April 2012 - Freeradius-Users - lists.freeradius.org

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

Huntgroup Checking
by simonm123 28 Feb '13

28 Feb '13

Am new to freeradius but have it mainly set up just fine. It's a fantastic tool and I'm enjoying using it :) Just one thing I'm struggling with is the huntgroups. I've followed the wiki to the letter and can see the server checking in the debug log. What I basically want to do is restrict users to certain networks, as per the wiki. If their huntgroup-name matches their huntgroup based on nasip, they can get online, otherwise they're rejected. I've put Huntgroup-Name = NetworkA in my radgroupcheck folder. In my radhuntgroup table, I have the nasip and groupname = NetworkA Then, in the authorize section of my default host, I put: update request { Huntgroup-Name := "%{sql:SELECT `groupname` FROM `radhuntgroup` WHERE nasipaddress='%{NAS-IP-Address}'}" } if (Huntgroup-Name == ''){ reject } All as per the tutorial In my debug log, if there is no match by IP, Huntgroup-Name is blank and the user is rejected. However, if the nasip address match but the name is different, the user is still allowed on. Do I need a more advanced query in the if section and if so,could you please advise what it should be Simon -- View this message in context: http://freeradius.1045715.n5.nabble.com/Huntgroup-Checking-tp4950385p495038… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Re: rlm_perl authentication override
by Henry 20 Nov '12

20 Nov '12

Quoting tnt(a)kalik.net: >>>> Is there a way to change the reply from Access-Reject, to Access-Accept? >>>> > > Change freeradius.internal attribute Packet-Type in Post-Auth-Type Reject > section. Changing freeradius.internal Packet-Type from Access-Reject to Access-Accept would affect ALL logins - even logins which *should* be rejected. I'm referring to changing Access-Reject to Access-Accept under certain circumstances only -- not globally for all logins. ...or am I misunderstanding what you're suggesting? Thanks Henry

5 13

RE: Wimax with Free radius
by Mulindwa 10 Aug '12

10 Aug '12

Hallo there, i have an issue with my wimax setup, am trying to have my users authenticate using the wonderful freeradius but still failing. Am suing WASN9970 and using freeradius 2.1.12, When i turn on radius using radius-X, this is what i get, and client never authenticates someone please come to my rescue istening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 196.0.4.18 port 1812, id=250, length=187 User-Name = "gulucdp@utmax" NAS-IP-Address = 192.168.224.70 Calling-Station-Id = "6416f00100e1" NAS-Identifier = "WASN9770" Event-Timestamp = "Mar 5 2012 09:14:53 EAT" EAP-Message = 0x020100120167756c756364704075746d6178 WiMAX-Release = "1.1" WiMAX-Accounting-Capabilities = Flow-Based WiMAX-BS-Id = 0x303030303038316235393030 WiMAX-GMT-Timezone-offset = 10800 NAS-Port-Type = Wireless-802.16 WiMAX-Available-In-Client = 3 Service-Type = Framed-User Message-Authenticator = 0x143b601c01eca1d4595511b0a81c0d78 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/196.0.4.18/auth-detail-20120305 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/196.0.4.18/auth-detail-20120305 [auth_log] expand: %t -> Mon Mar 5 08:59:56 2012 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop ++[wimax] returns ok [suffix] Looking up realm "utmax" for User-Name = "gulucdp@utmax" [suffix] Found realm "utmax" [suffix] Adding Realm = "utmax" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 125 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 250 to 196.0.4.18 port 1812 Service-Type = Framed-User Framed-Protocol = PPP Framed-Address = 255.255.255.254 Framed-Netmask = 255.255.255.255 EAP-Message = 0x0102001604101bd377e252fa3b4f59a9210cb6a3fdfb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0dc4c5bf0dc6c1ff885e3d68e8e55b4e Finished request 0. Eric M

7 34

Freeradius 2 , TTLS/PAP, multiples questions
by Jérôme BERTHIER 19 Jun '12

19 Jun '12

Hi, I'm trying to configure Freeradius 2 to implement EAP/TTLS-PAP authentication method on my Cisco AP1242. It works but I'd like some precisions to get configuration files as small as possible. What is the shortest way to configure it ? authorize { preprocess auth_log suffix eap { ok = return } files ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } eap } Are the lines correct ? Moreover, I've got trouble to implement few functions. First, what's the right way to implement check for Simultaneous-Use ? For cisco nas type, Freeradius seems to use snmp check but where should I configure SNMP read community in order to make it possible ? Then, during EAP process, is it possible to check if inner identity equal outer identity and if not to reject request ? Finally, I've got problem with NetworkManager under Fedora 9 (not tested on other distribution). If Session resumption / fast reauthentication cache is not enabled, clients can't reassociate and ask for session resumption again. Is there a workaround ? Thanks -- Jérôme BERTHIER Network administrator INRIA Bordeaux - Sud-Ouest Service des Moyens Informatiques 05 24 57 40 50

4 8

EAP-TTLS-PAP-LDAP
by Rohaizam Abu Bakar 12 Jun '12

12 Jun '12

Trying to do EAP-TTLS-PAP with CRYPT passwd in LDAP.. The tunelling seems fine.. but up to comparing the password it will failed. Refer below logs & config Some says (http://felipe-alfaro.org/blog/category/radius/) PAP is tunneled inside EAP-TTLS through EAP-GTC... Tried that as well.. still same error.. gtc { auth_type = PAP [even trying to change to LDAP/OCE - still same error) } Error ==== auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [jaroce2(a)ocemy015.com] (from client localhost port 0) TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 9 modcall: leaving group authenticate (returns invalid) for request 9 auth: Failed to validate the user. Login incorrect: [jaroce2(a)ocemy015.com] (from client OCE_JARING port 241 cli 00-11-5b-2d-b2-8e) With setting:- a) radiusd.conf ldapOCE { --some setting } authorize { eap Autz-Type OCE { ldapOCE } } authenticate { Auth-Type OCE { ldapOCE } eap } b) eap.conf eap { default_eap_type = ttls tls { --some setting } ttls { default_eap_type = md5 } c) users:- DEFAULT Realm == "my015.com", Autz-Type := OCE

9 16

MSCHAPv2 followed by a smsotp authentication
by Thomas Glanzmann 08 Jun '12

08 Jun '12

Hello, I have a propiertary radius client which I want to authenticate against freeradius the following way: - User types is username: directory\Administrator password:secret - Freeradius authenticates against active directory. This already works - From the documentation of the propiertary radius client: After authenticating to RADIUS, you may get another prompt if the RADIUS server responded with a supported Access Challenge. Full generic RADIUS challenge/response is not supported, but a limited access challenge for a string token code is supported. - So now I want freeradius to send 'Access Challenge' and send a sms to the user (for that purpose I wrote a perl daemon which listens on a unix socket in order to talk to smsotp freeradius module)[1]. However nothing comes in. I configured freeradius the following way: sites-enabled/default: authorize { smsotp mschap } authenticate { mschap Auth-Type smsotp { mschap smsotp } Auth-Type smsotp-reply { smsotp } } users: DEFAULT Auth-Type = smsotp radius -X output here: http://thomas.glanzmann.de/tmp/radius-x.txt [1] smsotpd: http://thomas.glanzmann.de/tmp/smsotpd.pl And now my questions: - Is it possible to do a mschapv2 authentication followed by Access challenge in order to send out a sms with a one time password by configuring freeradius or do I need to code? Where do I find pointers? I read the source code of the smsotp and the rlm_example module, I get the basic idea that first the otp is generated and than it is checked, however I don't get how to configure freeradius to choose the codepath. I also don't get if it is possible to stack authentication methods in freeradius. Cheers, Thomas

3 22

logintime attribute - most specific time
by jomajo 11 May '12

11 May '12

Hello. I found an old example here how to set logintime attributes , http://www.gnu.org/software/radius/manual/html_node/radius_236.html . But maybe you know how to set logintime for the specific day of month / month / year ? Etc. this attribute says that user can login at this time : 2012/04/17/1700-1800 Thank you for the information! -- View this message in context: http://freeradius.1045715.n5.nabble.com/logintime-attribute-most-specific-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 8

[EAP-TLS Windows 7] Problem with chain certificate on the client side
by jinx_20 04 May '12

04 May '12

Hi all, My PKI infrastructure is hierarchical, meaning that client certificate path looks like below: ROOT_CA->Sub1_CA->Sub2_CA->Client_Cert Client_Cert & Sub2_CA purposes are set correctly. After I import client certificate (client.p12) into the Windows Cert Store the following events occur: -Root CA cert is imported into the Trusted Root CAs, -every sub CA cert (Sub1 CA & Sub2 CA) is imported into the Intermediate CAs, -user's cert is imported into Personal Certificates, I can't connect.... As soon as I delete Sub2 CA (that is, the CA certificate of the certificate authority which issued client's certificate) I am able to connect successfully. I suspect that Windows 7 supplicant sends entire chain of client certificate to FreeRadius server what makes it confused. I suppose that FreeRadius cannot verify Sub2_CA certificate received from the client because its purpose is not "Client Auth". As a result FreeRadius outputs the following message: *--> verify error:num=26:unsupported certificate purpose [tls] >>> TLS 1.0 Alert [length 0002], fatal unsupported_certificate TLS Alert write:fatal:unsupported certificate TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation* Below you can find two debug outputs. First one represents situation when Sub2 CA is present in the Intermediate CAs Store and another one shows the case when Sub2 CA was deleted. Additionally, CA_file in the eap.conf is set to ${cadir}/Sub2_CA_*entire_chain*.pem When I try to connect from linux machine everything works great (wpa supplicant doesn't send entire client's certificate chain toward radius server, it sends only client cert - the last cert from the chain). The problem arised while connecting from Windows 7 machine. Is there any way to configure FreeRadius server to explicitly accept intermediate CAs received from the client supplicant? Appreciate any hints. Gabriel ############################################### ################## FAILD ###################### ################## FAILD ###################### ############################################### rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=182, length=193 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 182 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=183, length=298 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 105 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 95 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 005a], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 0578], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00f9], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 183 to 172.16.16.1 port 32770 EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=184, length=199 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 184 to 172.16.16.1 port 32770 EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=185, length=1695 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 5695 [tls] Received EAP-TLS First Fragment of the message [tls] eaptls_verify returned 9 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 185 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=186, length=1695 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] More fragments to follow [tls] eaptls_verify returned 10 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 186 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=187, length=1695 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] More fragments to follow [tls] eaptls_verify returned 10 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 187 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=188, length=1448 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 13f3], Certificate --> verify error:num=26:unsupported certificate purpose [tls] >>> TLS 1.0 Alert [length 0002], fatal unsupported_certificate TLS Alert write:fatal:unsupported certificate TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 2762_hd.test6 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 188 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF Waking up in 3.9 seconds. Cleaning up request 0 ID 182 with timestamp +23 Cleaning up request 1 ID 183 with timestamp +23 Cleaning up request 2 ID 184 with timestamp +23 Cleaning up request 3 ID 185 with timestamp +23 Cleaning up request 4 ID 186 with timestamp +23 Cleaning up request 5 ID 187 with timestamp +23 Waking up in 1.0 seconds. Cleaning up request 6 ID 188 with timestamp +23 Ready to process requests. ############################################### ################## ACCEPT ###################### ################## ACCEPT ###################### ############################################### rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=189, length=193 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 189 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=190, length=298 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 105 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 95 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 005a], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 0578], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00f9], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 190 to 172.16.16.1 port 32770 EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=191, length=199 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 191 to 172.16.16.1 port 32770 EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=192, length=1695 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 2193 [tls] Received EAP-TLS First Fragment of the message [tls] eaptls_verify returned 9 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 192 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=193, length=914 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 0645], Certificate [tls] chain-depth=3, [tls] error=0 [tls] --> User-Name = 2762_hd.test6 [tls] --> BUF-Name = SNAKE OIL ROOT CA [tls] --> subject = /CN=SNAKE OIL ROOT CA/OU=Digital Certificate Services/O=Snake Oil Company/C=PL [tls] --> issuer = /CN=SNAKE OIL ROOT CA/OU=Digital Certificate Services/O=Snake Oil Company/C=PL [tls] --> verify return:1 [tls] chain-depth=2, [tls] error=0 [tls] --> User-Name = 2762_hd.test6 [tls] --> BUF-Name = SNAKE OIL CA [tls] --> subject = /CN=SNAKE OIL CA/O=Snake Oil Company 2/C=PL [tls] --> issuer = /CN=SNAKE OIL ROOT CA/OU=Digital Certificate Services/O=Snake Oil Company/C=PL [tls] --> verify return:1 [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = 2762_hd.test6 [tls] --> BUF-Name = SNAKE OIL WIFI CA [tls] --> subject = /CN=SNAKE OIL WIFI CA/O=Snake Oil Company 2/C=PL [tls] --> issuer = /CN=SNAKE OIL CA/O=Snake Oil Company 2/C=PL [tls] --> verify return:1 [tls] Verifying client certificate: /etc/freeradius/geppetto.sh %{TLS-Client-Cert-Filename} %{Called-Station-Id} [tls] expand: %{TLS-Client-Cert-Filename} -> /tmp/radiusd/freeradius.client.XXnI1oCe [tls] expand: %{Called-Station-Id} -> XX-XX-XX-XX-XX-XX:SSID + GREP=/bin/grep + LDAP=/usr/bin/ldapsearch + OPENSSL=/usr/bin/openssl + cp /tmp/radiusd/freeradius.client.XXnI1oCe /tmp/ + exit 0 Exec-Program output: Exec-Program: returned: 0 [tls] Client certificate CN 2762_hd.test6 passed external validation [tls] chain-depth=0, [tls] error=0 [tls] --> User-Name = 2762_hd.test6 [tls] --> BUF-Name = 2762_hd.test6 [tls] --> subject = /emailAddress=2762_hd.test6@snakeoil.com/CN=2762_hd.test6/GN=HD/SN=Test6/OU=Operations/OU=HelpDesk/O=Snake Oil Company [tls] --> issuer = /CN=SNAKE OIL WIFI CA/O=Snake Oil Company 2/C=PL [tls] --> verify return:1 [tls] TLS_accept: SSLv3 read client certificate A [tls] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [tls] TLS_accept: SSLv3 read client key exchange A [tls] <<< TLS 1.0 Handshake [length 0106], CertificateVerify [tls] TLS_accept: SSLv3 read certificate verify A [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [tls] <<< TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 read finished A [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [tls] TLS_accept: SSLv3 write change cipher spec A [tls] >>> TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 write finished A [tls] TLS_accept: SSLv3 flush data [tls] (other): SSL negotiation finished successfully SSL Connection Established [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 193 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=194, length=199 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake is finished [tls] eaptls_verify returned 3 [tls] eaptls_process returned 3 [tls] Adding user data to cached session [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 194 to 172.16.16.1 port 32770 MS-MPPE-Recv-Key = 0xFF MS-MPPE-Send-Key = 0xFF EAP-Message = 0xFF Message-Authenticator = 0xFF User-Name = "2762_hd.test6" Finished request 5. Going to the next request Waking up in 4.9 seconds. -- View this message in context: http://freeradius.1045715.n5.nabble.com/EAP-TLS-Windows-7-Problem-with-chai… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 13