December 2012 - Freeradius-Users - lists.freeradius.org

computer authentication
by Dan Letkeman 07 Dec '12

07 Dec '12

Hello, I'm having some trouble with my setup and I am not sure where things have gone wrong. I don't think there is anything from with the freeradius server or the switch setup. My goal is to get computer authentication working, and from what I understand from this post it should just work with the default setup with only two modifications: See the post from Phil Mayers http://freeradius.1045715.n5.nabble.com/PEAP-with-Machine-auth-td4939666.ht… Here is my debug log: rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=236, length=158 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x0201000f01686f73742f44414e3031 Message-Authenticator = 0xd542a2a3a3407e6908953cd7dca08817 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 15 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 236 to 10.11.200.73 port 1645 EAP-Message = 0x010200160410dda0857597b1b9c5d2114f6c83f2606d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096017b44e4c1b393ed153b7774 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=237, length=167 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x020200060319 Message-Authenticator = 0x36c72a6e152d0376c4c2e898ed25103b NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096017b44e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 237 to 10.11.200.73 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096007a59e4c1b393ed153b7774 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=238, length=266 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x0203006919800000005f160301005a01000056030150c2020ad42f8473aaa4763bfe5559b68809e4731258d02a19bd5a83025e02fc000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 Message-Authenticator = 0x0a4d04f9f52dbc7c000f26f2b9046e3d NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096007a59e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 105 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 95 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 238 to 10.11.200.73 port 1645 EAP-Message = 0x0104040019c0000008a216030100310200002d030150c1ad7788786b10acec0131f1a69bc414f87718bb71685367e6e6a53ec0a1e600002f000005ff01000100160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3132313230363138333330375a170d3133303230343138333330375a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100badff6cb7179506abce81b22c0c12ce92f128d1fc2ffd51b159010f8bd9aa0352e9eb68fa01ede9d61214a39d78d2972b5406699eae304 EAP-Message = 0xb40a74524471ec05582582a7aa9710aabd4a895773a02042e67db8e42572635efda35a45df5c9518a02c6a7e75a64051d60d436bfa62bfd6e5f88a8ebf3ba48c19e48a25c8662e19a29d92cb6317e067b7c6cb4f24976519a55c2681eb97f8d5974f8244dc50f641b03615ee14d5c8085664bff3c1be7247c1e4d98c9120319edfb4c167d0888140cbc768a81e8d1d016a0d093490a913578946ea9b21706066f1428370666364ed5f80919a0ca2d368daf1c85311c8375a27adb09e7d5bb7800c1bf66af0a86690470203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003820101004857 EAP-Message = 0xf861c78b2469007a3a0faeca30c4dd0c107a661f63e949e4ddfb4ffd28045199bd58e642837569ffa14e8521d161b0940802b3ad216b021a30c322814659bc1d6224205d65000c39c6edcea942e8c06965e1b9f6fb7f1654191940a392c2ef81a11d25fb73ce358bd6eadca1ef0e15f8572c232a04ec1629f0e727021ced7bd079d72cdb2d86bcc8ffdf334842f089ab15936eb7ba0cffcc0e9b37a37a216f0ed402d7200f210a7352cb339affdae7e5b6ba90f4108b22a3b1b713057809817b46cc6733fe03884dfb9f895552203bf1e1e403cf1f663a831936d41c25b9514f360416020b0fdb33a3b573396f3ae552c08799d85a40efb32cda9d1e60 EAP-Message = 0xa00004ab308204a73082038f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096037d59e4c1b393ed153b7774 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=239, length=167 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x020400061900 Message-Authenticator = 0x57fa2f2fa8a12654c84ef47f24b9300c NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096037d59e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 239 to 10.11.200.73 port 1645 EAP-Message = 0x010503fc1940a003020102020900a33fb10c1664a44e300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3132313230363138333330375a170d3133303230343138333330375a308193310b3009060355040613024652310f300d0603550408130652616469757331 EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100ba09abda0f9f2632773b404162045d145d1961f5d44cf7feafb38e5d352d7b7a47091b9156ef81be2c8d1ed9994cc2d88b530cdaa51bdc2d4f3132329fd958ffb5fe7f8a2a2d0c699ce8d434041d80898eb0a0ff623813aeb5d0f8e82dc094db92237c3b17987a19 EAP-Message = 0x5711bd563ba0d6f947104787918866aa0c6fdc717bef128d0038637d4fa15a0a8428f3ff47235404c78e050425cd6ea33ad80dc5fc7dda16a76d4f49d679ac0cdac557620d3c7fb5dd508889d75c014f2bab7281a6514e9ef8801b49b2b62d7346e381ef28280ba2654505b85c1cc63ecb7664dfd46e3e1561d87c24ee7bd2ffea5e3282b2c722ccafb1ffe460fa8612ae82267c3e1df60d0203010001a381fb3081f8301d0603551d0e041604149a8d8e6f296e96fcc7d303cccfeeae2052615f093081c80603551d230481c03081bd80149a8d8e6f296e96fcc7d303cccfeeae2052615f09a18199a48196308193310b300906035504061302465231 EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900a33fb10c1664a44e300c0603551d13040530030101ff300d06092a864886f70d010105050003820101002a98ee33183e9c46aafd4385195180fff00f029253c1c1818934722dc09e3722378f93ecf6a21a98cf44c848e524a051bfa6c0d5b22b26088b06313e84de17bc22e7d9a3a87d466abd8ffc EAP-Message = 0x1e707bf177e925d2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096027c59e4c1b393ed153b7774 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=240, length=167 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x020500061900 Message-Authenticator = 0xbb0a37ac80ac127d37623ac19d8cb7d7 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096027c59e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 240 to 10.11.200.73 port 1645 EAP-Message = 0x010600bc1900c35695b88d735375e6daf6e9fd7517c11036a05a4e769075fda1f4931e91e5a98d20c5f13886c0502b7e5fadd8851996d4cf5f418695e9e485411c391758f37c7ee4a00cf3f5eeebec0deb2bbfdfbdcc9a7df103311f69d7e81dba31d00cc887f1c93b24bc2bd77affe2451277fb4df09d82bbe43269c1b591503e03c5f678db04a77d6a42e55816b412aedf69c2b379d07157c74d5efe0b1ff411a138624d54324d91438a42c0d71567a80f1316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096057f59e4c1b393ed153b7774 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=241, length=499 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x02060150198000000146160301010610000102010052d9ea3856c176e5673da4cbe02a911e8f5fb543684e6ae8649d79c8e15d3a4fb6c1ed37d45ed785d3891bbdf1c3868cde05e75d91280f2c026c15f4e968ef6cdd4094a8a59e2ad1ceac5c53ce8af6084b98de2668567a254913920f266e0a7bca00f50db7c7c26552fe2b171b0287003ffea4ba84143cc567a4cb7748f46312957f4997aed1b64f62c21d03bb7139f79e44534c0158175a629a98f4b585f87330442382e4e51b6de60635494d4e66a3aabd88b4c8874f268cd5ec3e5f334b84b75e06fd0fbc3afaa27a6af9303ed65e2af56d02a8aeaceadcd48679055748fa722d14f6c4961534 EAP-Message = 0x5a1cade40955c92b534083c6292fd0bac23cb7bb5bb1d90f14030100010116030100307e72a5c4189bf36cac8747ffabc198bd4f5d400baf2bb5cb001a022908448a37cf7ddea27654ff7fc282934932a55ffa Message-Authenticator = 0x11d9f6622d3f3949df452fd64e4e7a03 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096057f59e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 241 to 10.11.200.73 port 1645 EAP-Message = 0x010700411900140301000101160301003088525279f0a666be9158b77193e0cb5d44491d1d577a8862254f5ef9f6dba07116b5e566e39572ba0e981cbd85b7bbc5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096047e59e4c1b393ed153b7774 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=242, length=167 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x020700061900 Message-Authenticator = 0x211323fa12841ee03e548aa79f457385 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096047e59e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 242 to 10.11.200.73 port 1645 EAP-Message = 0x0108002b19001703010020ac4efbfa7535f97705d24f884cbcff69c35d3995a8cf49f9f54b5839d5fbbc70 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096077159e4c1b393ed153b7774 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=243, length=204 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x0208002b190017030100207a18e0fc66bc4e107ff7c3add2fd502f7c9de5a24918f020cd08237c80606225 Message-Authenticator = 0x58eb948731c85961f83971425c7f49d0 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096077159e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - host/DAN01 [peap] Got inner identity 'host/DAN01' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0208000f01686f73742f44414e3031 server { [peap] Setting User-Name to host/DAN01 Sending tunneled request EAP-Message = 0x0208000f01686f73742f44414e3031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/DAN01" server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 15 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010900241a0109001f1030afe7e31b9243b22b1edc4da600654f686f73742f44414e3031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf36f0859f36612161ae524fe7d89d60e [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010900241a0109001f1030afe7e31b9243b22b1edc4da600654f686f73742f44414e3031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf36f0859f36612161ae524fe7d89d60e [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 243 to 10.11.200.73 port 1645 EAP-Message = 0x0109004b190017030100406378cb7289eb8c26ab103a27d7ddd562178502ee511763eb4dcdd2148b2e2828f04def0d118c5f79480070084a5d6d20db5e2d378185c951aefa1db0ed8373f8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096067059e4c1b393ed153b7774 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=244, length=268 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x0209006b190017030100602ba93efbbefd59197061b3c1cfe8a8c3ed52c8c3bb04d8407d3a8a194ff63d304de6151122e5f2ee830478996fd21f1b386795640464bd68df45b537168ea55a5733946cd255eab36e80551b6b1e1e77b43b075925fd7722f626a31be711402d Message-Authenticator = 0xcc8e1ecd017ffb90d560f6c53e4646e3 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096067059e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020900451a0209004031efe81adb9299be4739da1763d1702e44000000000000000000000000000000000000000000000000000000000000000000686f73742f44414e3031 server { [peap] Setting User-Name to host/DAN01 Sending tunneled request EAP-Message = 0x020900451a0209004031efe81adb9299be4739da1763d1702e44000000000000000000000000000000000000000000000000000000000000000000686f73742f44414e3031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/DAN01" State = 0xf36f0859f36612161ae524fe7d89d60e server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 69 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: host/DAN01 [mschap] Told to do MS-CHAPv2 for host/DAN01 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\tE=691 R=1" EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\tE=691 R=1" EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 244 to 10.11.200.73 port 1645 EAP-Message = 0x010a002b19001703010020b18b2f6ba2a15eb8ccf6796e5f1978974c30c0ab7e60faef3aab29c75ebfa183 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096097359e4c1b393ed153b7774 Finished request 8. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=245, length=204 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x020a002b19001703010020da286d0d7cd1b91d931d0059695ecf9ed2f5640c0975ae5ec20d8b34d2cc599a Message-Authenticator = 0xc4e84370ab6a69e7ccecf9b8f70ec4e0 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096097359e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> host/DAN01 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 245 to 10.11.200.73 port 1645 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 236 with timestamp +39 Cleaning up request 1 ID 237 with timestamp +39 Cleaning up request 2 ID 238 with timestamp +39 Cleaning up request 3 ID 239 with timestamp +39 Cleaning up request 4 ID 240 with timestamp +39 Cleaning up request 5 ID 241 with timestamp +39 Cleaning up request 6 ID 242 with timestamp +39 Cleaning up request 7 ID 243 with timestamp +39 Cleaning up request 8 ID 244 with timestamp +39 Waking up in 1.0 seconds. Cleaning up request 9 ID 245 with timestamp +39 Ready to process requests.

2 1

eap-mschapv2 and radius.log
by Scott Armitage 06 Dec '12

06 Dec '12

All, I have noticed a behaviour in the logging and I'm not sure if it is misconfiguration on my part, misunderstanding of the expected behaviour or a bug. If I attempt to log in using EAP-MSCHAPv2 inside of an eap method (e.g. PEAP/EAP-MSCHAPv2) I see "Login OK:" for the outer EAP regardless of the result of the inner EAP. e.g: Thu Dec 6 11:10:55 2012 : Auth: Login OK: [scott] (from client pepsi port 0 cli 02-00-00-00-00-01 via TLS tunnel) Thu Dec 6 11:10:55 2012 : Auth: Login OK: [scott] (from client pepsi port 0 cli 02-00-00-00-00-01 via TLS tunnel) Thu Dec 6 11:10:56 2012 : Auth: Login OK: [anonymous(a)lboro.ac.uk] (from client pepsi port 0 cli 02-00-00-00-00-01) This means if I have a user with a bad password I get the following in the log: Thu Dec 6 11:21:37 2012 : Auth: Login OK: [scott] (from client pepsi port 0 cli 02-00-00-00-00-01 via TLS tunnel) As the mschap module is waiting for the user to re-enter their password eventual it times out. Therefore this is the only entry in the log. Which is somewhat confusing, as it has actually failed but the only log entry is "Login OK". Has anyone else noticed this behaviour? or have I configured something wrong? Regards Scott Armitage

1 2

ldap eDir support in master branch
by Olivier Beytrison 06 Dec '12

06 Dec '12

Hi, Now that I have my packages, i've started deploying FR3 for our eduroam federation. And I just saw that the eDir support is gone. now my question is : 1. is it abandoned ? 2. is it not yet ported to the new rlm_ldap code ? Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

2 2

Freeradius stops. Received HUP signal.
by substance SUBSTANCE 06 Dec '12

06 Dec '12

Hello guys. I'm using FreeRADIUS server for a few months now. I'm running it on Ubuntu 11.10 server. FreeRADIUS Version 2.1.10. The problem is that I started FreeRADIUS daemon on November 18th, and it stopped working after one week ( users authentication was not working). Sun Nov 18 06:30:58 2012 : Info: HUP - loading modules Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "files" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "attr_filter.access_reject" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "attr_filter.accounting_response" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "pap" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "detail" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "sql_log" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "auth_log" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "suffix" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "radutmp" Sun Nov 18 06:30:58 2012 : Info: Loaded virtual server inner-tunnel Sun Nov 18 06:30:58 2012 : Info: Loaded virtual server <default> Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Sun Nov 18 19:12:12 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Connected new DB handle, #1 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Sun Nov 18 19:12:12 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Connected new DB handle, #0 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Sun Nov 18 19:12:12 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Connected new DB handle, #4 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Sun Nov 18 19:12:12 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Connected new DB handle, #3 Sun Nov 18 19:13:33 2012 : Info: Loaded virtual server inner-tunnel Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Attempting to connect to root@localhost:/radius Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Sun Nov 18 19:13:33 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Connected new DB handle, #0 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Sun Nov 18 19:13:33 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Connected new DB handle, #1 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Sun Nov 18 19:13:33 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Connected new DB handle, #2 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Sun Nov 18 19:13:33 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Connected new DB handle, #3 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Sun Nov 18 19:13:33 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Connected new DB handle, #4 Sun Nov 18 19:13:33 2012 : Info: Loaded virtual server <default> Sun Nov 18 19:13:33 2012 : Info: Ready to process requests. *Sun Nov 25 06:46:34 2012 : Info: Received HUP signal.* Sun Nov 25 06:46:34 2012 : Info: HUP - Re-reading configuration files Sun Nov 25 06:46:34 2012 : Info: HUP - loading modules Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "files" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "attr_filter.access_reject" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "attr_filter.accounting_response" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "pap" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "detail" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "sql_log" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "auth_log" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "suffix" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "radutmp" Sun Nov 25 06:46:34 2012 : Info: Loaded virtual server inner-tunnel Sun Nov 25 06:46:34 2012 : Info: Loaded virtual server <default> Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Sun Nov 25 18:23:51 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Connected new DB handle, #2 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Sun Nov 25 18:23:51 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Connected new DB handle, #1 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Sun Nov 25 18:23:51 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Connected new DB handle, #0 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Sun Nov 25 18:23:51 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Connected new DB handle, #4 Sun Nov 25 18:24:16 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Sun Nov 25 18:24:16 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sun Nov 25 18:24:16 2012 : Info: rlm_sql (sql): Connected new DB handle, #3 *Sun Dec 2 06:38:05 2012 : Info: Received HUP signal.* Sun Dec 2 06:38:05 2012 : Info: HUP - Re-reading configuration files Why FreeRADIUS receives that HUP signal? Can I disable it , or should I update FreeRADIUS software? Thanks !

3 4

Re: preproxy_users
by Alan Buxey 06 Dec '12

06 Dec '12

Sounds like your old server had a local dictionary entry that your new server doesn't have alan

3 4

Python access to attribute lists
by Duarte Fonseca 05 Dec '12

05 Dec '12

Hi, Just wondering if someone can confirm something for me. The python module only passes the the request attribute list (not the reply, proxy-reply, control lists) to the python script, is that correct? Would it be possible to modify the module to pass the remaining lists to the python code? Thanks in advance, Duarte

4 3

rlm_python: no %RAD_REQUEST equivalent
by laurent.feron＠free.fr 05 Dec '12

05 Dec '12

Hello, I have a perl module that changes the username during the authorization phase (retrieve from a oracle database) by modifying the user-name attribute in the RAD_REQUEST dictionary. This update is global and can be used by the authentication phase (still handled by the perl script). I try to switch from perl to python as i'm more comfortable. Everything is ok except i don't know how to modify on the fly the user-name. in the 'authorize(p)' function, p is the read only tuple of the request. I cannot update the request here. The return of the function is (RLM_MODULE_something, tuple4reply, tuple4config). I still cannot change here. Moreover, if i change the tuple config in the authorize function , how i can retrieve it in the authentication function? Maybe i miss something as i'm a beginner on FR. Regards, Laurent

6 18

Accounting with Freeradius.
by Tzvika Gelber 05 Dec '12

05 Dec '12

I have one Freeradius server that i need to give to an outsource client of mine, the problem is that he is not a very Linux oriented (to put it gently) and have even less skills in any form of SQL. he is going to cover some of our tests and some of them are the accounting side of connected Clients. I know that FR has accounting enabled by default but in order to follow the accounting you need to have MySql installed and know how to look in to the SQL DB to fined the right entry's. is there a Graphic way to get that info? what i'm asking is this, does one of the "FreeRadius" GUI's out there can also interface with the MySql server and show the accounting info? if so - what one? Thank you. -- ____ Sometimes you just glow in the dark...

1 0

Authenticating users checking Huntgroup-Name in unlang
by suggestme IT 05 Dec '12

05 Dec '12

Hi, I have set FreeRadius 2.1.12 Server, and configured it to authorize and authenticate users that are in Active Directory and users file. I have tested in real wireless environment to authenticate users from Active Directory & users file and it is successful. But according to our organization's requirement I need to authenticate users to allow or reject users for wireless or VPN access checking huntgroups and attribute in AD or users file accordingly so, I have configured huntgroup name in huntgroups "wirelesstest" and have configured my NAS-IP-Address as: (Some names & IP Address are edited for privacy) /usr/local/etc/raddb/huntgroups wirelesstest NAS-IP-Address == IP Address wirelesstest NAS-IP-Address == IP Address wirelesstest NAS-IP-Address == IP Address Clients are configured in clients.conf file as: /usr/local/etc/raddb/clients.conf client Primary_controller{ ipaddr = IP Address secret = password shortname = primary nastype = enterasys } In default & inner_tunnel files configurations, unlang conditional checking are done under ldap & files sub-sections of "authorize" section /usr/local/etc/raddb/sites-enabled/default and /usr/local/etc/raddb/sites-enabled/inner-tunnel authorize { ............. ............ ldap if ("%{Huntgroup-Name}" == "wirelesstest"){ if (control:Connect-Type == wireless){ update control { Auth-Type := "Accept" } } else { update control { Auth-Type := "Reject" } } } files if ("%{Huntgroup-Name}" == "wirelesstest"){ if (control:Connect-Type == wireless){ update control { Auth-Type := "Accept" } } else { update control { Auth-Type := "Reject" } } } While testing through radtest it works as expected. Unlang condition is checked, and attribute is also checked against Active Directory or users file and authenticate users if it matches and it rejects if it doesn't match. But in Real wireless environment testing I don't get any response at Client side, and after long time it says can't connect. But while checking at debug log doing radiusd -X it shows it is checking the condition and sending Access-Accept or Access-Reject accordingly. I tried different conditional checkings in unlang; checking against shortname as: if ("%{client:shortname}" =~ /^primary/){ checking against huntgroup as: if ("%{client:huntgroup}" == "wireless"){ But any of these setting gives me no response at client side although my debug log shows the condition is being checked and Access-Accept ot Access-Reject is sent. Part of debug log is as follows: Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "test" User-Password = "password" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "test" User-Password = "password" FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = IP Address NAS-Port = 116 Framed-MTU = 1400 Called-Station-Id = "00:1e:35:7f:ec:35" Calling-Station-Id = "00:35:5c:68:c0:08" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "Wireless_Test" Service-Type = Framed-User Siemens-AP-Serial = "0600010084050956" Siemens-AP-Name = "TEST" Siemens-VNS-Name = "Wireless_Test" Siemens-SSID = "Wireless_Test" Siemens-BSS-MAC = "00:1e:35:7f:ec:35" server inner-tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[mschap] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for test [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> test [ldap] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=test) [ldap] expand: dc=example,dc=com -> dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=example,dc=com, with filter (sAMAccountName=test) [ldap] looking for check items in directory... [ldap] extensionAttribute15 -> Connect-Type == "wireless" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user test authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++? if ("%{Huntgroup-Name}" == "wirelesstest") expand: %{Huntgroup-Name} -> ? Evaluating ("%{Huntgroup-Name}" == "wirelesstest") -> TRUE ++? if ("%{Huntgroup-Name}" == "wirelesstest") -> TRUE ++- entering if ("%{Huntgroup-Name}" == wirelesstest) {...} +++? if (control:Connect-Type == wireless) ? Evaluating (control:Connect-Type == wireless) -> TRUE +++? if (control:Connect-Type == wireless) -> TRUE +++- entering if (control:Connect-Type == wireless) {...} ++++[control] returns ok +++- if (control:Connect-Type == wireless) returns ok +++ ... skipping else for request 1: Preceding "if" was taken ++- if ("%{Huntgroup-Name}" == wirelesstest) returns ok ++? if (control:Ldap-UserDN =~ /^[^,]+,OU=([^,]+),/) ? Evaluating (control:Ldap-UserDN =~ /^[^,]+,OU=([^,]+),/) -> TRUE ++? if (control:Ldap-UserDN =~ /^[^,]+,OU=([^,]+),/) -> TRUE ++- entering if (control:Ldap-UserDN =~ /^[^,]+,OU=([^,]+),/) {...} expand: %{1} -> Staff +++[control] returns ok ++- if (control:Ldap-UserDN =~ /^[^,]+,OU=([^,]+),/) returns ok [files] users: Matched entry DEFAULT at line 16 [files] expand: Enterasys:version=1:policy=%{control:Tmp-String-1} -> Enterasys:version=1:policy=Staff ++[files] returns ok ++? if ("%{Huntgroup-Name}" == "wirelesstest") expand: %{Huntgroup-Name} -> ? Evaluating ("%{Huntgroup-Name}" == "wirelesstest") -> TRUE ++? if ("%{Huntgroup-Name}" == "wirelesstest") -> TRUE ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = LDAP # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group LDAP {...} [ldap] login attempt by "test" with password "password" [ldap] user DN: CN=test,OU=Staff,OU=Employees,OU=Users,DC=example,DC=com [ldap] (re)connect to example.com:389, authentication 1 [ldap] bind as CN=test,OU=Staff,OU=Employees,OU=Users,DC=example,DC=com/test to example.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user test authenticated succesfully ++[ldap] returns ok Login OK: [test] (from client Primary_controller port 116 cli 00:1e:35:7f:ec:35 via TLS tunnel) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group post-auth {...} [reply_log] expand: /usr/local/var/log/radius/radacct/reply-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/reply-detail-20121204 [reply_log] /usr/local/var/log/radius/radacct/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/reply-detail-20121204 [reply_log] expand: %t -> Tue Dec 4 13:50:45 2012 ++[reply_log] returns ok } # server inner-tunnel [ttls] Got tunneled reply code 2 Filter-Id := "Enterasys:version=1:policy=Staff" [ttls] Got tunneled Access-Accept [eap] Freeing handler ++[eap] returns ok Login OK: [test] (from client Primary_controller port 116 cli 00:1e:35:7f:ec:35) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 239 to IP Address port 57700 Filter-Id := "Enterasys:version=1:policy=Staff" MS-MPPE-Recv-Key = 0xfc711ebb1ff8ea41b4f0d9bf76e424796aca3d9b7518154f00ab6f1e4d0cc474 MS-MPPE-Send-Key = 0x9fb92d6b82ec067b31dacae9e16e63ff86d702501266713701a377f220e4cbbb EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" Finished request 5. Going to the next request Waking up in 2.4 seconds. Cleaning up request 0 ID 231 with timestamp +5 Waking up in 1.0 seconds. Cleaning up request 1 ID 252 with timestamp +6 Cleaning up request 2 ID 86 with timestamp +7 Cleaning up request 3 ID 227 with timestamp +7 Waking up in 0.3 seconds. Cleaning up request 4 ID 169 with timestamp +7 Waking up in 1.0 seconds. Cleaning up request 5 ID 239 with timestamp +7 Ready to process requests. In /usr/local/var/log/radius/radius.log I see log message as: Tue Dec 4 15:02:56 2012 : Auth: Login OK: [test] (from client Primary_controller port 116 cli 00:1e:35:7f:ec:35) I don't get log as "Login OK via TLS tunnel". But any of these setting gives me no response at client side although my debug log shows the condition is being checked and Access-Accept ot Access-Reject is sent. Any Idea if I am missing something in my configuration that is preventing me to get response at Client side? I am using SecureW2 supplicant with EAP-PAP.

1 0

Re: Git master branch & Debian build
by Zenon Mousmoulas 05 Dec '12

05 Dec '12

Hi, I am also trying to build Debian packages from git master. On Fri Nov 23 20:52:32 CET 2012, Olivier Beytrison wrote: > I also noticed the following messages during package creation : > > dpkg-shlibdeps: warning: couldn't find library libfreeradius-eap.so > needed by debian/freeradius/usr/lib/freeradius/rlm_eap_peap.so (ELF > format: 'elf64-x86-64'; RPATH: '/usr/lib/ > freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius/usr/sbin/radmin (ELF format: 'elf64-x86-64'; > RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-eap.so > needed by debian/freeradius/usr/lib/freeradius/rlm_eap.so (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-eap.so > needed by debian/freeradius/usr/lib/freeradius/rlm_eap_tls.so (ELF > format: 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius/usr/sbin/freeradius (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-eap.so > needed by debian/freeradius/usr/lib/freeradius/rlm_eap_ttls.so (ELF > format: 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius-utils/usr/bin/radwho (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius-utils/usr/bin/smbencrypt (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius-utils/usr/bin/radclient (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius-utils/usr/bin/rlm_dbm_parser (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius-utils/usr/bin/radsniff (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius-utils/usr/bin/rlm_ippool_tool (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). The packages are built but I also see the warnings the OP noted above. The freeradius binary installed by this package does not run: /usr/sbin/freeradius: error while loading shared libraries: build/lib/.libs/rlm_acctlog.so: cannot open shared object file: No such file or directory # ldd /usr/sbin/freeradius linux-vdso.so.1 => (0x00007fff85fff000) libfreeradius-radius.so => /usr/lib/freeradius/libfreeradius-radius.so (0x00007faff937b000) build/lib/.libs/rlm_acctlog.so => not found build/lib/.libs/rlm_always.so => not found build/lib/.libs/rlm_attr_filter.so => not found build/lib/.libs/rlm_attr_rewrite.so => not found build/lib/.libs/rlm_cache.so => not found build/lib/.libs/rlm_chap.so => not found build/lib/.libs/rlm_checkval.so => not found build/lib/.libs/rlm_counter.so => not found build/lib/.libs/rlm_cram.so => not found build/lib/.libs/rlm_dbm.so => not found build/lib/.libs/rlm_detail.so => not found build/lib/.libs/rlm_dhcp.so => not found build/lib/.libs/rlm_digest.so => not found build/lib/.libs/rlm_dynamic_clients.so => not found build/lib/.libs/rlm_eap.so => not found build/lib/.libs/rlm_eap_gtc.so => not found build/lib/.libs/rlm_eap_leap.so => not found build/lib/.libs/rlm_eap_md5.so => not found build/lib/.libs/rlm_eap_mschapv2.so => not found build/lib/.libs/rlm_eap_peap.so => not found build/lib/.libs/rlm_eap_pwd.so => not found build/lib/.libs/rlm_eap_tls.so => not found build/lib/.libs/rlm_eap_ttls.so => not found build/lib/.libs/rlm_exec.so => not found build/lib/.libs/rlm_expiration.so => not found build/lib/.libs/rlm_expr.so => not found build/lib/.libs/rlm_fastusers.so => not found build/lib/.libs/rlm_files.so => not found build/lib/.libs/rlm_ippool.so => not found build/lib/.libs/rlm_jradius.so => not found build/lib/.libs/rlm_krb5.so => not found build/lib/.libs/rlm_ldap.so => not found build/lib/.libs/rlm_linelog.so => not found build/lib/.libs/rlm_logintime.so => not found build/lib/.libs/rlm_mschap.so => not found build/lib/.libs/rlm_otp.so => not found build/lib/.libs/rlm_pam.so => not found build/lib/.libs/rlm_pap.so => not found build/lib/.libs/rlm_passwd.so => not found build/lib/.libs/rlm_perl.so => not found build/lib/.libs/rlm_policy.so => not found build/lib/.libs/rlm_preprocess.so => not found build/lib/.libs/rlm_python.so => not found build/lib/.libs/rlm_radutmp.so => not found build/lib/.libs/rlm_realm.so => not found build/lib/.libs/rlm_replicate.so => not found build/lib/.libs/rlm_sim_files.so => not found build/lib/.libs/rlm_soh.so => not found build/lib/.libs/rlm_sometimes.so => not found build/lib/.libs/rlm_sql.so => not found build/lib/.libs/rlm_sql_iodbc.so => not found build/lib/.libs/rlm_sql_mysql.so => not found build/lib/.libs/rlm_sql_null.so => not found build/lib/.libs/rlm_sql_postgresql.so => not found build/lib/.libs/rlm_sqlcounter.so => not found build/lib/.libs/rlm_sqlippool.so => not found build/lib/.libs/rlm_unix.so => not found build/lib/.libs/rlm_utf8.so => not found build/lib/.libs/rlm_wimax.so => not found libfreeradius-eap.so => /usr/lib/freeradius/libfreeradius-eap.so (0x00007faff915a000) libnsl.so.1 => /lib/libnsl.so.1 (0x00007faff8f3d000) libresolv.so.2 => /lib/libresolv.so.2 (0x00007faff8d27000) libdl.so.2 => /lib/libdl.so.2 (0x00007faff8b22000) libpthread.so.0 => /lib/libpthread.so.0 (0x00007faff8906000) libreadline.so.6 => /lib/libreadline.so.6 (0x00007faff86c2000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x00007faff848a000) libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0x00007faff80e9000) libssl.so.0.9.8 => /usr/lib/libssl.so.0.9.8 (0x00007faff7e94000) libc.so.6 => /lib/libc.so.6 (0x00007faff7b31000) /lib64/ld-linux-x86-64.so.2 (0x00007faff95ad000) libncurses.so.5 => /lib/libncurses.so.5 (0x00007faff78eb000) libz.so.1 => /usr/lib/libz.so.1 (0x00007faff76d4000) It looks like something is wrong with the ELF attributes in the binaries: # objdump -p /usr/sbin/freeradius | grep NEEDED NEEDED libfreeradius-radius.so NEEDED build/lib/.libs/rlm_acctlog.so NEEDED build/lib/.libs/rlm_always.so NEEDED build/lib/.libs/rlm_attr_filter.so NEEDED build/lib/.libs/rlm_attr_rewrite.so NEEDED build/lib/.libs/rlm_cache.so NEEDED build/lib/.libs/rlm_chap.so NEEDED build/lib/.libs/rlm_checkval.so NEEDED build/lib/.libs/rlm_counter.so NEEDED build/lib/.libs/rlm_cram.so NEEDED build/lib/.libs/rlm_dbm.so NEEDED build/lib/.libs/rlm_detail.so NEEDED build/lib/.libs/rlm_dhcp.so NEEDED build/lib/.libs/rlm_digest.so NEEDED build/lib/.libs/rlm_dynamic_clients.so NEEDED build/lib/.libs/rlm_eap.so NEEDED build/lib/.libs/rlm_eap_gtc.so NEEDED build/lib/.libs/rlm_eap_leap.so NEEDED build/lib/.libs/rlm_eap_md5.so NEEDED build/lib/.libs/rlm_eap_mschapv2.so NEEDED build/lib/.libs/rlm_eap_peap.so NEEDED build/lib/.libs/rlm_eap_pwd.so NEEDED build/lib/.libs/rlm_eap_tls.so NEEDED build/lib/.libs/rlm_eap_ttls.so NEEDED build/lib/.libs/rlm_exec.so NEEDED build/lib/.libs/rlm_expiration.so NEEDED build/lib/.libs/rlm_expr.so NEEDED build/lib/.libs/rlm_fastusers.so NEEDED build/lib/.libs/rlm_files.so NEEDED build/lib/.libs/rlm_ippool.so NEEDED build/lib/.libs/rlm_jradius.so NEEDED build/lib/.libs/rlm_krb5.so NEEDED build/lib/.libs/rlm_ldap.so NEEDED build/lib/.libs/rlm_linelog.so NEEDED build/lib/.libs/rlm_logintime.so NEEDED build/lib/.libs/rlm_mschap.so NEEDED build/lib/.libs/rlm_otp.so NEEDED build/lib/.libs/rlm_pam.so NEEDED build/lib/.libs/rlm_pap.so NEEDED build/lib/.libs/rlm_passwd.so NEEDED build/lib/.libs/rlm_perl.so NEEDED build/lib/.libs/rlm_policy.so NEEDED build/lib/.libs/rlm_preprocess.so NEEDED build/lib/.libs/rlm_python.so NEEDED build/lib/.libs/rlm_radutmp.so NEEDED build/lib/.libs/rlm_realm.so NEEDED build/lib/.libs/rlm_replicate.so NEEDED build/lib/.libs/rlm_sim_files.so NEEDED build/lib/.libs/rlm_soh.so NEEDED build/lib/.libs/rlm_sometimes.so NEEDED build/lib/.libs/rlm_sql.so NEEDED build/lib/.libs/rlm_sql_iodbc.so NEEDED build/lib/.libs/rlm_sql_mysql.so NEEDED build/lib/.libs/rlm_sql_null.so NEEDED build/lib/.libs/rlm_sql_postgresql.so NEEDED build/lib/.libs/rlm_sqlcounter.so NEEDED build/lib/.libs/rlm_sqlippool.so NEEDED build/lib/.libs/rlm_unix.so NEEDED build/lib/.libs/rlm_utf8.so NEEDED build/lib/.libs/rlm_wimax.so NEEDED libfreeradius-eap.so NEEDED libnsl.so.1 NEEDED libresolv.so.2 NEEDED libdl.so.2 NEEDED libpthread.so.0 NEEDED libreadline.so.6 NEEDED libcrypt.so.1 NEEDED libcrypto.so.0.9.8 NEEDED libssl.so.0.9.8 NEEDED libc.so.6 # objdump -p /usr/lib/freeradius/libfreeradius-radius.so | grep SONAME # objdump -p /usr/lib/freeradius/libfreeradius-eap.so | grep SONAME Compared to Debian's freeradius 2.1.10+dfsg-2+squeeze1: # objdump -p /usr/sbin/freeradius | grep NEEDED NEEDED libfreeradius-radius-2.1.10.so NEEDED libnsl.so.1 NEEDED libresolv.so.2 NEEDED libpthread.so.0 NEEDED libcrypt.so.1 NEEDED libltdl.so.7 NEEDED libssl.so.0.9.8 NEEDED libcrypto.so.0.9.8 NEEDED libc.so.6 # objdump -p /usr/lib/freeradius/libfreeradius-radius-2.1.10.so | grep SONAME SONAME libfreeradius-radius-2.1.10.so # objdump -p /usr/lib/freeradius/libfreeradius-eap-2.1.10.so | grep SONAME SONAME libfreeradius-eap-2.1.10.so Any ideas? Thanks, Z.

3 10