November 2010 - Freeradius-Users - lists.freeradius.org

S/KEY authentication on FreeRADIUS
by Victor Guk 08 Nov '10

08 Nov '10

Hi all Can you please tell whether it is possible to configure FreeRADIUS to authenticate users on the "S/KEY One-Time Password System", which is described in RFC 1760 (http://tools.ietf.org/html/rfc1760) Thank you so much.

3 5

Segmentation Fault
by Michel Musslin 08 Nov '10

08 Nov '10

Hello, I actually try to cross compile freeradius 2.0.9 for powerpc. Everything looks good during compilation, but we get "Segmentation Fault" on our host when executing "radiusd -X". Our setup is : - EGLIBC 2.9 - GCC 4.3.2 - Linux 2.6.31 Could you please help me to find a way to solve this problem. Here you can find strace and gdb log. Michel M. strace log : sendto(4, "\0\0\0\24\0\26\3\1L\321-\374\0\0\0\0\0\0\0\0", 20, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 20 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\0\0\0000\0\24\0\2L\321-\374\0\0\7$\2\10\200\376\0\0\0\1\0\10\0\1\177\0\0\1"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 288 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\0\0\0@\0\24\0\2L\321-\374\0\0\7$\n\200\200\376\0\0\0\1\0\24\0\1\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 128 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\0\0\0\24\0\3\0\2L\321-\374\0\0\7$\0\0\0\0\0\0\0\1\0\24\0\1\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 20 close(4) = 0 fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(4, 64), ...}) = 0 ioctl(1, TCGETS, {B115200 opost isig icanon echo ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x48001000 open("/usr/local/lib/rlm_exec.la", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0755, st_size=814, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x48002000 read(4, "# rlm_exec.la - a libtool librar"..., 4096) = 814 read(4, "", 4096) = 0 close(4) = 0 munmap(0x48002000, 4096) = 0 open("/usr/local/lib/libpthread.la", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib/libpthread.la", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/lib/libpthread.la", O_RDONLY) = -1 ENOENT (No such file or directory) access("/usr/local/lib/libpthread.so", R_OK) = -1 ENOENT (No such file or directory) access("/lib/libpthread.so", R_OK) = -1 ENOENT (No such file or directory) access("/usr/lib/libpthread.so", R_OK) = 0 futex(0x1016e378, FUTEX_WAKE_PRIVATE, 2147483647) = 0 open("/usr/lib/libpthread.so", O_RDONLY) = 4 read(4, "/* GNU ld script\n Use the shar"..., 512) = 219 close(4) = 0 open("/usr/local/lib/libresolv.la", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib/libresolv.la", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/lib/libresolv.la", O_RDONLY) = -1 ENOENT (No such file or directory) access("/usr/local/lib/libresolv.so", R_OK) = -1 ENOENT (No such file or directory) access("/lib/libresolv.so", R_OK) = -1 ENOENT (No such file or directory) access("/usr/lib/libresolv.so", R_OK) = 0 open("/usr/lib/libresolv.so", O_RDONLY) = 4 read(4, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\0.X\0\0\0004"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=92607, ...}) = 0 mmap(0x6ffcb000, 150532, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x6ffcb000 mprotect(0x6ffdd000, 61440, PROT_NONE) = 0 mmap(0x6ffec000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x11000) = 0x6ffec000 mmap(0x6ffee000, 7172, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x6ffee000 close(4) = 0 open("/etc/ld.so.cache", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=4841, ...}) = 0 mmap(NULL, 4841, PROT_READ, MAP_PRIVATE, 4, 0) = 0x48002000 close(4) = 0 open("/lib/libc.so.6", O_RDONLY) = 4 read(4, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\1\356T\0\0\0004"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=1733649, ...}) = 0 mmap(0x6fe4f000, 1487896, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x6fe4f000 mprotect(0x6ffa4000, 61440, PROT_NONE) = 0 mmap(0x6ffb3000, 20480, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x154000) = 0x6ffb3000 mmap(0x6ffb8000, 9240, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x6ffb8000 close(4) = 0 open("/lib/ld.so.1", O_RDONLY) = 4 read(4, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\1_x\0\0\0004"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=143055, ...}) = 0 mmap(0x6fe10000, 192148, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x6fe10000 mprotect(0x6fe2e000, 61440, PROT_NONE) = 0 mmap(0x6fe3d000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x1d000) = 0x6fe3d000 close(4) = 0 mprotect(0x6fe3d000, 4096, PROT_READ) = 0 mprotect(0x6ffb3000, 8192, PROT_READ) = 0 mprotect(0x6ffec000, 4096, PROT_READ) = 0 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ gbd-radiusd.log : * 1 process 1821 0x100da888 in add_to_global () Thread 1 (process 1821): #0 0x100da888 in add_to_global () No locals. #1 0x100db1e4 in dl_open_worker () No locals. #2 0x100d8fa0 in _dl_catch_error () No locals. #3 0x100da620 in _dl_open () No locals. #4 0x10096428 in dlopen_doit () No locals. #5 0x100d8fa0 in _dl_catch_error () No locals. #6 0x10096828 in _dlerror_run () No locals. #7 0x10096364 in __dlopen () No locals. #8 0x10074d34 in dlopen () No locals. #9 0x10074cdc in sys_dl_open (loader_data=<value optimized out>, filename=0x1027d5b8 "/usr/lib/libresolv.so") at ltdl.c:1115 module = <value optimized out> __FUNCTION__ = "sys_dl_open" #10 0x10071db8 in tryall_dlopen (handle=0xbff58570, filename=0x1027d5b8 "/usr/lib/libresolv.so", useloader=0x0) at ltdl.c:2487 cur = (lt_dlhandle) 0x1027d528 loader = (lt_dlloader *) 0x1027d1e8 saved_error = 0x101341fc "file not found" errors = <value optimized out> #11 0x10074b40 in find_handle_callback ( filename=0x1027d5b8 "/usr/lib/libresolv.so", data=0xbff58570, ignored=<value optimized out>) at ltdl.c:2844 notfound = 0 #12 0x10072b54 in foreach_dirinpath (search_path=<value optimized out>, base_name=0x1027d4d0 "libresolv.so", func=0x10074ae0 <find_handle_callback>, data1=0xbff58570, data2=0x0) at ltdl.c:2767 lendir = 9 dir_name = 0x1027d515 "/usr/lib" result = <value optimized out> filenamesize = 22 lenbase = 12 argz_len = 14 argz = 0x1027d510 "/lib" filename = 0x1027d5b8 "/usr/lib/libresolv.so" canonical = 0x1027d4f8 "/lib:/usr/lib" __PRETTY_FUNCTION__ = "foreach_dirinpath" __FUNCTION__ = "foreach_dirinpath" #13 0x10072d74 in find_handle (search_path=0x10134088 "/lib:/usr/lib", base_name=0x1027d4d0 "libresolv.so", handle=0xbff58570) at ltdl.c:2867 __FUNCTION__ = "find_handle" #14 0x10073d74 in try_dlopen (phandle=0xbff585d8, filename=0x1027d4b8 "libresolv.so") at ltdl.c:3438 saved_error = 0x101341fc "file not found" canonical = 0x1027d4d0 "libresolv.so" base_name = 0x1027d4d0 "libresolv.so" dir = 0x0 name = <value optimized out> errors = 0 newhandle = (lt_dlhandle) 0x1027d528 __PRETTY_FUNCTION__ = "try_dlopen" #15 0x10074a7c in lt_dlopenext (filename=<value optimized out>) at ltdl.c:3606 handle = (lt_dlhandle) 0x1027d528 tmp = 0x1027d4b8 "libresolv.so" len = 9 errors = <value optimized out> __FUNCTION__ = "lt_dlopenext" #16 0x100746e4 in try_dlopen (phandle=0xbff58678, filename=<value optimized out>) at ltdl.c:3011 file = <value optimized out> libdir = 0x1027cf58 "/usr/local/lib" deplibs = 0x1027cf10 " /usr/local/lib/libfreeradius-radius.la -lnsl -lresolv -lpthread" line = <value optimized out> line_len = <value optimized out> dlname = 0x0 old_name = 0x1027d3e0 "librlm_exec.a" installed = 1 saved_error = 0x0 canonical = 0x1027d3c0 "rlm_exec.la" base_name = <value optimized out> dir = 0x1027d5a0 "/usr/local/lib" name = 0x1027d3d0 "rlm_exec" errors = <value optimized out> newhandle = <value optimized out> __PRETTY_FUNCTION__ = "try_dlopen" #17 0x10074984 in lt_dlopenext (filename=<value optimized out>) at ltdl.c:3564 handle = (lt_dlhandle) 0x1027cf70 tmp = 0x1027d3b0 "rlm_exec.la" len = 8 errors = <value optimized out> __FUNCTION__ = "lt_dlopenext" #18 0x10012aac in find_module_instance (modules=<value optimized out>, instname=0x1019362c "exec", do_link=1) at modules.c:491 check_config_safe = <value optimized out> cs = (CONF_SECTION *) 0x10195bb0 name1 = <value optimized out> node = (module_instance_t *) 0x1027d290 myNode = { name = "exec\000\005¶`\020\031.\b\000\000\000\t¿õ\212@\020\000CÄ", '\0' <repeats 20 times>, "\020\022\006´\020\031/þ\000\000\000 \000\000\000\000\000\000\000\000¿õ\212@\000\000\000\000\000\000\000\000\020\026-ø¿õ\220Ø\020\026\000\000\020\026\000\000\020\026.\b\020\021þ\034\000\000\000\000\020\002Y¸\020\021\224\004\020\026\000\000\020\021\234h\020\026\000\000\020\032 ¿õ\212\200\020\026ã|\000\000\000\024\020\026-ø¿õ\212\220\020\026\000\000\020\026\000\000\020\026-ø¿õ\220Ø\020\026\000\000\020\026\000\000\020\0314\200¿õ\212p\000\000\000\000\020\021¶ä\020\031\017\210¿õ\212\220\020\005¶\020\002\000\000\000¿õ\212¨\020\031"..., entry = 0x10190f88, insthandle = 0x0, mutex = 0x0, cs = 0x10193480, dead = 270077832, mh = 0x1019362c} module_name = "rlm_exec\000õ\206À\020\tCd\000\000\000\000\020\031û\020¿õ\206à\020\t.à\020\026\000\000\020\026.\b\020\026\000\000\000\000\000ÿH\000\003s\020\031û\020¿õ\206ð\020\t;\204\000\000\000\000\020\031û\020¿õ\2070\020\tI°\020\026\000\000\020\026.\b¿õ\211@\000\000\000\000\020\031\017h¿õ\207X¿õ\207 \020\021\224\004¿õ\207X\020\031&\210¿õ\207@\020\005¶\020\002\000ã|¿õ\207X¿õ\207\200\020\021\224\004\020\031%Ð\020\026-ø¿õ\220Ø\020\026\000\000\020\026\000\000\020\026.\b\020\026\000\000¿õ\207Ø\020\031%Ð\020\026\000\000¿õ\211\030\020\031& \020\026;@\000\000\000\000"... __FUNCTION__ = "find_module_instance" #19 0x10012fec in setup_modules (reload=<value optimized out>, config=0x10190f88) at modules.c:1542 ci = (CONF_ITEM *) 0x10193608 name = 0x1019362c "exec" cs = (CONF_SECTION *) 0x10193540 modules = (CONF_SECTION *) 0x10193480 listener = <value optimized out> __FUNCTION__ = "setup_modules" #20 0x100106bc in read_mainconfig (reload=<value optimized out>) at mainconfig.c:959 p = 0x10190f68 "/usr/local/etc/raddb" cs = (CONF_SECTION *) 0x10190f88 statbuf = {st_dev = 2065, st_ino = 8163, st_mode = 16877, st_nlink = 7, st_uid = 0, st_gid = 0, st_rdev = 0, __pad2 = 0, st_size = 4096, st_blksize = 4096, st_blocks = 8, st_atim = { tv_sec = 1288775159, tv_nsec = 0}, st_mtim = {tv_sec = 1288780664, tv_nsec = 0}, st_ctim = {tv_sec = 1288780691, tv_nsec = 0}, __unused4 = 0, __unused5 = 0} cc = <value optimized out> buffer = "/usr/local/etc/raddb/radiusd.conf", '\0' <repeats 711 times>, "¿õ\217°", '\0' <repeats 12 times>, "¿õ\220ü\000\000\000!\000\000\000\000¿õ\220ø¿õ\220ð\020\006\226¤\020\006\235,\020\000\000\004", '\0' <repeats 80 times>, "¿õ\2200", '\0' <repeats 12 times>, "\020\026-\224\020\026éD¿õ\224\024\020\026öH¿õ\220 \020\ná\034", '\0' <repeats 32 times>, "\204\000\004h\020\026-ø¿õ\220°\020\026\000\000\020\t8è\000\000\000\000\020\026\000\000\000\000\000\000\020\026.°\020\021Ç\b\020\021Ë\214$\000\004l\020\026.°\020"... __FUNCTION__ = "read_mainconfig" #21 0x10015ac0 in main (argc=2, argv=0xbff59414) at radiusd.c:265 rcode = <value optimized out> argval = <value optimized out> spawn_flag = 0 dont_fork = 1 flag = 0 act = {__sigaction_handler = {sa_handler = 0, sa_sigaction = 0}, sa_mask = {__val = {0 <repeats 32 times>}}, sa_flags = 0, sa_restorer = 0}

2 1

Formatting SSHA1-Passwords
by inetjunkmail 08 Nov '10

08 Nov '10

How do I specify the salt when storing passwords as a salted SHA1 hash? For instance: SSHA-Password := <hash>:<salt> or SSHA-Password := <salt>,<hash> etc.

2 1

EAP-AKA support (urgent)
by dfds fds 08 Nov '10

08 Nov '10

Hi , I want to know , is freeradius supports EAP-AKA? if supports , can i get instructions to set up EAP-AKA in free radiusthanks in advance RegardsSrini

3 3

%RAD_REPLY hash problem
by Ana Gallardo 08 Nov '10

08 Nov '10

Hello, I'm working with Freeradius 2.1.10 I want to authorize an user usng a multivaluated attribute (Relaciones), so I use perl. The values of the attribute Relaciones are store in ldap. Nombre-Completo is another attribute store in ldap. "Relaciones" is a integer value. An user is authorize if have one attribute "Relaciones" with a positive value (no + sign). Relaciones, Nombre-Completo and Codigo-Reject are vendor specific attributes defined in /usr/share/freeradius/dictionary.rinuex My script perl is: # cat /etc/freeradius/perl/checkRelaciones.pm #!/usr/bin/perl use strict; use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); #use Data::Dumper; use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ sub authorize { my $refRelaciones; if (exists $RAD_REPLY{'Relaciones'} && defined $RAD_REPLY{'Relaciones'}){ $refRelaciones=$RAD_REPLY{'Relaciones'}; foreach (@{$refRelaciones}) { if ($_ =~ /^[0-9]{2}/) { return RLM_MODULE_OK; } } $RAD_REPLY{'Codigo-Reject'}=11; #Sin-Relacion } return RLM_MODULE_REJECT; } Everything works fine. My problem is that rlm_perl duplicate an attribute in %RAD_REPLY hash. Debug: rad_recv: Access-Request packet from host x.x.x.x port 56822, id=100, length=75 User-Name = "ana(a)unex.es" User-Password = "1111" Calling-Station-Id = "..." server rinuex { ... [ldap1] looking for check items in directory... [ldap1] ntPassword -> NT-Password == 0x3.. [ldap1] looking for reply items in directory... [ldap1] Relaciones -> Relaciones += "03" [ldap1] sn -> Nombre-Completo = "Ana Gallardo" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap1] user ana authorized to use remote access [ldap1] ldap_release_conn: Release Id: 0 ++++[ldap1] returns ok ... rlm_perl: Added pair User-Name = ana(a)unex.es rlm_perl: Added pair User-Password = 1111 rlm_perl: Added pair Intentos-Reject = 0 rlm_perl: Added pair SQL-User-Name = ana rlm_perl: Added pair Realm = unex.es rlm_perl: Added pair Stripped-User-Name = ana rlm_perl: Added pair Calling-Station-Id = ... rlm_perl: Added pair Nombre-Completo = Ana Gallardo rlm_perl: Added pair Relaciones = 03 rlm_perl: Added pair Relaciones = Ana Gallardo rlm_perl: Added pair NT-Password = 0x344... rlm_perl: Added pair Simultaneous-Use = 1 rlm_perl: Added pair Ldap-UserDn = ... ++[perl] returns ok ... ++[pap] returns ok ... } # server rinuex Sending Access-Accept of id 100 to x.x.x.x port 56822 Nombre-Completo = "Ana Gallardo" Relaciones += "03" Relaciones += "Ana Gallardo" Any ideas?? Sorry for my english and thank you in advance. ____________________ Ana Gallardo Gómez ____________________

2 4

EAP-PEAP fatal unknown_ca
by westwood 08 Nov '10

08 Nov '10

*freeradius2.1.8 1、 win7+protected EAP(peap)+wpa-enterprise (laptop name :leeyu-laptop) 2、 i have install ca.der on the win7 and winxp 3、 winxp+**protected EAP(peap)**+ca testing successfully, but win7 fails ERROR happened before win7 prompted me to enter username&&password.....,freeradius debug: * Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/freeradius//var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.1 port 3075, id=144, length=191 User-Name = "host/Leeyu-Laptop" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "00195b04c9e2" Calling-Station-Id = "001e659fc674" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001601686f73742f4c656579752d4c6170746f70 Message-Authenticator = 0x2cca1e2672315cf4764cc0fd2544dfe3 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [Capitek.com] No '@' in User-Name = "host/Leeyu-Laptop", looking up realm NULL [Capitek.com] No such realm "NULL" ++[Capitek.com] returns noop [eap] EAP packet type response id 0 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql_oracle] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_oracle] ... expanding second conditional [sql_oracle] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_oracle] expand: %{User-Name:-DEFAULT} -> host/Leeyu-Laptop [sql_oracle] expand: %{Stripped-User-Name:-%{User-Name:-DEFAULT}} -> host/Leeyu-Laptop [sql_oracle] sql_set_user escaped user --> 'host/Leeyu-Laptop' rlm_sql (sql_oracle): Reserving sql socket id: 18 [sql_oracle] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'host/Leeyu-Laptop' ORDER BY id [sql_oracle] User found in radcheck table [sql_oracle] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'host/Leeyu-Laptop' ORDER BY id [sql_oracle] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM radusergroup WHERE UserName='host/Leeyu-Laptop' rlm_sql (sql_oracle): Released sql socket id: 18 ++[sql_oracle] returns ok [bklist] No Max-Attempts defined. ++[bklist] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 144 to 192.168.0.1 port 3075 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x246ddb0b246cc225aad5e24c6756cf9c Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 3075, id=145, length=307 User-Name = "host/Leeyu-Laptop" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "00195b04c9e2" Calling-Station-Id = "001e659fc674" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201007e198000000074160301006f0100006b03014cd4fdcd261077436d24f643f2f64fd5b4c4cb53d980a2f2400f17f2fd6205e8000018002f00350005000ac013c014c009c00a00320038001300040100002aff0100010000000011000f00000c6c656579752d6c6170746f70000a0006000400170018000b00020100 State = 0x246ddb0b246cc225aad5e24c6756cf9c Message-Authenticator = 0x08b295f4b9501d45e89fda21cf14c8ad +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [Capitek.com] No '@' in User-Name = "host/Leeyu-Laptop", looking up realm NULL [Capitek.com] No such realm "NULL" ++[Capitek.com] returns noop [eap] EAP packet type response id 1 length 126 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 116 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 006f], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085c], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 145 to 192.168.0.1 port 3075 EAP-Message = 0x0102040019c0000008a016030100310200002d03014cd4fe1b8df7a54a84f7cb54ee98830b53c41dd5275195bb31ca2bdf975ff9d200002f000005ff01000100160301085c0b0008580008550003a7308203a33082028ba003020102020101300d06092a864886f70d0101040500308192310b300906035504061302434e3110300e060355040813074361706974656b3110300e060355040713074265696a696e6731153013060355040a130c4361706974656b20496e632e3120301e06092a864886f70d010901161161646d696e404361706974656b2e636f6d312630240603550403131d4361706974656b20436572746966696361746520417574 EAP-Message = 0x686f72697479301e170d3130313032333039333530305a170d3131313032333039333530305a307e310b300906035504061302434e3110300e060355040813074361706974656b31153013060355040a130c4361706974656b20496e632e312330210603550403131a4361706974656b205365727665722043657274696669636174653121301f06092a864886f70d010901161261646d696e40654361706974656b2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100cdaab3f206b6cfc36821760b21090968cca6f8342aeb2ad8d1dd45e93b419a2c635a196c4ed6474947d5093a914c84ee21111bf134a3 EAP-Message = 0x43f31ceede8c211b49965710ac8ce6e362addd4d741bdf59fa081bfe86fe3e43cf8289e8ed4e151da4460204318b808959194ba8196e0e6af6d15bd032b1d87a3a34ad2e62982cef6534d7b364afe0241ca534984b2d8d770795fed8e5857bd155a2cc7207d81012fe262344ff32882baa32713ebb2ed1b5d246bcee1dfc31faa51392a1b9578091814034b56bb39fa012062352b08aae929a508b4ec41fe06a071ed6216a360d14253023e52e327bf1b0ebdd2cf0e67b3edc72a134750781b41558f23b9e5cca09558d0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010045 EAP-Message = 0x3a993396c01ab3e963bd6f828ece8d30a9e4783015a3c2fff68c0ac81506ba39520977b7b2c111d64b0da28081fb018e6de7ee2f4ca76271ecff6f3e59b36825d9e1d5c3141fb8e05ff230e16de497169f25a7e62a207b0f231ca98a16154894e02cf279e59ed4f165149775a1eaaa52d6ed58f555684d84b0b3caca3227068bf2591434fce17120f5b4c90d687eb9d7b0e77007f98d4c7751432e2c5e71cfa7ff2ceb8f1a2a05f1e20e8a4d639b091a814059665db63b843c207d5c7e4ab13d572224fbb28fe822e1d1a316af5ecee361cffc24143ff40331b2eb5868d5f751299e7ef832297caf99c1f8a199442ee3e7f0375a492cebfde4c1729001 EAP-Message = 0x0ac70004a8308204a4308203 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x246ddb0b256fc225aad5e24c6756cf9c Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 3075, id=146, length=187 User-Name = "host/Leeyu-Laptop" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "00195b04c9e2" Calling-Station-Id = "001e659fc674" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200061900 State = 0x246ddb0b256fc225aad5e24c6756cf9c Message-Authenticator = 0xafa36e7177fb2841b5512080ba8fa1f6 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [Capitek.com] No '@' in User-Name = "host/Leeyu-Laptop", looking up realm NULL [Capitek.com] No such realm "NULL" ++[Capitek.com] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 146 to 192.168.0.1 port 3075 EAP-Message = 0x010303fc19408ca003020102020900a82c41eeeb4a4d37300d06092a864886f70d0101050500308192310b300906035504061302434e3110300e060355040813074361706974656b3110300e060355040713074265696a696e6731153013060355040a130c4361706974656b20496e632e3120301e06092a864886f70d010901161161646d696e404361706974656b2e636f6d312630240603550403131d4361706974656b20436572746966696361746520417574686f72697479301e170d3130313032333039333434365a170d3131313032333039333434365a308192310b300906035504061302434e3110300e060355040813074361706974656b EAP-Message = 0x3110300e060355040713074265696a696e6731153013060355040a130c4361706974656b20496e632e3120301e06092a864886f70d010901161161646d696e404361706974656b2e636f6d312630240603550403131d4361706974656b20436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100b2d3f0c5f84705f3b0aec33fdcc4d9a052e18fbe093c2a3e147725a85f48153b57bb2cdd3d664a2882e49283cb928f0d7433dbed09bc6f8ed1082bd63ed64e8d6325181bc1124cecb84b9a9e2a143b9fc7562848c826476367e476f530d7d320d774218490b24b0d54 EAP-Message = 0x0d725d80646614ed1ff8f074950ab5b3591857ea0a7a6b96ff6088f38ad60a9aec2afc811468d592ae6f0daa3505b4a771c76cb2e95c849b1606372f2d2eb2c860570eaa98d162f411c0fd6e620912f8f58a44a96376fa7ce14b576fe127a57810128fcd25e63706bb41dee082c5aeeba98d6d650276daa7520d0bd5280cc96c998d68cbe9e0ade80efb32e844b927418d9fdb96865ae90203010001a381fa3081f7301d0603551d0e04160414e411bcc416724dfec735b59ffe5b25952ffe185b3081c70603551d230481bf3081bc8014e411bcc416724dfec735b59ffe5b25952ffe185ba18198a48195308192310b300906035504061302434e3110 EAP-Message = 0x300e060355040813074361706974656b3110300e060355040713074265696a696e6731153013060355040a130c4361706974656b20496e632e3120301e06092a864886f70d010901161161646d696e404361706974656b2e636f6d312630240603550403131d4361706974656b20436572746966696361746520417574686f72697479820900a82c41eeeb4a4d37300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100359ee20c5583cf62b6e23e2986ffc80212677987b02b22ef7bf81e52c6a83ea14a09b12736a0c94d1f6f9fe6ba982abe033a1fab74b1398695263ad861a1ab176498c2ebadcca488a078893acf EAP-Message = 0x6d1762af9cc32f77 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x246ddb0b266ec225aad5e24c6756cf9c Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 3075, id=147, length=187 User-Name = "host/Leeyu-Laptop" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "00195b04c9e2" Calling-Station-Id = "001e659fc674" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0x246ddb0b266ec225aad5e24c6756cf9c Message-Authenticator = 0x09cd348a564b11f4a1a5ee3f8aad59a8 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [Capitek.com] No '@' in User-Name = "host/Leeyu-Laptop", looking up realm NULL [Capitek.com] No such realm "NULL" ++[Capitek.com] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 147 to 192.168.0.1 port 3075 EAP-Message = 0x010400ba1900f2af5e0bbbca5b63619eda4eafebcc8ce7dd49123dec621a9ee82327050c940e017b605759c85305c408f8e295be432e983bc762c496a9d45daa7044bfb8914236f4a38e213c5f16ac998128ca6f463e57823c7ed2e85ede9522f53be56f523460033146a70d509fa700ea0d7b139040adece74cd15c33064e4604d955a0cdbdfca05de47f8dd88d49935506ed4e61e8beb817af9ba7b135faa8ed6f63239f855d144a1887b38ee114f4a916030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x246ddb0b2769c225aad5e24c6756cf9c Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 3075, id=148, length=198 User-Name = "host/Leeyu-Laptop" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "00195b04c9e2" Calling-Station-Id = "001e659fc674" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0204001119800000000715030100020230 State = 0x246ddb0b2769c225aad5e24c6756cf9c Message-Authenticator = 0x540a124a43aaa2b5ab81e6c6c5ae9452 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [Capitek.com] No '@' in User-Name = "host/Leeyu-Laptop", looking up realm NULL [Capitek.com] No such realm "NULL" ++[Capitek.com] returns noop [eap] EAP packet type response id 4 length 17 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 7 [peap] Length Included [peap] eaptls_verify returned 11 *[peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation* [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} ++[bklist] returns noop [sql_oracle] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_oracle] ... expanding second conditional [sql_oracle] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_oracle] expand: %{User-Name:-DEFAULT} -> host/Leeyu-Laptop [sql_oracle] expand: %{Stripped-User-Name:-%{User-Name:-DEFAULT}} -> host/Leeyu-Laptop [sql_oracle] sql_set_user escaped user --> 'host/Leeyu-Laptop' [sql_oracle] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '<Crypted>', '%{reply:Packet-Type}', TO_DATE('%S','yyyy-mm-dd hh24:mi:ss')) -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'host/Leeyu-Laptop', '<Crypted>', 'Access-Reject', TO_DATE('2010-11-06 15:04:59','yyyy-mm-dd hh24:mi:ss')) rlm_sql (sql_oracle) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'host/Leeyu-Laptop', '<Crypted>', 'Access-Reject', TO_DATE('2010-11-06 15:04:59','yyyy-mm-dd hh24:mi:ss')) rlm_sql (sql_oracle): Reserving sql socket id: 17 rlm_sql (sql_oracle): Released sql socket id: 17 ++[sql_oracle] returns ok [attr_filter.access_reject] expand: %{User-Name} -> host/Leeyu-Laptop attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 148 to 192.168.0.1 port 3075 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 144 with timestamp +3 Cleaning up request 1 ID 145 with timestamp +3 Cleaning up request 2 ID 146 with timestamp +3 Cleaning up request 3 ID 147 with timestamp +3 Waking up in 1.0 seconds. Cleaning up request 4 ID 148 with timestamp +3 Ready to process requests. * winxp do not send its hostname to radius server,but win7 will...,and how this happened ?*

2 1

urgent help about login Auth: Login incorrect
by ann kok 07 Nov '10

07 Nov '10

Hi all I am using the NTRadping is fine for user. The radius log is showing "Auth: Login OK:" But when I try it via Lns, it won't work. It shows "Login incorrect" in the same user in NTRadping What is this problem? How can I check it? Thank you so much.

2 3

Clear text password not available issue
by ann kok 07 Nov '10

07 Nov '10

Hi I am trying new FreeRADIUS Version 2.0.4 and testing Ntrping software The radius log keep saying that Auth: Login incorrect (rlm_chap: Clear text password not available I already tried different password attribute eg: CHAP-Password, Cleartext-Password and User-Password All won't work I am also seaching the google and FAQ too Could you help what I am doing wrong? Thank you

2 1

Authentication doesn't work anymore
by snowman5840 07 Nov '10

07 Nov '10

Hi I'm going crazy with my RADIUS configuration. For some days all works. But now i can't authenticate with xp client, linux still works. It seams that it is a problem with the EAP configuration or with the certificates, but i doesn't find any error in the debug output!? Maybe this will be the problem, "[eap] No EAP Start, assuming it's an on-going EAP conversation" but I don't know waht i can do. Please give me some futher hints. I want to authenticate with EAP-PEAP and MSCHAP. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=43, length=145 NAS-IP-Address = 192.168.0.2 NAS-Port = 50005 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C5" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x02000014014649524d41315c626c657273636861 Message-Authenticator = 0x7371c1f1726066beb9dabe848c328593 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101107 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101107 [auth_log] expand: %t -> Sun Nov 7 11:36:33 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 0 length 20 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for usera [ldap] expand: %{Stripped-User-Name} -> usera [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=usera) [ldap] expand: dc=firma1,dc=de -> dc=firma1,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=firma1,dc=de, with filter (uid=usera) [ldap] Added User-Password = {SSHA}WNtfzJKztV/VYNqJAew//EpfaqFTTmRY in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] sambaNtPassword -> NT-Password == 0x3043423639343838303546373937424632413832383037393733423839353337 [ldap] sambaLmPassword -> LM-Password == 0x3031464335413642453742433639323941414433423433354235313430344545 [ldap] looking for reply items in directory... [ldap] user usera authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 43 to 192.168.0.2 port 1812 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe5811fdbe58006df807df3f78bad2b67 Finished request 42. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=44, length=230 NAS-IP-Address = 192.168.0.2 NAS-Port = 50005 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C5" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0xe5811fdbe58006df807df3f78bad2b67 EAP-Message = 0x0201005719800000004d16030100480100004403014cd6813031d93b50d4e589daaf39973f09262a8588b4684bfd4c30b952c9245a00001600040005000a0009006400620003000600130012006301000005ff01000100 Message-Authenticator = 0xc287af478d7c193cfcec6b09c33c099c +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101107 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101107 [auth_log] expand: %t -> Sun Nov 7 11:36:33 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 1 length 87 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 77 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0048], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 07d8], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 44 to 192.168.0.2 port 1812 EAP-Message = 0x0102040019c00000081c16030100310200002d03014cd68131c9a74e02de2ba907521446470a623f35b17ca47f32683ec55db8455f000004000005ff0100010016030107d80b0007d40007d10003733082036f30820257a003020102020101300d06092a864886f70d01010405003079310b3009060355040613024445311630140603550408130d426c6572736368526164697573311330110603550407130a5765696e67617274656e3110300e060355040a1307426c65727363683115301306092a864886f70d01090116066140612e6465311430120603550403130b5261646975732054657374301e170d3130313030373135303932315a170d31 EAP-Message = 0x31313030373135303932315a3064310b3009060355040613024445311630140603550408130d426c65727363685261646975733110300e060355040a1307426c6572736368311430120603550403130b52616469757320546573743115301306092a864886f70d01090116066140612e646530820122300d06092a864886f70d01010105000382010f003082010a0282010100beade1be49bb6da9990ac95083434e9fc6a86411143c8cec2aef5f2aaa5801a97f756f621461a34bfbaf348c97bd48269a36888e97d5b7e9dc765889712b4cd98092f312a6be1b96a3438646c64c974cefb4accf93ce7414a33b29922f3e8d268cfb61fcdb0309bba351 EAP-Message = 0x7defd94f63fe21857a958338d7f7337892653b9184d3b54ee131516261aaa8ac47bc6349e3100ff08c9714f8abc6cadd64dc50e00296adf04aa8a9e22c8cd35b0731246f9702849e480790d3bb1d2970917402cb8b2f3a0639b69a53447def512699944541b9be1e94a9528737e87496604a035f7a86220fffabc75b8c19429f067cf502276b22f0741c0646087a88e095844c4d616b0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100bd0d00c31db1f9d3792d88680abc76fd9c368ebe49bd728bdb8db8504d75fba64aff2a141ac63c8004a01a43291071f4f91337c6f9 EAP-Message = 0xf68cb9c7c714631cc88be66a728078e474df461ddf20f2db5f52cedf381646c1ba0c2e08b64a6d30946daaf5d92798d628631218c3c724290f9f3344d87b94428b7aa02dab38004100a0eea379017950d458cb34c71928a77018d9a83b80b5614d0303956dff622d133f88b8dc17bb608cd21ff12590332857a08949c72bff9c57f279a6e752797bb9d004467efefb38fd944c328fb43ac6a60be70233ee8f402e996c84d5d64de6ab91348af2063c3e8e27bde3eba4ef831431ab18e999225f1ee674c55d7d048d89d1d2000458308204543082033ca003020102020900f014131264b7ade5300d06092a864886f70d01010505003079310b30090603 EAP-Message = 0x550406130244453116301406 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe5811fdbe48306df807df3f78bad2b67 Finished request 43. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=45, length=149 NAS-IP-Address = 192.168.0.2 NAS-Port = 50005 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C5" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0xe5811fdbe48306df807df3f78bad2b67 EAP-Message = 0x020200061900 Message-Authenticator = 0x6595267991b7298210d423ea9e5e7e34 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101107 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101107 [auth_log] expand: %t -> Sun Nov 7 11:36:33 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 45 to 192.168.0.2 port 1812 EAP-Message = 0x010303fc194003550408130d426c6572736368526164697573311330110603550407130a5765696e67617274656e3110300e060355040a1307426c65727363683115301306092a864886f70d01090116066140612e6465311430120603550403130b5261646975732054657374301e170d3130313030373135303932315a170d3230313031343135303932315a3079310b3009060355040613024445311630140603550408130d426c6572736368526164697573311330110603550407130a5765696e67617274656e3110300e060355040a1307426c65727363683115301306092a864886f70d01090116066140612e6465311430120603550403130b EAP-Message = 0x526164697573205465737430820122300d06092a864886f70d01010105000382010f003082010a0282010100ed103b08365fb46bcabb1cb67f18b2a11a8b1b091c1984839c573cd2a8b07d4c7581a7288f4e58ced2e6429f6cc5a9caf7d3af27c77c3ddf2a4d15b3edbdc4107f4c2349a9d0ed866830996fe189872d5453deed13f6834c9a19a45a67acb59e4929acdb9ae55f43bf357f331b50e49a351b0339b462f845e2a24d81eceb0f63526bcec87858a85ffb7fe7cfe31fd84a4bbd06192401160c7103f7f77f961f7c2dd84c87427e900456941c33425630b692611cc96c79bee4fb28e78dfe18b9465f1b63dc71e12c3a780ac82d775764a451 EAP-Message = 0xe24474c861b96895fa7fad9add315db3c9d6bd413d193cbd431147f6a318743d7c29ed7656a7380b8ebf4fe110ae910203010001a381de3081db301d0603551d0e04160414ac77f070444423b5a05945e1546a0c7747062ba73081ab0603551d230481a33081a08014ac77f070444423b5a05945e1546a0c7747062ba7a17da47b3079310b3009060355040613024445311630140603550408130d426c6572736368526164697573311330110603550407130a5765696e67617274656e3110300e060355040a1307426c65727363683115301306092a864886f70d01090116066140612e6465311430120603550403130b526164697573205465737482 EAP-Message = 0x0900f014131264b7ade5300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100a4eda8c0530c34b7000a8955c4b977fafa376631a7e70b7f97e4d6ecdcde16be2bdd9b63eec98684dbbc0e5b1260fb2dbfbc176a70413802943b7ce71a3a17eea80c47adfb49282ad8511bc247e4cb07ce7d1750d89f1f72e3958222a60b3446b371eabaf0cd1cdac6500bb05edc876d5b3fa65fe194901d6782ce781ec2af28202ccc9c8f11359eca01a21530a84c5bc8d3e83eed89158a3408b6500a36e7e9adaa579df3447a5df899d7db132e2015685539921cb6cc2cf78048cd5b6afb367da3720cf912fa8b573958c54803929861 EAP-Message = 0xe30c97f4b32d6d07 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe5811fdbe78206df807df3f78bad2b67 Finished request 44. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=46, length=149 NAS-IP-Address = 192.168.0.2 NAS-Port = 50005 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C5" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0xe5811fdbe78206df807df3f78bad2b67 EAP-Message = 0x020300061900 Message-Authenticator = 0x5b1899fb14339eca7ba59de266860af7 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101107 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101107 [auth_log] expand: %t -> Sun Nov 7 11:36:33 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 46 to 192.168.0.2 port 1812 EAP-Message = 0x0104003619000f0b409c6f7dd2e83b8a1ad34c1b43c61b5cfa499e7822f081073040ea4c9280acd2686fd194f216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe5811fdbe68506df807df3f78bad2b67 Finished request 45. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=47, length=149 NAS-IP-Address = 192.168.0.2 NAS-Port = 50005 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C5" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0xe5811fdbe68506df807df3f78bad2b67 EAP-Message = 0x020400061900 Message-Authenticator = 0xc59a1a2d0cfb101ec430dad4e10897b6 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101107 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101107 [auth_log] expand: %t -> Sun Nov 7 11:36:33 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 47 to 192.168.0.2 port 1812 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe5811fdbe18406df807df3f78bad2b67 Finished request 46. Going to the next request Waking up in 4.9 seconds. Cleaning up request 42 ID 43 with timestamp +2802 Cleaning up request 43 ID 44 with timestamp +2802 Cleaning up request 44 ID 45 with timestamp +2802 Cleaning up request 45 ID 46 with timestamp +2802 Cleaning up request 46 ID 47 with timestamp +2802 Ready to process requests. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-doesn-t-work-anymore… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Re: PEAP w/ freeradius to LDAP storing ntPassword not working - resolved
by schilling 07 Nov '10

07 Nov '10

I am able to have peap/mschpv2 work with ldap nt hash. radtest -t mschap will not work for peap/mschapv2, the real windows supplicant, wireless access point will work. The format in ldap is not relevant, w/ or w/o the preceding 0x will work. The configuration I changed from default are the following clients.conf to add testing AP ip and secret eap.conf to add the real certificate thing etc. modules/ldap to add the ldap proxy account information. site-enabled/inner-tunnel - uncomment the ldap line in authorize authorize { # # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap } Now whenever I try to have a virtual server for another instance, then it will have the same error as before. Then I copied the site-enabled/default content and put them within the virtual server, it's working again. I then try to reduce to the minimum necessary configuration, the following is for the virtual server to work server ldap_ntpassword_1814 { listen { type = auth ipaddr = * port = 1814 } listen { ipaddr = * port = 1815 type = acct } authorize { eap { ok = return } } authenticate { eap } } Thanks, Schilling On Fri, Nov 5, 2010 at 7:12 AM, schilling <schilling2006(a)gmail.com> wrote: > I asked the ldap admin to change the format of the ntPassword to > prepend with 0x, now radius -X get the right hash, but it still have > no "known good" password was found in LDAP. Nevertheless, the > authorization is ok. What is the right format to put in our ldap > ntPassword attribute? Should I ignore the error and focus on the > Auth-Type error? > > I will reinstall 2.1.0 with all default, and try it again. > > Thanks, > > Schilling > > [ldap] looking for check items in directory... > [ldap] ntPassword -> NT-Password == 0x771cfdfe02a8c15e15b3e0e4974602fa > [ldap] looking for reply items in directory... > WARNING: No "known good" password was found in LDAP. Are you sure > that the user is configured correctly? > [ldap] user sding authorized to use remote access > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns ok > > > On Thu, Nov 4, 2010 at 11:10 PM, Alan DeKok <aland(a)deployingradius.com> wrote: >> schilling wrote: >>> Found Auth-Type = EAP >>> WARNING: Unknown value specified for Auth-Type. Cannot perform >>> requested action. >> >> You have edited the default configuration and broken it. Don't do that. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >

2 3