October 2010 - Freeradius-Users - lists.freeradius.org

RE: Service-Logon
by Jay Kuhne (jkuhne) 15 Oct '10

15 Oct '10

Hello, I am attempting to "COA Service-Logon" with Radclient and cisco av-pair attributes. I can perform other COA like tagged ACL or Named but so far not service-logon Local ACL "IN_ACL_NAMED_v4_2" is on my ISG gateway (Cisco ASR1k). Have this cmd which I understand allows radius to define the policy. aaa authorization subscriber-service default group RADIUS_GROUP Syntax I am using for Radclient/coa to existing session: (Have tried without Outbound-User as well) Acct-Session-Id="000003EE" Service-Type += Outbound-User cisco-avpair="subscriber:command=activate-service" cisco-avpair="subscriber:service-name=v4_POLICY" cisco-avpair="ip:inacl=IN_ACL_NAMED_v4_2" Am seeing the following on the gateway: "COA: Message Authenticator missing or failed decode" Could someone verify my syntax and give any suggestions? Do I need to actually define/configure "v4_POLICY" anywhere? Jay

2 7

Merging authentication log messages
by Harry Hoffman 14 Oct '10

14 Oct '10

Hi, I'm trying to figure out how to merge log messages when T(T)LS is in use. Right now both the outer (anonymous) identity and the inner (real) identity are logged: Oct 14 09:35:14 siteone.some.edu: radiusd[28928]: Login OK: [hhoffman] (from client wifi-ap port 0 via TLS tunnel) Oct 14 09:35:15 siteone.some.edu: radiusd[28928]: Login OK: [anonymous] (from client wifi-ap port 0 cli 02-00-00-00-00-01) So, the hhoffman is the actual user name and the 02-00-00-00-00-01 is the mac address that is passed along from the ap. I'd like to be able to combine this as I don't need to know the outer (anonymous) id. I'm looking at modules/{linelog,detail.lgo} but neither look like they produce what is being logging via syslog to the file. radiusd.conf contains a logging section that point to log_* but I don't see how to configure the auth messages in a different way. Cheers, Harry

2 1

Tying radius to mysql...
by rktechie 14 Oct '10

14 Oct '10

I'm sure I am missing something simple and probably obvious. Now that I have installed freeradius (2.1.9-1.fc13.i686) and imported the mysql schema and populated it with a test user, I would like to know if there are some basic config instructions for telling freeradius to actually use the users from the db rather than the /etc/raddb/users file? radtest testing1 guest 127.0.0.1 0 testing123 results in rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=27, length=20 but if I put my "testing1" user in /etc/raddb/users it accepts the login ok. I'm not real clear on what data I need in the db. What is the minimum to create a valid test? NAS info? I tried following http://wiki.freeradius.org/SQL_HOWTO but the radius server doesn't seem to be talking to mysql. In my troubleshooting, I added "sql" at the bottom of the "instantiate" section in the /etc/raddb/radiusd.conf file (Is this the proper way to get them talking?), and now radiusd does seem to communicate with mysql, but although it successfully logs in it doesn't seem to interact with the user data to authorize anything. It seems there is something else I need to add to the config files to make radius look to mysql rather than a users file for the data. (I would like to have freeradius log all the authorization info to mysql as well, but first things first...) My `radcheck` table contains: INSERT INTO `radcheck` (`id`, `username`, `attribute`, `op`, `value`) VALUES (1, 'testing1', 'Cleartext-Password', ':=', 'guest'); Some of the output from radiusd -X ... including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf ... radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "rad1" password = "rad1" radius_db = "rad1" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" ... } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to rad1@localhost:/rad1 rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 } radiusd: #### Loading Virtual Servers #### ... radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Ready to process requests. ... Running radtest from the terminal: radtest testing1 guest 127.0.0.1 0 testing123 Sending Access-Request of id 66 to 127.0.0.1 port 1812 User-Name = "testing1" User-Password = "guest" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=66, length=20 ... rad_recv: Access-Request packet from host 127.0.0.1 port 41218, id=66, length=60 User-Name = "testing1" User-Password = "guest" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testing1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 66 to 127.0.0.1 port 41218 Waking up in 4.9 seconds. Cleaning up request 1 ID 66 with timestamp +360 Ready to process requests. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Tying-radius-to-mysql-tp3212438p321… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

DEFAULT policy order in Users file
by Jevos, Peter 14 Oct '10

14 Oct '10

Hi I have at the end of Users file two DEFAULTS statements: DEFAULT Auth-Type := ntlm_auth_vpn_comp NAS-IP-Address == 10.1.1.1, Service-Type = Framed-User, Framed-Protocol = PPP, DEFAULT Auth-Type := vpn_auth_name Service-Type = Framed-User, Framed-Protocol = PPP, So it means, when access request comes from the address 10.1.1.1 use authentication type ntlm_auth_vpn_comp. If access request comes from the other address use Auth-Type vpn_auth_name which is default for everybody The point is that I have more VPN gates and I can decide which authentication will be used for them However it doesn't work, cause every request match only the first DEFAULT statement, despite of that it comes from different NAS-IP-Address then 10.1.1.1 Do you know why it is happen ? Thanks pet

3 3

Re: Unfinished Request no Database
by João Romariz 14 Oct '10

14 Oct '10

Hi Alan, Thanks for your help. In fact the IPPool is using the db.ippool and db.ipindex files on the freeradius directory. Regards, Jromariz.

1 0

Proxying question for Eduroam
by Peter Kruppa 14 Oct '10

14 Oct '10

Hi all, We use a freeradius proxy for proxying wireless PEAP requests to one of our two domains (via IAS and NPS in the near future) or to the next Eduroam proxy. Visa versa PEAP requests send by our students at other schools are forwarded to our freeradius proxy. Everything seems to work when we use the wireless clients of Windows, Mac OS 10, Linux, smartphones, etc...), but there is one scenario where it won't work and what some schools use for testing. I managed to reproduce that situation by using eapol_test, in that case requests to IAS aren't logged and it never replies with a Access-Challenge. The versions of the software are: FreeRADIUS 2.1.8+dfsg-1ubuntu1 OpenSSL 0.9.8k-7ubuntu8.3 Eapol_test from wpa_supplicant 0.7.3 The configuration is simple and transparant, we have some clients and some proxies, on the base of the realm the request is proxied to the next radius server, without termination of EAP at freeradius. If EAP is the problem, I could terminate the EAP tunnel for our 2 domain on freeradius, how should I do that? Do I need to use the inner-tunnel? Or proxy-inner-tunnel (what about Proxy-To-Realm than because we have 2 domains)? In any case I would like to use a method without using winbind. Hope someone will give me a hint... Best regards, Peter Kruppa

3 2

Facing mSchapv2 errors
by Bhanu Vegesna 13 Oct '10

13 Oct '10

HI All, PLease find below the complete server dump,facing some mschapv2 error Mysetup is with local users files, can you please help me in resolving the issues ad_recv: Access-Request packet from host 192.168.1.225 port 1812, id=30, length=65 User-Name = "ctc" NAS-IP-Address = 192.168.1.225 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020a000801637463 Message-Authenticator = 0x8619073533db3cd0ddeb56ce1822da9f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 10 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 30 to 192.168.1.225 port 1812 EAP-Message = 0x010b00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x31e9dd0431e2c4ed979caadd4b7fe761 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 30 with timestamp +5 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.225 port 1812, id=31, length=65 User-Name = "ctc" NAS-IP-Address = 192.168.1.225 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020d000801637463 Message-Authenticator = 0x3daea945933e3b0ef11e27cb1e17b548 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 13 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 31 to 192.168.1.225 port 1812 EAP-Message = 0x010e00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0592eaef059cf3f26e32a90a78f08b93 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.225 port 1812, id=32, length=187 User-Name = "ctc" NAS-IP-Address = 192.168.1.225 NAS-Port-Type = Wireless-802.11 State = 0x0592eaef059cf3f26e32a90a78f08b93 EAP-Message = 0x020e007019800000006616030100610100005d03014cb424696a5b618d15d8430c16c42c1ae8dfd99f406eac38508a26405123c9d400003600390038003500160013000a00330032002f0007006600050004006300620061001500120009006500640060001400110008000600030100 Message-Authenticator = 0x854bee3b67e4c64a4ae4855f5aa7606f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 14 length 112 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 102 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0061], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 02e3], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 32 to 192.168.1.225 port 1812 EAP-Message = 0x010f040019c0000004b2160301002a0200002603014cb439c5d26ef7dea90580fde09366c70047db45a70f6328d9ed2e1f5dbde33a0000390016030102e30b0002df0002dc0002d9308202d53082023ea0030201020202011e300d06092a864886f70d0101050500306e310b3009060355040613025553311330110603550408130a43616c69666f726e69613112301006035504071309526f736576696c6c65310b3009060355040a1302485031153013060355040b130c436f6e6e65637469766974793112301006035504031309535049526f6f744341301e170d3035303230343232323234335a170d3135303230323232323234335a3075310b30 EAP-Message = 0x09060355040613025553311330110603550408130a43616c69666f726e69613112301006035504071309526f736576696c6c65310b3009060355040a1302485031153013060355040b130c436f6e6e656374697669747931193017060355040313105350494a65746469726563744365727430819f300d06092a864886f70d010101050003818d0030818902818100bbd338b0895e740f87744e3eadb598954e8849c718e0ef1a33349a97cef1c15ae1dfd3e2001e2c492b0973636898bd6517e22f8cd3e46dd52cf99343d6dcdbfb080dc156b967ba289bb4a01deb868978029c6b921377afaa0d1c267ea0eda80dd163194aa9cfe9ea6141b2e50572 EAP-Message = 0x5bc3fe12b66ec5dad5664fff2491561ebe770203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e041604148aec1592b20b02575f324f4d959e328a9a51b064301f0603551d2304183016801439822e0a473ef400e88f0b174dd11002917fe453300d06092a864886f70d010105050003818100465ef23653a631f1442994430160e8777692fbe38cc2880ae88fa131c296c4e020c45b120a47ddd07b7cec63adaddc38dd228a609ff82524f38e4bc5e9e8c7f144fd9d8cc123c6a5b4e1254926de469b6567c508279a EAP-Message = 0x408370cfcdb4bda34822aca61daddcd4e0e96d70eea09cef4463a6a6ef1b141f8289246d189ddbbe4145160301018d0c0001890080a379bbfdad1a102091cb387317deb180ab78b2aa3eb33f9f9e80d7ddb93ad20154c85b76742b98ea0e209c0a0e4f3c49a0ed372c7187f6438fc19ffd1d338ebacb0baad62566c9b51c25d95b30dc88f1c8f0dc348c33b0e2047f215ea111e033b71fa2352f5f2703cced7616586ee31c66250c57cbc2e82c4ed04f82fd718b730001020080827fcb4097afc48c9f4f6843d32f3844d05036b0c64d179808d4d4176d6b212ea1394166a00ae1f17d96ed5a55824ae4b9fc1bc2984d892df37be5a66e6394d61e1ec8 EAP-Message = 0xe2bcd0d1f54c65294ede9c2e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0592eaef049df3f26e32a90a78f08b93 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.225 port 1812, id=33, length=81 User-Name = "ctc" NAS-IP-Address = 192.168.1.225 NAS-Port-Type = Wireless-802.11 State = 0x0592eaef049df3f26e32a90a78f08b93 EAP-Message = 0x020f00061900 Message-Authenticator = 0x7a647b4f8c583fafe9877035ac44b488 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 15 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 33 to 192.168.1.225 port 1812 EAP-Message = 0x011000c21900061298473bfa3edf593c1f757c3cedfc001c5e7f32245ba23b4abf3a8348339300588584b783ee84c159d0cee3d64507e20080886112bc2c4052e2a070718307e7eb0b584998a4c06c585d11c8764f6026b715a631c15c7569898b596abb40196dee281f53df6de23b712cdd20940835182c61cdf28fe0237b96b64da92d44616214b1b11007e6144b05929579e138957685801e9d7a31b416db3fc41e6e0461853308f4cc7a1d7d6b9bd66dd67737eedf6a5f16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0592eaef0782f3f26e32a90a78f08b93 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.225 port 1812, id=34, length=283 User-Name = "ctc" NAS-IP-Address = 192.168.1.225 NAS-Port-Type = Wireless-802.11 State = 0x0592eaef0782f3f26e32a90a78f08b93 EAP-Message = 0x021000d01980000000c616030100861000008200804d7a87dfa4bc3dfe580bfb1975b4092b051e2d12a0fb60dc7bb5f6f52d023c69174fca627013cabb64ba726700d855bc0e82fb374a8dd80f53a8908cf4e1f1b5a12119eed763132242818d8f0d1c9c64e10f3315a89a0ea81d6fe621a4d560c2410164803ad24231ad143249931cbb282b7c5bdf746dfeefbd142377e74d751414030100010116030100303746ccf8800106b03c3a9c0e631af338b7fa61b84dd8990e6589edd28ae8fd7800e2be1f5987743d1296928b7a1afe03 Message-Authenticator = 0x427829e4fced10fd250e94933f83f3bf +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 16 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 34 to 192.168.1.225 port 1812 EAP-Message = 0x0111004119001403010001011603010030e1bfe6c5f3644d41a581a4cf68165ab2f8af3bf19fcc7f4afe227776e9d8b9052fa1cfccc9d628b558d11246d5422f2b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0592eaef0683f3f26e32a90a78f08b93 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.1.225 port 1812, id=35, length=81 User-Name = "ctc" NAS-IP-Address = 192.168.1.225 NAS-Port-Type = Wireless-802.11 State = 0x0592eaef0683f3f26e32a90a78f08b93 EAP-Message = 0x021100061900 Message-Authenticator = 0x7fe6a72bc495b4bb0259d663fd843b23 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 17 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 35 to 192.168.1.225 port 1812 EAP-Message = 0x0112002b190017030100202b1bf52fc85ed7e7cb678fe08745237c4720fad5597f289aa4a115fbc0e1de91 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0592eaef0180f3f26e32a90a78f08b93 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.1.225 port 1812, id=36, length=155 User-Name = "ctc" NAS-IP-Address = 192.168.1.225 NAS-Port-Type = Wireless-802.11 State = 0x0592eaef0180f3f26e32a90a78f08b93 EAP-Message = 0x02120050190017030100202838541640a936d238183ad162d36122e47fee60fb5611f34191ef8666f7107a1703010020659553682dc050f325783e499974d17ad3e4d4645d6706cb4545cdeea4ebeef3 Message-Authenticator = 0x05137589fd1f344d82046b17c65b4c5a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 18 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - ctc [peap] Got tunneled request EAP-Message = 0x0212000801637463 server { PEAP: Got tunneled identity of ctc PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to ctc Sending tunneled request EAP-Message = 0x0212000801637463 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ctc" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[control] returns noop [eap] EAP packet type response id 18 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x0113001d1a01130018107f5953c57504dfb4e738ab8850e3189e637463 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x45c4c38d45d7d9aca82c004c4020e30c [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0113001d1a01130018107f5953c57504dfb4e738ab8850e3189e637463 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x45c4c38d45d7d9aca82c004c4020e30c [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 36 to 192.168.1.225 port 1812 EAP-Message = 0x0113003b19001703010030c502a17459c1df87c914d120795b43e58f931927e1d98fec9dc6b3a616ebf6bfe291d7815f67b3bf6ecd1c8dca8288a3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0592eaef0081f3f26e32a90a78f08b93 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.1.225 port 1812, id=37, length=203 User-Name = "ctc" NAS-IP-Address = 192.168.1.225 NAS-Port-Type = Wireless-802.11 State = 0x0592eaef0081f3f26e32a90a78f08b93 EAP-Message = 0x02130080190017030100202bd5e425a8b8c27f0ed175d03cfc2b636b73cef4935b1a3ae7a0ee198315330e1703010050e137ac521ede7b4d9b5cab90e1a55134aecd8a030e81251b5953ed5a35053015501ec66e9dfefd97c1feef0208b4eafe312f1062874217272143210177dcbb241448fcc867973edc6cdc2a9687a893ab Message-Authenticator = 0xb5d69cbc6b213a5a007885c1725a47e5 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 19 length 128 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0213003e1a0213003931f2ced11e011c01cdaa5c3be3d4dd3b6c00000000000000003b69010be7c7034733e2601cf7616467d33075c4aa62733f00637463 server { PEAP: Setting User-Name to ctc Sending tunneled request EAP-Message = 0x0213003e1a0213003931f2ced11e011c01cdaa5c3be3d4dd3b6c00000000000000003b69010be7c7034733e2601cf7616467d33075c4aa62733f00637463 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ctc" State = 0x45c4c38d45d7d9aca82c004c4020e30c server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[control] returns noop [eap] EAP packet type response id 19 length 62 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for ctc with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\023E=691 R=1" EAP-Message = 0x04130004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\023E=691 R=1" EAP-Message = 0x04130004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 37 to 192.168.1.225 port 1812 EAP-Message = 0x0114002b19001703010020b4a3a6faa307f943267cf71f698cc9b917cc5d430a4b8aac632c19fa5a3d3f32 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0592eaef0386f3f26e32a90a78f08b93 Finished request 7. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.1.225 port 1812, id=38, length=155 User-Name = "ctc" NAS-IP-Address = 192.168.1.225 NAS-Port-Type = Wireless-802.11 State = 0x0592eaef0386f3f26e32a90a78f08b93 EAP-Message = 0x0214005019001703010020394df60d43869f97f778161a3f55a8a2949614abc592ecb4fb6f0a5f081a77e0170301002047e097a428103d4872d14e7d1b08a46322486d5520997a850b8c1c4b2a139d8a Message-Authenticator = 0x9d0178b358e3af2393f8c89e6be815b1 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 20 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ctc attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 38 to 192.168.1.225 port 1812 EAP-Message = 0x04140004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 1 ID 31 with timestamp +33 Cleaning up request 2 ID 32 with timestamp +33 Cleaning up request 3 ID 33 with timestamp +33 Waking up in 0.1 seconds. Cleaning up request 4 ID 34 with timestamp +33 Cleaning up request 5 ID 35 with timestamp +33 Cleaning up request 6 ID 36 with timestamp +33 Cleaning up request 7 ID 37 with timestamp +33 Waking up in 1.0 seconds. Cleaning up request 8 ID 38 with timestamp +33 Ready to process requests.

2 3

Re: MSCHAP vs MSCHAPv2 for VPN
by freeradius＠corwyn.net 13 Oct '10

13 Oct '10

At 03:43 PM 10/13/2010, Alan DeKok wrote: > > Wed Oct 13 14:50:57 2010 : Debug: Exec-Program output: NT_KEY: > > DDE9BB9EA12ED17BE5F358CB53EE6A8F > > Change the version of Samba that you're using. 3.5.5 contains a fix >which addresses this issue. Thanks Alan. That server is running samba3x-3.3.8-0.52.el5_5.2 , so that's quite useful! What's interesting is that I have found a server running samba3x-3.3.8-0.52.el5_5 (separate installation, same config files, also VPN <> sonicwall) which is not exhibiting this issue. Regardless, I'll go see about finding the new samba. Rick > Alan DeKok. >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

MSCHAP vs MSCHAPv2 for VPN
by freeradius＠corwyn.net 13 Oct '10

13 Oct '10

Using freeradius 2.1.8, I have a sonicwall firewall that authenticates VPN users against the freeradius server. The VPN clients are the native MSFT VPN client. When the client is configured for L2TP, MS-CHAP, the client connects. When the client is configured for L2TP MSChapv2, the client fails to connect with an error "It was not possible to verify the identity of the server" As I understand it, the difference between mschapv1 and v2 is that the server sends back an authentication response. Seems like that handshake isn't working out? I know I've missed something somewhere. . . radiusd -xX: rad_recv: Access-Request packet from host 192.168.104.1 port 3873, id=22, length=124 User-Name = "rsteeves" MS-CHAP-Challenge = 0x68dd158c5082247cfe49fecd9520386a MS-CHAP2-Response = 0x010005edd3135eca19372073504d57f8a4b30000000000000000ab31aff8b876e703bb4141ddc19afff921f6a358cd80b94b NAS-IP-Address = x.x.x.x NAS-Port = 0 Wed Oct 13 14:50:57 2010 : Info: server server_vpn { Wed Oct 13 14:50:57 2010 : Info: +- entering group authorize {...} Wed Oct 13 14:50:57 2010 : Info: ++[preprocess] returns ok Wed Oct 13 14:50:57 2010 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Wed Oct 13 14:50:57 2010 : Info: ++[mschap] returns ok Wed Oct 13 14:50:57 2010 : Debug: [ldap] Entering ldap_groupcmp() Wed Oct 13 14:50:57 2010 : Info: [files] expand: OU=Enterprise,DC=int,DC=example,DC=com -> OU=Enterprise,DC=int,DC=example,DC=com Wed Oct 13 14:50:57 2010 : Info: [files] expand: %{Stripped-User-Name} -> Wed Oct 13 14:50:57 2010 : Info: [files] ... expanding second conditional Wed Oct 13 14:50:57 2010 : Info: [files] expand: %{User-Name} -> rsteeves Wed Oct 13 14:50:57 2010 : Info: [files] expand: (&(sAMAccountname=%{%{Stripped-User-Name}:-%{User-Name}})(objectClass=person)) -> (&(sAMAccountname=rsteeves)(objectClass=person)) Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=example,DC=com, with filter (&(sAMAccountname=rsteeves)(objectClass=person)) Wed Oct 13 14:50:57 2010 : Error: [ldap] ldap_search() failed: LDAP connection lost. Wed Oct 13 14:50:57 2010 : Info: [ldap] Attempting reconnect Wed Oct 13 14:50:57 2010 : Debug: [ldap] attempting LDAP reconnection Wed Oct 13 14:50:57 2010 : Debug: [ldap] closing existing LDAP connection Wed Oct 13 14:50:57 2010 : Debug: [ldap] (re)connect to dc.int.example.com:389, authentication 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] bind as CN=_UserID,OU=Service Accounts,OU=Special User Accounts,OU=Enterprise,DC=int,DC=example,DC=com/wvyjCHCd2LJHcNrmpr0I to dc.int.example.com:389 Wed Oct 13 14:50:57 2010 : Debug: [ldap] waiting for bind result ... Wed Oct 13 14:50:57 2010 : Debug: [ldap] Bind was successful Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=example,DC=com, with filter (&(sAMAccountname=rsteeves)(objectClass=person)) Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Oct 13 14:50:57 2010 : Info: [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))) Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=example,DC=com, with filter (&(cn=VPN_Users)(|(&(objectClass=GroupOfNames)(member=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom)))) Wed Oct 13 14:50:57 2010 : Debug: [ldap] object not found Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in CN=Rick Steeves,OU=IS,OU=Users,OU=Enterprise,DC=int,DC=example,DC=com, with filter (objectclass=*) Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in CN=VPN_Users,OU=Security Groups,OU=Enterprise,DC=int,DC=example,DC=com, with filter (cn=VPN_Users) Wed Oct 13 14:50:57 2010 : Debug: rlm_ldap::ldap_groupcmp: User found in group VPN_Users Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Oct 13 14:50:57 2010 : Info: [files] users: Matched entry DEFAULT at line 11 Wed Oct 13 14:50:57 2010 : Info: ++[files] returns ok Wed Oct 13 14:50:57 2010 : Info: [ldap] performing user authorization for rsteeves Wed Oct 13 14:50:57 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> Wed Oct 13 14:50:57 2010 : Info: [ldap] ... expanding second conditional Wed Oct 13 14:50:57 2010 : Info: [ldap] expand: %{User-Name} -> rsteeves Wed Oct 13 14:50:57 2010 : Info: [ldap] expand: (&(sAMAccountname=%{%{Stripped-User-Name}:-%{User-Name}})(objectClass=person)) -> (&(sAMAccountname=rsteeves)(objectClass=person)) Wed Oct 13 14:50:57 2010 : Info: [ldap] expand: OU=Enterprise,DC=int,DC=example,DC=com -> OU=Enterprise,DC=int,DC=example,DC=com Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=example,DC=com, with filter (&(sAMAccountname=rsteeves)(objectClass=person)) Wed Oct 13 14:50:57 2010 : Info: [ldap] looking for check items in directory... Wed Oct 13 14:50:57 2010 : Info: [ldap] looking for reply items in directory... Wed Oct 13 14:50:57 2010 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Wed Oct 13 14:50:57 2010 : Info: [ldap] user rsteeves authorized to use remote access Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Oct 13 14:50:57 2010 : Info: ++[ldap] returns ok Wed Oct 13 14:50:57 2010 : Info: ++? if (Huntgroup-Name == "VPN_Huntgroup") Wed Oct 13 14:50:57 2010 : Info: ? Evaluating (Huntgroup-Name == "VPN_Huntgroup") -> TRUE Wed Oct 13 14:50:57 2010 : Info: ++? if (Huntgroup-Name == "VPN_Huntgroup") -> TRUE Wed Oct 13 14:50:57 2010 : Info: ++- entering if (Huntgroup-Name == "VPN_Huntgroup") {...} Wed Oct 13 14:50:57 2010 : Info: +++? if (Ldap-Group == "VPN_Users") Wed Oct 13 14:50:57 2010 : Debug: [ldap] Entering ldap_groupcmp() Wed Oct 13 14:50:57 2010 : Info: expand: OU=Enterprise,DC=int,DC=example,DC=com -> OU=Enterprise,DC=int,DC=example,DC=com Wed Oct 13 14:50:57 2010 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))) Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=example,DC=com, with filter (&(cn=VPN_Users)(|(&(objectClass=GroupOfNames)(member=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRick Steeves\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom)))) Wed Oct 13 14:50:57 2010 : Debug: [ldap] object not found Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in CN=Rick Steeves,OU=IS,OU=Users,OU=Enterprise,DC=int,DC=example,DC=com, with filter (objectclass=*) Wed Oct 13 14:50:57 2010 : Debug: [ldap] performing search in CN=VPN_Users,OU=Security Groups,OU=Enterprise,DC=int,DC=example,DC=com, with filter (cn=VPN_Users) Wed Oct 13 14:50:57 2010 : Debug: rlm_ldap::ldap_groupcmp: User found in group VPN_Users Wed Oct 13 14:50:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Oct 13 14:50:57 2010 : Info: ? Evaluating (Ldap-Group == "VPN_Users") -> TRUE Wed Oct 13 14:50:57 2010 : Info: +++? if (Ldap-Group == "VPN_Users") -> TRUE Wed Oct 13 14:50:57 2010 : Info: +++- entering if (Ldap-Group == "VPN_Users") {...} Wed Oct 13 14:50:57 2010 : Info: ++++[ok] returns ok Wed Oct 13 14:50:57 2010 : Info: +++- if (Ldap-Group == "VPN_Users") returns ok Wed Oct 13 14:50:57 2010 : Info: +++ ... skipping else for request 2: Preceding "if" was taken Wed Oct 13 14:50:57 2010 : Info: ++- if (Huntgroup-Name == "VPN_Huntgroup") returns ok Wed Oct 13 14:50:57 2010 : Info: Found Auth-Type = MSCHAP Wed Oct 13 14:50:57 2010 : Info: +- entering group MS-CHAP {...} Wed Oct 13 14:50:57 2010 : Info: [mschap] Told to do MS-CHAPv2 for rsteeves with NT-Password Wed Oct 13 14:50:57 2010 : Info: [mschap] expand: --username=%{mschap:User-Name} -> --username=rsteeves Wed Oct 13 14:50:57 2010 : Info: [mschap] No NT-Domain was found in the User-Name. Wed Oct 13 14:50:57 2010 : Info: [mschap] expand: --domain=%{mschap:NT-Domain:-int.example.com} -> --domain= Wed Oct 13 14:50:57 2010 : Info: [mschap] mschap2: 68 Wed Oct 13 14:50:57 2010 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=39232bda5539ec44 Wed Oct 13 14:50:57 2010 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=ab31aff8b876e703bb4141ddc19afff921f6a358cd80b94b Wed Oct 13 14:50:57 2010 : Debug: Exec-Program output: NT_KEY: DDE9BB9EA12ED17BE5F358CB53EE6A8F Wed Oct 13 14:50:57 2010 : Debug: Exec-Program-Wait: plaintext: NT_KEY: DDE9BB9EA12ED17BE5F358CB53EE6A8F Wed Oct 13 14:50:57 2010 : Debug: Exec-Program: returned: 0 Wed Oct 13 14:50:57 2010 : Info: [mschap] adding MS-CHAPv2 MPPE keys Wed Oct 13 14:50:57 2010 : Info: ++[mschap] returns ok Wed Oct 13 14:50:57 2010 : Auth: Login OK: [rsteeves] (from client VPN_Fay port 0) Wed Oct 13 14:50:57 2010 : Info: +- entering group post-auth {...} Wed Oct 13 14:50:57 2010 : Info: ++[exec] returns noop Wed Oct 13 14:50:57 2010 : Info: } # server server_vpn Sending Access-Accept of id 22 to 192.168.104.1 port 3873 Reply-Message := "Authorized Users Only" MS-CHAP2-Success = 0x01533d39353639333834444241444635364135383445383643433543433231384234303431383736343144 MS-MPPE-Recv-Key = 0x18fe4b2752e2b4ff2cc2f0d951f26c42 MS-MPPE-Send-Key = 0xe25177ef572676aa3f9883443c93fbc1 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Wed Oct 13 14:50:57 2010 : Info: Finished request 2. Wed Oct 13 14:50:57 2010 : Debug: Going to the next request Wed Oct 13 14:50:57 2010 : Debug: Waking up in 4.9 seconds. Wed Oct 13 14:51:02 2010 : Info: Cleaning up request 2 ID 22 with timestamp +991 Wed Oct 13 14:51:02 2010 : Info: Ready to process requests. Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

2 1

freeradius 2.1.10 DHCP not responding
by Zietz, Marco 13 Oct '10

13 Oct '10

Hi, I'm playing with freeradius acting as DHCP-server - which is a magnificent idea! Got a little problem getting it up and running. Already checked any comments in sources, list archive, recent git patches related to dhcp and my favourite search engine. Also used two different machines with other nic's. Used ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.10.tar.bz2 and followed directions in raddb/sites-enabled/dhcp. Configure, make and make install with no errors/warnings. But radiusd does not react to any DHCP-discover. I can see the discovers coming in via tcpdump but radiusd -X remains quiet: ============================= linux:/usr/local/src# tcpdump -vvvni eth0 tcpdump: WARNING: eth0: no IPv4 address assigned tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 17:19:09.548866 vlan 72, p 0, IP (tos 0x0, ttl 64, id 17503, offset 0, flags [none], proto UDP (17), length 377) 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from bc:05:43:41:1d:8d, length 349, xid 0x7e969d44, Flags [none] (0x0000) Client-Ethernet-Address bc:05:43:XX:1d:8d [|bootp] 17:19:00.583066 vlan 73, p 0, IP (tos 0x0, ttl 64, id 2146, offset 0, flags [none], proto UDP (17), length 373) 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from bc:05:43:41:1d:8e, length 345, xid 0x48413368, Flags [none] (0x0000) Client-Ethernet-Address bc:05:43:XX:1d:8e [|bootp] ============================= linux:/usr/local# /usr/local/sbin/radiusd -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Oct 13 2010 at 16:06:27 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/dhcp.net2 including configuration file /usr/local/etc/raddb/sites-enabled/dhcp.net1 including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server dhcp { # from file /usr/local/etc/raddb/sites-enabled/dhcp.net2 modules { Module: Checking dhcp DHCP-Discover {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "ok" from file /usr/local/etc/raddb/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Checking dhcp DHCP-Request {...} for more modules to load Module: Checking dhcp (null) {...} for more modules to load /usr/local/etc/raddb/sites-enabled/dhcp.net2[123]: No name specified for Post-Auth-Type block } # modules } # server server dhcp { # from file /usr/local/etc/raddb/sites-enabled/dhcp.net1 modules { Module: Checking dhcp DHCP-Discover {...} for more modules to load Module: Checking dhcp DHCP-Request {...} for more modules to load Module: Checking dhcp (null) {...} for more modules to load /usr/local/etc/raddb/sites-enabled/dhcp.net1[123]: No name specified for Post-Auth-Type block } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "dhcp" ipaddr = 192.168.73.10 port = 67 } listen { type = "dhcp" ipaddr = 192.168.72.10 port = 67 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on dhcp interface vlan73 address 192.168.73.10 port 67 as server dhcp Listening on dhcp interface vlan72 address 192.168.72.10 port 67 as server dhcp Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ============================= linux:/usr/local/etc/raddb/sites-available# egrep -v "^$|^[[:space:]]*#" dhcp.net1 server dhcp { listen { ipaddr = 192.168.72.10 port = 67 type = dhcp interface = vlan72 broadcast = yes } dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update reply { DHCP-Domain-Name-Server = XXX.65.0.XXX DHCP-Domain-Name-Server = XXX.65.31.XXX DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 192.168.72.1 DHCP-IP-Address-Lease-Time = 400 DHCP-DHCP-Server-Identifier = 192.168.72.10 } ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = XXX.65.0.XXX DHCP-Domain-Name-Server = XXX.65.31.XXX DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 192.168.72.1 DHCP-IP-Address-Lease-Time = 400 DHCP-DHCP-Server-Identifier = 192.168.72.10 } ok } dhcp { reject } } =================================== Any hint appreciated! If you need extra info let me know. Thank you for your help! Cheers Marco

3 2