April 2011 - Freeradius-Users - lists.freeradius.org

associating mac addresses with usernames
by Stephen Vigus 10 Apr '11

10 Apr '11

Hi all First post to the list ;) I want to use both mac authentication and username authentication. I have both working fine separately from mysql, but I want associate certain mac addresses to certain usernames and have it authenticate with the username. I thought I could use the following to authenticate mac addresses: if("%{sql:SELECT radusergroup.username FROM authorized_macs LEFT JOIN radusergroup ON ( authorized_macs.username = radusergroup.username ) WHERE authorized_macs.macaddr = ''%{User-Name}'}" > 0){ ok } else{ reject } In mysql this query would display the username associated to the mac (eg, user1@realm1), although it seems freeradius does not like this. Can anyone point me in the right direction so freeradius would think its "user1@realm1" authenticating when it receives the mac address? thanks Stephen

2 3

how to radtest from another client
by 徐宇 09 Apr '11

09 Apr '11

I install freeradius in the server its ip is 192.168.1.1. In the server I have already do the radtest ,and the result is OK rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=11, length=20 I want to add a test authenticator host client. So I add something at the end of my clients.conf and assign a shared-secret. client 192.168.1.100 { secret = testing123 shortname = 192.168.1.100 } Should I do other things to finish it? I need to do the radtest in the client(192.168.1.100) right? But there isn't a radtest command in the client, Need I install some softwares in the client? thank you for your help ,best regards.

3 5

rlm_sql_unixodbc ?
by Jim Rice 08 Apr '11

08 Apr '11

Quick question: I am looking into adding an ACT! Plugin to populate the Radius MySQL database through unix ODBC. Found rlm_sql_unixodbc and wondered if this is already provided for this purpose, or something else? Looks like it needs to be run through "make"... (not installed by default). Otherwise, I can go through the steps for installing mysql-connector-odbc and friends. Thanks, Jim

4 11

Restrict access per NAS
by Sergio Belkin 08 Apr '11

08 Apr '11

Hi, Is there a way to restrict an LDAP user to be authorized only from an specific NAS (Access Point)? I'm using FreeRADIUS Version 2.1.1 Thanks in advance! -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com LPIC-2 Certified - http://www.lpi.org

2 1

PC XP SP2 with 802.1x/PEAP authenticate problem
by irena grubnic 08 Apr '11

08 Apr '11

Hi, maybe somebody can help me in my attempt to authenticate supplicant PC (WinXP SP2 with enabled 802.1x authentication using PEAP and Authentication Mehtod "Secured password EAP-MSCHAP v2") using Free RADIUS Version 2.1.10. RADIUS client is ONT (GPON, 802.1x enabled on it's Ethernet port). I have modified 3 RADIUS configuration files: *********** 1.eap.conf* *********** deafault_eap_type = peap *************** 2.clients.conf* *************** Added new client (PC is connected to ONT which further forwards requests to BLM acting as client). client 10.223.0.131 { ipaddr = 10.223.0.131 secret = hello123 require_message_authenticator = no nastype = other # localhost isn't usually a NAS... } Secret password "hello123" is also configured on related client (ONT): RADIUS proxy address | 100.1.1.1 RADIUS proxy secret | ont343 RADIUS auth server 1 | 10.223.0.13 RADIUS auth secret 1 | hello123 RADIUS auth port 1 | 1812 RADIUS auth server 2 | 0.0.0.0 RADIUS auth secret 2 | - RADIUS auth port 2 | 0 RADIUS auth server 3 | 0.0.0.0 RADIUS auth secret 3 | - RADIUS auth port 3 | 0 ******** 3.users* ******** Added new entry for PC using its MAC address for credentials: 00:02:a5:f8:70:29 Cleartext-Password := "00:02:a5:f8:70:29" When I try to authenticate PC by entering its MAC address as user name/password RADIUS Access-Reject message is generated by Free RADIUS and in debug window following output is obtained: rad_recv: Access-Request packet from host 10.223.0.131 port 65534, id=71, length=142 NAS-IP-Address = 100.1.1.1 NAS-Port-Id = "1.2" Framed-MTU = 1024 User-Name = "00-02-A5-F8-70-29" Calling-Station-Id = "00-02-A5-F8-70-29" Message-Authenticator = 0xe990ef46d4eaddc9760eff3924f3613e EAP-Message = 0x025200160130303a30323a61353a66383a37303a3239 NAS-Identifier = "PENKALA" Ericsson-Attr-101 = 0x4552494353534f4e # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "00-02-A5-F8-70-29", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 82 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 00-02-A5-F8-70-29 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 71 to 10.223.0.131 port 65534 Waking up in 4.9 seconds. Cleaning up request 0 ID 71 with timestamp +160 Ready to process requests. Please can you help me with this issue, I assume I missed something related to configuration.. BR, Irena ---------------------- T - C o m - - W e b m a i l ---------------------- Ova poruka poslana je upotrebom T-Com Webmail usluge Uzivajte u shoppingu ne napustajuci udobnost svoga doma! http://shopping.tportal.hr

4 3

segfault in detail listener
by Phil Mayers 08 Apr '11

08 Apr '11

All, We're seeing very occasional segfaults in the detail listener. I've managed to catch one under gdb, and the backtrace shows it dying at detail.c:601: if (feof(data->fp)) goto cleanup; ...because data->fp == NULL I can't follow the control flow to see why this might happen, but I did gather a backtrace etc.

2 1

Per Vendor NAS-Port documentation
by Olivier Bilodeau 08 Apr '11

08 Apr '11

Hi, I was wondering if there has been a collective effort to document the meaning of the NAS-Port by the various Network Vendors? We are working on PacketFence here (an open source NAC) and we translate the NAS-Port to the ifIndex so we can request a dot1x reauthentication to the ifIndex if we want to (ie: IDS event). We've done the translation by ourselves since vendor documentation is often lacking and I was thinking there must exist such a resource. Does anyone here know? I know we could use CoA with the original NAS-Port but it's less supported than the SNMP PAE Reauthenticate MIBs. Thanks! -- Olivier Bilodeau obilodeau(a)inverse.ca :: +1.514.447.4918 *115 :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

4 5

mschapv2 and peap not working, please help
by syharash 07 Apr '11

07 Apr '11

Hi, I am a newbee on Linux and RAdius stuff. I am trying to authenticate WinXP and Win 7 machines on wireless using Freeradius, LDAP authentication. Please help. Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap ldap { server = "10.73.93.13" port = 389 password = "" identity = "" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=uforadius,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x9ac42e8 Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server_keycert.pem" certificate_file = "/etc/raddb/certs/server_keycert.pem" CA_file = "/etc/raddb/certs/cacert.pem" private_key_password = "ufo@123" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 1813 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. [ldap] looking for reply items in directory... [ldap] user mahendra authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server [peap] Got tunneled reply code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 EAP-Message = 0x010800221a0108001d10f7973d26db065858580c2296c2a3df776d6168656e647261 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5e8caef75e84b4df9661a9005c9f7f60 [peap] Got tunneled reply RADIUS code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 EAP-Message = 0x010800221a0108001d10f7973d26db065858580c2296c2a3df776d6168656e647261 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5e8caef75e84b4df9661a9005c9f7f60 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 244 to 10.73.93.151 port 1027 EAP-Message = 0x010800391900170301002ee74a640228010756561c836a369e3317bd7c17ce26878f4122350b0fb26885e6ffadb3826841e731266a7356c939 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x91d6325996de2bb0f03f9ab7fb903713 Finished request 7. Going to the next request Waking up in 1.5 seconds. rad_recv: Access-Request packet from host 10.73.93.151 port 1027, id=245, length=286 User-Name = "mahendra" Calling-Station-Id = "00-1F-3C-E1-17-A9" NAS-IP-Address = 10.73.93.151 NAS-Port = 1 Called-Station-Id = "AC-67-06-39-C6-59" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AC-67-06-39-C6-59" Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0208005a1900170301004fba54ddc1773706da1c180a69c21a6c1a0d0e5a461491374132cd70d5627be31dbade31fa910676053a7ac065595523a960b54039ec23d4b9ee842adddefcaa9b6cb0ef69bd73f0ade2dc4db2a9c2af State = 0x91d6325996de2bb0f03f9ab7fb903713 Vendor-25053-Attr-3 = 0x55464f4d6f7669657a Message-Authenticator = 0xeb1b3365cbe0ebcae1c4ffd65d153119 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mahendra", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 90 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800431a0208003e318cc1ff4314496a738afa9d819cbc6ca80000000000000000edd8688f221fea656143e0f13405d011f0622a7a24f16481006d6168656e647261 server { PEAP: Setting User-Name to mahendra Sending tunneled request EAP-Message = 0x020800431a0208003e318cc1ff4314496a738afa9d819cbc6ca80000000000000000edd8688f221fea656143e0f13405d011f0622a7a24f16481006d6168656e647261 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "mahendra" State = 0x5e8caef75e84b4df9661a9005c9f7f60 server { # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mahendra", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 67 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry DEFAULT at line 3 ++[files] returns ok [ldap] performing user authorization for mahendra [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> mahendra [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=mahendra) [ldap] expand: dc=uforadius,dc=com -> dc=uforadius,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=uforadius,dc=com, with filter (uid=mahendra) [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{crypt}$1$94hl3NgJ$AuuZleae5i2GkzrT9XIye0" [ldap] looking for reply items in directory... [ldap] user mahendra authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/default [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: mahendra [mschap] Told to do MS-CHAPv2 for mahendra with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [mahendra] (from client UFO-Network port 0 via TLS tunnel) } # server [peap] Got tunneled reply code 3 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 245 to 10.73.93.151 port 1027 EAP-Message = 0x010900261900170301001bf48d95f3c39075c79520a6eee44c17e2d9ae0941c29d65ec059b22 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x91d6325999df2bb0f03f9ab7fb903713 Finished request 8. Going to the next request Waking up in 1.5 seconds. rad_recv: Access-Request packet from host 10.73.93.151 port 1027, id=246, length=234 User-Name = "mahendra" Calling-Station-Id = "00-1F-3C-E1-17-A9" NAS-IP-Address = 10.73.93.151 NAS-Port = 1 Called-Station-Id = "AC-67-06-39-C6-59" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AC-67-06-39-C6-59" Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020900261900170301001b61517419592d02817a09b553536ccb662e4e62ca241c6f768e47c5 State = 0x91d6325999df2bb0f03f9ab7fb903713 Vendor-25053-Attr-3 = 0x55464f4d6f7669657a Message-Authenticator = 0x986e9740d6c4076ab6c8dd79e0e4c2e8 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mahendra", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [mahendra] (from client UFO-Network port 1 cli 00-1F-3C-E1-17-A9) Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> mahendra attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 246 to 10.73.93.151 port 1027 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.5 seconds. Cleaning up request 0 ID 237 with timestamp +51 Cleaning up request 1 ID 238 with timestamp +51 Cleaning up request 2 ID 239 with timestamp +51 Cleaning up request 3 ID 240 with timestamp +52 Cleaning up request 4 ID 241 with timestamp +52 Cleaning up request 5 ID 242 with timestamp +52 Waking up in 3.3 seconds. Cleaning up request 6 ID 243 with timestamp +55 Cleaning up request 7 ID 244 with timestamp +55 Cleaning up request 8 ID 245 with timestamp +55 Waking up in 0.7 seconds. Cleaning up request 9 ID 246 with timestamp +55 Ready to process requests. -- View this message in context: http://freeradius.1045715.n5.nabble.com/mschapv2-and-peap-not-working-pleas… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 7

PEAP/MSCHAPv2 problem
by Jürgen Stader 07 Apr '11

07 Apr '11

Hello, i have a problem with my freeradius 2.1.10. I try to use PEAP and MSCHAPv2 to authenticate my wireless client against radius and ldap. The client is a Windows XP Proffesional and configuered to use "protected EAP(PEAP)" for the wireless network. On the radius servers console the following debug output is shown. It seems that the radius wants to use tls instead of peap, but the client don't have a client-certificate because EAP-MSCHAP v2 should be used. The amazing thing is, this radius server is a vm-clone from an other radius, but the other radius works fine. Debug Output: rad_recv: Access-Request packet from host ... port 32769, id=219, length=159 User-Name = "xy" Calling-Station-Id = "..." Called-Station-Id = "..." NAS-Port = 1 NAS-IP-Address = ... NAS-Identifier = "T:WLC2125" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202000b01737461646572 Message-Authenticator = 0xe5b0ffbed84243bf27ac1ac9c9fcd0b5 server eduroam { # Executing section authorize from file /etc/freeradius/sites-enabled/eduroam +- entering group authorize {...} [suffix] No '@' in User-Name = "xy", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[mschap] returns noop [eap] EAP packet type response id 2 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/eduroam +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 219 to ... port 32769 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3abc7e1c3abf6764392496688aff7b3f Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ... port 32769, id=219, length=159 Sending duplicate reply to client WLC-TUT port 32769 - ID: 219 Sending Access-Challenge of id 219 to ... port 32769 Waking up in 2.0 seconds. Cleaning up request 0 ID 219 with timestamp +3 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x3abc7e1c3abf6764 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. eap.conf: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } tls { certdir = /etc/hostcertkey cadir = /etc/cacert dh_file = ${certdir}/dh private_key_file = ${certdir}/roaming.key certificate_file = ${certdir}/roaming.pem CA_file = ${cadir}/chain.txt dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = yes #use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes #use_tunneled_reply = yes #proxy_tunneled_request_as_eap = yes virtual_server = "eduroam-inner-tunnel" } mschapv2 { } } -- Mit freundlichen Grüßen, Jürgen Stader Rechenzentrum Hochschule Furtwangen www.hs-furtwangen.de

3 12

no authenticate step ...
by Michael Arndt 07 Apr '11

07 Apr '11

hello * i try to transfer a working configuration from an very old (1.x) freeradius version to a more recent radius version: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:14:10 My problem: after authenticate against ldap and auth-type = ldap is set, no authorize step is done the next step happening is trying the next entry from the users file expected: authenticate with bind as user and password hash of the user against ldap here the snippet from debug log i assume relevant: hu Apr 7 12:45:28 2011 : Info: [auth_log] expand: %t -> Thu Apr 7 12:45:28 2011 Thu Apr 7 12:45:28 2011 : Info: ++[auth_log] returns ok Thu Apr 7 12:45:28 2011 : Info: ++[mschap] returns noop Thu Apr 7 12:45:28 2011 : Info: [suffix] No '@' in User-Name = "pilot00001", looking up realm NULL Thu Apr 7 12:45:28 2011 : Info: [suffix] No such realm "NULL" Thu Apr 7 12:45:28 2011 : Info: ++[suffix] returns noop Thu Apr 7 12:45:28 2011 : Info: [ldap] performing user authorization for pilot00001 Thu Apr 7 12:45:28 2011 : Info: [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Thu Apr 7 12:45:28 2011 : Info: [ldap] ... expanding second conditional Thu Apr 7 12:45:28 2011 : Info: [ldap] expand: %{User-Name} -> pilot00001 Thu Apr 7 12:45:28 2011 : Info: [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=pilot00001) Thu Apr 7 12:45:28 2011 : Info: [ldap] expand: l=Berlin,dc=de,o=ABC-> l=Berlin,dc=de,o=ABC Thu Apr 7 12:45:28 2011 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Apr 7 12:45:28 2011 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Apr 7 12:45:28 2011 : Debug: [ldap] attempting LDAP reconnection Thu Apr 7 12:45:28 2011 : Debug: [ldap] (re)connect to 10.128.1.1:389, authentication 0 Thu Apr 7 12:45:28 2011 : Debug: [ldap] bind as cn=Manager,o=ABC/xyz to 10.128.1.1:389 Thu Apr 7 12:45:28 2011 : Debug: [ldap] waiting for bind result ... Thu Apr 7 12:45:28 2011 : Debug: [ldap] Bind was successful Thu Apr 7 12:45:28 2011 : Debug: [ldap] performing search in l=Berlin,dc=de,o=ABC, with filter (uid=pilot00001) Thu Apr 7 12:45:28 2011 : Info: [ldap] No default NMAS login sequence Thu Apr 7 12:45:28 2011 : Info: [ldap] looking for check items in directory... Thu Apr 7 12:45:28 2011 : Debug: [ldap] userPassword -> Password-With-Header == "{MD5}hashvalueD1xtOw==" <- the sequence after the hashed pw astonishes me, the D1xt0w Thu Apr 7 12:45:28 2011 : Info: [ldap] looking for reply items in directory... Thu Apr 7 12:45:28 2011 : Info: [ldap] Setting Auth-Type = LDAP Thu Apr 7 12:45:28 2011 : Info: [ldap] user pilot00001 authorized to use remote access Thu Apr 7 12:45:28 2011 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Apr 7 12:45:28 2011 : Info: ++[ldap] returns ok Thu Apr 7 12:45:28 2011 : Info: [eap] No EAP-Message, not doing EAP Thu Apr 7 12:45:28 2011 : Info: ++[eap] returns noop ... next line / match in users file is done next ...in the old config next step was authenticate So clearly i do a mistake and have overlooked a neccessary config option any hints where to look next ? The hint to transfer a deprecated expression from users file to unlang will be done when i succeed with auth TIA Micha

2 1