Hi,
>> I'm new to RADIUS servers and I'm trying to enable EAP-FAST. Is there a
>> documentation I can use to enable it? I'm using version 3.0.12.
> The documentation in the EAP module is all you need.
>> Anyway, this is what I've done.
> That should work.
>> I don't know where to look at in the debug output but shown below is part
>> of it.
>>
>> (9) eap_fast: Got tunneled Access-Reject
>> (9) eap_fast: Reject
>> (9) eap: ERROR: Failed continuing EAP FAST (43) session. EAP sub-module
>> failed
> Well... look at the *earlier* messages to see what's wrong. If you're
running it in a terminal, the error message will even be colourised to show
importance.
I'm seeing another error, MS-CHAP2-Response is failing. And there are
warnings also shown. Please help me solve this. Thanks.
(8) eap_fast: WARNING: AUTHENTICATION
(8) eap_fast: WARNING: AUTHENTICATION
(8) WARNING: Outer and inner identities are the same. User privacy is
compromised.
(9) mschap: ERROR: MS-CHAP2-Response is incorrect
(9) eap: ERROR: Failed continuing EAP FAST (43) session. EAP sub-module
failed
Shown below in a snippet of the debug output.
(8) Received Access-Request Id 120 from 10.30.32.46:3073 to 10.30.32.40:1812
length 221
(8) User-Name = "bob"
(8) NAS-Port = 0
(8) Called-Station-Id = "14-D6-4D-C7-DC-88:DLINK-SDESQE-EAP-2"
(8) Calling-Station-Id = "00-AE-FA-9C-FF-FC"
(8) Framed-MTU = 1400
(8) NAS-Port-Type = Wireless-802.11
(8) Connect-Info = "CONNECT 11Mbps 802.11b"
(8) EAP-Message =
0x020b003b2b011703010030395790f43e1b9dcf131fb7f74983d279244d9ae2493d1ca9270a9ef434fcafc937b4fcf9cb3e0fc8390047a796569cf6
(8) State = 0xd951d3a9dd5af8abc01e99543ad15de0
(8) Message-Authenticator = 0x52eec993910273fb7aa3ece5018c83fe
(8) session-state: No cached attributes
(8) # Executing section authorize from file
/usr/local/etc/raddb/sites-enabled/default
(8) authorize {
(8) policy filter_username {
(8) if (&User-Name) {
(8) if (&User-Name) -> TRUE
(8) if (&User-Name) {
(8) if (&User-Name =~ / /) {
(8) if (&User-Name =~ / /) -> FALSE
(8) if (&User-Name =~ /@[^@]*@/ ) {
(8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(8) if (&User-Name =~ /\.\./ ) {
(8) if (&User-Name =~ /\.\./ ) -> FALSE
(8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(8) if (&User-Name =~ /\.$/) {
(8) if (&User-Name =~ /\.$/) -> FALSE
(8) if (&User-Name =~ /(a)\./) {
(8) if (&User-Name =~ /(a)\./) -> FALSE
(8) } # if (&User-Name) = notfound
(8) } # policy filter_username = notfound
(8) [preprocess] = ok
(8) [chap] = noop
(8) [mschap] = noop
(8) [digest] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: No '@' in User-Name = "bob", looking up realm NULL
(8) suffix: No such realm "NULL"
(8) [suffix] = noop
(8) eap: Peer sent EAP Response (code 2) ID 11 length 59
(8) eap: No EAP Start, assuming it's an on-going EAP conversation
(8) [eap] = updated
(8) files: users: Matched entry bob at line 87
(8) [files] = ok
(8) [expiration] = noop
(8) [logintime] = noop
(8) pap: WARNING: Auth-Type already set. Not setting to PAP
(8) [pap] = noop
(8) } # authorize = updated
(8) Found Auth-Type = eap
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(8) authenticate {
(8) eap: Expiring EAP session with state 0x592fa0ee5b2c8b60
(8) eap: Finished EAP session with state 0xd951d3a9dd5af8ab
(8) eap: Previous EAP request found for state 0xd951d3a9dd5af8ab, released
from the list
(8) eap: Peer sent packet with method EAP FAST (43)
(8) eap: Calling submodule eap_fast to process data
(8) eap_fast: Authenticate
(8) eap_fast: Continuing EAP-TLS
(8) eap_fast: [eaptls verify] = ok
(8) eap_fast: Done initial handshake
(8) eap_fast: [eaptls process] = ok
(8) eap_fast: Session established. Proceeding to decode tunneled attributes
(8) eap_fast: Got Tunneled FAST TLVs
(8) eap_fast: FreeRADIUS-EAP-FAST-EAP-Payload = 0x020b000801626f62
(8) eap_fast: Processing received EAP Payload
(8) eap_fast: Got tunneled request
(8) eap_fast: EAP-Message = 0x020b000801626f62
(8) eap_fast: Got tunneled identity of bob
(8) eap_fast: WARNING: AUTHENTICATION
(8) eap_fast: WARNING: AUTHENTICATION
(8) Virtual server inner-tunnel received request
(8) EAP-Message = 0x020b000801626f62
(8) FreeRADIUS-Proxied-To = 127.0.0.1
(8) User-Name = "bob"
(8) WARNING: Outer and inner identities are the same. User privacy is
compromised.
(8) server inner-tunnel {
(8) # Executing section authorize from file
/usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) authorize {
(8) policy filter_username {
(8) if (&User-Name) {
(8) if (&User-Name) -> TRUE
(8) if (&User-Name) {
(8) if (&User-Name =~ / /) {
(8) if (&User-Name =~ / /) -> FALSE
(8) if (&User-Name =~ /@[^@]*@/ ) {
(8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(8) if (&User-Name =~ /\.\./ ) {
(8) if (&User-Name =~ /\.\./ ) -> FALSE
(8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/))
-> FALSE
(8) if (&User-Name =~ /\.$/) {
(8) if (&User-Name =~ /\.$/) -> FALSE
(8) if (&User-Name =~ /(a)\./) {
(8) if (&User-Name =~ /(a)\./) -> FALSE
(8) } # if (&User-Name) = notfound
(8) } # policy filter_username = notfound
(8) [chap] = noop
(8) [mschap] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: No '@' in User-Name = "bob", looking up realm NULL
(8) suffix: No such realm "NULL"
(8) [suffix] = noop
(8) update control {
(8) &Proxy-To-Realm := LOCAL
(8) } # update control = noop
(8) eap: Peer sent EAP Response (code 2) ID 11 length 8
(8) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the
rest of authorize
(8) [eap] = ok
(8) } # authorize = ok
(8) Found Auth-Type = eap
(8) # Executing group from file
/usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) authenticate {
(8) eap: Peer sent packet with method EAP Identity (1)
(8) eap: Calling submodule eap_mschapv2 to process data
(8) eap_mschapv2: Issuing Challenge
(8) eap: Sending EAP Request (code 1) ID 12 length 43
(8) eap: EAP session adding &reply:State = 0xcd5f27e3cd533d7f
(8) [eap] = handled
(8) } # authenticate = handled
(8) } # server inner-tunnel
(8) Virtual server sending reply
(8) EAP-Message =
0x010c002b1a010c002610fba8fb3aac28c0bc78ca631f320436b6667265657261646975732d332e302e3132
(8) Message-Authenticator = 0x00000000000000000000000000000000
(8) State = 0xcd5f27e3cd533d7f53bfae26bc7d5c8e
(8) eap_fast: Got tunneled Access-Challenge
(8) eap_fast: Challenge
(8) eap: Sending EAP Request (code 1) ID 12 length 91
(8) eap: EAP session adding &reply:State = 0xd951d3a9dc5df8ab
(8) [eap] = handled
(8) } # authenticate = handled
(8) Using Post-Auth-Type Challenge
(8) Post-Auth-Type sub-section not found. Ignoring.
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(8) Sent Access-Challenge Id 120 from 10.30.32.40:1812 to 10.30.32.46:3073
length 0
(8) EAP-Message =
0x010c005b2b0117030100505c32d6e574493d1fae7ed03024b6391b56fd8373b43e14b9908313ec682d1b783b962518a2f3666e7f13f843f37e6f924435d3d074119b47d571473c95478d5cfcc443fea1145ff781a807b56b7ccbe1
(8) Message-Authenticator = 0x00000000000000000000000000000000
(8) State = 0xd951d3a9dc5df8abc01e99543ad15de0
(8) Finished request
Waking up in 4.2 seconds.
(9) Received Access-Request Id 121 from 10.30.32.46:3073 to 10.30.32.40:1812
length 269
(9) User-Name = "bob"
(9) NAS-Port = 0
(9) Called-Station-Id = "14-D6-4D-C7-DC-88:DLINK-SDESQE-EAP-2"
(9) Calling-Station-Id = "00-AE-FA-9C-FF-FC"
(9) Framed-MTU = 1400
(9) NAS-Port-Type = Wireless-802.11
(9) Connect-Info = "CONNECT 11Mbps 802.11b"
(9) EAP-Message =
0x020c006b2b011703010060fe42e1f967e18b8037a3c0dc98b2488f66fa4c0f9eb383d19e0632cf01ec98325fbb3eeb5c6f503235e424c8ae20a288d039334e277fc5c34a28d2308b03a2f750b82b736652de1faaf697bdd5171a70727aebda1f253487ef0dd7d9c1d73505
(9) State = 0xd951d3a9dc5df8abc01e99543ad15de0
(9) Message-Authenticator = 0xf2df5a7c3c9352285f1942cc3e56db7b
(9) session-state: No cached attributes
(9) # Executing section authorize from file
/usr/local/etc/raddb/sites-enabled/default
(9) authorize {
(9) policy filter_username {
(9) if (&User-Name) {
(9) if (&User-Name) -> TRUE
(9) if (&User-Name) {
(9) if (&User-Name =~ / /) {
(9) if (&User-Name =~ / /) -> FALSE
(9) if (&User-Name =~ /@[^@]*@/ ) {
(9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(9) if (&User-Name =~ /\.\./ ) {
(9) if (&User-Name =~ /\.\./ ) -> FALSE
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(9) if (&User-Name =~ /\.$/) {
(9) if (&User-Name =~ /\.$/) -> FALSE
(9) if (&User-Name =~ /(a)\./) {
(9) if (&User-Name =~ /(a)\./) -> FALSE
(9) } # if (&User-Name) = notfound
(9) } # policy filter_username = notfound
(9) [preprocess] = ok
(9) [chap] = noop
(9) [mschap] = noop
(9) [digest] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: No '@' in User-Name = "bob", looking up realm NULL
(9) suffix: No such realm "NULL"
(9) [suffix] = noop
(9) eap: Peer sent EAP Response (code 2) ID 12 length 107
(9) eap: No EAP Start, assuming it's an on-going EAP conversation
(9) [eap] = updated
(9) files: users: Matched entry bob at line 87
(9) [files] = ok
(9) [expiration] = noop
(9) [logintime] = noop
(9) pap: WARNING: Auth-Type already set. Not setting to PAP
(9) [pap] = noop
(9) } # authorize = updated
(9) Found Auth-Type = eap
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(9) authenticate {
(9) eap: Expiring EAP session with state 0x592fa0ee5b2c8b60
(9) eap: Finished EAP session with state 0xd951d3a9dc5df8ab
(9) eap: Previous EAP request found for state 0xd951d3a9dc5df8ab, released
from the list
(9) eap: Peer sent packet with method EAP FAST (43)
(9) eap: Calling submodule eap_fast to process data
(9) eap_fast: Authenticate
(9) eap_fast: Continuing EAP-TLS
(9) eap_fast: [eaptls verify] = ok
(9) eap_fast: Done initial handshake
(9) eap_fast: [eaptls process] = ok
(9) eap_fast: Session established. Proceeding to decode tunneled attributes
(9) eap_fast: Got Tunneled FAST TLVs
(9) eap_fast: FreeRADIUS-EAP-FAST-EAP-Payload =
0x020c003e1a020c0039310000000000000000000000000000000000000000000000002f87a8fd680c8c2541e34eb0ae6de571dcc6da7cb15872c900626f62
(9) eap_fast: Processing received EAP Payload
(9) eap_fast: Got tunneled request
(9) eap_fast: EAP-Message =
0x020c003e1a020c0039310000000000000000000000000000000000000000000000002f87a8fd680c8c2541e34eb0ae6de571dcc6da7cb15872c900626f62
(9) eap_fast: WARNING: AUTHENTICATION
(9) eap_fast: WARNING: AUTHENTICATION
(9) Virtual server inner-tunnel received request
(9) EAP-Message =
0x020c003e1a020c0039310000000000000000000000000000000000000000000000002f87a8fd680c8c2541e34eb0ae6de571dcc6da7cb15872c900626f62
(9) FreeRADIUS-Proxied-To = 127.0.0.1
(9) User-Name = "bob"
(9) State = 0xcd5f27e3cd533d7f53bfae26bc7d5c8e
(9) WARNING: Outer and inner identities are the same. User privacy is
compromised.
(9) server inner-tunnel {
(9) session-state: No cached attributes
(9) # Executing section authorize from file
/usr/local/etc/raddb/sites-enabled/inner-tunnel
(9) authorize {
(9) policy filter_username {
(9) if (&User-Name) {
(9) if (&User-Name) -> TRUE
(9) if (&User-Name) {
(9) if (&User-Name =~ / /) {
(9) if (&User-Name =~ / /) -> FALSE
(9) if (&User-Name =~ /@[^@]*@/ ) {
(9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(9) if (&User-Name =~ /\.\./ ) {
(9) if (&User-Name =~ /\.\./ ) -> FALSE
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/))
-> FALSE
(9) if (&User-Name =~ /\.$/) {
(9) if (&User-Name =~ /\.$/) -> FALSE
(9) if (&User-Name =~ /(a)\./) {
(9) if (&User-Name =~ /(a)\./) -> FALSE
(9) } # if (&User-Name) = notfound
(9) } # policy filter_username = notfound
(9) [chap] = noop
(9) [mschap] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: No '@' in User-Name = "bob", looking up realm NULL
(9) suffix: No such realm "NULL"
(9) [suffix] = noop
(9) update control {
(9) &Proxy-To-Realm := LOCAL
(9) } # update control = noop
(9) eap: Peer sent EAP Response (code 2) ID 12 length 62
(9) eap: No EAP Start, assuming it's an on-going EAP conversation
(9) [eap] = updated
(9) files: users: Matched entry bob at line 87
(9) [files] = ok
(9) [expiration] = noop
(9) [logintime] = noop
(9) pap: WARNING: Auth-Type already set. Not setting to PAP
(9) [pap] = noop
(9) } # authorize = updated
(9) Found Auth-Type = eap
(9) # Executing group from file
/usr/local/etc/raddb/sites-enabled/inner-tunnel
(9) authenticate {
(9) eap: Expiring EAP session with state 0x592fa0ee5b2c8b60
(9) eap: Finished EAP session with state 0xcd5f27e3cd533d7f
(9) eap: Previous EAP request found for state 0xcd5f27e3cd533d7f, released
from the list
(9) eap: Peer sent packet with method EAP MSCHAPv2 (26)
(9) eap: Calling submodule eap_mschapv2 to process data
(9) eap_mschapv2: # Executing group from file
/usr/local/etc/raddb/sites-enabled/inner-tunnel
(9) eap_mschapv2: authenticate {
(9) mschap: Found Cleartext-Password, hashing to create NT-Password
(9) mschap: Found Cleartext-Password, hashing to create LM-Password
(9) mschap: Creating challenge hash with username: bob
(9) mschap: Client is using MS-CHAPv2
(9) mschap: ERROR: MS-CHAP2-Response is incorrect
(9) [mschap] = reject
(9) } # authenticate = reject
(9) eap: Sending EAP Failure (code 4) ID 12 length 4
(9) eap: Freeing handler
(9) [eap] = reject
(9) } # authenticate = reject
(9) Failed to authenticate the user
(9) Using Post-Auth-Type Reject
(9) # Executing group from file
/usr/local/etc/raddb/sites-enabled/inner-tunnel
(9) Post-Auth-Type REJECT {
(9) attr_filter.access_reject: EXPAND %{User-Name}
(9) attr_filter.access_reject: --> bob
(9) attr_filter.access_reject: Matched entry DEFAULT at line 11
(9) [attr_filter.access_reject] = updated
(9) update outer.session-state {
(9) &Module-Failure-Message := &request:Module-Failure-Message ->
'mschap: MS-CHAP2-Response is incorrect'
(9) } # update outer.session-state = noop
(9) } # Post-Auth-Type REJECT = updated
(9) } # server inner-tunnel
(9) Virtual server sending reply
(9) MS-CHAP-Error = "\014E=691 R=1 C=4a33d9cc35a85083c14a907490347b3c V=3
M=Authentication failed"
(9) EAP-Message = 0x040c0004
(9) Message-Authenticator = 0x00000000000000000000000000000000
(9) eap_fast: Got tunneled Access-Reject
(9) eap_fast: Reject
(9) eap: ERROR: Failed continuing EAP FAST (43) session. EAP sub-module
failed
(9) eap: Sending EAP Failure (code 4) ID 12 length 4
(9) eap: Failed in EAP select
(9) [eap] = invalid
(9) } # authenticate = invalid
(9) Failed to authenticate the user
(9) Using Post-Auth-Type Reject
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(9) Post-Auth-Type REJECT {
(9) attr_filter.access_reject: EXPAND %{User-Name}
(9) attr_filter.access_reject: --> bob
(9) attr_filter.access_reject: Matched entry DEFAULT at line 11
(9) [attr_filter.access_reject] = updated
(9) [eap] = noop
(9) policy remove_reply_message_if_eap {
(9) if (&reply:EAP-Message && &reply:Reply-Message) {
(9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(9) else {
(9) [noop] = noop
(9) } # else = noop
(9) } # policy remove_reply_message_if_eap = noop
(9) } # Post-Auth-Type REJECT = updated
(9) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(9) Sending delayed response
(9) Sent Access-Reject Id 121 from 10.30.32.40:1812 to 10.30.32.46:3073
length 44
(9) EAP-Message = 0x040c0004
(9) Message-Authenticator = 0x00000000000000000000000000000000
