October 2010 - Freeradius-Users - lists.freeradius.org

Disabling users/hosts
by Ramon Escriba 06 Oct '10

06 Oct '10

Hi List, It's a bit naive question, just to keep concepts clear. I want to use the "dialupAccess" attribute to enable or disable one user/host to login. So if "dialupAccess : disabled", the user/host is rejected. I've one ldap instance with: # # Group membership checking. Disabled by default. # groupname_attribute = dialupAccess groupmembership_filter = "(objectClass=radiusProfile)(uid=%u)" groupmembership_attribute = dialupAccess In users: ############################################################################ ###### ## Disabled accounts in LDAP ############################################################################ ###### DEFAULT Ldap-Group==disabled, Auth-Type := Reject Reply-Message := "FAIL: Account disabled. Please call helpdesk.", Fall-Through = no ############################################################################ ###### Matchs the idea?, or should be done in a different way? Thanks.

2 2

HOWTO:Centralised LDAP Authentication - Part 2 - Using dyamic-clients instead of huntgroups
by Peter Lambrechtsen 06 Oct '10

06 Oct '10

Following on from my previous post on Centralised LDAP Auth post: http://lists.freeradius.org/pipermail/freeradius-users/2010-September/msg00… I've found that using dynamic-clients gives me a few advantages over using huntgroups. 1) Dynamic Clients allows you to have per-NAS shared secrets stored in LDAP (or SQL) instead of having a whole network with the same shared secret. This way you have better pseudo security by being able to set a password for each individual NAS element. 2) Reduced LDAP queries due to dynamic-client's caching of the query results. This is also helps to reduce one extra query against the LDAP database since the client is cached in radiusd's memory. So to set it up it's the same configuration as specified in the above post, with the following differences: Element Setup: It's the same apart from now you need to add a second value to each element for the Shared Secret password. In the below cases I use the "ou" or Department attribute. --- OU=Elements,OU=Radius,DC=ACME,DC=COM Elements will hold a record of every NAS in your Network. You will create Group objects based on the IP Address of the NAS and set the "Location" or "l" attribute to the NAS Huntgroup the NAS belongs to allow them to be centrally managed in LDAP. IE CN=10.1.2.3,OU=Elements,OU=Radius,DC=ACME,DC=COM With a "l" value of "CiscoRTR" for a Cisco Router that has a NAS-IP-Address or Source-IP-Address of 10.1.2.3. This will make more sense further on. And with a "ou" value of the shared secret password for the NAS element. ie "password" --- FILE:/etc/raddb/clients.conf - Don't need to make any changes into this file anymore. With the default config you will need to copy or symlink the dynamic-clients file into the sites-enabled directory. The easist way is to symlink: cd etc/raddb/sites-enabled ln -s ../sites-available/dynamic-clients dynamic-clients Now modify the dynamic-clients file: FILE: /etc/raddb/sites-available/dynamic-clients client dynamic { #Include all IP's in the Dynamic Clients range ipaddr = 0.0.0.0 netmask = 0 dynamic_clients = dynamic_client_server lifetime = 86400 } server dynamic_client_server { authorize { #Do a ldap lookup in the elements OU, check to see if the Packet-Src-IP-Address object has a "ou" attribute, if it does continue. if ("%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?ou?sub?cn=%{Packet-Src-IP-Address}}") { update control { FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" #Set the Client-Shortname to be the Location "l" just like in the Huntgroups, but this time to the shortname. FreeRADIUS-Client-Shortname = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?l?sub?cn=%{Packet-Src-IP-Address}}" #NAS Type can't be used so no point in including it. #FreeRADIUS-Client-NAS-Type = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?o?sub?cn=%{Packet-Src-IP-Address}}" #Lookup and set the Shared Secret based on the "ou" attribute. FreeRADIUS-Client-Secret = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?ou?sub?cn=%{Packet-Src-IP-Address}}" } } ok } } ----- END FILE:/etc/raddb/sites-enabled/default Instead of setting the Huntgroup, set the FreeRadius Client Name, so change: update request { Huntgroup-Name := "%{ldap:ldap:///ou=Elements,ou=Radius,DC=ACME,DC=COM?l?sub?cn=%{Packet-Src-IP-Address}}" } with update request { Client-Shortname := "%{Client-Shortname}" } So that Client-Shortname is available in this virtual server and make all the same changes in the default file as per the above post. Now lastly the changes in the users file to perform the lookup. Change: DEFAULT Huntgroup-Name == Junipers, Ldap-Group == "cn=JuniperAdmin,ou=Roles,ou=Radius,DC=ACME,DC=COM" With DEFAULT Client-Shortname == Junipers, Ldap-Group == "cn=JuniperAdmin,ou=Roles,ou=Radius,DC=ACME,DC=COM" And all the same settings as per the previous post. This way you still have the advantages of per-NAS authentication, and now you can also set passwords per-NAS, and less un-necessary traffic to the LDAP server. A win win all around. Alan, do you want me to turn this into a Wiki entry???

1 0

dynamic clients and nas-type
by Peter Lambrechtsen 06 Oct '10

06 Oct '10

I'm trying to setup my dynamic clients and specify a nas-type. In my dynamic-clients I have: server dynamic_client_server { authorize { FreeRADIUS-Client-Shortname = "Cisco" FreeRADIUS-Client-NAS-Type = "other" ... Then in my sites-enabled/default in the authorize section I have: update request { # NAS-Vendor is a local custom dict addition FreeRADIUS-Client-Shortname := "%{Client-Shortname}" FreeRADIUS-Client-NAS-Type := "%{FreeRADIUS-Client-NAS-Type}" } To see what my Client-Shortname and NasType are set to using unlang. But in the debug output I get: ++[request] returns notfound expand: %{Client-Shortname} -> Cisco expand: %{FreeRADIUS-Client-NAS-Type} -> ++[request] returns notfound What field should I be trying to lookup to find out what value I set my NAS-Type to in Dynamic Clients while in the Authorize section in my default?? And as per the docs: http://wiki.freeradius.org/Clients.conf Are the list of permitted nastypes valid, or can I use any string and do further checks for it later?

2 2

Check multiple attributes for one user
by Krijn Tanis | WiMood 06 Oct '10

06 Oct '10

Hello all, For a project I am working on 802.1x WPA-EAP authentication and for this I use a Freeradius server. This part of authentication works perfect. Now I also want to check the Calling-Station-Id for the user, in this case it is MAC address of the wireless client. I want this because I want to allow the user to connect only from one MAC address (else user is able to use a other device that is not in our control, I want to prevent this. So I want to check the Password ánd Calling-Station-Id in one and the same Access Request. If both match an Access-Accept is sent, in all other cases (when password or Calling-Station-Id do not match for the user) an Access-Reject. I tried to do this: +----+----------------+--------------------+------------------+------+ | id | UserName | Attribute | Value | Op | +----+----------------+--------------------+------------------+------+ | 1 | krijn | Calling-Station-Id | 00-0B-6B-D9-D0-14| == | | 2 | krijn | Cleartext-Password | test123 | := | But this doesnt work, the user is rejected. Can somebody point me into the right direction? Kind regards, Krijn Tanis WiMood

3 9

radutmp only show one user
by Daniel Soto 06 Oct '10

06 Oct '10

hi, mi name is Daniel. my problem is about simultaneous-use, i need use this attribute, but when i try use it, only the last user logged apply this attribute. i think the problem is radutmp, when i execute the radwho command i only can see the last user logged. is possible a problem whit the nas-port (ever is nas port 0), too i received this message Error: rlm_radutmp: Logout entry for NAS cisco_pruebas port 0 has wrong ID when the user that appear in radwho is disconnected. this is my radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = yes main: snmp = yes main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 12.12.12.40 IP address [12.12.12.40] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "clear" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded Pam pam: pam_auth = "radiusd" Module: Instantiated pam (pam) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "10.40.30.80" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "" ldap: basedn = "ou=prf, dc=uax,dc=es" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "{clear}" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap_client1-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap_client1-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap_client1 rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP digestHA1 mapped to RADIUS Digest-HA1 rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x9f4d188 Module: Instantiated ldap (ldap_client1) ldap: server = "10.40.40.20" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "" ldap: basedn = "ou=alum,dc=uax,dc=es" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "{clear}" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap_client2-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap_client2-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap_client2 rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP digestHA1 mapped to RADIUS Digest-HA1 rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x9f4e370 Module: Instantiated ldap (ldap_client2) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = yes preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded attr_filter attr_filter: attrsfile = "/etc/raddb/attrs" rlm_attr_filter: Authorize method will be deprecated. Module: Instantiated attr_filter (attr_filter) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = no radutmp: check_with_nas = yes radutmp: perm = 511 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded IPPOOL ippool: session-db = "/etc/raddb/danipool.db" ippool: ip-index = "/etc/raddb/ipindex.db" ippool: range-start = 10.132.0.98 IP address [10.132.0.98] ippool: range-stop = 10.132.0.100 IP address [10.132.0.100] ippool: netmask = 255.255.255.0 IP address [255.255.255.0] ippool: cache-size = 800 ippool: override = yes ippool: maximum-timeout = 0 Module: Instantiated ippool (dani_pool) ippool: session-db = "/etc/raddb/mainpool.db" ippool: ip-index = "/etc/raddb/mainindex.db" ippool: range-start = 10.130.0.70 IP address [10.130.0.70] ippool: range-stop = 10.130.0.100 IP address [10.130.0.100] ippool: netmask = 255.255.255.0 IP address [255.255.255.0] ippool: cache-size = 800 ippool: override = yes ippool: maximum-timeout = 0 Module: Instantiated ippool (main_pool) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (pre_proxy_log) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (reply_log) main: smux_password = "" main: snmp_write_access = yes SMUX connect try 1 Can't connect to SNMP agent with SMUX: Connection refused Listening on authentication 12.12.12.40:1812 Listening on accounting 12.12.12.40:1813 Listening on proxy 12.12.12.40:1814 Ready to process requests my nas is a cisco 1841 v12.4 and my freeradius is version 1.1.3 over red hat. thanks -- thanks --

2 2

replylog
by Alexandre Chapellon 06 Oct '10

06 Oct '10

Hy everybody, I would like to add the username to the replylog when logging access replies. Of course I do not want the attributes to be sent, just to be logged. I have seen the supress stanza in the example detail.log module. Is there any add stanza? regards -- Follow us on: twitter https://www.twitter.com/manainternet

2 1

EAP-MSCHAP-V2 - [mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
by bmano 06 Oct '10

06 Oct '10

Hello, I am trying to Implement EAP-ttls and MSCHAP(V2). I tried all the forums to solutions. I am getting the following error. [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for john with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect below is the Radius information: FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 5 2010 at 02:49:11 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { allow_core_dumps = yes } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 127.0.0.1 { require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } client 5.5.5.101/24 { require_message_authenticator = no secret = "secret" shortname = "private-network-1" } client 192.168.0.0/16 { require_message_authenticator = no secret = "secret" shortname = "private-network-1" } client 10.0.0.0/8 { require_message_authenticator = no secret = "secret" shortname = "private-network-1" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "crypt" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/root/server_key.pem" certificate_file = "/root/server_cert.pem" CA_file = "/root/ca_cert.pem" private_key_password = "whatever" dh_file = "/dev/null" random_file = "/dev/urandom" fragment_size = 500 include_length = yes check_crl = no cache { enable = no lifetime = 24 max_entries = 255 } } WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! WARNING: Fix this by running the OpenSSL command listed in eap.conf Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes include_length = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.0.151 port = 0 } listen { type = "acct" ipaddr = 192.168.0.151 port = 0 } Listening on authentication address 192.168.0.151 port 1812 Listening on accounting address 192.168.0.151 port 1813 Listening on proxy address 192.168.0.151 port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=0, length=116 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000009016a6f686e Message-Authenticator = 0x63345840c269c1b54fb17e2e2137cdb8 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.0.177 port 58989 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e297084136bafa60810ea244249 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=1, length=131 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060315 State = 0x70851e297084136bafa60810ea244249 Message-Authenticator = 0x704f97c360d41603d551267a2a606547 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.0.177 port 58989 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e2971870b6bafa60810ea244249 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=2, length=219 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202005e150016030100530100004f03014caaabcb897edcddb6e87019dafef307071a0b69b3b6320ebe5ee47115c46ed200002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100 State = 0x70851e2971870b6bafa60810ea244249 Message-Authenticator = 0x763cd104835060737d3e97197682e6de +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 94 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0053], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 06d7], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.0.177 port 58989 EAP-Message = 0x010301f415c000000714160301002a0200002603014caaabcd3694a1eea025793dc8efac1460a8fe1589ebad434ea5d0a0064bfe8b0000350016030106d70b0006d30006d00002da308202d63082023fa003020102020102300d06092a864886f70d01010405003081ab310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f0603550407130853616e204a6f73653111300f060355040a1308576963686f727573310c300a060355040b1303456e67311f301d06035504030c16776963686f7275735f726f6f7443415f676368656e673132303006092a864886f70d0109011623776963686f7275735f726f EAP-Message = 0x6f7443415f676368656e6740776963686f7275732e636f6d301e170d3038303531323231313432395a170d3138303531303231313432395a30819c310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f0603550407130853616e204a6f73653111300f060355040a1308576963686f727573310d300b060355040b1304456e6767311730150603550403140e64736861685f7365727665725f32312a302806092a864886f70d010901161b64736861685f7365727665725f3240776963686f7275732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100b4cc27 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e2972860b6bafa60810ea244249 Finished request 2. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=3, length=131 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061500 State = 0x70851e2972860b6bafa60810ea244249 Message-Authenticator = 0x444c552d039d79bf7b6763fb8a91ecdb +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 192.168.0.177 port 58989 EAP-Message = 0x010401f415c0000007140b8841d4dac7027a6813c7a611bca71603326411eb6fa08837767df699faf74b2a8f056feee9e9ffa990f4b41014f59ed1bcb85aed3026235df4fbdeca8def862015a5386c3d109c30c3a884cf6f83f7162543a9a61dbc3fd75119b4160c83451699ede9167aba5889f16a6461264c50d92c496799ccfc44e189e887870203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a77640e1c7f72e1499bcc1cda2a0d443c880db7ef1436d441b07f801608bbd1d88ba15c816f01eef6fa85b08e961958225385fbe79b9fc7fc5b33004a77b7c1e67704bc05 EAP-Message = 0x357dcf0bccca40f004504648c02ec1df9f6e91e7600f90669fb3385b64ea4ff1880def479e02f66c4620d448606e623b967e370814fd1f5d512cca0003f0308203ec30820355a0030201020209009c1418fe79618077300d06092a864886f70d01010505003081ab310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f0603550407130853616e204a6f73653111300f060355040a1308576963686f727573310c300a060355040b1303456e67311f301d06035504030c16776963686f7275735f726f6f7443415f676368656e673132303006092a864886f70d0109011623776963686f7275 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e2973810b6bafa60810ea244249 Finished request 3. Going to the next request Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=4, length=131 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400061500 State = 0x70851e2973810b6bafa60810ea244249 Message-Authenticator = 0x140b333768c76c631cabee64dfef9fee +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 4 to 192.168.0.177 port 58989 EAP-Message = 0x010501f415c000000714735f726f6f7443415f676368656e6740776963686f7275732e636f6d301e170d3038303531323230353935335a170d3138303531303230353935335a3081ab310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f0603550407130853616e204a6f73653111300f060355040a1308576963686f727573310c300a060355040b1303456e67311f301d06035504030c16776963686f7275735f726f6f7443415f676368656e673132303006092a864886f70d0109011623776963686f7275735f726f6f7443415f676368656e6740776963686f7275732e636f6d30819f300d06092a86 EAP-Message = 0x4886f70d010101050003818d0030818902818100a35084afbdc782cb1111d16f11d6372c4aac07118813f2d55b0a52a3df951f961530fd4694defb94981e172e46e25e7fb7925a86975a933cb8761c243575b397abde2a6133b294b1b3bd1ef6a62a6882bdd7761d7942a77cf43422b526742dd45c4cf6cd167e43b8e256778e097490fdf0ce872e23c310806e68f16b32167e290203010001a382011430820110301d0603551d0e04160414d34f52eabf21357fb1085256754198a926aab1723081e00603551d230481d83081d58014d34f52eabf21357fb1085256754198a926aab172a181b1a481ae3081ab310b3009060355040613 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e2974800b6bafa60810ea244249 Finished request 4. Going to the next request Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=5, length=131 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061500 State = 0x70851e2974800b6bafa60810ea244249 Message-Authenticator = 0x6a3bdc1ff10f32916a28e534be84ff3d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 5 to 192.168.0.177 port 58989 EAP-Message = 0x01060160158000000714025553311330110603550408130a43616c69666f726e69613111300f0603550407130853616e204a6f73653111300f060355040a1308576963686f727573310c300a060355040b1303456e67311f301d06035504030c16776963686f7275735f726f6f7443415f676368656e673132303006092a864886f70d0109011623776963686f7275735f726f6f7443415f676368656e6740776963686f7275732e636f6d8209009c1418fe79618077300c0603551d13040530030101ff300d06092a864886f70d01010505000381810086c1ee74467f2615a8d5fe190ff44735bbcb3efe675302d5d0f881fc3c7a5c6395d7ccc5d7b5 EAP-Message = 0x23ce6ff7e87fcd4a52df7ec5b518b687912c535d1f4b875542b1c49997ad16b4408ea16a423ad1e504eab9d6bd33aa4c1b6c1cea5cee6b52dcb7dd251f0a20aac54e0ef046f1d41d62a6f31c8f1c75c6ce9b1a74633147671b5016030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e2975830b6bafa60810ea244249 Finished request 5. Going to the next request Waking up in 4.0 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=6, length=329 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020600cc150016030100861000008200801dd452024420fce1efff4fdf3553a914faf288e5aa0a5c3a1c38ddf96cd6e626efee41762495b18e7768d44cc9128088ba76483ceaf73cb746f3fc785c3298321053c6b90276eec623eeefa2648c8d2ec1e96a1005c262c91f10d6faa3eb55768e46dc7e35978325d5f7b6857a75fe48322dcec2e17bab2af4d6d4de0bd696d81403010001011603010030c4f83f149442210cb5d56e073822928b7eb57cd891c3e934f01f4e55b1161dc00bcb5316e6e0fb3cb888a15dc739ea36 State = 0x70851e2975830b6bafa60810ea244249 Message-Authenticator = 0x88fab0713d28fae91f143a8e06f7a508 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.0.177 port 58989 EAP-Message = 0x0107004515800000003b14030100010116030100307f9a14be792d03d1f03354c1fca77fe40b4c45ca62ca82615333432f0690a6d70f619ae59a7b3f675013ebf231abc2c5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e2976820b6bafa60810ea244249 Finished request 6. Going to the next request Waking up in 3.9 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=7, length=221 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02070060150017030100202abf4899df6abcd33096f265cdd16e719635702bf38ce8f880b7e0fb959799051703010030d2669fb2fb2f436aa094debcdb79518f4c0ee3f33e2877a4a44f3a446ccc10c64a542bb3b5378c56b5418653b3164466 State = 0x70851e2976820b6bafa60810ea244249 Message-Authenticator = 0x1e478f10f4bab4278b9faf92ba4d5b0d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x02000009016a6f686e FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Got tunneled identity of john [ttls] Setting default EAP type for tunneled EAP session. [ttls] Sending tunneled request EAP-Message = 0x02000009016a6f686e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "john" server { +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled } # server [ttls] Got tunneled reply code 11 EAP-Message = 0x010100160410e04582c33411dfd2af929b709cc23601 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb0ed2c00b0ec285c05125915d24f2066 [ttls] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 7 to 192.168.0.177 port 58989 EAP-Message = 0x0108004f1580000000451703010040a13a91a48ddd4ed8d7e4b2cfb5e0b567a38096afc082a654395446250099e84d5d5e952f3e2875e15e3e18ca6b750ad68395704ca589b175659d71ddbfc8c29f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e29778d0b6bafa60810ea244249 Finished request 7. Going to the next request Waking up in 3.8 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=8, length=221 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02080060150017030100208dddbae8a2d00c011b90a2f31006dcde6475e6e38ef85fc464516e9080f6d72617030100309d5904194f3b071d1e938c302c13147ca9db0230e7ae163df618f510286caf2c01d77224032f091cf153429ab9707d97 State = 0x70851e29778d0b6bafa60810ea244249 Message-Authenticator = 0xe690ad1ec9220fb4e4d1bd78cec8e20a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x02010006031a FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x02010006031a FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "john" State = 0xb0ed2c00b0ec285c05125915d24f2066 server { +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/mschapv2 [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server [ttls] Got tunneled reply code 11 EAP-Message = 0x0102001e1a01020019102959e603f5ec55fc4d3b4d1e6cdfb4626a6f686e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb0ed2c00b1ef365c05125915d24f2066 [ttls] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 8 to 192.168.0.177 port 58989 EAP-Message = 0x0109004f158000000045170301004000f2d6ff37bd5591853aac3b581da2ef6734c26110f9a51dabcbba3d31640c1dbf58e744e564b57c15209c7f26b384d6f91de9623bdc2c9c4671f9ae0f60f00f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e29788c0b6bafa60810ea244249 Finished request 8. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=9, length=269 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020900901500170301002059b68674bd770cdb478dc184ed5ed0ba3d492448af8b1f4eb868a73db5c164901703010060b6dd122a70a4b877fd516c218f952adf2a645b4c942718926f817788a5682539e3e1498d33b9ba76d3f14a3185140df1e4f89583990dbd365c432a7f0ebcc5b2af9a7762688a2318f7c972f3055bcdee12b2d334d3e233d4a1ee57ff15ef61c0 State = 0x70851e29788c0b6bafa60810ea244249 Message-Authenticator = 0x03d36e4152a4b579117dbbcded472d58 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x0202003f1a0202003a313040f71ffff45932c78288172e36d8020000000000000000fed561ff311854eb54e8dbc91a6c84a5461735610fc0a048006a6f686e FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x0202003f1a0202003a313040f71ffff45932c78288172e36d8020000000000000000fed561ff311854eb54e8dbc91a6c84a5461735610fc0a048006a6f686e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "john" State = 0xb0ed2c00b1ef365c05125915d24f2066 server { +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 63 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for john with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server [ttls] Got tunneled reply code 3 MS-CHAP-Error = "\002E=691 R=1" EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user john [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> john attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 9 to 192.168.0.177 port 58989 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 2.4 seconds. Cleaning up request 0 ID 0 with timestamp +173 Cleaning up request 1 ID 1 with timestamp +173 Waking up in 0.6 seconds. Cleaning up request 2 ID 2 with timestamp +173 Cleaning up request 3 ID 3 with timestamp +174 Waking up in 0.1 seconds. Cleaning up request 4 ID 4 with timestamp +174 Cleaning up request 5 ID 5 with timestamp +174 Waking up in 0.1 seconds. Cleaning up request 6 ID 6 with timestamp +174 Waking up in 0.1 seconds. Cleaning up request 7 ID 7 with timestamp +174 Waking up in 0.1 seconds. Cleaning up request 8 ID 8 with timestamp +174 Waking up in 1.2 seconds. Cleaning up request 9 ID 9 with timestamp +174 Ready to process requests. Thanks, BMano -- View this message in context: http://freeradius.1045715.n5.nabble.com/EAP-MSCHAP-V2-mschap-FAILED-No-NT-L… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

Half OT: Windows XP won't connect
by Sergio Belkin 05 Oct '10

05 Oct '10

Hi, I have a freeradius with LDAP, supplicants use either EAP-PEAP or EAP-TTLS. Sometimes, Windows (mainly XP) systems won't connect, packages arrive only to Access Point but no to radius server. Generally, solution is rebooting the AP but I wonder if I need to tweak something on AP, this the result from tcpdump: 12:45:07.808808 00:22:5f:43:f4:31 (oui Unknown) > Broadcast Null Unnumbered, xid, Flags [Response], length 6: 01 00 12:45:07.815594 02:25:9c:14:06:6e (oui Unknown) > 00:25:9c:14:06:6e (oui Unknown), ethertype Unknown (0x886c), length 94: 0x0000: 8001 007a 0000 1018 0001 0001 0000 0000 ...z............ 0x0010: 0008 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 0016 0022 5f43 f431 776c 3000 0000 0000 ..."_C.1wl0..... 0x0030: 0000 0000 0000 0000 3014 0100 000f ac02 ........0....... 0x0040: 0100 000f ac04 0100 000 ac01 0000 0000 ................ 12:45:07.819711 EAPOL start (1) v1, len 0 12:45:07.825580 02:25:9c:14:06:6e (oui Unknown) > 00:25:9c:14:06:6e (oui Unknown), ethertype Unknown (0x886c), length 77: 0x0000: 8001 0069 0000 1018 0001 0001 0000 0000 ...i............ 0x0010: 0019 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 0005 0022 5f43 f431 776d 3000 0000 0000 ..."_C.1wl0..... 0x0030: 0000 0000 0000 0000 0101 0000 0000 00 ............... 12:45:18.821489 IP 192.168.188.131.17500 > 192.168.188.255.17500: UDP, length 127 12:45:20.417512 ARP, Request who-has 192.168.188.1 (00:25:9c:14:06:6c (oui Unknown)) tell 192.168.188.187, length 28 12:45:20.417682 ARP, Reply 192.168.188.1 is-at 00:25:9c:14:06:6c (oui Unknown), length 28 12:45:28.095608 ARP, Request who-has 192.168.188.131 tell 192.168.188.1, length 28 12:45:28.098097 ARP, Reply 192.168.188.131 is-at 00:1f:5b:bb:77:f2 (oui Unknown), length 28 12:45:31.165528 ARP, Request who-has 192.168.188.187 tell 192.168.188.1, length 28 12:45:31.169815 ARP, Reply 192.168.188.187 is-at 00:25:d3:74:49:ac (oui Unknown), length 28 12:45:48.919456 ARP, Request who-has 192.168.188.1 (00:25:9c:14:06:6c (oui Unknown)) tell 192.168.188.187, length 28 12:45:48.919612 ARP, Reply 192.168.188.1 is-at 00:25:9c:14:06:6c (oui Unknown), length 28 12:46:04.655521 ARP, Request who-has 192.168.188.187 tell 192.168.188.1, length 28 12:46:04.656464 ARP, Reply 192.168.188.187 is-at 00:25:d3:74:49:ac (oui Unknown), length 28 12:46:09.114950 EAPOL start (1) v1, len 0 12:46:09.115553 02:25:9c:14:06:6e (oui Unknown) > 00:25:9c:14:06:6e (oui Unknown), ethertype Unknown (0x886c), length 77: 0x0000: 8001 0069 0000 1018 0001 0001 0000 0000 ...i............ 0x0010: 0019 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 0005 0022 5f43 f431 776d 3000 0000 0000 ..."_.1wl0..... 0x0030: 0000 0000 0000 0000 0101 0000 0000 00 ............... 12:46:14.920025 ARP, Request who-has 192.168.188.1 (00:25:9c:14:06:6c (oui Unknown)) tell 192.168.188.187, length 28 12:46:14.920228 ARP, Reply 192.168.188.1 is-at 00:25:9c:14:06:6c (oui Unknown), length 28 Thanks in advance! -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

FW: Session Resumption fails
by Panagiotis Georgopoulos 05 Oct '10

05 Oct '10

Hello all, I am resending this to the list as the debugging output was more than 100KB and the message was rejected. Alexander who was copied in my email, kindly provided feedback already. In short, "use_tunneled_reply = yes" should be able to solve the problem with session resumption in FR 2.1.10, although I understand that break the end client's privacy as it reveals its identity to the NAS. When I test it I'll get back to you as I am guessing this interests more people. Cheers, Panos Debug output here : http://pastebin.com/7u1tjbYE > -----Original Message----- > From: Panagiotis Georgopoulos [mailto:panos@comp.lancs.ac.uk] > Sent: Friday, September 24, 2010 04:17 > To: 'FreeRadius users mailing list'; 'Alexander Clouter' > Subject: RE: Session Resumption fails > > Hi Alexander, all > > Thanks a lot for your reply, it helped my understanding of what is > occurring. Please see below for my comments. > > > > > Panagiotis Georgopoulos <panos(a)comp.lancs.ac.uk> wrote: > > > > > > I have a client machine that authenticates to FreeRadius using > > > EAP-TTLS over Access_Point_1 just fine. When I roam the client to > > > Access_Point_2 and tries to authenticate again to FreeRadius, > > > session resumption seems to be failing with the following error. > > > > > > [snipped] > > > > > > One thing to note on the above is that there is no cached > > information, > > > which seems strange as the client was authenticated some minutes > > > over Access_Point_1. The other thing is that user authentication > > > fails completely and the client resides to restart EAP-TTLS from the > > > start that finishes successfully. > > > > > The session cache stores what is in the *reply* packet of the inner > > request (if that makes sense). > > > > In your eap.conf file, you refer to a virtual server to palm off > > requests to once the EAP layer has been peeled off. In that virtual > > server say in the authorize{} section: > > ---- > > update reply { > > User-Name := "%{request:User-Name}" > > } > > ---- > > > > Now you will find on resumption the username appears magically; > > session resumption is a feature of SSL/TLS and so the user-name is not > > accessible; hence the need to dig into the cache. > > > > I also recommend that you also do: > > ---- > > update outer.request { > > User-Name := "%{request:User-Name}" > > } > > ---- > > I am afraid your suggestion though to add the above in my inner-tunnel virtual > server didn't solve the problem. After having searched the archives of the > list, I found out that this is an OpenSSL bug and there is a fix in FreeRadius > 2.1.10 for it. > > I just compiled 2.1.10 and I verify that I don't see resuming sessions failing > with this no information in the cache : > > Info: [ttls] Skipping Phase2 due to session resumption > Info: [ttls] WARNING: No information in cached session! > > However, I am not seeing the correct behaviour either :-/ > > I am seeing the server adding information in the cache : > > - Debug: SSL: adding session > 1d6029bbddba233cd443d692b968df093237d9ad982f9ccc8a2defcd3edeb243 to cache > - Info: [ttls] (other): SSL negotiation finished successfully > - Debug: SSL Connection Established > > .. but it *never* says that it tries to e.g. skip phase 2 and try resumption > (as I was seeing with FR 2.1.8). > > However in some occasions it says : > > - Info: [ttls] WARNING: No information to cache: session caching will be > disabled for this session. > - Debug: SSL: Removing session > 69c204b29e84878591c19645ed74c1ff4b656c30f66adad78d268df65d2e1d14 from the > cache > > Does anyone have any pointers/suggestions? Anyone who managed to do session > resumption with 2.1.10? > > Thanks a lot in advance, > Panos > > > Ps. By the way, you can find attached my radiusd debugging output with a > client trying to authenticate over different NASs. All authentications > succeed, and info in the cache is stored, but FR never resumes a session. > (nb. in the attached debug, I am restarting my NASs first before the client > starts roaming from one NAS to the other using EAP-TTLS) >

2 8

Freeradius Attribute Subtypes
by Kevin Baier 04 Oct '10

04 Oct '10

Hi List, My freeradius version is 2.0.4 shipped with standard debian lenny package. I have to implement some special attribute to control the users bandwidth on an Special NAS. Here ist the attribute: Type: 26 Length = 12 Vendor ID: 3902 Vendor-Type = 3 Vendor-Length = 14 Sub-Type = 1 Forward maximum gross aggregate bandwidth value Length = 6 Vendor-Value = 1 – 2**32 -1(binary value of the gross aggregate bandwidth for the user, in bits per second) Sub-Type = 2 Reverse maximum gross aggregate bandwidth value Length = 6 Vendor-Value = 1 – 2**32 -1(binary value of the gross aggregate bandwidth for the user, in bits per second) As I can see the attribute itself has two subtyped values. How can I declare them in the dictionary file? Thank you for your help! -- Kevin Baier

2 2