorize]: module "etc_group" returns notfound for request 2 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 106 to 10.100.13.12 port 19527 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0104003915800000042f639f242a6f6541ec7b1afbb86af1958c2e4ed1ab48a226b2d15b08e4b7887f25691e005162bd16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xabc302506c895702968419cddb2c0be9 Finished request 2 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.100.13.12:19527, id=107, length=533 User-Name = "HTN\\josh" Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff" Calling-Station-Id = "00-0E-35-B6-74-AF" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.100.13.12 NAS-Identifier = "Houghton Wireless Services" NAS-Port-Id = "HTNStaff" Connect-Info = "CONNECT 54Mbps 802.11g" State = 0xabc302506c895702968419cddb2c0be9 EAP-Message = 0x020401441500160301010610000102010037c452398dbb3df5559e7ef631f93adac1c31949e8b2e189e656c42563825fedb650c87be7a05cfa2b6ab6d25b111dfb5ed36ceafc6a81c2d90982bc4b9514fc25cca8f EAP-Message = 0xb50e2ba24d87acf465b6923ae7229fe4e011258f1403010001011603010028faee95c6e785c7a0c1f7794e71c76e67ff5ba2f4006e2aa188af3b9da28d6e2419833ca0820678c1 Message-Authenticator = 0xc0ff62f05516e184511c415d87cbbc2c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 3 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 3 modcall[authorize]: module "etc_group" returns notfound for request 3 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 107 to 10.100.13.12 port 19527 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0105003d1580000000331403010001011603010028721fb19555db97969e579863ff1f6fce4169183c7a0abb3ea443be416f722adbc21b355b7ac01a45 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe4bddc9ecec467abc03da29934752e16 Finished request 3 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.100.13.12:19527, id=108, length=290 User-Name = "HTN\\josh" Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff" Calling-Station-Id = "00-0E-35-B6-74-AF" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.100.13.12 NAS-Identifier = "Houghton Wireless Services" NAS-Port-Id = "HTNStaff" Connect-Info = "CONNECT 54Mbps 802.11g" State = 0xe4bddc9ecec467abc03da29934752e16 EAP-Message = 0x02050053150017030100485562de8771e70ff92e34bb96bf0f6c24b6e6aca70841355cc05a96146c524e1c2b177149e577817012b73f9bb41d96639692cbab41f711878b16e20d5a7c04b16bc67577457b2d47 Message-Authenticator = 0x37c5fec48b0fa7f5c14dddc680e8c4f2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 4 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 83 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 4 modcall[authorize]: module "etc_group" returns notfound for request 4 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled request EAP-Message = 0x0200000d0148544e5c6a6f7368 Message-Authenticator = 0x00000000000000000000000000000000 FreeRADIUS-Proxied-To = 127.0.0.1 TTLS: Got tunneled identity of HTN\josh TTLS: Setting default EAP type for tunneled EAP session. TTLS: Sending tunneled request EAP-Message = 0x0200000d0148544e5c6a6f7368 Message-Authenticator = 0x00000000000000000000000000000000 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "HTN\\josh" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 4 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 4 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 4 modcall[authorize]: module "etc_group" returns notfound for request 4 modcall[authorize]: module "files" returns notfound for request 4 modcall[authorize]: module "mschap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 TTLS: Got tunneled reply RADIUS code 11 EAP-Message = 0x010100221a0101001d1023197ffb3fbee0431fa33dd4ffe6ee4848544e5c6a6f7368 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9023e8d5cfb89d9eedf0b95ea0ea8077 TTLS: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 108 to 10.100.13.12 port 19527 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0106007415800000006a170301001869103bd6a2fc06d853c018dec840fcee432f605b3bbd5c7b170301004882ddab817db15367d699b45444ae600ef8afaba3ca3c2eae0b4be817885fde9ab28ecedeca71e5371 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc1a3900bb47d4eeed37494a4af610f6a Finished request 4 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.100.13.12:19527, id=109, length=346 User-Name = "HTN\\josh" Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff" Calling-Station-Id = "00-0E-35-B6-74-AF" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.100.13.12 NAS-Identifier = "Houghton Wireless Services" NAS-Port-Id = "HTNStaff" Connect-Info = "CONNECT 54Mbps 802.11g" State = 0xc1a3900bb47d4eeed37494a4af610f6a EAP-Message = 0x0206008b15001703010080ec308e1a81a20c80b07a9399135ce92cb9856ea5b98bf1d18e5b53c8959c899f7e0a5ac3cb31cd966591961318eb728dc0cdc95c3a09318920c6f9fba21b88827380f0ca91a8b66b9da Message-Authenticator = 0x24e4740de40c15633d63d47b2e2dcc5e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 5 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 139 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 5 modcall[authorize]: module "etc_group" returns notfound for request 5 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled request EAP-Message = 0x020100431a0201003e310fc0026c362449dfb52a48226b9bf58e000000000000000055a52026985b92247cf83d076fd500b15479fccd5f204f5f0048544e5c6a6f7368 Message-Authenticator = 0x00000000000000000000000000000000 FreeRADIUS-Proxied-To = 127.0.0.1 TTLS: Adding old state with 90 23 TTLS: Sending tunneled request EAP-Message = 0x020100431a0201003e310fc0026c362449dfb52a48226b9bf58e000000000000000055a52026985b92247cf83d076fd500b15479fccd5f204f5f0048544e5c6a6f7368 Message-Authenticator = 0x00000000000000000000000000000000 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "HTN\\josh" State = 0x9023e8d5cfb89d9eedf0b95ea0ea8077 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 5 rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "josh" rlm_realm: Proxying request from user josh to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 5 rlm_eap: EAP packet type response id 1 length 67 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall[authorize]: module "etc_smbpasswd" returns notfound for request 5 modcall[authorize]: module "etc_group" returns notfound for request 5 modcall[authorize]: module "files" returns notfound for request 5 modcall[authorize]: module "mschap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 5 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for josh with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 5 modcall: leaving group MS-CHAP (returns reject) for request 5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 5 modcall: leaving group authenticate (returns reject) for request 5 auth: Failed to validate the user. TTLS: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\001E=691 R=1" EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls TTLS: Freeing handler for user HTN\josh rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 104 with timestamp 49642f7a Sending Access-Reject of id 109 to 10.100.13.12 port 19527 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1 seconds... [root@file raddb]# Relevent lines of config (all else is default pretty much) proxy.conf realm DEFAULT { type = radius authhost = LOCAL accthost = LOCAL # authhost = radius.company.com:1600 # accthost = radius.company.com:1601 secret = testing123 # nostrip } In radiusd.conf here is my etc_smbpasswd section passwd etc_smbpasswd { filename = /etc/samba/smbpasswd format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" authtype = MS-CHAP hashsize = 100 ignorenislike = no allowmultiplekeys = no } My ntdomain realm definition realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = yes }

5 6