January 2011 - Freeradius-Users - lists.freeradius.org

force_check_config - how to use?
by William Bulley 19 Jan '11

19 Jan '11

About twenty months ago, a commit to src/main/modules.c occurred with the following comment: Allow administrators to force_check_config There is a check inside find_module_instance() in that file for a value pair of that name with a value of "yes": cp = cf_pair_find(cs, "force_check_config"); if (cp) value = cf_pair_value(cp); if (value && (strcmp(value, "yes") == 0)) goto print_inst; cf_log_module(cs, "Skipping instantiation of %s", instname); The use of force_check_config doesn't seem to be documented anywhere. The only hits on Google are from the above commit. I have seached back three years on this list for the string force_check_config to no avail. I assume I need to have a force_check_config value pair with a value of "yes" somewhere in the request, but I don't know how to make that happen. Any pointers would be appreciated. Thanks. Regards, web... -- William Bulley Email: web(a)umich.edu 72 characters width template ----------------------------------------->|

2 1

Problem with iPods/iTouches
by Rob Yamry 19 Jan '11

19 Jan '11

We have a stangle problem going on with the Apple iTouches in the district here. This started since they were upgraded to iOS v.4.x....so it seems. What is happening is that the user will put in their credentials and get prompted to accept the certificate as it says its untrusted. The user clicks accept, all looks good and then it says it failed to connected. So they hit dismiss on that message, click join again, accept the certificate again and then they are accepted onto the network. But, sometimes they have to hit Dismiss/Join up to 15-20 times until it will accept it. Right now I am working with a default install FreeRadius v2.1.8 for testing this, including default certificates. I was planning on slowly adding in my config to narrow it down, but the problem appears to be happening by default. I *thought* that setting the default_eap_type to peap was causing it, but I had it happen when it was set to md5 as well. Im working on a iPod Touch with iOS v4.2. Below is the debug output of a failed attempt, and the follow up attempt that put the user through. *********************** FAILED ATTEMPT *************************** Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, length=277 User-Name = "ktest5" NAS-IP-Address = 127.0.4.1 NAS-Port = 259 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "58:b0:35:28:19:ad" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "KASD_TEST" Service-Type = Framed-User Vendor-4329-Attr-3 = 0x3035303030313031343330353233 > > 3035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x0200000b016b7465737435 > Message-Authenticator = 0x32cf9f891633152f0f139a53cb61f9ee > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 0 length 11 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[unix] returns notfound > ++[files] returns noop > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type tls > [tls] Initiate > [tls] Start returned 1 > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = 0x010100061920 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xc4b1fdf8c4b0e4f9163ffe27c4915746 > Finished request 0. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=420 > Cleaning up request 0 ID 66 with timestamp +30 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = > 0x0201008819800000007e16030100790100007503014d2e0343e5f920d1f519dbfeac002febc3736014d9bee7e0c55fd8085b99b7af00003ac00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a0009000300080033003900160015001401000012000a00080006001700180019000b00020100 > State = 0xc4b1fdf8c4b0e4f9163ffe27c4915746 > Message-Authenticator = 0xf4e7c59223ecd3e5741cc6cc48762e1f > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 1 length 136 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > TLS Length 126 > [peap] Length Included > [peap] eaptls_verify returned 11 > [peap] (other): before/accept initialization > [peap] TLS_accept: before/accept initialization > [peap] <<< TLS 1.0 Handshake [length 0079], ClientHello > [peap] TLS_accept: SSLv3 read client hello A > [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello > [peap] TLS_accept: SSLv3 write server hello A > [peap] >>> TLS 1.0 Handshake [length 085e], Certificate > [peap] TLS_accept: SSLv3 write certificate A > [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone > [peap] TLS_accept: SSLv3 write server done A > [peap] TLS_accept: SSLv3 flush data > [peap] TLS_accept: Need to read more data: SSLv3 read client > certificate A > In SSL Handshake Phase > In SSL Accept mode > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x0102040019c00000089b160301002a0200002603014d2e0330bf07fe39f7236a619358e64fa3db011bcbda7c9b9584846f6e32102000002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 > EAP-Message = > 0x301e170d3131303131323138353335325a170d3132303131323138353335325a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100e8460af12ab26451d71f5f5853ac201a8dee4f3c17d2f6c4725f4c9cc44fc6ae87c1b32d3e62fcd1964c8b1f81044272b76dbaa079cbd3dd727461dfd7a5 > EAP-Message = > 0x8b623cc4e0c8beccafbc499fc74e8d17e3c9fbd9aafbac061bfa1309372c83e95c8dd5da071d7d97fdd7660ab45c93db04d72184885f895897d840ac4934c11f51c81c4d2e83dccf646b499739781cdff243a48f064e209bef2d2bcde936c6104b63ee467f448d005c127b83bfa708aeed69f1467d3b280a4f1b151d153ce7216ea94c2e33fe400de92d84b823c5b32828959b9ea5b8afbc063ba5db0cabb0b602fdf90e60c354b8e788facfc654ff2310ea763297ea1aef098b4ddb5466abb528910203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100904c9828165a2de337 > EAP-Message = > 0x50191a87ef600b1584376573598f31e772c944faf6e61c383d477c201b0aa6cf8bcb49d8b416f2de1e84774a9423608aad94af078dad2b6b30979d1c6b58cd8eefa9cf827d27f7755f8030dbc7c9e230187f212a5d4400928da0cc2845a7b5048a3b7425818fb437ac9c33746b39aaf4aa49af51340496250c837496f449307860f6cae9bd224c557af44806b46ac837b12a149124e35da9bde2538d9f39c2c33fe33dc7df0d45c5bec5bda68294a994af2db4f7298cf47e680cbca4789791aa3048a17761e4c71ebbd9b82bd324af0dbe8ce26ae88ee8a5d16dbd6685dce7ecb7af820abf975c67bfd34797fbefa47a4eed95cca895860004ab308204 > EAP-Message = 0xa73082038fa0030201020209 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xc4b1fdf8c5b3e4f9163ffe27c4915746 > Finished request 1. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 1 ID 66 with timestamp +30 > Ready to process requests. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=290 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x020200061900 > State = 0xc4b1fdf8c5b3e4f9163ffe27c4915746 > Message-Authenticator = 0xa5c69d05dee0560c68b7d67d25b2e0b1 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 2 length 6 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] Received TLS ACK > [peap] ACK handshake fragment handler > [peap] eaptls_verify returned 1 > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x010303fc194000ae0fc87b0b841be2300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3131303131323138353335315a170d3132303131323138353335315a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 > EAP-Message = > 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d73060bc3e4f3bacd8c526ff5efa081cbfd333963c0a90272e83d654b8d1a16a25c9e1358b347d3f91d49ed29d387fd6de5ba5fe18c43b48065e8f1bb9dcb22d1a8679925af0bdc049d32199ba543f1d40a7c6b3578892efcaea646bdde6442593b17cb4713fb4d6f0616a5db38d9b > EAP-Message = > 0xfd1d6e9dd30b6e536ba717a75adaa7c87fd019e83bea06f5eacb6a09fa9954b60ccc92116455610a2674a03a4ecacee05ce914a72a27965d55471df19c8751fdb69fe66426bb236f7d57cfffe41822e7d8ddfc6c1c8f5b45e6010c896918c4f111626979b280ddf2219099024cb0efb17c9660df9fc642edc9874074cb83e93349b19a2c16409b7444545ee27b2a52bb9d0203010001a381fb3081f8301d0603551d0e04160414872c00a6ed850850f4e202b4d86a1d663b35fd8e3081c80603551d230481c03081bd8014872c00a6ed850850f4e202b4d86a1d663b35fd8ea18199a48196308193310b3009060355040613024652310f300d06035504 > EAP-Message = > 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900ae0fc87b0b841be2300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100a5c0c601e1cb4606aa986dc240b7488bb4afd8c0e81ba0361530d556ad117222cdcc5a57a13fe3eb073ca72dff40db0a58c8d835ec110485bd158ab6cd1d8583cd575710b49070b3794384d2cff45f22b81e > EAP-Message = 0x2dc327be959645c8 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xc4b1fdf8c6b2e4f9163ffe27c4915746 > Finished request 2. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=290 > Cleaning up request 2 ID 66 with timestamp +39 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x020300061900 > State = 0xc4b1fdf8c6b2e4f9163ffe27c4915746 > Message-Authenticator = 0x834956d460493056f00e0117298d68d7 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 3 length 6 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] Received TLS ACK > [peap] ACK handshake fragment handler > [peap] eaptls_verify returned 1 > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x010400b51900387bb57f237040a0b009495fcb1c4460694c6214f871d93a5afddfcc7aa7727e9ce657d22551e936e9415eea3a0ce78a7ea4b121f711fc19e2b505b4fa004bcc2952effdc18d0cd1ec6fe10bf431e8a189a5cbefcaebd9beab4e75c2309b55de25a9e392112915ad1c7b866a902f091b366eb96e7aa6ab544889069e70fda7ad8a9ec9eb729a6db3aeeb3ca9965daf0d515783a89a0947b6004eaad452777ae3413772aa2f5f16030100040e000000 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xc4b1fdf8c7b5e4f9163ffe27c4915746 > Finished request 3. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=622 > Cleaning up request 3 ID 66 with timestamp +39 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = > 0x020401501980000001461603010106100001020100373aae08036c5c081766d84efb8b257d7a9840bd2d91f9fbb1bad0c23993b1becc777b0890f6c8eb6b9ad515a2a5436dd50ea6feaeb8d0e9d3b7142af44ef0a0d52004a50e4b3022e3c2752cbc9caff85cbbd8281543a4a2c1b8a9a9141dd4430cafb7375f8d1a299c321a10edf205010f828f80cb188855d7888ef33d2c14d9bbc52bb23e99e2570ec2be2e6896f918c61926fbfc21009af339abbf671c483c897e7f5a9614f7ffd003d126edeebb752e3af6f8dc63a10a314fb5d105124ce25332a68c7b6aee6bebcf5eb9aa3a3853cdb0ecef655a78107a86ce327d51d84fb858490131e5c8 > EAP-Message = > 0x4fdfa622a41c66fd40edceb1c3cc99f33a0591a75a1c419d681403010001011603010030183a1d1ce2e805a60d16d91940d4b659bc1ecda540c675ea25f530b5c3ebe4114d5553609074df1351384da76ab4f78a > State = 0xc4b1fdf8c7b5e4f9163ffe27c4915746 > Message-Authenticator = 0xef9d2df3d5a31b39f3ddf68d687d6b5c > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 4 length 252 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > TLS Length 326 > [peap] Length Included > [peap] eaptls_verify returned 11 > [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange > [peap] TLS_accept: SSLv3 read client key exchange A > [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] > [peap] <<< TLS 1.0 Handshake [length 0010], Finished > [peap] TLS_accept: SSLv3 read finished A > [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] > [peap] TLS_accept: SSLv3 write change cipher spec A > [peap] >>> TLS 1.0 Handshake [length 0010], Finished > [peap] TLS_accept: SSLv3 write finished A > [peap] TLS_accept: SSLv3 flush data > [peap] (other): SSL negotiation finished successfully > SSL Connection Established > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x0105004119001403010001011603010030c5ca03d2a20ef23d2e6375c8153c3e6c1afa2151b0232004998802bece4070cb14b8a1bffac3874c849f89a1f8450de2 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xc4b1fdf8c0b4e4f9163ffe27c4915746 > Finished request 4. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=277 > Cleaning up request 4 ID 66 with timestamp +39 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x0206000b016b7465737435 > Message-Authenticator = 0x7667edddd0b6ae7ddec276f6fc0d09fd > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 6 length 11 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[unix] returns notfound > ++[files] returns noop > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type tls > [tls] Initiate > [tls] Start returned 1 > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = 0x010700061920 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x8791eff18796f6b55a0a76adc31036d5 > Finished request 5. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=420 > Cleaning up request 5 ID 66 with timestamp +42 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = > 0x0207008819800000007e16030100790100007503014d2e034fe43eb22c54e9c30587e009b69a0a7712664fc62b7754d5321207a9e700003ac00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a0009000300080033003900160015001401000012000a00080006001700180019000b00020100 > State = 0x8791eff18796f6b55a0a76adc31036d5 > Message-Authenticator = 0xdd954eaa01deac01b7a9d0973e934401 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 7 length 136 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > TLS Length 126 > [peap] Length Included > [peap] eaptls_verify returned 11 > [peap] (other): before/accept initialization > [peap] TLS_accept: before/accept initialization > [peap] <<< TLS 1.0 Handshake [length 0079], ClientHello > [peap] TLS_accept: SSLv3 read client hello A > [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello > [peap] TLS_accept: SSLv3 write server hello A > [peap] >>> TLS 1.0 Handshake [length 085e], Certificate > [peap] TLS_accept: SSLv3 write certificate A > [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone > [peap] TLS_accept: SSLv3 write server done A > [peap] TLS_accept: SSLv3 flush data > [peap] TLS_accept: Need to read more data: SSLv3 read client > certificate A > In SSL Handshake Phase > In SSL Accept mode > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x0108040019c00000089b160301002a0200002603014d2e033cabdd48cf6a4f062f86f5947a33952f7547e4871741c1b81a7c7ae51e00002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 > EAP-Message = > 0x301e170d3131303131323138353335325a170d3132303131323138353335325a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100e8460af12ab26451d71f5f5853ac201a8dee4f3c17d2f6c4725f4c9cc44fc6ae87c1b32d3e62fcd1964c8b1f81044272b76dbaa079cbd3dd727461dfd7a5 > EAP-Message = > 0x8b623cc4e0c8beccafbc499fc74e8d17e3c9fbd9aafbac061bfa1309372c83e95c8dd5da071d7d97fdd7660ab45c93db04d72184885f895897d840ac4934c11f51c81c4d2e83dccf646b499739781cdff243a48f064e209bef2d2bcde936c6104b63ee467f448d005c127b83bfa708aeed69f1467d3b280a4f1b151d153ce7216ea94c2e33fe400de92d84b823c5b32828959b9ea5b8afbc063ba5db0cabb0b602fdf90e60c354b8e788facfc654ff2310ea763297ea1aef098b4ddb5466abb528910203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100904c9828165a2de337 > EAP-Message = > 0x50191a87ef600b1584376573598f31e772c944faf6e61c383d477c201b0aa6cf8bcb49d8b416f2de1e84774a9423608aad94af078dad2b6b30979d1c6b58cd8eefa9cf827d27f7755f8030dbc7c9e230187f212a5d4400928da0cc2845a7b5048a3b7425818fb437ac9c33746b39aaf4aa49af51340496250c837496f449307860f6cae9bd224c557af44806b46ac837b12a149124e35da9bde2538d9f39c2c33fe33dc7df0d45c5bec5bda68294a994af2db4f7298cf47e680cbca4789791aa3048a17761e4c71ebbd9b82bd324af0dbe8ce26ae88ee8a5d16dbd6685dce7ecb7af820abf975c67bfd34797fbefa47a4eed95cca895860004ab308204 > EAP-Message = 0xa73082038fa0030201020209 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x8791eff18699f6b55a0a76adc31036d5 > Finished request 6. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=290 > Cleaning up request 6 ID 66 with timestamp +42 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x020800061900 > State = 0x8791eff18699f6b55a0a76adc31036d5 > Message-Authenticator = 0x806cd522495a9dea0f1b63c2c7612616 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 8 length 6 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] Received TLS ACK > [peap] ACK handshake fragment handler > [peap] eaptls_verify returned 1 > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x010903fc194000ae0fc87b0b841be2300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3131303131323138353335315a170d3132303131323138353335315a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 > EAP-Message = > 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d73060bc3e4f3bacd8c526ff5efa081cbfd333963c0a90272e83d654b8d1a16a25c9e1358b347d3f91d49ed29d387fd6de5ba5fe18c43b48065e8f1bb9dcb22d1a8679925af0bdc049d32199ba543f1d40a7c6b3578892efcaea646bdde6442593b17cb4713fb4d6f0616a5db38d9b > EAP-Message = > 0xfd1d6e9dd30b6e536ba717a75adaa7c87fd019e83bea06f5eacb6a09fa9954b60ccc92116455610a2674a03a4ecacee05ce914a72a27965d55471df19c8751fdb69fe66426bb236f7d57cfffe41822e7d8ddfc6c1c8f5b45e6010c896918c4f111626979b280ddf2219099024cb0efb17c9660df9fc642edc9874074cb83e93349b19a2c16409b7444545ee27b2a52bb9d0203010001a381fb3081f8301d0603551d0e04160414872c00a6ed850850f4e202b4d86a1d663b35fd8e3081c80603551d230481c03081bd8014872c00a6ed850850f4e202b4d86a1d663b35fd8ea18199a48196308193310b3009060355040613024652310f300d06035504 > EAP-Message = > 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900ae0fc87b0b841be2300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100a5c0c601e1cb4606aa986dc240b7488bb4afd8c0e81ba0361530d556ad117222cdcc5a57a13fe3eb073ca72dff40db0a58c8d835ec110485bd158ab6cd1d8583cd575710b49070b3794384d2cff45f22b81e > EAP-Message = 0x2dc327be959645c8 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x8791eff18598f6b55a0a76adc31036d5 > Finished request 7. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=290 > Cleaning up request 7 ID 66 with timestamp +43 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x020900061900 > State = 0x8791eff18598f6b55a0a76adc31036d5 > Message-Authenticator = 0xf2ec741c480f9339eaa13537cadc59e4 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 9 length 6 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] Received TLS ACK > [peap] ACK handshake fragment handler > [peap] eaptls_verify returned 1 > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x010a00b51900387bb57f237040a0b009495fcb1c4460694c6214f871d93a5afddfcc7aa7727e9ce657d22551e936e9415eea3a0ce78a7ea4b121f711fc19e2b505b4fa004bcc2952effdc18d0cd1ec6fe10bf431e8a189a5cbefcaebd9beab4e75c2309b55de25a9e392112915ad1c7b866a902f091b366eb96e7aa6ab544889069e70fda7ad8a9ec9eb729a6db3aeeb3ca9965daf0d515783a89a0947b6004eaad452777ae3413772aa2f5f16030100040e000000 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x8791eff1849bf6b55a0a76adc31036d5 > Finished request 8. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 8 ID 66 with timestamp +43 > Ready to process requests. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=277 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = 0x0201000b016b7465737435 > Message-Authenticator = 0xacd1f25254d19ef7ef878a3a79e240be > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 1 length 11 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[unix] returns notfound > ++[files] returns noop > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type tls > [tls] Initiate > [tls] Start returned 1 > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = 0x010200061920 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x119bd5731199cc528cc4c05b9703cffa > Finished request 9. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.1.1.1 port 38428, id=66, > length=420 > Cleaning up request 9 ID 66 with timestamp +48 > User-Name = "ktest5" > NAS-IP-Address = 127.0.4.1 > NAS-Port = 259 > Framed-MTU = 1400 > Called-Station-Id = "00:1f:45:7f:83:fa" > Calling-Station-Id = "58:b0:35:28:19:ad" > NAS-Port-Type = Wireless-802.11 > NAS-Identifier = "KASD_TEST" > Service-Type = Framed-User > Vendor-4329-Attr-3 = 0x30353030303130313433303532333035 > Vendor-4329-Attr-2 = 0x4a52472d31464c2d41503039 > Vendor-4329-Attr-4 = 0x4b4153445f54455354 > Vendor-4329-Attr-5 = 0x4b4153445f54455354 > Vendor-4329-Attr-6 = 0x30303a31663a34353a37663a38333a6661 > Vendor-4329-Attr-7 = 0x53747564656e7473 > Vendor-4329-Attr-8 = 0x4b41534453747564656e7473 > EAP-Message = > 0x0202008819800000007e16030100790100007503014d2e0355d881daaa7bc48ab53b8cbf1877d5045d28d27e8bc56439c8160f2d2e00003ac00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a0009000300080033003900160015001401000012000a00080006001700180019000b00020100 > State = 0x119bd5731199cc528cc4c05b9703cffa > Message-Authenticator = 0x502685c6634bcf13076884276d720178 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "ktest5", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 2 length 136 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > TLS Length 126 > [peap] Length Included > [peap] eaptls_verify returned 11 > [peap] (other): before/accept initialization > [peap] TLS_accept: before/accept initialization > [peap] <<< TLS 1.0 Handshake [length 0079], ClientHello > [peap] TLS_accept: SSLv3 read client hello A > [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello > [peap] TLS_accept: SSLv3 write server hello A > [peap] >>> TLS 1.0 Handshake [length 085e], Certificate > [peap] TLS_accept: SSLv3 write certificate A > [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone > [peap] TLS_accept: SSLv3 write server done A > [peap] TLS_accept: SSLv3 flush data > [peap] TLS_accept: Need to read more data: SSLv3 read client > certificate A > In SSL Handshake Phase > In SSL Accept mode > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 66 to 10.1.1.1 port 38428 > EAP-Message = > 0x0103040019c00000089b160301002a0200002603014d2e0342163fcd54d6877c34fe6b48bf4ada483c9daaeb893988fd2bdc1ee46300002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 > EAP-Message = > 0x301e170d3131303131323138353335325a170d3132303131323138353335325a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100e8460af12ab26451d71f5f5853ac201a8dee4f3c17d2f6c4725f4c9cc44fc6ae87c1b32d3e62fcd1964c8b1f81044272b76dbaa079cbd3dd727461dfd7a5 > EAP-Message = > 0x8b623cc4e0c8beccafbc499fc74e8d17e3c9fbd9aafbac061bfa1309372c83e95c8dd5da071d7d97fdd7660ab45c93db04d72184885f895897d840ac4934c11f51c81c4d2e83dccf646b499739781cdff243a48f064e209bef2d2bcde936c6104b63ee467f448d005c127b83bfa708aeed69f1467d3b280a4f1b151d153ce7216ea94c2e33fe400de92d84b823c5b32828959b9ea5b8afbc063ba5db0cabb0b602fdf90e60c354b8e788facfc654ff2310ea763297ea1aef098b4ddb5466abb528910203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100904c9828165a2de337 > EAP-Message = > 0x50191a87ef600b1584376573598f31e772c944faf6e61c383d477c201b0aa6cf8bcb49d8b416f2de1e84774a9423608aad94af078dad2b6b30979d1c6b58cd8eefa9cf827d27f7755f8030dbc7c9e230187f212a5d4400928da0cc2845a7b5048a3b7425818fb437ac9c33746b39aaf4aa49af51340496250c837496f449307860f6cae9bd224c557af44806b46ac837b12a149124e35da9bde2538d9f39c2c33fe33dc7df0d45c5bec5bda68294a994af2db4f7298cf47e680cbca4789791aa3048a17761e4c71ebbd9b82bd324af0dbe8ce26ae88ee8a5d16dbd6685dce7ecb7af820abf975c67bfd34797fbefa47a4eed95cca895860004ab308204 > EAP-Message = 0xa73082038fa0030201020209 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x119bd5731098cc528cc4c05b9703cffa > Finished request 10. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 10 ID 66 with timestamp +48 > Ready to process requests.

5 10

Help needed with user authentication
by Luke Hammond 19 Jan '11

19 Jan '11

Hey, i am new so sorry that i know nothing about Freeradius. Basically, i found a tutorial and followed it to get Freeradius2, Mysql and Daloradius working together.. that part is ok. But i am confused with this: I want to have a wireless network, that will be open, and when a user connects and tries to browse they get redirected to a page where they have to login, and that will talk to freeradius to make sure the user is authorised, then it will accept them and continue to where they were trying to browse to.. Thats basically what i need, but how does Freeradius do that? Where is that page so i can edit it with my logo or whatever? Or do i need more software to have that login page? Please assist, am desperate here to get this working.. thanks in advance!

3 3

Spaces in the end of User-Name.
by admin 19 Jan '11

19 Jan '11

Hi! What i must to specify in a config file of freeradius2 that in each request before its further handling it automatically deleted spaces in the end of %{User-Name}? The parameter nospace_user doesn't work. Not to start up users with spaces in username doesn't approach.

3 6

Request information for EAP TTLS
by Aman Arneja 19 Jan '11

19 Jan '11

> Hi > > I am new to Free Radius and was just wondering if some1 can help me out. I > am planning to implement an EAP TTLS client and was wondering the following > about Free Radius for my testing. > > 1.) Does Free Radius Implementation of EAP TTLS Support the following > > a.) Client auth during phase 1 > b.) Id privacy can be explicitly enabled or disables > c.) Allowing tunneled methods such as FAST, PEAP as inner methods > d.) Method chaining in phase 2 > > Thanx in advance for your help guys > > Aman Arneja > >

1 0

Proxying authentication from FreeRadius to Cisco ACS
by Erisan Nyamutenha 19 Jan '11

19 Jan '11

Hello All, I am setting up an Eduroam authentication server using FreeRadius 2.1.1 on Suse Linux 12. I am proxying authentication requests to a Cisco ACS. When testing using radtest from the FreeRadius box authentication is proxyed to ACS fine and i get an access-accept back. However when i try from a wireless client the proxy response from the ACS is an Access-Reject. In the failed attempts logs on the ACS it says bad username or password. i'm pretty sure im using the correct password. Is there any reason why this should not work? I've posted my logs below:- rad_recv: Access-Request packet from host 1.1.1.1 port 32768, id=210, length=255 User-Name = "username ( mailto:01420893@uct.ac.za )(a)xyz.ac.za" Calling-Station-Id = "00-1e-64-8f-f1-2a" Called-Station-Id = "08-17-35-32-f2-90:Eduroam" NAS-Port = 29 NAS-IP-Address = 1.1.1.1 NAS-Identifier = "uc-wism-2" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "63" EAP-Message = 0x02a0002b190017030100204673d48ae9e9d21afa7fe1fd6cae4d95841ae136e4fe85ad44acd3a4d0228a69 State = 0x4541503d302e66666666666666662e63666337302e373b5356433d302e31363139623b Message-Authenticator = 0xaab2e06ffb5753411ad8d42b71cafbdd +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "xyz.ac.za" for User-Name = "username(a)xyz.ac.za" [suffix] Found realm "xyz.ac.za" [suffix] Adding Stripped-User-Name = "username" [suffix] Adding Realm = "xyz.ac.za" [suffix] Proxying request from user username to realm xyz.ac.za [suffix] Preparing to proxy authentication request to realm "xyz.ac.za" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm xyz.ac.za. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Sending Access-Request of id 81 to 2.2.2.2 port 1812 User-Name = "username" Calling-Station-Id = "00-1e-64-8f-f1-2a" Called-Station-Id = "08-17-35-32-f2-90:Eduroam" NAS-Port = 29 NAS-IP-Address = 1.1.1.1 NAS-Identifier = "uc-wism-2" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "63" EAP-Message = 0x02a0002b190017030100204673d48ae9e9d21afa7fe1fd6cae4d95841ae136e4fe85ad44acd3a4d0228a69 State = 0x4541503d302e66666666666666662e63666337302e373b5356433d302e31363139623b Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x323130 Proxying request 8 to home server 2.2.2.2 port 1812 Sending Access-Request of id 81 to 2.2.2.2 port 1812 User-Name = "username" Calling-Station-Id = "00-1e-64-8f-f1-2a" Called-Station-Id = "08-17-35-32-f2-90:Eduroam" NAS-Port = 29 NAS-IP-Address = 1.1.1.1 NAS-Identifier = "uc-wism-2" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "63" EAP-Message = 0x02a0002b190017030100204673d48ae9e9d21afa7fe1fd6cae4d95841ae136e4fe85ad44acd3a4d0228a69 State = 0x4541503d302e66666666666666662e63666337302e373b5356433d302e31363139623b Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x323130 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Reject packet from host 2.2.2.2 port 1812, id=81, length=61 Proxy-State = 0x323130 EAP-Message = 0x04a00004 Reply-Message = "Rejected\n\r" Message-Authenticator = 0xbcede120e168d2d92558e5f4ab8e03d5 Thanks Erisan ### UNIVERSITY OF CAPE TOWN This e-mail is subject to the UCT ICT policies and e-mail disclaimer published on our website at http://www.uct.ac.za/about/policies/emaildisclaimer/ or obtainable from +27 21 650 9111. This e-mail is intended only for the person(s) to whom it is addressed. If the e-mail has reached you in error, please notify the author. If you are not the intended recipient of the e-mail you may not use, disclose, copy, redirect or print the content. If this e-mail is not related to the business of UCT it is sent by the sender in the sender's individual capacity. ###

4 3

Re: Storing of salt in freeradius
by Mark 19 Jan '11

19 Jan '11

Hi folks, Been trying to look for information on this but haven't been able to find anything, prompting me to turn to the mailing list for help. In the event of using salted md5 hashes for passwords, where exactly does one store the salt? There doesn't seem to be a place within the FR config to do that. Any advice would be much appreciated. Thanks in advance! Kind regards, Mark

4 7

Freeradius 2.1.10
by Samuel Isaias Barriga Perez 19 Jan '11

19 Jan '11

Hi to all freeradius users: I'm working on setting it up to authenticate users (windows XP) to our wireless network which I succesfully completed, when I run radiusd -X (debug) my output is as follow: rad_recv: Access-Request packet from host 172.16.x.x port 1029, id=13, length=229 Message-Authenticator = 0x8fc8a30cc4c74e50a1bab260971c63d1 Service-Type = Framed-User User-Name = "CAMINOSCA\\samuel.barriga" Framed-MTU = 1488 State = 0x37f6879135fb9ef39d433a1d3d148b7b Called-Station-Id = "00-1E-58-A3-C9-1C:FREERADIUS" Calling-Station-Id = "00-11-95-DF-71-29" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020d00061900 NAS-IP-Address = 172.16.x.x NAS-Port = 1 NAS-Port-Id = "STA port # 1" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default.original +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "CAMINOSCA\samuel.barriga", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 13 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default.original +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 13 to 172.16.3.8 port 1029 EAP-Message = 0x010e00061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x37f6879134f89ef39d433a1d3d148b7b Finished request 19. Going to the next request Waking up in 4.9 seconds. Cleaning up request 16 ID 10 with timestamp +252 Cleaning up request 17 ID 11 with timestamp +252 Cleaning up request 18 ID 12 with timestamp +252 Cleaning up request 19 ID 13 with timestamp +252 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x37f6879134f89ef3 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. I tried everything and according to the debug output this is what I am getting, and the wiki page said that I should check into the certificates, I erase the the clients certificates reinstalled and I have the same output, plese can some one give me a hand. Thank you Saludos cordiales, Samuel I. Barriga Dpto. Sistemas EMAIL: samuel.barriga(a)caminosca-sa.com Mariana de Jesús E7 -248 y La Pradera PBX:+ 593 2 2236759 Ext. 215 Fax: + 593 2 2564193 www.caminosca.com

2 1

Call for 2.1.11
by Alan DeKok 19 Jan '11

19 Jan '11

Anything else for 2.1.11? It's been 5 months since 2.1.10. I think the updfromto fixes should go in, if I can figure out how to make it work on Linux *and* other systems. Alan DeKok.

3 3

Machine Authentication and Active Directory group lookups
by Graham, Robert 18 Jan '11

18 Jan '11

Hello all, I have FreeRadius v 2.1.10 installed and configured to authenticate users against Active Directory using PEAP/MSChapV2 and perform Group membership lookups via the ldap module so that I can configure radius reply attributes to provide VLAN assignment and Dymanic ACL's. All is working extremely well, but one item that I would also like to get working is the Machine Authentication. Machine Authentication is working with the exception of the ldap group lookup. From what I can tell, when the machine authenticates, the ntlm_auth knows that the request is a Machine Authentication and appends the $ to the end of the username for the sAMAccountName: # Executing group from file /usr//etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [inner-eap] Request found, released from the list [inner-eap] EAP/mschapv2 [inner-eap] processing type mschapv2 [mschapv2] # Executing group from file /usr//etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: host/lab.XXXX.com [mschap] Told to do MS-CHAPv2 for host/lab.XXXX.XXX with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=lab$ [mschap] mschap2: 78 [mschap] Creating challenge hash with username: host/lab.XXXX.XXX [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=a9c34f78fae78fd0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=961d047adaedc84346d00fcd2a0a67139ff4a95c9e13ae61 Exec-Program output: NT_KEY: 65891DD9BE6290D3EEB54D8EB6612EFF Exec-Program-Wait: plaintext: NT_KEY: 65891DD9BE6290D3EEB54D8EB6612EFF Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success Since I am using: filter = "(&(sAMAccountName=%{mschap:User-Name}))" in the ldap module, FreeRadius is trying to do a group lookup on: lab$ which is not found in any Active Directory groups: # Executing section post-auth from file /usr//etc/raddb/sites-enabled/default +- entering group post-auth {...} [ldap] Entering ldap_groupcmp() [files] expand: ou=XXXX,dc=XXXX,dc=XXX -> ou=XXXX,dc=XXXX,dc=XXX [files] expand: (&(sAMAccountName=%{mschap:User-Name})) -> (&(sAMAccountName=lab$)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=XXXX,dc=XXXX,dc=XXX, with filter (&(sAMAccountName=lab$)) [ldap] object not found Is it possible to remove the "$" from the sAMAccountName in the LDAP module without breaking the User Authentication? Thanks Robert Graham

1 0