- Freeradius-Users - lists.freeradius.org

ntlm_auth and mschap doc diffs
by Gary Gatten 12 May '11

12 May '11

Hello, There are some minor diffs between the doc on "deployingradius.com" and the embedded doc in the mschap module. Which one should I use? Specifically, what is the "correct" ntlm_auth command string, and should I enable the "with_ntdomain_hack" in the mschap module? TIA! Gary <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 1

FreeRADIUS compatibility with OpenSSL
by Nitin Bhardwaj 12 May '11

12 May '11

Hi, FreeRADIUS crashes with a segmentation fault when running with openssl-1.0.0, while handling PEAP tunnel. (Both ver 2.x as well as 3.0.0), However it works fine with openssl 0.9.8x My question is - what version of openssl is FreeRADIUS compatible with to build and link ? -- Thanks, Nitin

2 1

LGPLv2 and GPLv2 licenses of freeradius-server-src-lib.
by Raja Sekhar Manchikalapudi 12 May '11

12 May '11

Hi, While browsing the code in the distribution of the free-radius server, have observed that the .../src/lib folder (files like radius.c) is licensed under LGPLv2 where as its corresponding header files (specifically libradius.h) are licensed with GPLv2 ? This kind of different licensing for the same library is done with purpose ? I was thinking the header files required for the library also to be available under LGPLv2 ... Can somebody clarify how to use the LGPLv2 source (library) with out violating the licensing ? Thanks, Sekhar.

2 1

Install new version (2.1.10) to completely different location
by Gary Gatten 12 May '11

12 May '11

Good morning, I'm wanting to upgrade to 2.1.10, however, I want to install *all* files to a different location so I don't overwrite *any* 2.1.6 production files. Once I've validated operation on 2.1.10 I'll install it to it's normal location. So, if I specify -prefix=/devel/; will this work OK for what I'm wanting - or do I need to take other actions as well, such as: --with-radacctdir= and --with-raddbdir=, etc.? TIA! Gary <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

5 9

Bug in proxy code with IPv6?
by Stefan Winter 12 May '11

12 May '11

Hello, this is about 2.1.10. In my proxy.conf, I have two clauses for a host ( see [1] and [2] below), once with ipaddr for IPv4 and once with ipv6addr for IPv6. If I set the pool to use the IPv4 one (see [3]) , packets get proxied just fine. If I replace with IPv6, no packet leaves the server (i.e. tcpdump on the FR machine sees no packet leaving) [4]. With tcpdump not seeing anything, I'm pretty sure that something's wrong inside FR - i.e. not a firewall problem. Host firewall is off anyway. In -X [5], the server *says* it's going to proxy the packet, but a simultaneous tcpdump just doesn't see it, and there's no auth happening. As soon as I change the proxy pool definition back to the v4 variant, things start working again. That's a bit strange... Greetings, Stefan Winter [1] IPv4 proxy definition: home_server radius-int-1-v4 { type = auth+acct ipaddr = 158.64.X.Y port = 1812 secret = ............... response_window = 20 zombie_period = 40 revive_interval = 60 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } [2] IPv6 proxy defintiion: home_server radius-int-1-v6 { type = auth+acct ipv6addr = 2001:a18:X:Y::Z port = 1812 secret = .................. response_window = 20 zombie_period = 40 revive_interval = 60 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } [3] working pool (the non-working one only replaces -v4 with -v6): home_server_pool RESTENA-internal { type = fail-over home_server = radius-int-1-v4 home_server = ... more servers ... } [4] access point tries to auth user, packet goes into FR server, but nothing leaves; in non-proxy operation, server works nicely, see Status-Server reply: tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 14:45:50.592669 IP ap-2.rest.restena.lu.csd-monitor > galadriel.restena.lu.radius: RADIUS, Access Request (1), id: 0x24 length: 226 14:45:54.644141 IP ap-2.rest.restena.lu.csd-monitor > galadriel.restena.lu.radius: RADIUS, Access Request (1), id: 0x44 length: 226 14:45:55.590066 IP ap-2.rest.restena.lu.csd-monitor > galadriel.restena.lu.radius: RADIUS, Access Request (1), id: 0x24 length: 226 14:45:56.985799 IP haldir.restena.lu.59546 > galadriel.restena.lu.radius: RADIUS, Status Server (12), id: 0x00 length: 38 14:45:56.986208 IP galadriel.restena.lu.radius > haldir.restena.lu.59546: RADIUS, Access Accept (2), id: 0x00 length: 20 [5] -X: Ready to process requests. rad_recv: Access-Request packet from host 158.64.A.B port 3072, id=126, length=226 User-Name = "certuser-2010-001(a)restena.lu" Service-Type = Framed-User NAS-IP-Address = 158.64.A.B NAS-Port = 3 NAS-Port-Id = "3" Called-Station-Id = "00-A0-57-16-91-27:eduroam-restena" Calling-Station-Id = "64-B9-E8-A0-2E-A4" Connect-Info = "CONNECT 54 Mbps 802.11g" NAS-Identifier = "ap-2.rest" NAS-Port-Type = Wireless-802.11 Framed-MTU = 1500 EAP-Message = 0x020100210163657274757365722d323031302d3030314072657374656e612e6c75 Message-Authenticator = 0x181d5b6f8959d9d079807ea00c77bcbc server eduroam { # Executing section authorize from file /usr/local/freeradius/config//raddb/sites-enabled/eduroam +- entering group authorize {...} ++[request] returns notfound [auth_log] expand: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/auth-detail -> /var/log/radius/radacct/20110511/eduroam-lu-service/auth-detail [auth_log] /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/auth-detail expands to /var/log/radius/radacct/20110511/eduroam-lu-service/auth-detail [auth_log] expand: %t -> Wed May 11 14:57:05 2011 ++[auth_log] returns ok [suffix] Looking up realm "restena.lu" for User-Name = "certuser-2010-001(a)restena.lu" [suffix] Found realm "restena.lu" [suffix] Adding Realm = "restena.lu" [suffix] Proxying request from user certuser-2010-001 to realm restena.lu [suffix] Preparing to proxy authentication request to realm "restena.lu" ++[suffix] returns updated } # server eduroam # Executing section pre-proxy from file /usr/local/freeradius/config//raddb/sites-enabled/eduroam +- entering group pre-proxy {...} ++- entering policy cui_pre-proxy {...} +++? if (Packet-Type == Access-Request) ? Evaluating (Packet-Type == Access-Request) -> TRUE +++? if (Packet-Type == Access-Request) -> TRUE +++- entering if (Packet-Type == Access-Request) {...} expand: modules.sql[cui].sp_operator_name -> modules.sql[cui].sp_operator_name expand: 1%{config:modules.sql[cui].sp_operator_name} -> 1restena.lu ++++[proxy-request] returns noop +++- if (Packet-Type == Access-Request) returns noop ++- policy cui_pre-proxy returns noop [pre_proxy_log] expand: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/pre-proxy-detail -> /var/log/radius/radacct/20110511/eduroam-lu-service/pre-proxy-detail [pre_proxy_log] /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/pre-proxy-detail expands to /var/log/radius/radacct/20110511/eduroam-lu-service/pre-proxy-detail [pre_proxy_log] expand: %t -> Wed May 11 14:57:05 2011 ++[pre_proxy_log] returns ok ++? if (Packet-Type != Accounting-Request) ? Evaluating (Packet-Type != Accounting-Request) -> FALSE ++? if (Packet-Type != Accounting-Request) -> FALSE Sending Access-Request of id 235 to 2001:a18:X:Y::Z port 1812 User-Name = "certuser-2010-001(a)restena.lu" Service-Type = Framed-User NAS-IP-Address = 158.64.A.B NAS-Port = 3 NAS-Port-Id = "3" Called-Station-Id = "00-A0-57-16-91-27:eduroam-restena" Calling-Station-Id = "64-B9-E8-A0-2E-A4" Connect-Info = "CONNECT 54 Mbps 802.11g" NAS-Identifier = "ap-2.rest" NAS-Port-Type = Wireless-802.11 Framed-MTU = 1500 EAP-Message = 0x020100210163657274757365722d323031302d3030314072657374656e612e6c75 Message-Authenticator = 0x00000000000000000000000000000000 RESTENA-Service-Type = "eduroam-lu" Proxy-State = 0x313236 Chargeable-User-Identity = "" Operator-Name = "1restena.lu" Proxying request 0 to home server 2001:a18:X:Y::Z port 1812 Sending Access-Request of id 235 to 2001:a18:X:Y::Z port 1812 User-Name = "certuser-2010-001(a)restena.lu" Service-Type = Framed-User NAS-IP-Address = 158.64.A.B NAS-Port = 3 NAS-Port-Id = "3" Called-Station-Id = "00-A0-57-16-91-27:eduroam-restena" Calling-Station-Id = "64-B9-E8-A0-2E-A4" Connect-Info = "CONNECT 54 Mbps 802.11g" NAS-Identifier = "ap-2.rest" NAS-Port-Type = Wireless-802.11 Framed-MTU = 1500 EAP-Message = 0x020100210163657274757365722d323031302d3030314072657374656e612e6c75 Message-Authenticator = 0x00000000000000000000000000000000 RESTENA-Service-Type = "eduroam-lu" Proxy-State = 0x313236 Chargeable-User-Identity = "" Operator-Name = "1restena.lu" Going to the next request Waking up in 0.9 seconds. Waking up in 19.0 seconds. tcpdump: incoming from the AP, but no outgoing traffic. Just a few retries from AP. 14:57:05.912601 IP (tos 0x0, ttl 57, id 40049, offset 0, flags [none], proto UDP (17), length 254) ap-2.rest.restena.lu.csd-monitor > galadriel.restena.lu.radius: [udp sum ok] RADIUS, length: 226 Access Request (1), id: 0x7e, Authenticator: 3f3f3f3fbf7f9fef578be5d2e9542a15 Username Attribute (1), length: 30, Value: certuser-2010-001(a)restena.lu 0x0000: 6365 7274 7573 6572 2d32 3031 302d 3030 0x0010: 3140 7265 7374 656e 612e 6c75 Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 NAS IP Address Attribute (4), length: 6, Value: ap-2.rest.restena.lu 0x0000: 9e40 3322 NAS Port Attribute (5), length: 6, Value: 3 0x0000: 0000 0003 NAS Port ID Attribute (87), length: 3, Value: 3 0x0000: 33 Called Station Attribute (30), length: 35, Value: 00-A0-57-16-91-27:eduroam-restena 0x0000: 3030 2d41 302d 3537 2d31 362d 3931 2d32 0x0010: 373a 6564 7572 6f61 6d2d 7265 7374 656e 0x0020: 61 Calling Station Attribute (31), length: 19, Value: 64-B9-E8-A0-2E-A4 0x0000: 3634 2d42 392d 4538 2d41 302d 3245 2d41 0x0010: 34 Connect Info Attribute (77), length: 25, Value: CONNECT 54 Mbps 802.11g 0x0000: 434f 4e4e 4543 5420 3534 204d 6270 7320 0x0010: 3830 322e 3131 67 NAS ID Attribute (32), length: 11, Value: ap-2.rest 0x0000: 6170 2d32 2e72 6573 74 NAS Port Type Attribute (61), length: 6, Value: Wireless - IEEE 802.11 0x0000: 0000 0013 Framed MTU Attribute (12), length: 6, Value: 1500 0x0000: 0000 05dc EAP Message Attribute (79), length: 35, Value: .. 0x0000: 0201 0021 0163 6572 7475 7365 722d 3230 0x0010: 3130 2d30 3031 4072 6573 7465 6e61 2e6c 0x0020: 75 Message Authentication Attribute (80), length: 18, Value: ..[o.Y..y�~..w.. 0x0000: 181d 5b6f 8959 d9d0 7980 7ea0 0c77 bcbc 14:57:09.937572 IP (tos 0x0, ttl 57, id 40050, offset 0, flags [none], proto UDP (17), length 254) ap-2.rest.restena.lu.csd-monitor > galadriel.restena.lu.radius: [udp sum ok] RADIUS, length: 226 Access Request (1), id: 0x2a, Authenticator: 15aa550a8562b1783c1e0f2733b9fc7e Username Attribute (1), length: 30, Value: certuser-2010-001(a)restena.lu 0x0000: 6365 7274 7573 6572 2d32 3031 302d 3030 0x0010: 3140 7265 7374 656e 612e 6c75 Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 NAS IP Address Attribute (4), length: 6, Value: ap-2.rest.restena.lu 0x0000: 9e40 3322 NAS Port Attribute (5), length: 6, Value: 3 0x0000: 0000 0003 NAS Port ID Attribute (87), length: 3, Value: 3 0x0000: 33 Called Station Attribute (30), length: 35, Value: 00-A0-57-16-91-27:eduroam-restena 0x0000: 3030 2d41 302d 3537 2d31 362d 3931 2d32 0x0010: 373a 6564 7572 6f61 6d2d 7265 7374 656e 0x0020: 61 Calling Station Attribute (31), length: 19, Value: 64-B9-E8-A0-2E-A4 0x0000: 3634 2d42 392d 4538 2d41 302d 3245 2d41 0x0010: 34 Connect Info Attribute (77), length: 25, Value: CONNECT 54 Mbps 802.11g 0x0000: 434f 4e4e 4543 5420 3534 204d 6270 7320 0x0010: 3830 322e 3131 67 NAS ID Attribute (32), length: 11, Value: ap-2.rest 0x0000: 6170 2d32 2e72 6573 74 NAS Port Type Attribute (61), length: 6, Value: Wireless - IEEE 802.11 0x0000: 0000 0013 Framed MTU Attribute (12), length: 6, Value: 1500 0x0000: 0000 05dc EAP Message Attribute (79), length: 35, Value: .. 0x0000: 0202 0021 0163 6572 7475 7365 722d 3230 0x0010: 3130 2d30 3031 4072 6573 7465 6e61 2e6c 0x0020: 75 Message Authentication Attribute (80), length: 18, Value: yVD........P.H{ 0x0000: 7956 447f b7f5 c70d 8af0 1715 50e5 487b 14:57:10.910074 IP (tos 0x0, ttl 57, id 40051, offset 0, flags [none], proto UDP (17), length 254) ap-2.rest.restena.lu.csd-monitor > galadriel.restena.lu.radius: [udp sum ok] RADIUS, length: 226 -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 4

MSCHAP failing on new 2.1.10 install
by Gary Gatten 12 May '11

12 May '11

PAP works, MSCHAP fails - specifically MSCHAPv2. This is a fresh install of 2.1.10, built from source. I'm using ntlm_auth; samba version 3.0.33-3.7.el5 I also have version 2.1.6 running on the same box and it "mostly" works: seems to work with everything except Winblows7, hence I installed 2.1.10 in a different dir structure and it's listening on different ports. I just tested a login using the same user account and pw; works great on 2.1.6 but fails on 2.1.10. I've tried 4 or 5 different command strings for ntlm_auth - no go. It's as if mschap is not using ntlm_auth, but not sure. I'll keep checking and googling, but any hints would be appreciated! TIA! Gary I've changed only the minimum from the default, clients.conf and the recommended for integrating with AD: http://deployingradius.com/documents/configuration/active_directory.html rad_recv: Access-Request packet from host 1.1.2.4 port 33350, id=19, length=224 NAS-IP-Address = 1.1.2.4 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "netengtest" Calling-Station-Id = "000000000000" Called-Station-Id = "000B8661BF34" MS-CHAP-Challenge = 0x9b1a142405c7a0dbe4f486d9d3fb2090 MS-CHAP2-Response = 0x00006cda5d434c296668b7f2b446899e01af0000000000000000419c6cfec984b856377a6c40c6144373a1dbc14f777ce8eb Service-Type = Login-User Aruba-Location-Id = "N/A" NAS-Identifier = "My802.11controller" Message-Authenticator = 0x02610ba4a72cdc35ce94415f1ae46dcb # Executing section authorize from file /devel/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "netengtest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /devel/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: netengtest [mschap] Told to do MS-CHAPv2 for netengtest with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /devel/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> netengtest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 19 to 1.1.2.4 port 33350 Waking up in 4.9 seconds. Cleaning up request 3 ID 19 with timestamp +372 Ready to process requests. <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

7 12

Invalid signature
by Sergio Belkin 11 May '11

11 May '11

Hi, I am receiving error from some NAS: rad_recv: Accounting-Request packet from host 201.216.227.201 port 58999, id=0, length=86 Received Accounting-Request packet from 201.216.227.201 with invalid signature! (Shared secret is incorrect.) Dropping packe t without response. It's a werd thing, because the secret on both radius server and NASes are the same! I don't understand the problem! Thanks in advance! -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com LPIC-2 Certified - http://www.lpi.org

2 2

RE: MSCHAP failing on new 2.1.10 install
by Gary Gatten 11 May '11

11 May '11

PS: I apparently have to leave the "DEFAULT Auth-Type = ntlm_auth " in the users file or "nothing" works. FWIW I am exclusively using AD/ntlm_auth for all auth types, so hopefully this won't matter? I did find a Wiki article about updating the control such that if Auth-Type doesn't exist then set it to ntlm_auth. I have this in my 2.1.6 deployment, so may copy it over here as well. I'm trying to change as little as possible from the default confs.... ________________________________ From: Gary Gatten Sent: Wednesday, May 11, 2011 3:13 PM To: FreeRadius users mailing list Subject: MSCHAP failing on new 2.1.10 install PAP works, MSCHAP fails - specifically MSCHAPv2. This is a fresh install of 2.1.10, built from source. I'm using ntlm_auth; samba version 3.0.33-3.7.el5 I also have version 2.1.6 running on the same box and it "mostly" works: seems to work with everything except Winblows7, hence I installed 2.1.10 in a different dir structure and it's listening on different ports. I just tested a login using the same user account and pw; works great on 2.1.6 but fails on 2.1.10. I've tried 4 or 5 different command strings for ntlm_auth - no go. It's as if mschap is not using ntlm_auth, but not sure. I'll keep checking and googling, but any hints would be appreciated! TIA! Gary I've changed only the minimum from the default, clients.conf and the recommended for integrating with AD: http://deployingradius.com/documents/configuration/active_directory.html rad_recv: Access-Request packet from host 1.1.2.4 port 33350, id=19, length=224 NAS-IP-Address = 1.1.2.4 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "netengtest" Calling-Station-Id = "000000000000" Called-Station-Id = "000B8661BF34" MS-CHAP-Challenge = 0x9b1a142405c7a0dbe4f486d9d3fb2090 MS-CHAP2-Response = 0x00006cda5d434c296668b7f2b446899e01af0000000000000000419c6cfec984b856377a6c40c6144373a1dbc14f777ce8eb Service-Type = Login-User Aruba-Location-Id = "N/A" NAS-Identifier = "My802.11controller" Message-Authenticator = 0x02610ba4a72cdc35ce94415f1ae46dcb # Executing section authorize from file /devel/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "netengtest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /devel/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: netengtest [mschap] Told to do MS-CHAPv2 for netengtest with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /devel/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> netengtest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 19 to 1.1.2.4 port 33350 Waking up in 4.9 seconds. Cleaning up request 3 ID 19 with timestamp +372 Ready to process requests. <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 2

Problem with EAP-TLS.
by Miguel Miralles 11 May '11

11 May '11

Hi, i'm implementing authentication for 802.1X using Freeradius (version 2.1.6 ) in Fedora10. The supplicant is windows XP wiht Service pack 3. The NAS is Switch cisco and the network is wire. My problem is what the connection works good when the autentication is for user and password, but if changing the configuration for authenticate using certified the authentication the connection fails. In this case to use user and password, validating the certificate server works good, is fact windows xp requires the confirm the server certificate. The certificate server and certificate client have been generated by the same CA( this is own) y with the OID's required for Windows. The problem is when the server ask for the certified client the connection seems to cut, the question is: (considering what the configuration is the recommended por varios documents and tutorials, at least is what I mean) which could be the problem??? The final in radius -X say: rad_recv: Access-Request packet from host 192.168.101.254 port 49154, id=0, length=124 Cleaning up request 81 ID 0 with timestamp +1769 NAS-IP-Address = 192.168.101.254 NAS-Port-Type = Ethernet NAS-Port = 5 User-Name = "mz254.mtm" State = 0xe985bf0fef95a607b34238093b97add2 EAP-Message = 0x021000251900170301001a11c6b5cf6d88c21a6758d861aa6d49e3a4686ffa5cb4a4380d20 Message-Authenticator = 0x46f742c7927f46d42c9708a756a03bfd +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 16 length 37 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - mz254.mtm [peap] Got tunneled request EAP-Message = 0x0210000e016d7a3235342e6d746d server { PEAP: Got tunneled identity of mz254.mtm PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to mz254.mtm Sending tunneled request EAP-Message = 0x0210000e016d7a3235342e6d746d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "mz254.mtm" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 16 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x011100231a0111001e10a7a80a0d95340caaef928a607b6afaec6d7a3235342e6d746d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0831d1c40820cb8cd5b8829097e99997 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x011100231a0111001e10a7a80a0d95340caaef928a607b6afaec6d7a3235342e6d746d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0831d1c40820cb8cd5b8829097e99997 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.101.254 port 49154 EAP-Message = 0x0111003a1900170301002fe48c43420e254b8de5958f35506d01a8077e703876321c1aac403281cf905c26fe5e4e8d17c412c32d2f6db08d876b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe985bf0fee94a607b34238093b97add2 Finished request 82. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.101.254 port 49154, id=0, length=116 Cleaning up request 82 ID 0 with timestamp +1769 NAS-IP-Address = 192.168.101.254 NAS-Port-Type = Ethernet NAS-Port = 5 User-Name = "mz254.mtm" State = 0xe985bf0fee94a607b34238093b97add2 EAP-Message = 0x0211001d19001703010012d4f65388faa55d96da4c39fd25a2781ab64d Message-Authenticator = 0x0ddd687b9218a2e5cb52ae4e06735fc8 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 17 length 29 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type nak [peap] Got tunneled request EAP-Message = 0x02110006030d server { PEAP: Setting User-Name to mz254.mtm Sending tunneled request EAP-Message = 0x02110006030d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "mz254.mtm" State = 0x0831d1c40820cb8cd5b8829097e99997 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 17 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/tls [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x011200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0831d1c40923dc8cd5b8829097e99997 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x011200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0831d1c40923dc8cd5b8829097e99997 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.101.254 port 49154 EAP-Message = 0x0112001d19001703010012cae867eb763daa542fc65b9c67ab94c4fe21 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe985bf0fe197a607b34238093b97add2 Finished request 83. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.101.254 port 49154, id=0, length=190 Cleaning up request 83 ID 0 with timestamp +1769 NAS-IP-Address = 192.168.101.254 NAS-Port-Type = Ethernet NAS-Port = 5 User-Name = "mz254.mtm" State = 0xe985bf0fe197a607b34238093b97add2 EAP-Message = 0x021200671900170301005ce0549b2a1b945c71e5696bd5b46950b5958ac040274a4217e3ff26d685a74594049fea12d4bae4e09c7119bad31cea81699dd953c79b536dd53dfead7281499ace37ff9cdbf342a5c7803673b2f09883b16fabbe5b3ca8fc81e6ac81 Message-Authenticator = 0xe50342f509c7d70a7a40b733653658fd +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 18 length 103 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type tls [peap] Got tunneled request EAP-Message = 0x021200500d800000004616030100410100003d03014dc01a18f6c3d3a9524dc7896df274307ebd918011714be32204ce96e3108ff600001600040005000a000900640062000300060013001200630100 server { PEAP: Setting User-Name to mz254.mtm Sending tunneled request EAP-Message = 0x021200500d800000004616030100410100003d03014dc01a18f6c3d3a9524dc7896df274307ebd918011714be32204ce96e3108ff600001600040005000a000900640062000300060013001200630100 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "mz254.mtm" State = 0x0831d1c40923dc8cd5b8829097e99997 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 18 length 80 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 70 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0041], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 081a], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 007c], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x011304000dc0000008cf160301002a0200002603014dc014ba69a4e4904b4864f80ed6cf43eea65370906c43feb609f3234613502000000400160301081a0b0008160008130003ef308203eb308202d3a00302010202010b300d06092a864886f70d0101050500306b310b30090603550406130241523110300e060355040813074d656e646f7a6131183016060355040a130f4d6f6e74656d61722050727565626131133011060355040b130a534c4720507275656261311b3019060355040313124341204d6f6e74656d617220507275656261301e170d3131303432373136333734375a170d3133303432363136333734375a3073310b3009060355 EAP-Message = 0x0406130241523110300e060355040813074d656e646f7a613110300e060355040713074d656e646f7a6131183016060355040a130f4d6f6e74656d61722050727565626131133011060355040b130a534c47205072756562613111300f060355040313086665646f7261303130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6deee09048786218bf3e874398aa662c6f61b9298eddf33d3663a8d85e51b3031a70046ba1c15695976ff4dc78498f6e27f432d6df5c42349a29241a955d07c813a6ef8690ddf16eefb5fa414f3e2ecc29eacf9224660361dd7839431f85106bc5e8f890e236705f4afb860bc7d22fd EAP-Message = 0x146f9aeffc1404a8f961a297ecca08d38554f3e0ac75940614a7765893f0da2bbd0a4382b76a742d97be8fb014e6c397668877a140bf69537fe526af59194c876b008b5187bb56d5a8b30abbd2d746b029d1b528eb844db590fcb48da7a186c9faf0e691a25b233434e2713afde902236a3393c16b22c756ff1ba0ee75036f8cca897cce5edd7166f6644d5dda79e3ab0203010001a3819130818e30130603551d25040c300a06082b0601050507030130090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e041604148929112c325ec9491b EAP-Message = 0xda7461f9df24f3a0d26cc8301f0603551d23041830168014e6a44a4b3671560188d79e38de3e6c523ec2979a300d06092a864886f70d01010505000382010100272aaa1e38409b4ccee282d77457651dae1d93892fea8d4e0d5617e84637870806c313c3fc1c625beb7b4d00276dbfaddaae0ccc8958c968dda5ac507b2b9aa08821fdbe6275f928ca9dfdb36ade702778b65800947aabba3921d7d3fda04d2565cd41835cbc243435bdd012c62d59ee3dfeec2a39a6aef03668620a1657e4617264abbc72073a8a093012f40c61735d118bcf66596df8943f2f7c448d89423fda29e43ed1983cdfe07a2f435a4ff406a716ab22f67ba400f653b2b74b EAP-Message = 0xacd7d2074a502468df7e7963 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0831d1c40a22dc8cd5b8829097e99997 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x011304000dc0000008cf160301002a0200002603014dc014ba69a4e4904b4864f80ed6cf43eea65370906c43feb609f3234613502000000400160301081a0b0008160008130003ef308203eb308202d3a00302010202010b300d06092a864886f70d0101050500306b310b30090603550406130241523110300e060355040813074d656e646f7a6131183016060355040a130f4d6f6e74656d61722050727565626131133011060355040b130a534c4720507275656261311b3019060355040313124341204d6f6e74656d617220507275656261301e170d3131303432373136333734375a170d3133303432363136333734375a3073310b3009060355 EAP-Message = 0x0406130241523110300e060355040813074d656e646f7a613110300e060355040713074d656e646f7a6131183016060355040a130f4d6f6e74656d61722050727565626131133011060355040b130a534c47205072756562613111300f060355040313086665646f7261303130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6deee09048786218bf3e874398aa662c6f61b9298eddf33d3663a8d85e51b3031a70046ba1c15695976ff4dc78498f6e27f432d6df5c42349a29241a955d07c813a6ef8690ddf16eefb5fa414f3e2ecc29eacf9224660361dd7839431f85106bc5e8f890e236705f4afb860bc7d22fd EAP-Message = 0x146f9aeffc1404a8f961a297ecca08d38554f3e0ac75940614a7765893f0da2bbd0a4382b76a742d97be8fb014e6c397668877a140bf69537fe526af59194c876b008b5187bb56d5a8b30abbd2d746b029d1b528eb844db590fcb48da7a186c9faf0e691a25b233434e2713afde902236a3393c16b22c756ff1ba0ee75036f8cca897cce5edd7166f6644d5dda79e3ab0203010001a3819130818e30130603551d25040c300a06082b0601050507030130090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e041604148929112c325ec9491b EAP-Message = 0xda7461f9df24f3a0d26cc8301f0603551d23041830168014e6a44a4b3671560188d79e38de3e6c523ec2979a300d06092a864886f70d01010505000382010100272aaa1e38409b4ccee282d77457651dae1d93892fea8d4e0d5617e84637870806c313c3fc1c625beb7b4d00276dbfaddaae0ccc8958c968dda5ac507b2b9aa08821fdbe6275f928ca9dfdb36ade702778b65800947aabba3921d7d3fda04d2565cd41835cbc243435bdd012c62d59ee3dfeec2a39a6aef03668620a1657e4617264abbc72073a8a093012f40c61735d118bcf66596df8943f2f7c448d89423fda29e43ed1983cdfe07a2f435a4ff406a716ab22f67ba400f653b2b74b EAP-Message = 0xacd7d2074a502468df7e7963 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0831d1c40a22dc8cd5b8829097e99997 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.101.254 port 49154 EAP-Message = 0x0113040019c000000411170301040c0a26e6079ff37415887c6e864dbd7b3b93a29852b3a0143f07a8409f3f94620de9084bb6aafda166ef99945d4f51acf414b02543a15a55f60e418d7624b73f431f5fd023c8986bc0a889304bc68a0e333b8d431b0e6a84c06e8b9fdb782e175e03e6c9d8107ae3f4d1df94e2df4b719f67d0406304a53e8041e9ba18cee4c91521c57846e3327b4a2c73f4c787efc359a15d6ed82fa319c0aa724c9c521712231365e20a1e8d4b041494fd0193fd2c015a7091a0fb5ff693a4dfb94ff8c75ad7260300ee2619364f2e0db579a6ce831bb3dd816113b547a79f173c3dc5a01336704d9a63af0e290cd9518c27b682 EAP-Message = 0x71df0c5e2d1e95ef2f49647a42369c8be08448f5c5c8de03eaabfd4db90ca1dfacbd497f191fa1e6799b06dbb3f560fe7ef7e5d8c76581a09c860f9127c1dbfff4286db4af3bb405d3c20d7846828136ef1f164784786cb44933add06fff29457d058b7785683d39e41965ecb1b96ee6fd5d908cc5c62142858b958ad641304b74fd5d272633f7ce4dd61a01383ce6db3e0f80d06b00668a925038cec0c638efadc27f01aa50c4f3d17ef7204da74ddf17096e347f1d4f511895b58ccf7e4d2e7a09de3a36f19e1ff345e9e784620c13f2cdbd0cff512bf77f8c28878b5074c7cbbe43647dc45cbfb681950dc6e9a0502202c044276683359662e6b0ca EAP-Message = 0x330b19a685b14bddafcc997a81e82534c5a69f2b5c498b01fda904ce743d8c7c523906aed3b76cee8b0fe1bcede93aef85aa0adbc4b6657710f0e7a2a72a285abc13a2d9b5ffb8bc99d28235e1db82373bd8660b015aa504b7a2c0db198b4f8dcd6fc42c73af72854125d18f8cb03ccd96979982db76c4b4752a5aa5f83782e570806d882a3c7d01f633ad8b733650709304ee76a146c75ef2344dc701f974ef882a7939aa0662814637db4798c8d471a9332656dacff4aa05930e2919c50ffc317e094986e557f5247860d227607676a99252b53d08e4364a81f85deb3d9fb7deb93fb1eda64c9fbd1811828eb11e82b3d27d032664d6ca8f5fe818d2 EAP-Message = 0xcdc91b24b32d3cb7941a25a4fe03ff434755f898bb5fa1c1d695c9ddeda1cb008573525bd6b46b134138672c0afde2337d5c282de83ac2c08795319a7fc6e07b92736796bec8749aa4082dfa7cf66f706102c334f6773dd0ca9ebf759f565bafe4c4292261ffedf19bec22aa1eced2d6ed61a6c28b6ef5cdc37ac18a523071d9e9e23475d36cb4cfbe034b72ecccb17b0bfaecd7839b96baba4ba4be20b02eda7ca728d016eaa5e4098bed3bd0c3bfdd9c393170e0c1799062670ca8cda12a904bdfb4974c248d696f577754da2057f9167eaca632bc4e73c79e58db0d69a7ea8ac9a8942aaf6e6a5f086eeb7dbeca84a2cc9d63c5e9fe4d26fd87ecd4 EAP-Message = 0x21fadae229d18ab0506ef141 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe985bf0fe096a607b34238093b97add2 Finished request 84. Going to the next request Waking up in 4.9 seconds. Cleaning up request 84 ID 0 with timestamp +1769 Ready to process requests. rad_recv: Access-Request packet from host 192.168.101.254 port 49154, id=0, length=83 NAS-IP-Address = 192.168.101.254 NAS-Port-Type = Ethernet NAS-Port = 5 User-Name = "mz254.mtm" EAP-Message = 0x0214000e016d7a3235342e6d746d Message-Authenticator = 0x78f7a34500a508c5078c6c93779f7575 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 20 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.101.254 port 49154 EAP-Message = 0x011500060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0ff1a38a0fe4ae700e5cfd450ee7a44f Finished request 85. Going to the next request Waking up in 4.9 seconds. Cleaning up request 85 ID 0 with timestamp +1787 Ready to process requests. Thanks.

1 0

Custom reply message
by Franz 11 May '11

11 May '11

Hi, I have freeradius 2.1.10 installed and was able to customize some reply messages to another language, the only one I am unable to change is the one for simultaneous login check, where would I chnage this reply message? Thanks

2 4