- Freeradius-Users - lists.freeradius.org

pam_radius_auth query
by vijay s sheelavantar 25 Feb '11

25 Feb '11

Hi,Please clarify my doubts. 1. does pam_radius_auth.so support authorization of user accounts? 2. If Yes how can we achieve it? what configurations need to be done. Now pam_radius_auth.c sends authentication requests with the value PW_AUTHENTICATE_ONLY. what value i need to send? and what configuration I have to make at server side to implement authorization. I am using pam_radius_auth.so for authentication and it is working fine. At the free radius server side  I am authenticating users using /etc/password  file as database.(I have enabled "unix" option in "default" file authorization section.) Thanks and Regards, VIJAY S.

3 2

TTLS-MSCHAPv2 works but PEAP-MSCHAPv2 doesn't (FreeRADIUS 2.1.3)
by Wenche Backman 25 Feb '11

25 Feb '11

Hi, I have a FreeRADIUS-server for configuration testing purposes and on this server TTLS-MSCHAPv2 works fine but PEAP-MSCHAPv2 fails. PEAP-MSCHAPv2 fails both with the WindowsXP client and the NetworkManager included in Ubuntu 8.04 LTS. The output from radius -X are shown below. The configuration files are attached. I'd appreciate if someone could take a look at this and check where the problem might be. Regards, Wenche Backman PEAP-MSCHAPv2 failure (this one from Ubuntu 8.04 LTS, the output from WinXP is the same): Ready to process requests rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=137 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000011016475406d79746573742e6669 Message-Authenticator = 0xb613072b66070df9b35799b65683a666 server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 0 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b666ed0567b6ebba8e637a5c Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=231 Cleaning up request 0 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b666ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005d190016030100520100004e03014d638d2813d992579c034f3369d4734a02fcc8603b1297948e5ee5d6950eb9ae00002600390038003500160013000a00330032002f0005000400150012000900140011000800060003020100 Message-Authenticator = 0x7aaf685db9bfc8a730e04e61846a8ba4 server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 93 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0052], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x0102040019c000000aad160301002a0200002603014d638d2822caad2a4af2262ab74eea2824d9767d409a66ca0cfad0ae45610e7500003901160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303131363130323433375a170d3130303131363130323433375a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100bca3a7d340515ebd6023cbfb2c18b2ffc99f5276c2af17db6621b34a2e596aa4193eee8582efc0a84f8cb24b740602f7344f0d3e07f05dfab378f03112e3 EAP-Message = 0xa43530d75b5a611e456d530cc9e9a5143dbdcf6129d99273f9960b4d6bb2124f42bc61be778bad4e34a21d75e2904cc26ab003927898cdab60fb4bc1780c19d23e5d64065248e8a2e586a9d7f7ac6dc089269890532c952ea979de7202b549e5979c1be63419a29d64febe0a4576d629e7431a2e1fcca05c550172c0c4e309e746662bb2a80d26c975b979409596dd3e079a96850532745cb92dfdca8aab7bbb66fedd8a9ac3f30c62252a453c57acbc33cb0f669326ece07032fafb4584bcc417430203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100110e3b6ca51ea7854b EAP-Message = 0x05a122cefcc96f0060bc1c3d2de06a79f50ff17de7c50664598b7b499ebf536f80bc0c3a86bfb6c9837cd23992d522be1693f12aa3b9e8eead66d0e85316cb038b7673642d83b924891b057126d85e52d91452c0a52203424fc16d6094e812ef0bd1535852edbe3e5a9696a0c5c7611badba4f789f1a04dd6548127c82d7b4e4635c03b12b621b2b4022644907e12ab5f0ecfd4863cfeb440636da869fcb57b65d67b95c007afb7bd160d20e01d946cb8f4d7a3d6c252417172ea45ffb847585e98c8c6d0d34094d031cc69cfc015b24297fa0d085fe4dfb2b2de27a9363d8d023b151867e8a5c04dcfc072e0397a063db3bf4bdc5f26f0004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b765ed0567b6ebba8e637a5c Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=144 Cleaning up request 1 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b765ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200061900 Message-Authenticator = 0xf24d59a32f188207dee0c313a901bfb3 server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x010303fc19400095425f8466e364f5300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303131363130323433375a170d3130303131363130323433375a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a79b656861b09eb9d5bd77174981b3b00554530ffc18238cf3164a1882e42c6379db8d256187bc4788e63349ae25379f606087ab41864d8a533d738c7c5286b4057c96d0f5be5972a34b0d27d784d2571bc8a085f15fd17942948566e7589f1b4994676beb9e3d9828bdda3bd6f767 EAP-Message = 0xed21bdf2e4bd035a8e235ddf4341c2b5a587e707e5b333c49d4533110ce905b31071c90bc795dee46e8b0b063862c0d58c4765553bcef3d8408dffcb951b81a1b5e8e61f5e857bc6f5931f132146fd145ed316517e7e8bd8f5941b7d571a7a0b8500a2d4538c0a036d12ce655a55dea0b4360739b0c251ed44c91900b67a7206c83e22b34ead286d9ac6023258892f4d150203010001a381fb3081f8301d0603551d0e041604140397fbc3d67c570e8f13b91c45394b5f44616cf43081c80603551d230481c03081bd80140397fbc3d67c570e8f13b91c45394b5f44616cf4a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747982090095425f8466e364f5300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010023477ecf0e1f391af60dccc8605dd8743615a07242f1d68f3815855b86ab605a9fa22c9da76fe73fdcceb1a76afb224d424dd032efa93e7d7bacc26a0fc592ed29a04993e5c4043fcfd4312b92337b2919f5 EAP-Message = 0x5746b2fc48857aac Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b464ed0567b6ebba8e637a5c Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=144 Cleaning up request 2 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b464ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0xb8250ec4167cfca1229cd8fed99c2ebe server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x010402c71900d8fba265108675c4143ba764839add9dad12b1e94d9c914c0f18108e5d9f99090bf291b83623238457fe4576e87c1f3b3cb9dd0cf0de1522e48948e5af796c8ed530986f5610a0dc3b0d89fa14686238e318a1cbb0de862d2ea63cc0b0b29ae1210bf94ab9e772de19b817e7d0df45b71a9595499756b5d5e6c757ca7bc55b1fc7a3ebe98be922105889149cfaa023c94eda62121c053d11f6c6e59736b2d25a0496aab4db2f160301020d0c0002090080d6c327b60d685b7dea0b3bf533d54f8e151fb5d72b4a805e4c120a847706984eedeb80d3a48fabd0f36bbabdd4125fe717709c5c73010ac5185e4154b12c4738f6cb62d40b82 EAP-Message = 0x47efc9ae7da9c0612f0bf7592be07f1eb2f5b45b5289743831f2b2cad359dbf213c9e14aaf44a1ede1e7ac48b9fbb7b371d82ec2d6ab9415ff230001020080185049cf069168f5fa3037bab3f8cbe72ffa09d5222d80db41a2265b2a270aae741f7ef06a574144055e27724d75001556dd166feedcfb7827625b2fa66f72a1c85cd9dc3e1dd693ef38f2bf0c3d8f08e21d86b9ed9d8dba54a571bdb36bed6190ddfa42816f76e3a154799ba7c629ca358df7f55f2746f7918be7a9ded259fb01006b443e4a0e6f85d615db5c3a3308860a8e7335b4c3ed7a6ca6a26b60b60399b81d97499c77a6c889c21293b3bcc5ff03b87cc98556f0b3d6c1e211ed EAP-Message = 0x7e11c75caad6f24d6d967130f88120690fbce884666d5c4d9e235230e58b53878eb7437b253601580401c2cafba3ae088abce707763cec25709e95cb0dc4a3a9b772a507058baa5783dbf780b2e59cc2be5e8bf28401722211bec6093170c426993baf969daad724132211f1ae38314bbbb6e6a7681a57894482574f43fc60fc18d8f40b92d2fa6de896ddedfd5be469845235a8fa561c2abc94cd37764575ff0c209165d1d128af9cde0b51be10533052b7180313f411529ba43abd073e54b2111495a516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b563ed0567b6ebba8e637a5c Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=342 Cleaning up request 3 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b563ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400cc1900160301008610000082008086f0298b073e157e853a830e045a18b40f17a02efbe131d943518b00817f8a72a2be1b64d1208657beea1cff038418106c6beda352e34d9950e7b9c397932bd7cb8f722ff87b819edfea5910676e1e898ec4c071c6cdedab5b8c8980dbd752c9f74bbf5818cc35900515d0a97a4b6139b94e24c2b0aa1aa7ca282e205952121e140301000101160301003053d0e5fbe8ed7e32c5d7318f3baf834371d7ccc760d9a0fb0b2320f9707c9acf7f218bcb8c70a8b51e88bbdc2274aec8 Message-Authenticator = 0x7b92c60ebe961910947ed53e0f3deced server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x01050041190014030100010116030100305a7b9877876923768d3f6b8ddffb2a49d7c701b35c74a0c803a5c99b9b632fcb4eeb6ef635de4e8994feef3c84f828ff Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b262ed0567b6ebba8e637a5c Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=144 Cleaning up request 4 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b262ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0xc5648cb005eb7be3dcd512844c73fc53 server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x0106002b190017030100204911606b54a92f837428b80e62f8fd2eaa9def9e14ca28d915ccc4e1718e421e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b361ed0567b6ebba8e637a5c Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=234 Cleaning up request 5 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b361ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600601900170301002084f81dbeee164be0d004166b849fec7362852574d78846dad2b62b39b08cf6a51703010030825c7db26910cfcc090ad6f9edf862db3bf8a16401564750eb0bcf77857da0fdb7de955192557ac83755357f816949b9 Message-Authenticator = 0xa9e56e06a53d4769e832e0f8cee70a4d server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - du(a)mytest.fi [peap] Got tunneled request EAP-Message = 0x02060011016475406d79746573742e6669 server eduroam { PEAP: Got tunneled identity of du(a)mytest.fi PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to du(a)mytest.fi Sending tunneled request EAP-Message = 0x02060011016475406d79746573742e6669 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 server eduroam-inner-tunnel { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [files] users: Matched entry du(a)mytest.fi at line 206 ++[files] returns ok ++[mschap] returns noop [pap] Normalizing NT-Password from hex encoding [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. } # server eduroam-inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x0107003b19001703010030998319d6fd8e167dc17373bdbd74ff90ed3b3565f1eeec9f48a3fabf8022e8a3f0d84d04fed1507c2be2696c67f0591b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b060ed0567b6ebba8e637a5c Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=234 Cleaning up request 6 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b060ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02070060190017030100206a2891cc8d712812216d36fc9a6aafafcfa02faf5c3746b46c8b5bd3fec306071703010030bb13eb9f3a5a8808db75cf59c22d50994ae45e0ecc1f7b91c3e00de1e70e8e45a98adbe3b2d7a7e15547c50362d7fdda Message-Authenticator = 0x534b7bb55532f1fde1e5c3205e83ecae server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server eduroam Using Post-Auth-Type Reject +- entering group REJECT {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/reply-detail-20110222 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/reply-detail-20110222 [reply_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[reply_log] returns ok Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 7 ID 0 with timestamp +107 Ready to process requests. Wenche Backman Tietoliikenneasiantuntija CSC - Tieteen tietotekniikan keskus Oy PL 405, 02101 Espoo (09) 457 2737, Wenche.Backman(a)csc.fi Ms. Wenche Backman Data Communications Specialist CSC - IT Center for Science Ltd. P.O. BOX 405, FI-02101 Espoo, Finland +358 9 457 2737, Wenche.Backman(a)csc.fi

2 2

Logging the matched SQL-Group
by Brian Candler 24 Feb '11

24 Feb '11

When rlm_sql is running through each of a user's groups, the value %{SQL-Group} is set for each iteration. However it's cleared at the end. I would like to be able to capture the value of SQL-Group which was successfully matched (if any), so that I can log it in rlm_sql_log. Is there a straightforward way of doing this? Because I can't see one right now... Thanks, Brian.

2 2

non-standard authentication
by Travis Dimmig 24 Feb '11

24 Feb '11

I have a problem scenario where I need to be able to handle the authentication of users myself. I am looking into using either rlm_perl or (preferably) rlm_jradius to be able to write my own piece to do authentication. I believe this is possible with either module (please correct me if I'm wrong on that, it would stop me in my tracks). What I need to know is if when writing my own authenticator there is a terribly complicated process of requests and responses that I have to honor in order to make the supplicant happy, or if I can trivially accept or reject based on the parameters of my business problem. As a test case, I wrote a Java class for rlm_jradius that just replaced reject packets with accept packets, to see if it would work. I found that if I hooked into it at the 'post_auth' stage it didn't matter what my reply was, freeRadius remembered that auth had failed and stripped all the attributes from the response packet. That was long winded, here is a summary of my questions. Can I write my own piece to do authentication? Where in the freeRadius process do I list that listener? Is there a series of requests and responses that I have to honor? -Travis

4 5

Re: TTLS-MSCHAPv2 works but PEAP-MSCHAPv2 doesn't (FreeRADIUS 2.1.3)
by Alan Buxey 24 Feb '11

24 Feb '11

Quick answer . Your eduroam inner tunnel virtual server isnt handling it ... No auth method found . Mschap noop. Alan ----- Reply message ----- From: "Wenche Backman" <Wenche.Backman(a)csc.fi> Date: Thu, Feb 24, 2011 08:14 Subject: TTLS-MSCHAPv2 works but PEAP-MSCHAPv2 doesn't (FreeRADIUS 2.1.3) To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Hi, I have a FreeRADIUS-server for configuration testing purposes and on this server TTLS-MSCHAPv2 works fine but PEAP-MSCHAPv2 fails. PEAP-MSCHAPv2 fails both with the WindowsXP client and the NetworkManager included in Ubuntu 8.04 LTS. The output from radius -X are shown below. The configuration files are attached. I'd appreciate if someone could take a look at this and check where the problem might be. Regards, Wenche Backman PEAP-MSCHAPv2 failure (this one from Ubuntu 8.04 LTS, the output from WinXP is the same): Ready to process requests rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=137 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000011016475406d79746573742e6669 Message-Authenticator = 0xb613072b66070df9b35799b65683a666 server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 0 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b666ed0567b6ebba8e637a5c Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=231 Cleaning up request 0 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b666ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005d190016030100520100004e03014d638d2813d992579c034f3369d4734a02fcc8603b1297948e5ee5d6950eb9ae00002600390038003500160013000a00330032002f0005000400150012000900140011000800060003020100 Message-Authenticator = 0x7aaf685db9bfc8a730e04e61846a8ba4 server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 93 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0052], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x0102040019c000000aad160301002a0200002603014d638d2822caad2a4af2262ab74eea2824d9767d409a66ca0cfad0ae45610e7500003901160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303131363130323433375a170d3130303131363130323433375a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100bca3a7d340515ebd6023cbfb2c18b2ffc99f5276c2af17db6621b34a2e596aa4193eee8582efc0a84f8cb24b740602f7344f0d3e07f05dfab378f03112e3 EAP-Message = 0xa43530d75b5a611e456d530cc9e9a5143dbdcf6129d99273f9960b4d6bb2124f42bc61be778bad4e34a21d75e2904cc26ab003927898cdab60fb4bc1780c19d23e5d64065248e8a2e586a9d7f7ac6dc089269890532c952ea979de7202b549e5979c1be63419a29d64febe0a4576d629e7431a2e1fcca05c550172c0c4e309e746662bb2a80d26c975b979409596dd3e079a96850532745cb92dfdca8aab7bbb66fedd8a9ac3f30c62252a453c57acbc33cb0f669326ece07032fafb4584bcc417430203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100110e3b6ca51ea7854b EAP-Message = 0x05a122cefcc96f0060bc1c3d2de06a79f50ff17de7c50664598b7b499ebf536f80bc0c3a86bfb6c9837cd23992d522be1693f12aa3b9e8eead66d0e85316cb038b7673642d83b924891b057126d85e52d91452c0a52203424fc16d6094e812ef0bd1535852edbe3e5a9696a0c5c7611badba4f789f1a04dd6548127c82d7b4e4635c03b12b621b2b4022644907e12ab5f0ecfd4863cfeb440636da869fcb57b65d67b95c007afb7bd160d20e01d946cb8f4d7a3d6c252417172ea45ffb847585e98c8c6d0d34094d031cc69cfc015b24297fa0d085fe4dfb2b2de27a9363d8d023b151867e8a5c04dcfc072e0397a063db3bf4bdc5f26f0004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b765ed0567b6ebba8e637a5c Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=144 Cleaning up request 1 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b765ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200061900 Message-Authenticator = 0xf24d59a32f188207dee0c313a901bfb3 server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x010303fc19400095425f8466e364f5300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303131363130323433375a170d3130303131363130323433375a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a79b656861b09eb9d5bd77174981b3b00554530ffc18238cf3164a1882e42c6379db8d256187bc4788e63349ae25379f606087ab41864d8a533d738c7c5286b4057c96d0f5be5972a34b0d27d784d2571bc8a085f15fd17942948566e7589f1b4994676beb9e3d9828bdda3bd6f767 EAP-Message = 0xed21bdf2e4bd035a8e235ddf4341c2b5a587e707e5b333c49d4533110ce905b31071c90bc795dee46e8b0b063862c0d58c4765553bcef3d8408dffcb951b81a1b5e8e61f5e857bc6f5931f132146fd145ed316517e7e8bd8f5941b7d571a7a0b8500a2d4538c0a036d12ce655a55dea0b4360739b0c251ed44c91900b67a7206c83e22b34ead286d9ac6023258892f4d150203010001a381fb3081f8301d0603551d0e041604140397fbc3d67c570e8f13b91c45394b5f44616cf43081c80603551d230481c03081bd80140397fbc3d67c570e8f13b91c45394b5f44616cf4a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747982090095425f8466e364f5300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010023477ecf0e1f391af60dccc8605dd8743615a07242f1d68f3815855b86ab605a9fa22c9da76fe73fdcceb1a76afb224d424dd032efa93e7d7bacc26a0fc592ed29a04993e5c4043fcfd4312b92337b2919f5 EAP-Message = 0x5746b2fc48857aac Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b464ed0567b6ebba8e637a5c Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=144 Cleaning up request 2 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b464ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0xb8250ec4167cfca1229cd8fed99c2ebe server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x010402c71900d8fba265108675c4143ba764839add9dad12b1e94d9c914c0f18108e5d9f99090bf291b83623238457fe4576e87c1f3b3cb9dd0cf0de1522e48948e5af796c8ed530986f5610a0dc3b0d89fa14686238e318a1cbb0de862d2ea63cc0b0b29ae1210bf94ab9e772de19b817e7d0df45b71a9595499756b5d5e6c757ca7bc55b1fc7a3ebe98be922105889149cfaa023c94eda62121c053d11f6c6e59736b2d25a0496aab4db2f160301020d0c0002090080d6c327b60d685b7dea0b3bf533d54f8e151fb5d72b4a805e4c120a847706984eedeb80d3a48fabd0f36bbabdd4125fe717709c5c73010ac5185e4154b12c4738f6cb62d40b82 EAP-Message = 0x47efc9ae7da9c0612f0bf7592be07f1eb2f5b45b5289743831f2b2cad359dbf213c9e14aaf44a1ede1e7ac48b9fbb7b371d82ec2d6ab9415ff230001020080185049cf069168f5fa3037bab3f8cbe72ffa09d5222d80db41a2265b2a270aae741f7ef06a574144055e27724d75001556dd166feedcfb7827625b2fa66f72a1c85cd9dc3e1dd693ef38f2bf0c3d8f08e21d86b9ed9d8dba54a571bdb36bed6190ddfa42816f76e3a154799ba7c629ca358df7f55f2746f7918be7a9ded259fb01006b443e4a0e6f85d615db5c3a3308860a8e7335b4c3ed7a6ca6a26b60b60399b81d97499c77a6c889c21293b3bcc5ff03b87cc98556f0b3d6c1e211ed EAP-Message = 0x7e11c75caad6f24d6d967130f88120690fbce884666d5c4d9e235230e58b53878eb7437b253601580401c2cafba3ae088abce707763cec25709e95cb0dc4a3a9b772a507058baa5783dbf780b2e59cc2be5e8bf28401722211bec6093170c426993baf969daad724132211f1ae38314bbbb6e6a7681a57894482574f43fc60fc18d8f40b92d2fa6de896ddedfd5be469845235a8fa561c2abc94cd37764575ff0c209165d1d128af9cde0b51be10533052b7180313f411529ba43abd073e54b2111495a516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b563ed0567b6ebba8e637a5c Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=342 Cleaning up request 3 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b563ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400cc1900160301008610000082008086f0298b073e157e853a830e045a18b40f17a02efbe131d943518b00817f8a72a2be1b64d1208657beea1cff038418106c6beda352e34d9950e7b9c397932bd7cb8f722ff87b819edfea5910676e1e898ec4c071c6cdedab5b8c8980dbd752c9f74bbf5818cc35900515d0a97a4b6139b94e24c2b0aa1aa7ca282e205952121e140301000101160301003053d0e5fbe8ed7e32c5d7318f3baf834371d7ccc760d9a0fb0b2320f9707c9acf7f218bcb8c70a8b51e88bbdc2274aec8 Message-Authenticator = 0x7b92c60ebe961910947ed53e0f3deced server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x01050041190014030100010116030100305a7b9877876923768d3f6b8ddffb2a49d7c701b35c74a0c803a5c99b9b632fcb4eeb6ef635de4e8994feef3c84f828ff Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b262ed0567b6ebba8e637a5c Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=144 Cleaning up request 4 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b262ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0xc5648cb005eb7be3dcd512844c73fc53 server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x0106002b190017030100204911606b54a92f837428b80e62f8fd2eaa9def9e14ca28d915ccc4e1718e421e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b361ed0567b6ebba8e637a5c Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=234 Cleaning up request 5 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b361ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600601900170301002084f81dbeee164be0d004166b849fec7362852574d78846dad2b62b39b08cf6a51703010030825c7db26910cfcc090ad6f9edf862db3bf8a16401564750eb0bcf77857da0fdb7de955192557ac83755357f816949b9 Message-Authenticator = 0xa9e56e06a53d4769e832e0f8cee70a4d server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - du(a)mytest.fi [peap] Got tunneled request EAP-Message = 0x02060011016475406d79746573742e6669 server eduroam { PEAP: Got tunneled identity of du(a)mytest.fi PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to du(a)mytest.fi Sending tunneled request EAP-Message = 0x02060011016475406d79746573742e6669 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 server eduroam-inner-tunnel { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [files] users: Matched entry du(a)mytest.fi at line 206 ++[files] returns ok ++[mschap] returns noop [pap] Normalizing NT-Password from hex encoding [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. } # server eduroam-inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x0107003b19001703010030998319d6fd8e167dc17373bdbd74ff90ed3b3565f1eeec9f48a3fabf8022e8a3f0d84d04fed1507c2be2696c67f0591b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b060ed0567b6ebba8e637a5c Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=234 Cleaning up request 6 ID 0 with timestamp +107 User-Name = "du(a)mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b060ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02070060190017030100206a2891cc8d712812216d36fc9a6aafafcfa02faf5c3746b46c8b5bd3fec306071703010030bb13eb9f3a5a8808db75cf59c22d50994ae45e0ecc1f7b91c3e00de1e70e8e45a98adbe3b2d7a7e15547c50362d7fdda Message-Authenticator = 0x534b7bb55532f1fde1e5c3205e83ecae server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du(a)mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server eduroam Using Post-Auth-Type Reject +- entering group REJECT {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/reply-detail-20110222 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/reply-detail-20110222 [reply_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[reply_log] returns ok Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 7 ID 0 with timestamp +107 Ready to process requests. Wenche Backman Tietoliikenneasiantuntija CSC - Tieteen tietotekniikan keskus Oy PL 405, 02101 Espoo (09) 457 2737, Wenche.Backman(a)csc.fi Ms. Wenche Backman Data Communications Specialist CSC - IT Center for Science Ltd. P.O. BOX 405, FI-02101 Espoo, Finland +358 9 457 2737, Wenche.Backman(a)csc.fi

1 0

SSH - No authenticate method (Auth-Type)
by Jaikanth Krishnaswamy 24 Feb '11

24 Feb '11

Hi All, I am a newbie to freeradius world. I am using freeradius 2.1.10 for authorization and authentication. My authorization works Sending Access-Request of id 58 to X.X.X.X port Y User-Name = "test" User-Password = "test" NAS-IP-Address = X.X.X.X NAS-Port = Y Framed-Protocol = PPP rad_recv: Access-Accept packet from host X.X.X.X port Y, id=58, length=38 The freeradius is setup with an oracle db backend. I would like to use the freeradius for my SSH. I have read some online blogs and setup my SSH with PAM. When I establish an SSH Session to the host and this is what I see in the logs. ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. If I am using the oracle DB(sql) to perform authorization and it works what needs to be done to use the same oracle DB(sql maybe other tables) for authentication. Need your help or guidance with some links/documentation on how to set SSH+ Freeradius Thanks JK

4 5

Freeradius 2 and periodic accounting updates
by Matthew Moore 24 Feb '11

24 Feb '11

Hi, I am running freeradius 2 which is answering radius queries from a Cisco LNS terminating L2TP connections to serve DSL. It doesn't update the accounting info being received from the NAS until the connection either terminates or begins. From what I can see some disconnect all their users periodically to update the accounting info. I found this which works below but it of course changes the start record of when the session begins which is a nightmare trying to see when the connection actually really started. http://www.netexpertise.eu/en/freeradius/daily-accounting.html Is there anything now which updates the accounting information periodically in the database without modifying the start/stop records? The LNS sends periodic accounting updates to freeradius and ive configured that to every 5 minutes. Thanks Matt ________________________________ JPC InfoNet Limited Registered in England No.: 2983145 Registered Office: 1E Wicker Hill Trowbridge Wiltshire BA14 8JS t: +44 (0)1225 776 555 f: +44 (0)1225 774 299 Find us on the web at www.jpci.net - A Head Start for your business ========================================================================== The information transmitted in and/or with this email is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==========================================================================

2 3

Unknown CA errors
by Harry Hoffman 23 Feb '11

23 Feb '11

Hi All, I see a similar thing mentioned in the mailing list but I'm unsure why this is happening. In my eap.conf I see the following: # This parameter is used only for EAP-TLS, # when you issue client certificates. If you do # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. #CA_file = ${cadir}/ca.pem And I'm getting these errors logged from time to time. Feb 23 13:05:07 avocet radiusd[15992]: TLS Alert read:fatal:unknown CA Feb 23 13:05:07 avocet radiusd[15992]: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca If we're not using EAP-TLS but rather PEAP, EAP-TTLS-MSCHAPv2 do we really need to uncomment the CA_file variable? The docs seem to indicate no, but the mailing lists indicate yes. Can someone provide clarification? Cheers, Harry

2 1

Counting network traffic
by Sven Fein 23 Feb '11

23 Feb '11

1 0

proxy groups - load-balance and a failover
by Alan Buxey 22 Feb '11

22 Feb '11

hi, not sure if i'm being silly, not had enough coffee or it cant be done. basically, in a quick summary, want to have a proxy.conf which, for a realm will use a bunch of servers in load balance mode...and if those fail, then use another group of servers in a fail-over mode eg server_pool groupA { serverA serverB serverC client-load-balance } server_pool groupB { serverD } server_pool groupX { groupA groupB fail-over } with realm xxxxx.org using auth pool groupX (obviously serverA etc are defined as home_server....i've stripped some of the right words/config for brevity) therefore I'd have a nice load balance for clients to a bunch of servers....but if they all went wonky, i'd have a nice solid fallback server to use..... c'est possible? alan

2 1