April 2010 - Freeradius-Users - lists.freeradius.org

(no subject)
by Richie Lee 04 Apr '10

04 Apr '10

www.Newviagrashop.neipdnalu.com _________________________________________________________________ Hotmail & Messenger are available on your phone. Try now. http://go.microsoft.com/?linkid=9724461

1 0

Kerberos (krb5) Module Overrides Other Authentication Types . . .
by Mowgli Assor 03 Apr '10

03 Apr '10

I've had the rlm_krb5 module running for a while now, with the line in the users file : ----- DEFAULT Auth-Type = Kerberos ----- I found that was the only way to get the rlm_krb5 module to actually fire, otherwise the krb5 module would never try to authenticate anyone. I'm now trying to add authentication from an SQL database. So, I have an appropriate tested setup for SQL, and the following in the radreply table : mysql> select * from radreply; +----+----------+--------------+----+------------+ | id | username | attribute | op | value | +----+----------+--------------+----+------------+ | 1 | mowglidb | Service-Type | := | Login-User | | 2 | mowglidb | Fall-Through | = | No | | 3 | mowglidb | Auth-Type | := | Accept | | 4 | mowglidb | Hint | := | SQL | +----+----------+--------------+----+------------+ 4 rows in set (0.00 sec) I've verified that both authentication types work properly, but what happens is that the Kerberos result is the only one ever used, despite the fact that the SQL result appears valid. So when you lookup an ID in the SQL table which is valid, the Kerberos lookup executes, doesn't find the ID, and sends a REJECT. Here's partial radiusd -X output showing the results of a query . . . ----- Ready to process requests. rad_recv: Access-Request packet from host 128.146.XXX.XXX port 1166, id=12, length=48 User-Name = "mowglidb" User-Password = "1234abcd" +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/128.146.XXX.XXX/auth-detail-20100401 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/128.146.XXX.XXX/auth-detail-20100401 [auth_log] expand: %t -> Thu Apr 1 00:38:53 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [IPASS] No '/' in User-Name = "mowglidb", looking up realm NULL [IPASS] No such realm "NULL" ++[IPASS] returns noop [suffix] No '@' in User-Name = "mowglidb", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 210 ++[files] returns ok [sql] expand: %{User-Name} -> mowglidb [sql] sql_set_user escaped user --> 'mowglidb' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FRO M radcheck WHERE username = 'mowglidb' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mowglidb' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FRO M radreply WHERE username = 'mowglidb' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mowglidb' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'mowglidb' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'mowglidb' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Kerberos +- entering group Kerberos {...} rlm_krb5: [mowglidb] krb5_g_i_t_w_p failed: Client not found in Kerberos database ++[krb5] returns reject Failed to authenticate the user. Login incorrect: [mowglidb] (from client test port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> mowglidb attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 12 to 128.146.XXX.XXX port 1166 Finished request 1. Going to the next request ----- I've tried varying what is in the users file, but so far my only results are either the SQL result is squashed by the Kerberos result, or the Kerberos section never attempts a lookup. In reading the attributes description, it implies that if I put the "Auth-Type = Kerberos" in the check section for the DEFAULT entry, it should only add this if there is no Auth-Type, but I'm not clear on when the items from the radreply table are added to the reply. Explicitly setting the Auth-Type in the SQL reply doesn't appear to affect anything - the Kerberos DEFAULT entry seems to simply override it. I've tried swapping the order of the sql & files attributes in the authenticate section, but that didn't work either : ----- ++[sql] returns ok [files] users: Matched entry DEFAULT at line 210 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Kerberos +- entering group Kerberos {...} rlm_krb5: [mowglidb] krb5_g_i_t_w_p failed: Client not found in Kerberos database ++[krb5] returns reject Failed to authenticate the user. Login incorrect: [mowglidb] (from client test port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} ----- And modifying the users file so that the entry reads : ----- DEFAULT Auth-Type = Kerberos ----- resulted in the krb5 module failing to fire at all, even though the files result did match the DEFAULT rule : ----- ++[chap] returns noop ++[mschap] returns noop [IPASS] No '/' in User-Name = "assor.3", looking up realm NULL [IPASS] No such realm "NULL" ++[IPASS] returns noop [suffix] No '@' in User-Name = "assor.3", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 210 ++[files] returns ok [sql] expand: %{User-Name} -> assor.3 [sql] sql_set_user escaped user --> 'assor.3' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FRO M radcheck WHERE username = 'assor.3' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'assor.3' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'assor.3' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'assor.3' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User assor.3 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user ----- The users file really only has the single DEFAULT rule in it, but let me know if seeing any of the other configuration files would help. Otherwise, I'd appreciate any help on getting the krb5 module to work with other authentication types. One other thing, it might be useful to add an "extended debugging" flag to the -X option, which shows you the reply table entries after each module, to allow tracking what sets what values. I haven't seen that mentioned in any documentation, but in my case that would at least allow me to answer the question of what reply entries get set where when. Thanks, <Mowgli> -- The Ohio State University Network Security Group | Mowgli Assor ---------------------------------------------------+-------------------------- E-mail : security(a)osu.edu | Network Security Engineer Web : http://www.infosec.ohio-state.edu | Office : (Use E-mail)

3 5

(no subject)
by Saman Kwok 03 Apr '10

03 Apr '10

Hi ,I am happing problem that I couldn't resolve alone. If anyone in the list could help me will be appreciated. I have access point EnGenius 2610 and I run freeradius under RHEL5.RHEL5 have two ethernet card, eth0 : 192.168.1.4 to Internet, eth1 to Wifi Client with IP 192.168.0.1 (Client is Windows XP). Client authenticated with MS-Chapv2. I had installed ca_cert.der in XP. when I run radiusd -X everytime seem fine. Ready to process requests.rad_recv: Access-Request packet from host 192.168.0.3 port 1024, id=4, length=194 User-Name = "GRACELIA-4E4DD9\\gracelia" NAS-IP-Address = 192.168.0.3 NAS-Port = 0 Called-Station-Id = "00-02-6C-5B-0A-A3:mars_net" Calling-Station-Id = "00-80-A8-C1-C0-A3" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020d001d0147524143454c49412d3445344444395c67726163656c6961 Message-Authenticator = 0x5ad14aa7bbf1f169e0d16b594a0888ea+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop[suffix] No '@' in User-Name = "GRACELIA-4E4DD9\gracelia", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] EAP packet type response id 13 length 29[eap] No EAP Start, assuming it's an on-going EAP conversation++[eap] returns updated++[unix] returns notfound[files] users: Matched entry GRACELIA-4E4DD9\gracelia at line 94[files] expand: Hello, %{User-Name} -> Hello, GRACELIA-4E4DD9\gracelia++[files] returns ok++[expiration] returns noop++[logintime] returns noop[pap] Found existing Auth-Type, not changing it.++[pap] returns noopFound Auth-Type = EAP+- entering group authenticate {...}[eap] EAP Identity[eap] processing type tls[tls] Initiate[tls] Start returned 1++[eap] returns handledSending Access-Challenge of id 4 to 192.168.0.3 port 1024 Reply-Message = "Hello, GRACELIA-4E4DD9\\gracelia" EAP-Message = 0x010e00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1b2c209a1b2239d39cc5bd6f4ac49d46Finished request 18.Going to the next requestWaking up in 4.9 seconds.Cleaning up request 18 ID 4 with timestamp +307Ready to process requests. But it keep looping Access-Challege and Access-Request without Access-Reject or authenticated. I believe the certificate already have OID. When I check with Access Point Log..here the output Jan 1 00:17:35 (none) daemon.debug setup.cgi[465]: main: process ./html/CM_SystemStatus.htm takes 2300 ms----------------------------Jan 1 00:17:42 (none) daemon.debug hostapd: ath1: STA 00:80:x8:x1:x0:x3 IEEE 802.1X: aborting authenticationJan 1 00:17:42 (none) daemon.debug hostapd: ath1: STA 00:80:x8:x1:x0:x3 IEEE 802.1X: unauthorizing portJan 1 00:17:42 (none) daemon.debug hostapd: ath1: STA 00:80:x8:x1:x0:x3 IEEE 802.1X: received EAP packet (code=2 id=54 len=29) from STA: EAP Response-Identity (1)Jan 1 00:17:42 (none) daemon.debug hostapd: ath1: STA 00:80:x8:x1:x0:x3 IEEE 802.1X: STA identity 'GRACELIA-4E4DD9\gracelia'Jan 1 00:17:42 (none) daemon.debug hostapd: ath1: RADIUS Sending RADIUS message to authentication serverJan 1 00:17:42 (none) daemon.debug hostapd: ath1: RADIUS Next RADIUS client retransmit in 3 seconds Jan 1 00:17:45 (none) daemon.debug hostapd: ath1: STA 00:80:x8:x1:x0:c3 RADIUS: Resending RADIUS message (id=28)Jan 1 00:17:45 (none) daemon.debug hostapd: ath1: RADIUS Next RADIUS client retransmit in 1 secondsJan 1 00:17:45 (none) daemon.debug setup.cgi[491]: cgi_setup::main()------------------>HTTP_REFERER=http://192.168.0.3/setup.cgi?reqfile=./html/left.htm if I try to bind to eth1 or IP-Address, the server not receipt any request. Here the client.conf setting # -*- text -*-#### clients.conf -- client configuration directives#### $Id$ ######################################################################### Define RADIUS clients (usually a NAS, Access Point, etc.). ## Defines a RADIUS client.## '127.0.0.1' is another name for 'localhost'. It is enabled by default,# to allow testing of the server after an initial installation. If you# are not going to be permitting RADIUS queries from localhost, we suggest# that you delete, or comment out, this entry.## ## Each client has a "short name" that is used to distinguish it from# other clients.## In version 1.x, the string after the word "client" was the IP# address of the client. In 2.0, the IP address is configured via# the "ipaddr" or "ipv6addr" fields. For compatibility, the 1.x# format is still accepted.#client localhost { # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) ipaddr = 192.168.1.4 # OR, you can use an IPv6 address, but not both # at the same time.# ipv6addr = :: # any. ::1 == localhost # # A note on DNS: We STRONGLY recommend using IP addresses # rather than host names. Using host names means that the # server will do DNS lookups when it starts, making it # dependent on DNS. i.e. If anything goes wrong with DNS, # the server won't start! # # The server also looks up the IP address from DNS once, and # only once, when it starts. If the DNS record is later # updated, the server WILL NOT see that update. # # One client definition can be applied to an entire network. # e.g. 127/8 should be defined with "ipaddr = 127.0.0.0" and # "netmask = 8" # # If not specified, the default netmask is 32 (i.e. /32) # # We do NOT recommend using anything other than 32. There # are usually other, better ways to acheive the same goal. # Using netmasks of other than 32 can cause security issues. # # You can specify overlapping networks (127/8 and 127.0/16) # In that case, the smallest possible network will be used # as the "best match" for the client. # # Clients can also be defined dynamically at run time, based # on any criteria. e.g. SQL lookups, keying off of NAS-Identifier, # etc. # See raddb/sites-available/dynamic-clients for details. # # netmask = 32 # # The shared secret use to "encrypt" and "sign" packets between # the NAS and FreeRADIUS. You MUST change this secret from the # default, otherwise it's not a secret any more! # # The secret can be any string, up to 8k characters in length. # # Control codes can be entered vi octal encoding, # e.g. "\101\102" == "AB" # Quotation marks can be entered by escaping them, # e.g. "foo\"bar" # # A note on security: The security of the RADIUS protocol # depends COMPLETELY on this secret! We recommend using a # shared secret that is composed of: # # upper case letters # lower case letters # numbers # # And is at LEAST 8 characters long, preferably 16 characters in # length. The secret MUST be random, and should not be words, # phrase, or anything else that is recognizable. # # The default secret below is only for testing, and should # not be used in any real environment. # secret = testing123 # # Old-style clients do not send a Message-Authenticator # in an Access-Request. RFC 5080 suggests that all clients # SHOULD include it in an Access-Request. The configuration # item below allows the server to require it. If a client # is required to include a Message-Authenticator and it does # not, then the packet will be silently discarded. # # allowed values: yes, no require_message_authenticator = no # # The short name is used as an alias for the fully qualified # domain name, or the IP address. # # It is accepted for compatibility with 1.x, but it is no # longer necessary in 2.0 ## shortname = localhost # # the following three fields are optional, but may be used by # checkrad.pl for simultaneous use checks # # # The nastype tells 'checkrad.pl' which NAS-specific method to # use to query the NAS for simultaneous use. # # Permitted NAS types are: # # cisco # computone # livingston # max40xx # multitech # netserver # pathras # patton # portslave # tc # usrhiper # other # for all other types # nastype = other # localhost isn't usually a NAS... # # The following two configurations are for future use. # The 'naspasswd' file is currently used to store the NAS # login name and password, which is used by checkrad.pl # when querying the NAS for simultaneous use. ## login = !root# password = someadminpas # # As of 2.0, clients can also be tied to a virtual server. # This is done by setting the "virtual_server" configuration # item, as in the example below. ## virtual_server = home1} # IPv6 Client#client ::1 {# secret = testing123# shortname = localhost#}## All IPv6 Site-local clients#client fe80::/16 {# secret = testing123# shortname = localhost#} #client some.host.org {# secret = testing123# shortname = localhost#} ## You can now specify one secret for a network of clients.# When a client request comes in, the BEST match is chosen.# i.e. The entry from the smallest possible network.#client 192.168.0.0/24 { secret = testing123-1 shortname = private-network-1}##client 192.168.0.0/16 {# secret = testing123-2# shortname = private-network-2#} #client 10.10.10.10 {# # secret and password are mapped through the "secrets" file.# secret = testing123# shortname = liv1# # the following three fields are optional, but may be used by# # checkrad.pl for simultaneous usage checks# nastype = livingston# login = !root# password = someadminpas#} ######################################################################### Per-socket client lists. The configuration entries are exactly# the same as above, but they are nested inside of a section.## You can have as many per-socket client lists as you have "listen"# sections, or you can re-use a list among multiple "listen" sections.## Un-comment this section, and edit a "listen" section to add:# "clients = per_socket_clients". That IP address/port combination# will then accept ONLY the clients listed in this section.##clients per_socket_clients {# client 192.168.3.4 {# secret = testing123# }#} Am I wrongly configured in client.conf hence NAS-port = 0. _________________________________________________________________ Looking for a new home? With all the latest places, searching has never been easier. http://clk.atdmt.com/NMN/go/157631292/direct/01/

2 1

(no subject)
by Richie Lee 03 Apr '10

03 Apr '10

http://pylydywijekovy.ucoz.ua _________________________________________________________________ Hotmail & Messenger are available on your phone. Try now. http://go.microsoft.com/?linkid=9724461

1 0

Using Vendor Attributes
by Paul Varvel 02 Apr '10

02 Apr '10

Hi everybody, I'm beginner with FreeRadius and I'd like to know where can I use a vendor specific attribute for my Redback router (in which configuration file). The dictionary is in /usr/share/freeradius/dictionary.redback and loaded when FreeRadius starts. When is try to use Context-Name = "local" (a specific redback attribute) in my user configuration file. I obtain a Syntax error message. You'll find an example of Access Request from the router : Packet number 1 has just been sniffed From: 10.192.5.80:1812 To: 10.192.5.89:1812 Type: Access-Request User-Name = "00:0c:29:0e:79:dd" User-Password = "\002\251\374-f\211\204\232\232C\350\t%\362S\233" Service-Type = Dialout-Framed-User NAS-Identifier = "SE800" NAS-Port = 235077632 NAS-Real-Port = 3808428132 NAS-Port-Type = Virtual NAS-Port-Id = "" Medium-Type = DSL Mac-Addr = "00-0c-29-0e-79-dd" Platform-Type = SmartEdge-800 OS-Version = "6.2.1.2" Agent-Circuit-Id = "01" Vendor-Specific = 0x00000de901144f4e542d31332d312d313a313530303a3031 Redback-Attr-202 = 0x3d3d0701000c290e79dd Redback-Attr-202 = 0x0c0c0466747468 Redback-Attr-125 = 0x4d53465420352e30 In one word, we'd like to know where include VSAs and how to use it. Many thanks for your help. Regards

3 4

NAS-IP vs srcIP
by Marlon Duksa 01 Apr '10

01 Apr '10

Hi everyone - Can anyone think of a reason why the NAS-IP and the scr-IP of the access-req packet should not be the same? If the NAS-IP is configurable in the NAS, then the NAS-IP can be set to the IP address other than the src-ip of the NAS that is used in reqular FreeRadius accounting/authorization packets. The source IP address of the NAS is normally the native interface address from which access-req was sent (but it can be configurable). The NAS-IP would be used to address NAS in CoA requests sent from the FreeRadius. We need this behavior to address certain deployment requirements. for example: IP prot: srcIP: 1.1.1.1 dstIP: 2.2.2.2 Radius prot: code: access-request (1) AVPs: NAS-IP-Address: 3.3.3.3 scrIP != NAS-IP-Address Thanks, Marlon

6 5

Freeradius + PEAP.. stuck on validating identity..
by Bruno Kremel 01 Apr '10

01 Apr '10

Hi, I have freeradius for WPA2 Enterprise authentification in small network in library, it is stable version (2.0.4) on Debian Lenny compiled from sources with OpenSSL support.. Everything seems to be OK, but when I try to connect to AP from laptop with Windows XP after I enter name and password I am stuck on Validating identity, same on Ubuntu machine... My configuration is pretty much default except of enabling MySQL and setting paths and passwords to certificates (generated with make script in /etc/freeradius/certs, so they should be OK) and addresses of clients. This is what freeradius -X gives me when I try to connect to AP: Ready to process requests. rad_recv: Access-Request packet from host 192.168.3.1 port 1291, id=0, length=123 User-Name = "pokus" NAS-IP-Address = 192.168.3.1 Called-Station-Id = "00259c523046" Calling-Station-Id = "001e650eb532" NAS-Identifier = "00259c523046" NAS-Port = 9 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a01706f6b7573 Message-Authenticator = 0x634f3b088572fda3a12eca56ed6035b9 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "pokus", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> pokus rlm_sql (sql): sql_set_user escaped user --> 'pokus' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'pokus' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'pokus' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'pokus' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [pokus/<via Auth-Type = Accept>] (from client router port 9 cli 001e650eb532) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.3.1 port 1291 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +59 Ready to process requests. To me it seems that name/password was accepted so I have no clue where is the problem.. Thank you in advance for any help..

3 11

WPA2 802.1X PEAPv0/EAP-MSCHAPv2
by Ryan A. Krenzischek 01 Apr '10

01 Apr '10

Greetings! I am at a road block here. I know setting up WPA2 Enterprise PEAPv0/EAP-MSCHAPv2 / 802.1X should be simple. It just isn't working! Perhaps I am suffering from green screen syndrome :) I have followed directions from: http://tldp.org/HOWTO/html_single/8021X-HOWTO/ Aside from mschap being in the <etcdir>/raddb/modules directory and needing to enable mppe, the instructions are fairly straight forward. The certificates are generated from our certificate store. I'm trying a less complicated set up before moving on to OpenLDAP/Kerberos. During the build process, I made sure that OpenSSL was available. LDD shows that it is linked: # ldd /usr/local/sbin/radiusd /usr/local/sbin/radiusd: libfreeradius-radius-2.1.8.so => /usr/local/lib/freeradius-2.1.8/libfreeradius-radius-2.1.8.so (0x280b3000) libcrypt.so.2 => /lib/libcrypt.so.2 (0x280d5000) libltdl.so.7 => /usr/local/lib/libltdl.so.7 (0x280ed000) libssl.so.5 => /usr/local/lib/libssl.so.5 (0x280f7000) libcrypto.so.5 => /usr/local/lib/libcrypto.so.5 (0x2813e000) libpthread.so.1 => /usr/lib/libpthread.so.1 (0x282af000) libc.so.5 => /lib/libc.so.5 (0x282d3000) libz.so.2 => /lib/libz.so.2 (0x283ad000) The client computers are laptops running OpenSUSE 11.2 x86_64. Knetworkmanager is being used to configure the wireless security. the settings are: Security: WPA/WPA2 Enterprise Authentication: Protected EAP (PEAP) Anonymous Identity: <blank> CA Certificate: /etc/ssl/certs/ca.pem PEAP Version: Version 0 Inner Authentication: MSCHAPv2 Username: billgates Password: 98502 The "users" file contains: billgates User-Password := "98502" What I get on the test laptop in wpa_supplicant: Associated with 00:00:00:c0:ff:ee CTRL-EVENT-EAP-STARTED EAP Authentication started OpenSSL: tls_connection_ca_cert - Failed to parse ca_cert_blob error:0D0680A8:ASN1 encoding routines: ASN1_CHECK_TLEN:wrong tag openSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error TLS: Failed to set TLS connection parameters EAP-PEAP: Failed to initialize SSL. EAP: Failed to initialize EAP method: vendor 0 method 25 (PEAP) CTRL-EVENT-DISCONNECTED - Disconnect Event - Remove keys (this is repeated in the log several times) Debug Output: FreeRADIUS Version 2.1.8 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket main { user = "freeradius" group = "freeradius" allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib/freeradius-2.1.8" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/CA/private/radius.pem" certificate_file = "/usr/local/etc/CA/certs/radius.pem" CA_file = "/usr/local/etc/CA/cacert.pem" private_key_password = "1337" dh_file = "/usr/local/etc/CA/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/CA/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 clients = "per_socket_clients" client 1.2.3.4 { require_message_authenticator = no secret = "n0t4u2c" shortname = "WLAN" } } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Ready to process requests. rad_recv: Access-Request packet from host 1.2.3.4 port 1812, id=156, length=86 User-Name = "billgates" NAS-IP-Address = 1.2.3.4 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "01-23-45-67-89-AB" EAP-Message = 0x02770009017279616e Message-Authenticator = 0x124bad1be78335e5345ac1235dd5a0f2 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "billgates", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 119 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry billgates at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 156 to 1.2.3.4 port 1812 EAP-Message = 0x017800061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80109fb1806886dec5fe36c0b7659309 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 1.2.3.4 port 1812, id=157, length=101 User-Name = "billgates" NAS-IP-Address = 1.2.3.4 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "01-23-45-67-89-AB" State = 0x80109fb1806886dec5fe36c0b7659309 EAP-Message = 0x027800060300 Message-Authenticator = 0x5acdbbd8d404e0ff100969933c8254b3 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "billgates", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 120 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry billgates at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for bad type 0 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> billgates attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 157 to 1.2.3.4 port 1812 EAP-Message = 0x04780004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 2 ID 156 with timestamp +74 Waking up in 0.9 seconds. Cleaning up request 3 ID 157 with timestamp +74 Ready to process requests. TIA, Ryan

2 1