- Freeradius-Users - lists.freeradius.org

2.1.10 Certificate Compatibility Warning
by Ben Wiechman 06 Jan '11

06 Jan '11

I've been testing EAP-TTLS/MSCHAPv2 authentication with a network device. FreeRADIUS keeps complaining about EAP sessions not finishing with the link to the certificate compatibility wiki link, however the authentication process completes successfully. Looking at the packet exchanges more carefully it appears that the supplicant is not incrementing the Packet Identifier. Every EAP packet sent by the device uses an packet identifier of 0. Digging through the RFCs I didn't find a requirement that the Packet Identifier be incremented, only the note that it is used to correlate requests and responses. This is obviously probably more difficult if it never changes. Is it a requirement that the NAS increment or change this value? It would definitely seem to be the preferred choice. Or is the server a bit too aggressive in detecting incomplete EAP sessions in this case? rad_recv: Access-Request packet from host 66.242.65.10 port 28461, id=0, length=90 User-Name = "anonymous" NAS-IP-Address = 192.168.4.48 NAS-Port = 5 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1020 EAP-Message = 0x0201000f01616e6f6e796d6f757300 Message-Authenticator = 0x8509fb9d5f2dbeb7f8d46ab44db4053a Wed Jan 5 12:20:12 2011 : Info: server canopy { Wed Jan 5 12:20:12 2011 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: +- entering group authorize {...} Wed Jan 5 12:20:12 2011 : Info: expand: %{User-Name} -> anonymous Wed Jan 5 12:20:12 2011 : Info: ++[reply] returns notfound Wed Jan 5 12:20:12 2011 : Info: ++[preprocess] returns ok Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] EAP packet type response id 1 length 15 Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] No EAP Start, assuming it's an on-going EAP conversation Wed Jan 5 12:20:12 2011 : Info: ++[eap_canopy] returns updated Wed Jan 5 12:20:12 2011 : Info: Found Auth-Type = eap_canopy Wed Jan 5 12:20:12 2011 : Info: # Executing group from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: +- entering group authenticate {...} Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] EAP Identity Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] processing type tls Wed Jan 5 12:20:12 2011 : Info: [tls] Flushing SSL sessions (of #0) Wed Jan 5 12:20:12 2011 : Info: [tls] Initiate Wed Jan 5 12:20:12 2011 : Info: [tls] Start returned 1 Wed Jan 5 12:20:12 2011 : Info: ++[eap_canopy] returns handled Wed Jan 5 12:20:12 2011 : Info: } # server canopy Sending Access-Challenge of id 0 to 66.242.65.10 port 28461 User-Name = "anonymous" EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x349732523495276465a22536fa36099e Wed Jan 5 12:20:12 2011 : Info: Finished request 9. Wed Jan 5 12:20:12 2011 : Debug: Going to the next request Wed Jan 5 12:20:12 2011 : Debug: Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 66.242.65.10 port 28461, id=0, length=161 Wed Jan 5 12:20:12 2011 : Info: Cleaning up request 9 ID 0 with timestamp +54 Wed Jan 5 12:20:12 2011 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Wed Jan 5 12:20:12 2011 : Debug: WARNING: !! EAP session for state 0x3497325234952764 did not finish! Wed Jan 5 12:20:12 2011 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Wed Jan 5 12:20:12 2011 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User-Name = "anonymous" State = 0x349732523495276465a22536fa36099e NAS-IP-Address = 192.168.4.48 NAS-Port = 5 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1020 EAP-Message = 0x0202004415800000003a16030100350100003103017484d895bc503fb0c4c912ab6232d60da4629c843adb37f0faf3e30207d0cc4f00000a0035002f00040005000a0100 Message-Authenticator = 0x6b3d2a6441e0c787a2fd93770babab19 Wed Jan 5 12:20:12 2011 : Info: server canopy { Wed Jan 5 12:20:12 2011 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: +- entering group authorize {...} Wed Jan 5 12:20:12 2011 : Info: expand: %{User-Name} -> anonymous Wed Jan 5 12:20:12 2011 : Info: ++[reply] returns notfound Wed Jan 5 12:20:12 2011 : Info: ++[preprocess] returns ok Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] EAP packet type response id 2 length 68 Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] Continuing tunnel setup. Wed Jan 5 12:20:12 2011 : Info: ++[eap_canopy] returns ok Wed Jan 5 12:20:12 2011 : Info: Found Auth-Type = eap_canopy Wed Jan 5 12:20:12 2011 : Info: # Executing group from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: +- entering group authenticate {...} Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] Request found, released from the list Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] EAP/ttls Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] processing type ttls Wed Jan 5 12:20:12 2011 : Info: [ttls] Authenticate Wed Jan 5 12:20:12 2011 : Info: [ttls] processing EAP-TLS Wed Jan 5 12:20:12 2011 : Debug: TLS Length 58 Wed Jan 5 12:20:12 2011 : Info: [ttls] Length Included Wed Jan 5 12:20:12 2011 : Info: [ttls] eaptls_verify returned 11 Wed Jan 5 12:20:12 2011 : Info: [ttls] (other): before/accept initialization Wed Jan 5 12:20:12 2011 : Info: [ttls] TLS_accept: before/accept initialization Wed Jan 5 12:20:12 2011 : Info: [ttls] <<< TLS 1.0 Handshake [length 0035], ClientHello Wed Jan 5 12:20:12 2011 : Info: [ttls] TLS_accept: SSLv3 read client hello A Wed Jan 5 12:20:12 2011 : Info: [ttls] >>> TLS 1.0 Handshake [length 004a], ServerHello Wed Jan 5 12:20:12 2011 : Info: [ttls] TLS_accept: SSLv3 write server hello A Wed Jan 5 12:20:12 2011 : Info: [ttls] >>> TLS 1.0 Handshake [length 06ab], Certificate Wed Jan 5 12:20:12 2011 : Info: [ttls] TLS_accept: SSLv3 write certificate A Wed Jan 5 12:20:12 2011 : Info: [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Wed Jan 5 12:20:12 2011 : Info: [ttls] TLS_accept: SSLv3 write server done A Wed Jan 5 12:20:12 2011 : Info: [ttls] TLS_accept: SSLv3 flush data Wed Jan 5 12:20:12 2011 : Info: [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A Wed Jan 5 12:20:12 2011 : Debug: In SSL Handshake Phase Wed Jan 5 12:20:12 2011 : Debug: In SSL Accept mode Wed Jan 5 12:20:12 2011 : Info: [ttls] eaptls_process returned 13 Wed Jan 5 12:20:12 2011 : Info: ++[eap_canopy] returns handled Wed Jan 5 12:20:12 2011 : Info: } # server canopy Sending Access-Challenge of id 0 to 66.242.65.10 port 28461 User-Name = "anonymous" EAP-Message = 0x010303f815c000000708160301004a0200004603014d24b65c4dbdb63d3c79b319ba6a424ccf269a207ef66b8106ef2344c06569522056e4abbc8e95315b66f0618a78ce9a1ea6c20108ff0671f3835cc086cf08060500350016030106ab0b0006a70006a40003523082034e308202b7a003020102020101300d06092a864886f70d01010505003081c0310b30090603550406130255533111300f06035504081308496c6c696e6f69733121301f060355040a13184d6f746f726f6c6120536f6c7574696f6e732c20496e632e31223020060355040b131943616e6f707920576972656c6573732042726f616462616e64312230200603550403131943 EAP-Message = 0x616e6f707920414141205365727665722044656d6f2043413133303106092a864886f70d0109011624746563686e6963616c2d737570706f72744063616e6f7079776972656c6573732e636f6d301e170d3031303130313030303030305a170d3439313233313233353935395a3081c9310b30090603550406130255533111300f06035504081308496c6c696e6f69733121301f060355040a13184d6f746f726f6c6120536f6c7574696f6e732c20496e632e31223020060355040b131943616e6f707920576972656c6573732042726f616462616e64312b30290603550403132243616e6f707920414141205365727665722044656d6f2043657274 EAP-Message = 0x696669636174653133303106092a864886f70d0109011624746563686e6963616c2d737570706f72744063616e6f7079776972656c6573732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c32657829c0a23f3e456cbcb0128a00d9c180e00b857bcaecd388d159b14c017ff8e104968a1ab43622449c88cfcd301a5e78b3d54cbde59a1792118a2865b4359912727d8eff49120fdef4f16a0dd6d57298d4d8154c3cf5d7eaf0c2ff6d2464820206d9b1ce8eea199790cbffadc6da11ea78fa49717944f82a6e2f79396bd0203010001a34d304b30090603551d1304023000301d0603551d0e04160414c02f761f28 EAP-Message = 0xade55e9451ed89078a0a74230811b8301f0603551d23041830168014eb8c22114d8cc6f0968ff7e23373b77b2eb56940300d06092a864886f70d010105050003818100bbb34e7519ee8671fafa40eddaa5a35aeaf5d3c693f9edb171649daa0d4e1344517235eec07129b379c54ef5cc7bf973104e1ff809539c92b7609dcf54017f5943a86f09a4ec427954b926789b27a2aa13202128eca10f06f5f87935112e776441859d9c65d21b225c4e68189151445c0bd5ecddb60b737747dd693cc7baba4100034c30820348308202b1a003020102020100300d06092a864886f70d01010505003081c0310b30090603550406130255533111300f06035504 EAP-Message = 0x08130849 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x349732523594276465a22536fa36099e Wed Jan 5 12:20:12 2011 : Info: Finished request 10. Wed Jan 5 12:20:12 2011 : Debug: Going to the next request Wed Jan 5 12:20:12 2011 : Debug: Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 66.242.65.10 port 28461, id=0, length=99 Wed Jan 5 12:20:12 2011 : Info: Cleaning up request 10 ID 0 with timestamp +54 Wed Jan 5 12:20:12 2011 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Wed Jan 5 12:20:12 2011 : Debug: WARNING: !! EAP session for state 0x3497325235942764 did not finish! Wed Jan 5 12:20:12 2011 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Wed Jan 5 12:20:12 2011 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User-Name = "anonymous" State = 0x349732523594276465a22536fa36099e NAS-IP-Address = 192.168.4.48 NAS-Port = 5 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1020 EAP-Message = 0x020300061500 Message-Authenticator = 0x869522bac614c2e3093e89644c53dc6a Wed Jan 5 12:20:12 2011 : Info: server canopy { Wed Jan 5 12:20:12 2011 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: +- entering group authorize {...} Wed Jan 5 12:20:12 2011 : Info: expand: %{User-Name} -> anonymous Wed Jan 5 12:20:12 2011 : Info: ++[reply] returns notfound Wed Jan 5 12:20:12 2011 : Info: ++[preprocess] returns ok Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] EAP packet type response id 3 length 6 Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] Continuing tunnel setup. Wed Jan 5 12:20:12 2011 : Info: ++[eap_canopy] returns ok Wed Jan 5 12:20:12 2011 : Info: Found Auth-Type = eap_canopy Wed Jan 5 12:20:12 2011 : Info: # Executing group from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: +- entering group authenticate {...} Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] Request found, released from the list Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] EAP/ttls Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] processing type ttls Wed Jan 5 12:20:12 2011 : Info: [ttls] Authenticate Wed Jan 5 12:20:12 2011 : Info: [ttls] processing EAP-TLS Wed Jan 5 12:20:12 2011 : Info: [ttls] Received TLS ACK Wed Jan 5 12:20:12 2011 : Info: [ttls] ACK handshake fragment handler Wed Jan 5 12:20:12 2011 : Info: [ttls] eaptls_verify returned 1 Wed Jan 5 12:20:12 2011 : Info: [ttls] eaptls_process returned 13 Wed Jan 5 12:20:12 2011 : Info: ++[eap_canopy] returns handled Wed Jan 5 12:20:12 2011 : Info: } # server canopy Sending Access-Challenge of id 0 to 66.242.65.10 port 28461 User-Name = "anonymous" EAP-Message = 0x010403241580000007086c6c696e6f69733121301f060355040a13184d6f746f726f6c6120536f6c7574696f6e732c20496e632e31223020060355040b131943616e6f707920576972656c6573732042726f616462616e64312230200603550403131943616e6f707920414141205365727665722044656d6f2043413133303106092a864886f70d0109011624746563686e6963616c2d737570706f72744063616e6f7079776972656c6573732e636f6d301e170d3031303130313030303030305a170d3439313233313233353935395a3081c0310b30090603550406130255533111300f06035504081308496c6c696e6f69733121301f060355040a EAP-Message = 0x13184d6f746f726f6c6120536f6c7574696f6e732c20496e632e31223020060355040b131943616e6f707920576972656c6573732042726f616462616e64312230200603550403131943616e6f707920414141205365727665722044656d6f2043413133303106092a864886f70d0109011624746563686e6963616c2d737570706f72744063616e6f7079776972656c6573732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c0a0b87b37f1cab947267e48f511647106226ab3567a8c786eb048cd14d620a59af65c2efb8c7abd4438573a6984093cf44531efa8b5c776e2c8b88d1a2be829283d709a984b7e4ac9 EAP-Message = 0x1ea9fcf413b20379285b7ead840b68e0c586b5bf2ade8e8dc0d6822b31bcfaf9f15abc23d47991b99f8c7024ac0d3618cff88ea93e3ef10203010001a350304e300c0603551d13040530030101ff301d0603551d0e04160414eb8c22114d8cc6f0968ff7e23373b77b2eb56940301f0603551d23041830168014eb8c22114d8cc6f0968ff7e23373b77b2eb56940300d06092a864886f70d0101050500038181000360b68c65dde686acea14798fe0e4029fbda711f2045a40be3f76cd787312e9bcb022578026481262cc20b501ce55680dc88696e25d99d01d78f56d9f72473387c959208584dba1f7d29b2e9b2bca043d7454bc11d29cf395d9b15e EAP-Message = 0x501c5d3f10d8f9089544be01959ef9c6bc226f2b4042cf2db63d06918ea3c735fa891cd316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x349732523693276465a22536fa36099e Wed Jan 5 12:20:12 2011 : Info: Finished request 11. Wed Jan 5 12:20:12 2011 : Debug: Going to the next request Wed Jan 5 12:20:12 2011 : Debug: Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 66.242.65.10 port 28461, id=0, length=301 Wed Jan 5 12:20:12 2011 : Info: Cleaning up request 11 ID 0 with timestamp +54 Wed Jan 5 12:20:12 2011 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Wed Jan 5 12:20:12 2011 : Debug: WARNING: !! EAP session for state 0x3497325236932764 did not finish! Wed Jan 5 12:20:12 2011 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Wed Jan 5 12:20:12 2011 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User-Name = "anonymous" State = 0x349732523693276465a22536fa36099e NAS-IP-Address = 192.168.4.48 NAS-Port = 5 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1020 EAP-Message = 0x020400d01580000000c616030100861000008200806052251474e233df35b01e90a43892c2833489b2ac9d76b100f6c8a9c688586f7c4376c0ea704a68f593890d70beb86cca62eff2a3a00531bd58161c54db97dae680455d79d681d836da7d28dfd0c5f05ea7f16047526a173c7f336f1c4904313db71029a1a86df32ba82622bd7f4ffa9d1daa4b88cefce8adbaecb91d3639291403010001011603010030fc814716449d1366ced44cd691c760d23d77a919163b3e83226282d94e3bb860c2938036a236d260363f827a75e48337 Message-Authenticator = 0x180e7f18caa6a2932c7df9968425f0ac Wed Jan 5 12:20:12 2011 : Info: server canopy { Wed Jan 5 12:20:12 2011 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: +- entering group authorize {...} Wed Jan 5 12:20:12 2011 : Info: expand: %{User-Name} -> anonymous Wed Jan 5 12:20:12 2011 : Info: ++[reply] returns notfound Wed Jan 5 12:20:12 2011 : Info: ++[preprocess] returns ok Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] EAP packet type response id 4 length 208 Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] Continuing tunnel setup. Wed Jan 5 12:20:12 2011 : Info: ++[eap_canopy] returns ok Wed Jan 5 12:20:12 2011 : Info: Found Auth-Type = eap_canopy Wed Jan 5 12:20:12 2011 : Info: # Executing group from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: +- entering group authenticate {...} Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] Request found, released from the list Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] EAP/ttls Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] processing type ttls Wed Jan 5 12:20:12 2011 : Info: [ttls] Authenticate Wed Jan 5 12:20:12 2011 : Info: [ttls] processing EAP-TLS Wed Jan 5 12:20:12 2011 : Debug: TLS Length 198 Wed Jan 5 12:20:12 2011 : Info: [ttls] Length Included Wed Jan 5 12:20:12 2011 : Info: [ttls] eaptls_verify returned 11 Wed Jan 5 12:20:12 2011 : Info: [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange Wed Jan 5 12:20:12 2011 : Info: [ttls] TLS_accept: SSLv3 read client key exchange A Wed Jan 5 12:20:12 2011 : Info: [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] Wed Jan 5 12:20:12 2011 : Info: [ttls] <<< TLS 1.0 Handshake [length 0010], Finished Wed Jan 5 12:20:12 2011 : Info: [ttls] TLS_accept: SSLv3 read finished A Wed Jan 5 12:20:12 2011 : Info: [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] Wed Jan 5 12:20:12 2011 : Info: [ttls] TLS_accept: SSLv3 write change cipher spec A Wed Jan 5 12:20:12 2011 : Info: [ttls] >>> TLS 1.0 Handshake [length 0010], Finished Wed Jan 5 12:20:12 2011 : Info: [ttls] TLS_accept: SSLv3 write finished A Wed Jan 5 12:20:12 2011 : Info: [ttls] TLS_accept: SSLv3 flush data Wed Jan 5 12:20:12 2011 : Debug: SSL: adding session 56e4abbc8e95315b66f0618a78ce9a1ea6c20108ff0671f3835cc086cf080605 to cache Wed Jan 5 12:20:12 2011 : Info: [ttls] (other): SSL negotiation finished successfully Wed Jan 5 12:20:12 2011 : Debug: SSL Connection Established Wed Jan 5 12:20:12 2011 : Info: [ttls] eaptls_process returned 13 Wed Jan 5 12:20:12 2011 : Info: ++[eap_canopy] returns handled Wed Jan 5 12:20:12 2011 : Info: } # server canopy Sending Access-Challenge of id 0 to 66.242.65.10 port 28461 User-Name = "anonymous" EAP-Message = 0x0105004515800000003b14030100010116030100301424f225e78255e13ca118b19c0741d52c6605608b43cba7e33ec19ed7b362f2ad107a1297dd55d26f400cc6ad9d612e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x349732523792276465a22536fa36099e Wed Jan 5 12:20:12 2011 : Info: Finished request 12. Wed Jan 5 12:20:12 2011 : Debug: Going to the next request Wed Jan 5 12:20:12 2011 : Debug: Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 66.242.65.10 port 28461, id=0, length=252 Wed Jan 5 12:20:12 2011 : Info: Cleaning up request 12 ID 0 with timestamp +54 Wed Jan 5 12:20:12 2011 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Wed Jan 5 12:20:12 2011 : Debug: WARNING: !! EAP session for state 0x3497325237922764 did not finish! Wed Jan 5 12:20:12 2011 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Wed Jan 5 12:20:12 2011 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User-Name = "anonymous" State = 0x349732523792276465a22536fa36099e NAS-IP-Address = 192.168.4.48 NAS-Port = 5 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1020 EAP-Message = 0x0205009f158000000095170301009027f7fc953ec398362d2865c00dff24abe16326d4babc2080ebd9ffadd2ff577c401300c3b1ad3e6707880f3b156afca840797dc17605c07e2a339f0a017bac5036b081d71a4aa0f0cc397c27135a224da1be245b7456c5b1e569b24386ca2e2cfedfba5041d26a882307f7dfcc8f8cf4628d0ca11cbba6dc574523077723829df80fb27b0935ec431c77d350f981ee4c Message-Authenticator = 0x414201600d229c940acaa76321d47521 Wed Jan 5 12:20:12 2011 : Info: server canopy { Wed Jan 5 12:20:12 2011 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: +- entering group authorize {...} Wed Jan 5 12:20:12 2011 : Info: expand: %{User-Name} -> anonymous Wed Jan 5 12:20:12 2011 : Info: ++[reply] returns notfound Wed Jan 5 12:20:12 2011 : Info: ++[preprocess] returns ok Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] EAP packet type response id 5 length 159 Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] Continuing tunnel setup. Wed Jan 5 12:20:12 2011 : Info: ++[eap_canopy] returns ok Wed Jan 5 12:20:12 2011 : Info: Found Auth-Type = eap_canopy Wed Jan 5 12:20:12 2011 : Info: # Executing group from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: +- entering group authenticate {...} Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] Request found, released from the list Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] EAP/ttls Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] processing type ttls Wed Jan 5 12:20:12 2011 : Info: [ttls] Authenticate Wed Jan 5 12:20:12 2011 : Info: [ttls] processing EAP-TLS Wed Jan 5 12:20:12 2011 : Debug: TLS Length 149 Wed Jan 5 12:20:12 2011 : Info: [ttls] Length Included Wed Jan 5 12:20:12 2011 : Info: [ttls] eaptls_verify returned 11 Wed Jan 5 12:20:12 2011 : Info: [ttls] eaptls_process returned 7 Wed Jan 5 12:20:12 2011 : Info: [ttls] Session established. Proceeding to decode tunneled attributes. Wed Jan 5 12:20:12 2011 : Info: [ttls] Got tunneled request User-Name = "0a-00-3e-90-ff-93" MS-CHAP-Challenge = 0x55d8506d7436ba417bfaa01c8b21a04e MS-CHAP2-Response = 0xdd00c29e28c10e95bc0d708eed268ed9c633000000000000000006ce1ccccaa7956d849fd0aab90379270368a733b58f443b FreeRADIUS-Proxied-To = 127.0.0.1 Wed Jan 5 12:20:12 2011 : Info: [ttls] Sending tunneled request User-Name = "0a-00-3e-90-ff-93" MS-CHAP-Challenge = 0x55d8506d7436ba417bfaa01c8b21a04e MS-CHAP2-Response = 0xdd00c29e28c10e95bc0d708eed268ed9c633000000000000000006ce1ccccaa7956d849fd0aab90379270368a733b58f443b FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = 192.168.4.48 NAS-Port = 5 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1020 server inner-tunnel { Wed Jan 5 12:20:12 2011 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel Wed Jan 5 12:20:12 2011 : Info: +- entering group authorize {...} Wed Jan 5 12:20:12 2011 : Info: ++[chap] returns noop Wed Jan 5 12:20:12 2011 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Wed Jan 5 12:20:12 2011 : Info: ++[mschap] returns ok Wed Jan 5 12:20:12 2011 : Info: [suffix] No '@' in User-Name = "0a-00-3e-90-ff-93", looking up realm NULL Wed Jan 5 12:20:12 2011 : Info: [suffix] No such realm "NULL" Wed Jan 5 12:20:12 2011 : Info: ++[suffix] returns noop Wed Jan 5 12:20:12 2011 : Info: ++[control] returns noop Wed Jan 5 12:20:12 2011 : Info: [eap] No EAP-Message, not doing EAP Wed Jan 5 12:20:12 2011 : Info: ++[eap] returns noop Wed Jan 5 12:20:12 2011 : Info: ++- entering policy redundant {...} Wed Jan 5 12:20:12 2011 : Info: [sqlmain] expand: %{Stripped-User-Name} -> Wed Jan 5 12:20:12 2011 : Info: [sqlmain] ... expanding second conditional Wed Jan 5 12:20:12 2011 : Info: [sqlmain] expand: %{User-Name} -> 0a-00-3e-90-ff-93 Wed Jan 5 12:20:12 2011 : Info: [sqlmain] expand: %{%{User-Name}:-DEFAULT} -> 0a-00-3e-90-ff-93 Wed Jan 5 12:20:12 2011 : Info: [sqlmain] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> 0a-00-3e-90-ff-93 Wed Jan 5 12:20:12 2011 : Info: [sqlmain] sql_set_user escaped user --> '0a-00-3e-90-ff-93' Wed Jan 5 12:20:12 2011 : Debug: rlm_sql (sqlmain): Reserving sql socket id: 10 Wed Jan 5 12:20:12 2011 : Info: [sqlmain] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '0a-00-3e-90-ff-93' ORDER BY id Wed Jan 5 12:20:12 2011 : Info: [sqlmain] User found in radcheck table Wed Jan 5 12:20:12 2011 : Info: [sqlmain] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '0a-00-3e-90-ff-93' ORDER BY id Wed Jan 5 12:20:12 2011 : Info: [sqlmain] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY '0a-00-3e-90-ff-93' ORDER BY priority Wed Jan 5 12:20:12 2011 : Info: [sqlmain] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Canopy_SM' ORDER BY id Wed Jan 5 12:20:12 2011 : Info: [sqlmain] User found in group Canopy_SM Wed Jan 5 12:20:12 2011 : Info: [sqlmain] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Canopy_SM' ORDER BY id Wed Jan 5 12:20:12 2011 : Info: [sqlmain] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Canopy_Res1536' ORDER BY id Wed Jan 5 12:20:12 2011 : Info: [sqlmain] User found in group Canopy_Res1536 Wed Jan 5 12:20:12 2011 : Info: [sqlmain] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Canopy_Res1536' ORDER BY id Wed Jan 5 12:20:12 2011 : Debug: rlm_sql (sqlmain): Released sql socket id: 10 Wed Jan 5 12:20:12 2011 : Info: +++[sqlmain] returns ok Wed Jan 5 12:20:12 2011 : Info: ++- policy redundant returns ok Wed Jan 5 12:20:12 2011 : Info: ++[expiration] returns noop Wed Jan 5 12:20:12 2011 : Info: ++[logintime] returns noop Wed Jan 5 12:20:12 2011 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP Wed Jan 5 12:20:12 2011 : Info: ++[pap] returns noop Wed Jan 5 12:20:12 2011 : Info: Found Auth-Type = MSCHAP Wed Jan 5 12:20:12 2011 : Info: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel Wed Jan 5 12:20:12 2011 : Info: +- entering group MS-CHAP {...} Wed Jan 5 12:20:12 2011 : Info: [mschap] Creating challenge hash with username: 0a-00-3e-90-ff-93 Wed Jan 5 12:20:12 2011 : Info: [mschap] Told to do MS-CHAPv2 for 0a-00-3e-90-ff-93 with NT-Password Wed Jan 5 12:20:12 2011 : Info: [mschap] adding MS-CHAPv2 MPPE keys Wed Jan 5 12:20:12 2011 : Info: ++[mschap] returns ok Wed Jan 5 12:20:12 2011 : Auth: Login OK: [0a-00-3e-90-ff-93] (from client MTC WAN port 5 via TLS tunnel) Wed Jan 5 12:20:12 2011 : Info: WARNING: Empty post-auth section. Using default return values. Wed Jan 5 12:20:12 2011 : Info: # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel } # server inner-tunnel Wed Jan 5 12:20:12 2011 : Info: [ttls] Got tunneled reply code 2 Motorola-Canopy-VLLEARNEN = Enable Motorola-Canopy-VLFRAMES = All Motorola-Canopy-VLAGETO = 1440 Motorola-Canopy-VLSMMGPASS = Enable Motorola-Canopy-BCASTMIR = 200 Motorola-Canopy-HPENABLE = Disable Motorola-Canopy-ULBR = 512 Motorola-Canopy-ULBL = 1024 Motorola-Canopy-DLBR = 1536 Motorola-Canopy-DLBL = 3072 MS-CHAP2-Success = 0xdd533d35413832393633423538373533334437443036333545454243353939443343384237424435434344 MS-MPPE-Recv-Key = 0xbeb5c2f487f5d04afdd79d7a34333156 MS-MPPE-Send-Key = 0x654709eb0ed4833cfba23373b26ec90d MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Wed Jan 5 12:20:12 2011 : Info: [ttls] Got tunneled Access-Accept Wed Jan 5 12:20:12 2011 : Info: [ttls] Got MS-CHAP2-Success, tunneling it to the client in a challenge. Wed Jan 5 12:20:12 2011 : Info: ++[eap_canopy] returns handled Wed Jan 5 12:20:12 2011 : Info: } # server canopy Sending Access-Challenge of id 0 to 66.242.65.10 port 28461 User-Name = "anonymous" EAP-Message = 0x0106005f1580000000551703010050e31a54aa3f505e5dbd650217d16a5934079d8429ae74d54eaf4f71737d6738e4e87adfd2cdec2d815c71ccac52ac3b8fad73bcf6f6c17ac8e2ba97b734c77a285c4a15322756d40f6b294c001d5bf285 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x349732523091276465a22536fa36099e Wed Jan 5 12:20:12 2011 : Info: Finished request 13. Wed Jan 5 12:20:12 2011 : Debug: Going to the next request Wed Jan 5 12:20:12 2011 : Debug: Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 66.242.65.10 port 28461, id=0, length=99 Wed Jan 5 12:20:12 2011 : Info: Cleaning up request 13 ID 0 with timestamp +54 Wed Jan 5 12:20:12 2011 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Wed Jan 5 12:20:12 2011 : Debug: WARNING: !! EAP session for state 0x3497325230912764 did not finish! Wed Jan 5 12:20:12 2011 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Wed Jan 5 12:20:12 2011 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User-Name = "anonymous" State = 0x349732523091276465a22536fa36099e NAS-IP-Address = 192.168.4.48 NAS-Port = 5 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1020 EAP-Message = 0x020600061500 Message-Authenticator = 0xf0f5a88ff1fa628b41a033a2ece3f5d2 Wed Jan 5 12:20:12 2011 : Info: server canopy { Wed Jan 5 12:20:12 2011 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: +- entering group authorize {...} Wed Jan 5 12:20:12 2011 : Info: expand: %{User-Name} -> anonymous Wed Jan 5 12:20:12 2011 : Info: ++[reply] returns notfound Wed Jan 5 12:20:12 2011 : Info: ++[preprocess] returns ok Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] EAP packet type response id 6 length 6 Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] Continuing tunnel setup. Wed Jan 5 12:20:12 2011 : Info: ++[eap_canopy] returns ok Wed Jan 5 12:20:12 2011 : Info: Found Auth-Type = eap_canopy Wed Jan 5 12:20:12 2011 : Info: # Executing group from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: +- entering group authenticate {...} Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] Request found, released from the list Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] EAP/ttls Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] processing type ttls Wed Jan 5 12:20:12 2011 : Info: [ttls] Authenticate Wed Jan 5 12:20:12 2011 : Info: [ttls] processing EAP-TLS Wed Jan 5 12:20:12 2011 : Info: [ttls] Received TLS ACK Wed Jan 5 12:20:12 2011 : Info: [ttls] ACK handshake is finished Wed Jan 5 12:20:12 2011 : Info: [ttls] eaptls_verify returned 3 Wed Jan 5 12:20:12 2011 : Info: [ttls] eaptls_process returned 3 Wed Jan 5 12:20:12 2011 : Info: [ttls] Using saved attributes from the original Access-Accept Motorola-Canopy-VLLEARNEN = Enable Motorola-Canopy-VLFRAMES = All Motorola-Canopy-VLAGETO = 1440 Motorola-Canopy-VLSMMGPASS = Enable Motorola-Canopy-BCASTMIR = 200 Motorola-Canopy-HPENABLE = Disable Motorola-Canopy-ULBR = 512 Motorola-Canopy-ULBL = 1024 Motorola-Canopy-DLBR = 1536 Motorola-Canopy-DLBL = 3072 Wed Jan 5 12:20:12 2011 : Info: [ttls] Saving response in the cache Wed Jan 5 12:20:12 2011 : Info: [eap_canopy] Freeing handler Wed Jan 5 12:20:12 2011 : Info: ++[eap_canopy] returns ok Wed Jan 5 12:20:12 2011 : Auth: Login OK: [anonymous] (from client MTC WAN port 5) Wed Jan 5 12:20:12 2011 : Info: WARNING: Empty post-auth section. Using default return values. Wed Jan 5 12:20:12 2011 : Info: # Executing section post-auth from file /etc/raddb/sites-enabled/canopy Wed Jan 5 12:20:12 2011 : Info: } # server canopy Sending Access-Accept of id 0 to 66.242.65.10 port 28461 User-Name = "anonymous" Motorola-Canopy-VLLEARNEN = Enable Motorola-Canopy-VLFRAMES = All Motorola-Canopy-VLAGETO = 1440 Motorola-Canopy-VLSMMGPASS = Enable Motorola-Canopy-BCASTMIR = 200 Motorola-Canopy-HPENABLE = Disable Motorola-Canopy-ULBR = 512 Motorola-Canopy-ULBL = 1024 Motorola-Canopy-DLBR = 1536 Motorola-Canopy-DLBL = 3072 MS-MPPE-Recv-Key = 0xdd9e15596bfac7dd8c66fd557f61357419e77e8ecccac8e9f6a3355d982ce8ab MS-MPPE-Send-Key = 0x8d0293fbc4e5971e8b045d16916a67d912a1f68872c049d85794c76c4e523259 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 Wed Jan 5 12:20:12 2011 : Info: Finished request 14. Wed Jan 5 12:20:12 2011 : Debug: Going to the next request Wed Jan 5 12:20:12 2011 : Debug: Waking up in 2.9 seconds. Wed Jan 5 12:20:15 2011 : Info: Cleaning up request 14 ID 0 with timestamp +54 Wed Jan 5 12:20:15 2011 : Info: Ready to process requests. Compared to a different string of requests generated using wpa_supplicant the id is obviously incremented (skipping the first five packets): rad_recv: Access-Request packet from host 172.17.0.138 port 55717, id=6, length=316 User-Name = "anonymous(a)wisper-wireless.com" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 Connect-Info = "CONNECT 11Mbps 802.11b" NAS-Port-Type = Wireless-802.16 Service-Type = Framed-User EAP-Message = 0x020600a0150017030100203de4af49c951500431261fcd0f815bd5a18f05d0549a0ce4af46b54f2b0d59fd17030100708c00bea3cc199c88da3b652504a95d94b52bc4ee1fda8b284bfa8d5eefc11dc66b33dd975c9faf53b1300d96b900e17558935821f276bca430f73605d2c75d3982f50eaf7e26e1b3fa81faef891962505583b278adf9f6de430f4c81e084ed55575b8c38dd655187d8319b15050b17f3 State = 0xdf91ccf8da97d9cc64d8d4a9a5b4db83 Message-Authenticator = 0x55b6786727aeeca2723a076f66fb9a9f

3 4

multiple DNs in check_cert_issuer?
by Hendl Stephan 06 Jan '11

06 Jan '11

Hi list, we have a freeradius server with enabled tls and an own CA. We prove the validity of the cert issuer like it is aoutlined in the example below. check_cert_issuer = "/C=DE/ST=somewhere/L=someplace/O=AnyCompany" No we want to change our CA and want to use two CAs for a couple of weeks. Is it possible to configure that? Thanks Stephan

3 2

Microsoft SoH Support
by Alan DeKok 06 Jan '11

06 Jan '11

Thanks to a lot of work by Phil Mayers, the server now has support for Microsoft SoH in PEAP, normal RADIUS (MS VPN gateway), and in DHCP. The code is in the "v2.1.x" branch, and in the "stable" branch. It will be in 2.1.11, and all later versions of the server. The documentation is in doc/SoH.txt, and in raddb/sites-available/soh. The EAP configuration in eap.conf can also be updated to enable SoH on the server side. See http://git.freeradius.org/ for information on git. Alan DeKok.

5 22

help with MAC_auth
by Nagaraj Panyam 05 Jan '11

05 Jan '11

Hi, I installed freeradius2-2.1.7-7.el5.x86_64 and set it up for MAC_auth as explained in this freeradius wiki page <http://wiki.freeradius.org/Mac-Auth> But its not working. I am attaching the output of radiusd -X, and the policy.conf files I went through the output myself, I notice these: a) it has not executed "rewrite_calling_station", going by the mac format in the debug output. b) The wifi client has a window which prompts for username/password (not expected in simple mac_auth) Can someone point out what mistake I am doing? Thanks a lot. Nagaraj -- +----------------------------------+--------------------------------------+ Nagaraj Panyam | Office tel: +91-22-22782126 Dept of High Energy Physics | Office fax: +91-22-22804610 Tata Instt. of Fundamental Research| Home tel : +91-22-22804936 Mumbai - 400 005, INDIA | **Email** : pn(a)tifr.res.in +----------------------------------+--------------------------------------+ ad_recv: Access-Request packet from host xx.xx.xx.xx port 3072, id=57, length=185 User-Name = "TEST\\test-1804" NAS-IP-Address = xx.xx.xx.xx NAS-Port = 0 Called-Station-Id = "001f1fd74ce9" Calling-Station-Id = "001a734337c9" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001301544553545c746573742d31383034 Message-Authenticator = 0x8012a54d51c5aa3c6a6a96aa75aa18cd +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "TEST\test-1804", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 57 to xx.xx.xx.xx port 3072 EAP-Message = 0x010100160410bcac0552383c8987ceeedb8259d7512e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1c30f25f1c20b7f17369eba55349056 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host xx.xx.xx.xx port 3072, id=58, length=184 User-Name = "TEST\\test-1804" NAS-IP-Address = xx.xx.xx.xx NAS-Port = 0 Called-Station-Id = "001f1fd74ce9" Calling-Station-Id = "001a734337c9" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0xf1c30f25f1c20b7f17369eba55349056 Message-Authenticator = 0x9a186d278c1f81fb746473363ed32079 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "TEST\test-1804", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 58 to xx.xx.xx.xx port 3072 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1c30f25f0c1167f17369eba55349056 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host xx.xx.xx.xx port 3072, id=59, length=308 User-Name = "TEST\\test-1804" NAS-IP-Address = xx.xx.xx.xx NAS-Port = 0 Called-Station-Id = "001f1fd74ce9" Calling-Station-Id = "001a734337c9" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202008219800000007816030100730100006f03014d2465745b05fc2eeed27aa497d088ce5d8db0996b6a4a9486280ddf78927653000018002f00350005000ac009c00ac013c01400320038001300040100002e00000013001100000e746573745c746573742d31383034000a00080006001700180019000b00020100ff01000100 State = 0xf1c30f25f0c1167f17369eba55349056 Message-Authenticator = 0xc79d3a7230dc27da64618790895b12f4 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "TEST\test-1804", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 130 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 120 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0073], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 59 to xx.xx.xx.xx port 3072 EAP-Message = 0x0103040019c0000008a216030100310200002d03014d24658e440cdb90c5cf5817264cd7a51def1ffe8a170d51d4916929ded259cf00002f000005ff01000100160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3131303130333131343735385a170d3132303130333131343735385a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100e9ce0d20797f9d5a1d956453494dc3093fd6e4a816c41e0f287b56ac6000101537f12d02201a3a31a9e50dd8ed5f99a0d914e3389fca43 EAP-Message = 0x4ab5fa7821da3d5bc3492570e61024827d03917ab768326078804225ab57136d89997c5746ac5441671265cfe93ad9d36b72351d39f88b879b164502b5f20fd66efd76dec45e7d77597c25266ffc1d10ff38aa4c8e2de86e0d114183c4833e02f39e003d001b9a1921c7e61b3d6f6063237aca41a18e6a9bbdcd268685df6d66c1d644474a3be69e3a771554e6caceb9f9a930b9375a970ace830edf4b21baaccf669a462b18f2cb108dbeb6849ec0d6582cdded75442a6532f18a8ccf5066fa1c90394aeded6d1e590203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003820101009985 EAP-Message = 0x10e2b6a56e12676ab2c5cd1621418113f71ab254589459d5f509782e85c692446a86a0fac92cc5b60613e165251fc20bbe76c2cb969f934c4be73577fc59b9a3a639b2ba7f05712c1c07c4fd5b89358b2475002bb87fc880dd7239aa3bd46984338818ec7290c30ed5046b986c56f412602492b508550a5eaa12a437988f609701a051d12ba2ec9507cfe6f58f44f0167054d21f7971af197bf3145dded0906a85c58db37364565caf20d110893a26a9908a1008aff0fba755e5812d73731e7de519949d80f37e02024b1eeb2b557d91e2443462f1d716122a82089a282de906089eacaece3013ee68ed21175b263a80a2febe033d2e86fa626a819a45 EAP-Message = 0xf60004ab308204a73082038f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1c30f25f3c0167f17369eba55349056 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host xx.xx.xx.xx port 3072, id=60, length=184 User-Name = "TEST\\test-1804" NAS-IP-Address = xx.xx.xx.xx NAS-Port = 0 Called-Station-Id = "001f1fd74ce9" Calling-Station-Id = "001a734337c9" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0xf1c30f25f3c0167f17369eba55349056 Message-Authenticator = 0x261da0e043b9bfb64e89e09348b83a45 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "TEST\test-1804", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 60 to xx.xx.xx.xx port 3072 EAP-Message = 0x010403fc1940a003020102020900b703e3654b392aed300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3131303130333131343735385a170d3132303130333131343735385a308193310b3009060355040613024652310f300d0603550408130652616469757331 EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c5f36f8fe6bc13068e2daaadac4acac248ce11a0d13c5cab7b8b7dbd8084681e4cb9a9d3145b4e43b6462d71d4426a0aeaa641a0f9a5662cd522d345d87e3ab405c91692c2b5d4613c828191acc54b3e6e2421603eef58c716b2801eef3b79ad38943efab044f9ef EAP-Message = 0x6952c7b635961ed24273e357186d1070ff869f5747993caa0e7bf944f3c4e88e64c411fe3f60bb35b835a931d851cecea15e05d06b46b9f581aaed78e88392fb4cf9fec4f75e03384bc4af1e345dc82339a0fc7cd2f6047def8e61a0cd4e2d8206aa708cb5f6ab123f5e41735cd97fe41b8a49960c7597ed51066249e4e88bd910fc9385f828568573edada97b2fff45a57671f476c7992b0203010001a381fb3081f8301d0603551d0e041604145209f0d910b833d8c2bf21013979a67fbcc16c093081c80603551d230481c03081bd80145209f0d910b833d8c2bf21013979a67fbcc16c09a18199a48196308193310b300906035504061302465231 EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900b703e3654b392aed300c0603551d13040530030101ff300d06092a864886f70d010105050003820101001837a0d066840811146ee1438a22673ee350f09c19e284ff5da1e1725b8019bb089f4eac597f0381be89dfccfb98375c86128b2833bfe61122d3c8530da1d3fe8efe2cf6164c2560eda60d EAP-Message = 0x93a5a16694df2a56 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1c30f25f2c7167f17369eba55349056 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host xx.xx.xx.xx port 3072, id=61, length=184 User-Name = "TEST\\test-1804" NAS-IP-Address = xx.xx.xx.xx NAS-Port = 0 Called-Station-Id = "001f1fd74ce9" Calling-Station-Id = "001a734337c9" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400061900 State = 0xf1c30f25f2c7167f17369eba55349056 Message-Authenticator = 0x47f450d8911252a7359fb4aca48d6de0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "TEST\test-1804", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 61 to xx.xx.xx.xx port 3072 EAP-Message = 0x010500bc1900adf270039788633910428185442e7440ff8ee7c3c78d36f887e5137eeb0e7c3656e0c266b7fdbf30222d944164df65826d7ff08636f9272aa22ffe9123ead878173bb5b40938fc6600ea8c4a907a469a9542ae8aaedcf93a6a69edac75135e899d231022c6656be3091333a11e31943a7e306170683a98a2f3fd51f109e31d9b7706eca3748f7707d09d0e9b52d254ca8d86d1aacacd188fd789a6a5dba4f1fbde15f7d0063786469fce43fae316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1c30f25f5c6167f17369eba55349056 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host xx.xx.xx.xx port 3072, id=62, length=184 User-Name = "TEST\\test-1804" NAS-IP-Address = xx.xx.xx.xx NAS-Port = 0 Called-Station-Id = "001f1fd74ce9" Calling-Station-Id = "001a734337c9" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061900 State = 0xf1c30f25f5c6167f17369eba55349056 Message-Authenticator = 0xd8967a29a74719843bd5e7b6a8640645 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "TEST\test-1804", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 62 to xx.xx.xx.xx port 3072 EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1c30f25f4c5167f17369eba55349056 Finished request 5. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 57 with timestamp +39 Cleaning up request 1 ID 58 with timestamp +39 Cleaning up request 2 ID 59 with timestamp +39 Cleaning up request 3 ID 60 with timestamp +39 Cleaning up request 4 ID 61 with timestamp +39 Cleaning up request 5 ID 62 with timestamp +39 Ready to process requests. # -*- text -*- ## ## policy.conf -- FreeRADIUS server configuration file. ## ## http://www.freeradius.org/ ## $Id$ ## # # Policies are virtual modules, similar to those defined in the # "instantate" section of radiusd.conf. # # Defining a policy here means that it can be referenced in multiple # places as a *name*, rather than as a series of conditions to match, # and actions to take. # # Policies are something like subroutines in a normal language, but # they cannot be called recursively. They MUST be defined in order. # If policy A calls policy B, then B MUST be defined before A. # policy { # # Forbid all EAP types. # forbid_eap { if (EAP-Message) { reject } } # # Forbid all non-EAP types outside of an EAP tunnel. # permit_only_eap { if (!EAP-Message) { # We MAY be inside of a TTLS tunnel. # PEAP and EAP-FAST require EAP inside of # the tunnel, so this check is OK. # If so, then there MUST be an outer EAP message. if (!"%{outer.request:EAP-Message}") { reject } } } # # Forbid all attempts to login via realms. # deny_realms { if (User-Name =~ /@|\\/) { reject } } # # If you want the server to pretend that it is dead, # then use the "do_not_respond" policy. # do_not_respond { update control { Response-Packet-Type := Do-Not-Respond } handled } # # The following policies are for the Chargeable-User-Identity # (CUI) configuration. # # # The client indicates it can do CUI by sending a CUI attribute # containing one zero byte # cui_authorize { update request { Chargeable-User-Identity:='\\000' } } # # Add a CUI attribute based on the User-Name, and a secret key # known only to this server. # cui_postauth { if (FreeRadius-Proxied-To == 127.0.0.1) { if (outer.request:Chargeable-User-Identity) { update outer.reply { Chargeable-User-Identity:="%{md5:%{config:cui_hash_key}%{User-Name}}" } } } else { if (Chargeable-User-Identity) { update reply { Chargeable-User-Identity="%{md5:%{config:cui_hash_key}%{User-Name}}" } } } } # # If there is a CUI attribute in the reply, add it to the DB. # cui_updatedb { if (reply:Chargeable-User-Identity) { cui } } # # Rewrite called station id attribute into a standard format. # rewrite_calling_station_id { if(request:Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i){ update request { Calling-Station-Id := "%{1}-%{2}-%{3}-%{4}-%{5}-%{6}" } } else { noop } } # # If we had stored a CUI for the User, add it to the request. # cui_accounting { # # If the CUI isn't in the packet, see if we can find it # in the DB. # if (!Chargeable-User-Identity) { update control { Chargable-User-Identity := "%{cui: SELECT cui FROM cui WHERE clientipaddress = '%{Client-IP-Address}' AND callingstationid = '%{Calling-Station-Id}' AND username = '%{User-Name}'}" } } # # If it exists now, then write out when we last saw # this CUI. # if (Chargeable-User-Identity && (Chargeable-User-Identity != "")) { cui } } }

1 0

No EAP/TLS with XP SP3 since End December
by Alexandros Gougousoudis 05 Jan '11

05 Jan '11

Hi, I had a working FreeRadius 1.1.6 installation and running XP Pro SP3 with EAP/TLS on an Ethernet-Port. I use Linksys switches as authenticators. I think since end December (after I went into the xmas holidays) the Radius-Auth stopped working. I changed nothing at the Freeradius-Server. I suspect an MS-Update, major-security updates are rolled out automatically here. But I don't know which one. I made a debug with radiusd -X -A. The conversation looks normal, but at the end, I miss the "Login OK" Statement, it looks like the conversation is not finished and falls asleep. I don't see an error. Can anyone look over it please to give me a hint, where to look? TIA Alex Debug: rad_recv: Access-Request packet from host 10.48.250.10:49154, id=0, length=101 NAS-IP-Address = 10.48.250.10 NAS-Port-Type = Ethernet NAS-Port = 7 User-Name = "host/hfs-080806-02" EAP-Message = 0x0217001701686f73742f6866732d3038303830362d3032 Message-Authenticator = 0xcd421dbdb5fcc2e7692fe75fcbfd5892 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_eap: EAP packet type response id 23 length 23 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry host/hfs-080806-02 at line 3 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 0 to 10.48.250.10 port 49154 EAP-Message = 0x011800060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x793054942f9417f5a0886c08dd4a0e4e Finished request 6 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.48.250.10:49154, id=0, length=183 NAS-IP-Address = 10.48.250.10 NAS-Port-Type = Ethernet NAS-Port = 7 User-Name = "host/hfs-080806-02" State = 0x793054942f9417f5a0886c08dd4a0e4e EAP-Message = 0x021800570d800000004d16030100480100004403014d219685836869e950cfbb8e7ae7a18a95c8871d059171695d24fd163d12cec600001600040005000a0009006400620003000600130012006301000005ff01000100 Message-Authenticator = 0x714b3ff58781c8329f0cebcbf99bc3e2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_eap: EAP packet type response id 24 length 87 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry host/hfs-080806-02 at line 3 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0048], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0ed5], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00bd], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 0 to 10.48.250.10 port 49154 EAP-Message = 0x0119040a0dc000000feb160301004a0200004603014d2195c9e75e9057262ca89fcdd70206a44718c85887fd8a1ee0267568b1cee120013b9c1ff336b6d8838eeb017dbf377c9c69f6e387eeda5ee9daedd8336849600004001603010ed50b000ed1000ece00075c3082075830820540a003020102020162300d06092a864886f70d01010505003081aa310b3009060355040613024445310f300d060355040813064265726c696e310f300d060355040713064265726c696e31143012060355040a130b4b48422048664d2048665331193017060355040b13105365727669636543656e7465722d4954312530230603550403141c5365727669636543 EAP-Message = 0x656e7465722d49545f4b48425f48664d5f4866533121301f06092a864886f70d010901161273632d6974406b682d6265726c696e2e6465301e170d3037303831333038333434385a170d3132303831313038333434385a308189310b3009060355040613024445310f300d060355040813064265726c696e310f300d060355040713064265726c696e31143012060355040a130b4b48422048664d2048665331193017060355040b13105365727669636543656e7465722d4954312730250603550403131e7261646975732e76657277616c74756e672e6b682d6265726c696e2e646530820222300d06092a864886f70d01010105000382020f003082 EAP-Message = 0x020a02820201009d061598c850223454cb70a58cae0a1ac2db0b6a963d25c96c632b1eb2a9177e3e8a066fa9c3596c4a1b035def3b6c589a12209a6d7ab7aa4144de890803c34cb5239cdb3b7266426049d475ed3e354fe494dee46a17e7478065c7332f6ac621d9b754d46812dc4ffda7a39bf33987fbe6951a591aee791c9468cc70f5a821683640675bafea24fe5291d6750c30a1b0a4c52cbeb6a18ce514038432f3dc83ce12657de67976dff9a7643b7ad340240e5e69385355b64d3e77f4bb0dfbc8fd63258a308c2a6e82f9c0c92e7e4ccadf848cc3bb57d592dcf46930c794fa0b338c9db103b9a7162352ff8cac3b680d64ec0b865bf74778 EAP-Message = 0x839cd1530d79ba553a2bd9ffb112534cd758bb3b3dba26037ed1c158089af8903e9f5b684061ddd413fb192cfc5024c03b177184101d68bc7111ccdcb6bee8c98d1642bbc547e8211dab2fd5d45488da089a17edaa9b4dd4357d4adcb0e33553210a5ad0e84edc9f9a769297649672d5f78e2f3687e99c411abea88e0363fe1afb7dcf05a8838ef07cec88337f903a94a6207893b5e9ff80441a12b6847ff008eb8c257878f6711a8f8c053315d4ae87b36661cdee73a3cbaca92d14f480804c7476d36665c417db9c954795423ca49de599eb3ed3a6cc55f03bad529359b0a55e5bffa9cf65b3034d48c263c491b24ad9f9f74b6ea9cea17710efc22b EAP-Message = 0xc0d77f58b0a5d3589ab19f13f90203010001a38201a6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdd9f396cf15641e0754754ce9e335224 Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.48.250.10:49154, id=0, length=102 NAS-IP-Address = 10.48.250.10 NAS-Port-Type = Ethernet NAS-Port = 7 User-Name = "host/hfs-080806-02" State = 0xdd9f396cf15641e0754754ce9e335224 EAP-Message = 0x021900060d00 Message-Authenticator = 0x575c7e249430d63e09b6143649ca5d05 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_eap: EAP packet type response id 25 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry host/hfs-080806-02 at line 3 modcall[authorize]: module "files" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 8 modcall: leaving group authenticate (returns handled) for request 8 Sending Access-Challenge of id 0 to 10.48.250.10 port 49154 EAP-Message = 0x011a040a0dc000000feb308201a230090603551d1304023000301106096086480186f8420101040403020640302b06096086480186f842010d041e161c54696e7943412047656e657261746564204365727469666963617465301d0603551d0e0416041442a94a9f048871b178d41a5d00a5668e78c045ff3081df0603551d230481d73081d48014b939b6ce8a52912eaece162418b1f4d8303d042ea181b0a481ad3081aa310b3009060355040613024445310f300d060355040813064265726c696e310f300d060355040713064265726c696e31143012060355040a130b4b48422048664d2048665331193017060355040b13105365727669636543 EAP-Message = 0x656e7465722d4954312530230603550403141c5365727669636543656e7465722d49545f4b48425f48664d5f4866533121301f06092a864886f70d010901161273632d6974406b682d6265726c696e2e6465820900890d6f61ac0ce005301d0603551d1204163014811273632d6974406b682d6265726c696e2e6465301d0603551d1104163014811273632d6974406b682d6265726c696e2e646530160603551d250101ff040c300a06082b06010505070301300d06092a864886f70d0101050500038202010027ddc002c4835bb38b2152a1b93fc65419a91436bcd3e9e4f37b0eaf35498333305a12229d454d797f8cd3e678f0e73467237638ddec EAP-Message = 0x79c4e1f00fc72f18d51dc7658843c2855f5dcb3cc13b10730a5d9f99992e4924d9e28e1f7d12d285d815c734f8c63815124e5cc49d15777d233f7e3b1133c0773d3703e10a70203dc3557185bf629d1d2482d548d3b56f6ca28b7555b971c00899395a5c23a1378f495acbfe162b6929e63bd5c3bb20bb4268d9269235451378e34fde7df5a9392595a3d8c8d889e90a7dc934dce6d61b5cdec3f6652de92ba8786f4a0dffb00a0306873ecd695681eef4ec7cd5861dace26b6504f1ad1899f199ce4a121a3a37197ffe8145e4aee40b6a3fd627088908db8650557b984d447f3c65a6a697672bd242e260493073ee5532d2f4e3c6907332808995a54f EAP-Message = 0xa0c690bd3bdc09c2872280185e5a1e4b999241374ceaf16233fd91b124a65652bfd76cdc0735a06c4fb0197a919ad53d4f2953194e5c8def3884a10e95905dbe338dd2fdb9b997114a023866731016ed5195940ff9f8b1c85994c3fc52e6226d93e8bdebefed24376bae1c923813ea1b7c1d8bc5547a82258696ee03b2ee3b03bff43f28bd340219aaa58bfd28d6767c54269fe907b196157db92c807c693e3f01c81af0145b66af36ae839b4d8add58891ee3a64428c285942cc38c151b113084e252c094f196ab2927078fd100076c3082076830820550a003020102020900890d6f61ac0ce005300d06092a864886f70d01010505003081aa310b30 EAP-Message = 0x09060355040613024445310f300d0603550408130642 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x805e028e859aa0f88cfd562748aaba95 Finished request 8 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.48.250.10:49154, id=0, length=102 NAS-IP-Address = 10.48.250.10 NAS-Port-Type = Ethernet NAS-Port = 7 User-Name = "host/hfs-080806-02" State = 0x805e028e859aa0f88cfd562748aaba95 EAP-Message = 0x021a00060d00 Message-Authenticator = 0xb2e0f50abf1596f8862ed87864157eda Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_eap: EAP packet type response id 26 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 users: Matched entry host/hfs-080806-02 at line 3 modcall[authorize]: module "files" returns ok for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 9 modcall: leaving group authenticate (returns handled) for request 9 Sending Access-Challenge of id 0 to 10.48.250.10 port 49154 EAP-Message = 0x011b040a0dc000000feb65726c696e310f300d060355040713064265726c696e31143012060355040a130b4b48422048664d2048665331193017060355040b13105365727669636543656e7465722d4954312530230603550403141c5365727669636543656e7465722d49545f4b48425f48664d5f4866533121301f06092a864886f70d010901161273632d6974406b682d6265726c696e2e6465301e170d3035303930353038303532355a170d3135303930333038303532355a3081aa310b3009060355040613024445310f300d060355040813064265726c696e310f300d060355040713064265726c696e31143012060355040a130b4b48422048 EAP-Message = 0x664d2048665331193017060355040b13105365727669636543656e7465722d4954312530230603550403141c5365727669636543656e7465722d49545f4b48425f48664d5f4866533121301f06092a864886f70d010901161273632d6974406b682d6265726c696e2e646530820222300d06092a864886f70d01010105000382020f003082020a0282020100c4e58d7b46104aaed067a7f4e2c0bce5fd30388b52102731e8ae991947c14547ca41753f07ee2f50c4374b00950c83165fce3e38cdf4b4749dce3641ce01e450a7f1e53de6997ac4a19b93cc212b2cfb5425c7b1421b89951478dadba32ce7c00421c9791d1af1b38e9ce04141c724d866 EAP-Message = 0xfb11c06bd13a626f830825d002beccae484fcaa3840fdab94afdd1e454155451678ecb4ae36c1628afce08a8622736e5f29360512174ffa60a3a713794d781efa85d83c6df6cc78262910cb757c515450569cd668cdb29a709e3f8d52dde54c69e2b84b0be385347948e360e4095499957b42d0a918cbc647a2377c0c26e0925f386d520f0bc2f25b206a93075e9382d590f4724352edc61a0e497dece898c31ca22c4320d02b55bb519c90f228fcbd6f1d72057245e35a3170a354b207ef1f2a61585256e493bff8b363075452e21cbb5cb26167d8d1201c41911569768a99eea5cff0fb0458e5615e42e8aec5417f2493f5b81cf7b9cdb4ad1995c0c EAP-Message = 0x8bced370d073ee8eefb21f833372027c4fcb84c23c73d1b44df6f5ca34e0d9f674900f9ddf1340179016868a3697a807624dd8f0ff7aea8460241df0a8a74eb8b0151171395155db1fd0b87be63c7047fda731126880bf2228332a38f11ac024cb944d68ce72da5f43d73609e82f92486f4eaad235b104ae3c93061600b3a54e895841eac966309ad0c18cccf17453210f450203010001a382018d30820189301d0603551d0e04160414b939b6ce8a52912eaece162418b1f4d8303d042e3081df0603551d230481d73081d48014b939b6ce8a52912eaece162418b1f4d8303d042ea181b0a481ad3081aa310b3009060355040613024445310f300d06 EAP-Message = 0x0355040813064265726c696e310f300d060355040713 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb6b3d2f0a12aec39a8b4f8e2aec32085 Finished request 9 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.48.250.10:49154, id=0, length=102 NAS-IP-Address = 10.48.250.10 NAS-Port-Type = Ethernet NAS-Port = 7 User-Name = "host/hfs-080806-02" State = 0xb6b3d2f0a12aec39a8b4f8e2aec32085 EAP-Message = 0x021b00060d00 Message-Authenticator = 0xf2d26dcc1e1b911c078c3a416ea3c8a1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 10 modcall[authorize]: module "preprocess" returns ok for request 10 modcall[authorize]: module "mschap" returns noop for request 10 rlm_eap: EAP packet type response id 27 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 10 users: Matched entry host/hfs-080806-02 at line 3 modcall[authorize]: module "files" returns ok for request 10 modcall: leaving group authorize (returns updated) for request 10 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 10 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 10 modcall: leaving group authenticate (returns handled) for request 10 Sending Access-Challenge of id 0 to 10.48.250.10 port 49154 EAP-Message = 0x011c03f50d8000000feb064265726c696e31143012060355040a130b4b48422048664d2048665331193017060355040b13105365727669636543656e7465722d4954312530230603550403141c5365727669636543656e7465722d49545f4b48425f48664d5f4866533121301f06092a864886f70d010901161273632d6974406b682d6265726c696e2e6465820900890d6f61ac0ce005300f0603551d130101ff040530030101ff301106096086480186f842010104040302010630090603551d1204023000302b06096086480186f842010d041e161c54696e7943412047656e657261746564204365727469666963617465301d0603551d11041630 EAP-Message = 0x14811273632d6974406b682d6265726c696e2e6465300b0603551d0f040403020106300d06092a864886f70d0101050500038202010060f0ab4236cda26ba7ceaedfd61052c52b73e1e028ffe29171395f9074e4beee7eab73afc427c17cd0f37e96c7af6eda553a92b2b426f723c283c8ea027f3ab17c93d1ffa7c8a29fedbc83f11f8731a140393c56aceffae318f7ebbca367fed9280513ce2cfad1257c59f056e3898e928f968baa6c3cc094ca50b9072674b8fa43ab0e31c4a7a54eb8f96ad4d275011a449807c3abe4865d8f837ee4d8db0c081af218c00a878d4c7e30268282034b35a666b8295eb53ee41bcda9345a7d48fdb7dc306180df06 EAP-Message = 0xec546e826d73d7dd62bf449c6eb948aa85c808893b308a32636cb151b044b839fc382f8623863d7ac78b7bf3e0f2c1ac4c8a69b9184e58733d966120ce334ab7212f23b85a8e8d5b2ada0f4cc7cb981fafd3585c398b351a06870271c71e537b4010a7d2914151b076a5f4094d1ab64e46a93dbba7456fa75be4006a172f6824219fad1b4c95322c6b9a1703515545ebbdae485fa994ac81fb8d308cdb58038d6c95c15d29f0a317e03877225eebe3647f28dc2361d7fb1894231e475805ec5e95ab5a37c96c70b000695caee3562f474af69b11fc67ccf54e9f0f1d1adc2c9038d56a9fa3454320444843fe38e00de285cb9120b24416fa909c259b52 EAP-Message = 0xd069e64d0d9faa37c336f8bd3a8128a8f5e244029a5ded25e10bfc551dc08730e133a4e4b744cf3d8c038d38b1692c1d4876f92d109efcf136355c2216030100bd0d0000b50301020500af00ad3081aa310b3009060355040613024445310f300d060355040813064265726c696e310f300d060355040713064265726c696e31143012060355040a130b4b48422048664d2048665331193017060355040b13105365727669636543656e7465722d4954312530230603550403141c5365727669636543656e7465722d49545f4b48425f48664d5f4866533121301f06092a864886f70d010901161273632d6974406b682d6265726c696e2e64650e0000 EAP-Message = 0x00 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb96e1a3a059b60b96d74ce260c86a0c5 Finished request 10 Going to the next request Waking up in 6 seconds...

5 9

segfault with rlm_perl
by Anatoly Ivanov 05 Jan '11

05 Jan '11

Hi, I am running freeradius (2.1.8) with rlm_perl (5.10.1, USE_ITHREADS) on a Debian-Lenny system. The problem is radius fails with segfault – periodically and intermittently. I have no way to reliably reproduce the problem – it happens only in production, and it is impossible to reliably predict when or backtrace why. It seems that I am running into some kind of memory allocation error. Coredump type #3 (see below) is the most "popular" one; coredumps with backtrace going into perl seem to be rather random (it fails in different parts of libperl.so) - again, see below. I understand that freeradius has a newer version available - but I am hesitant to upgrade a production server without a very good reason. And I could not find such reason for an upgrade after reading the CHANGELOG for 2.1.10. But maybe I am wrong? Any ideas? Thank you! PS: bt for coredump #1: #0 0xb47d1ab6 in mysql_st_execute (sth=0xaf13a1a8, imp_sth=0xadf537a8) at dbdimp.c:3209 #1 0xb47da215 in XS_DBD__mysql__st_execute (my_perl=0xb831a08, cv=0xb1e16858) at mysql.xsi:588 #2 0xb70740ab in XS_DBI_dispatch () from /opt/server/lib/perl5/i686-linux-thread-multi/auto/DBI/DBI.so #3 0xb76a841e in Perl_pp_entersub () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #4 0xb76a6841 in Perl_runops_standard () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #5 0xb7641500 in Perl_call_sv () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #6 0xb7642284 in Perl_call_pv () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #7 0xb72026ad in rlmperl_call () from /opt/server/radius/lib/rlm_perl.so #8 0x08063524 in modcall () #9 0x0805ffe7 in indexed_modcall () #10 0x080602fc in module_accounting () #11 0x0804e9d1 in rad_accounting () #12 0x0806df65 in radius_handle_request () #13 0x080661d0 in request_handler_thread () #14 0xb759c4c0 in start_thread () from /lib/i686/cmov/libpthread.so.0 #15 0xb734384e in clone () from /lib/i686/cmov/libc.so.6 bt for coredump #2: #0 0xb7690c80 in Perl_pad_undef () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #1 0xb764db67 in Perl_cv_undef () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #2 0xb76dcf5a in Perl_sv_clear () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #3 0xb76dd288 in Perl_sv_free2 () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #4 0xb76dd391 in Perl_sv_free () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #5 0xb76dcd57 in Perl_sv_clear () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #6 0xb76dd288 in Perl_sv_free2 () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #7 0xb70af022 in XS_Sys__Syslog_closelog_xs () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/auto/Sys/Syslog/Syslog.so #8 0xb76c941e in Perl_pp_entersub () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #9 0xb76c7841 in Perl_runops_standard () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #10 0xb7662500 in Perl_call_sv () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #11 0xb7663284 in Perl_call_pv () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #12 0xb72236ad in rlmperl_call () from /opt/server/radius/lib/rlm_perl.so #13 0x08063524 in modcall () #14 0x0805ffe7 in indexed_modcall () #15 0x0806037c in module_authenticate () #16 0x0804f908 in rad_authenticate () #17 0x0806df65 in radius_handle_request () #18 0x080661d0 in request_handler_thread () #19 0xb75bd4c0 in start_thread () from /lib/i686/cmov/libpthread.so.0 #20 0xb736484e in clone () from /lib/i686/cmov/libc.so.6 bt for coredump #3: #0 0xb77a2424 in __kernel_vsyscall () #1 0xb72d6640 in raise () from /lib/i686/cmov/libc.so.6 #2 0xb72d8018 in abort () from /lib/i686/cmov/libc.so.6 #3 0xb731348d in ?? () from /lib/i686/cmov/libc.so.6 #4 0x00000005 in ?? () #5 0xb583f614 in ?? () #6 0x00000400 in ?? () #7 0xb73e97c8 in ?? () from /lib/i686/cmov/libc.so.6 #8 0x00000017 in ?? () #9 0xbfd8b66b in ?? () #10 0x00000020 in ?? () #11 0xb73e97e1 in ?? () from /lib/i686/cmov/libc.so.6 #12 0x00000002 in ?? () #13 0xb73e985c in ?? () from /lib/i686/cmov/libc.so.6 #14 0x00000023 in ?? () #15 0xb73e97e5 in ?? () from /lib/i686/cmov/libc.so.6 #16 0x00000004 in ?? () #17 0xb583fb43 in ?? () #18 0x00000008 in ?? () #19 0xb73e97eb in ?? () from /lib/i686/cmov/libc.so.6 #20 0x00000005 in ?? () #21 0xb72eb388 in vfprintf () from /lib/i686/cmov/libc.so.6 #22 0xb7319764 in ?? () from /lib/i686/cmov/libc.so.6 #23 0x00000002 in ?? () #24 0xb73e97c8 in ?? () from /lib/i686/cmov/libc.so.6 #25 0xbfd8b66b in ?? () #26 0xb73e985c in ?? () from /lib/i686/cmov/libc.so.6 #27 0xb583fb43 in ?? () #28 0xb73e985c in ?? () from /lib/i686/cmov/libc.so.6 #29 0x3079d6d0 in ?? () #30 0x61346564 in ?? () #31 0x00383132 in ?? () #32 0xb7401ff4 in ?? () from /lib/i686/cmov/libc.so.6 #33 0xb7403160 in ?? () from /lib/i686/cmov/libc.so.6 #34 0x0de4a218 in ?? () #35 0xb583fb78 in ?? () #36 0xb731b966 in free () from /lib/i686/cmov/libc.so.6 Backtrace stopped: frame did not save the PC bt for coredump #4: #0 0xb7673132 in Perl_av_fetch () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #1 0xb708c788 in DD_dump () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/auto/Data/Dumper/Dumper.so #2 0xb708d77f in DD_dump () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/auto/Data/Dumper/Dumper.so #3 0xb7090219 in XS_Data__Dumper_Dumpxs () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/auto/Data/Dumper/Dumper.so #4 0xb767541e in Perl_pp_entersub () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #5 0xb7673841 in Perl_runops_standard () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #6 0xb760e500 in Perl_call_sv () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #7 0xb760f284 in Perl_call_pv () from /opt/server/lib/perl5/5.10.1/i686-linux-thread-multi/CORE/libperl.so #8 0xb71cf6ad in rlmperl_call () from /opt/server/radius/lib/rlm_perl.so #9 0x08063524 in modcall () #10 0x0805ffe7 in indexed_modcall () #11 0x0806037c in module_authenticate () #12 0x0804f908 in rad_authenticate () #13 0x0806df65 in radius_handle_request () #14 0x080661d0 in request_handler_thread () #15 0xb75694c0 in start_thread () from /lib/i686/cmov/libpthread.so.0 #16 0xb731084e in clone () from /lib/i686/cmov/libc.so.6

4 3

thread pools in 2.1.10
by Keven Smith-Worthylake 04 Jan '11

04 Jan '11

Hi all, We just upgraded from freeRADIUS 1.1.7 to 2.1.10, and we're having issues getting freeRADIUS to work with a thread pool (see debug logs below). The thread pool config was working in version 1.1.7. Were there major changes on how threads were implemented from 1.1.7 to 2.1.10? Why might we be having this issue? Debug log with thread pool: >radiusd -fxx -l stdout FreeRADIUS Version 2.1.10, for host i586-wrs-linux-gnu, built on Nov 25 2010 at 01:29:23 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including configuration file /etc/raddb/eap.conf main { allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/lib" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log_auth = yes log_auth_badpass = no log_auth_goodpass = no log_stripped_names = no security { max_attributes = 200 reject_delay = 1 status_server = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 1 retry_count = 2 default_fallback = no dead_time = 600 wake_all_if_all_dead = no } radiusd: #### Loading Clients #### client 0.0.0.0/0 { require_message_authenticator = no secret = "siren123" shortname = "this_Shelf" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/radiusd.conf exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/radiusd.conf } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/radiusd.conf pap { encryption_scheme = "crypt" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/radiusd.conf Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/radiusd.conf mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/radiusd.conf unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! WARNING: Fix this by running the OpenSSL command listed in eap.conf Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/radiusd.conf preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/radiusd.conf realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/radiusd.conf files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/radiusd.conf acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/radiusd.conf detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/radiusd.conf radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } # modules } # server thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 } Thread spawned new child 1. Total threads in pool: 1 Thread 1 waiting to be assigned a request Thread spawned new child 2. Total threads in pool: 2 Thread 2 waiting to be assigned a request Thread spawned new child 3. Total threads in pool: 3 Thread 3 waiting to be assigned a request Thread spawned new child 4. Total threads in pool: 4 Thread 4 waiting to be assigned a request Thread spawned new child 5. Total threads in pool: 5 Thread 5 waiting to be assigned a request Thread pool initialized radiusd: #### Opening IP addresses and Ports #### bind_address = * WARNING: The directive 'bind_address' is deprecated, and will be removed in future versions of FreeRADIUS. Please edit the configuration files to use the directive 'listen'. Debug log without thread pool (commented out in radiusd.conf): > radiusd -fxx -l stdout FreeRADIUS Version 2.1.10, for host i586-wrs-linux-gnu, built on Nov 25 2010 at 01:29:23 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including configuration file /etc/raddb/eap.conf main { allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/lib" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log_auth = yes log_auth_badpass = no log_auth_goodpass = no log_stripped_names = no security { max_attributes = 200 reject_delay = 1 status_server = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 1 retry_count = 2 default_fallback = no dead_time = 600 wake_all_if_all_dead = no } radiusd: #### Loading Clients #### client 0.0.0.0/0 { require_message_authenticator = no secret = "siren123" shortname = "this_Shelf" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/radiusd.conf exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/radiusd.conf } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/radiusd.conf pap { encryption_scheme = "crypt" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/radiusd.conf Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/radiusd.conf mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/radiusd.conf unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! WARNING: Fix this by running the OpenSSL command listed in eap.conf Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/radiusd.conf preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/radiusd.conf realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/radiusd.conf files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/radiusd.conf acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/radiusd.conf detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/radiusd.conf radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### bind_address = * WARNING: The directive 'bind_address' is deprecated, and will be removed in future versions of FreeRADIUS. Please edit the configuration files to use the directive 'listen'. Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Thanks, Keven ---------- Keven Smith-Worthylake Software Designer, SI23 GENBAND 3500 Carling Ave Ottawa, ON, Canada, K2H 8E9 office keven.smithworthylake(a)genband.com www.genband.com

2 5

EAP Problem
by amin ahoora 04 Jan '11

04 Jan '11

Hi I have problem with EAP CAN YOU help me WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x90d4d2dd94c2cb92 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. rad_recv: Access-Request packet from host 172.16.15.1 port 1027, id=97, length=144 User-Name = "12" NAS-IP-Address = 172.16.15.1 NAS-Identifier = "aminahoora.home.ir" Framed-MTU = 1496 Called-Station-Id = "40-4a-03-ad-0b-b0" Calling-Station-Id = "00-22-41-7d-9f-91" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021600061900 State = 0x90d4d2dd94c2cb924b3cdc7780b3dc35 Message-Authenticator = 0xfa9a966f33ce0c76a0d15f303480f4ea # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [sql] expand: %{User-Name} -> 12 [sql] sql_set_user escaped user --> '12' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '12' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '12' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '12' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok [eap] EAP packet type response id 22 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 97 to 172.16.15.1 port 1027 EAP-Message = 0x0117002b19001703010020674bd0fe9ec9f56973ac49079d2029c578bad4ad1dac11d67968154832aa91fb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x90d4d2dd95c3cb924b3cdc7780b3dc35 Finished request 21. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.15.1 port 1027, id=98, length=181 User-Name = "12" NAS-IP-Address = 172.16.15.1 NAS-Identifier = "aminahoora.home.ir" Framed-MTU = 1496 Called-Station-Id = "40-4a-03-ad-0b-b0" Calling-Station-Id = "00-22-41-7d-9f-91" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0217002b19001703010020f8c94f58aabcbdadb5aa695270bfa559530931a394827ef3894bfc31d1f7f4a5 State = 0x90d4d2dd95c3cb924b3cdc7780b3dc35 Message-Authenticator = 0x54cf580c0926a0e3575707db7ec6e193 # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [sql] expand: %{User-Name} -> 12 [sql] sql_set_user escaped user --> '12' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '12' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '12' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '12' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [eap] EAP packet type response id 23 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - 12 [peap] Got inner identity '12' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x02170007013132 server { PEAP: Setting User-Name to 12 Sending tunneled request EAP-Message = 0x02170007013132 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "12" server inner-tunnel { No such virtual server "inner-tunnel" } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 98 to 172.16.15.1 port 1027 EAP-Message = 0x0118002b190017030100201edf1da3f3138e40f27c63d735a7bff7351f5abfac971a15b3d4c2369596858c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x90d4d2dd96cccb924b3cdc7780b3dc35 Finished request 22. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.15.1 port 1027, id=99, length=181 User-Name = "12" NAS-IP-Address = 172.16.15.1 NAS-Identifier = "aminahoora.home.ir" Framed-MTU = 1496 Called-Station-Id = "40-4a-03-ad-0b-b0" Calling-Station-Id = "00-22-41-7d-9f-91" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0218002b190017030100203bfebde9a8e41dc51e361c135f24a7d001553e501d1989e8273c42570d62bff4 State = 0x90d4d2dd96cccb924b3cdc7780b3dc35 Message-Authenticator = 0xcad2dc0f9ca9a3aab35ea19c0b9b6356 # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [sql] expand: %{User-Name} -> 12 [sql] sql_set_user escaped user --> '12' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '12' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '12' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '12' ORDER BY priority rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [eap] EAP packet type response id 24 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Sending Access-Reject of id 99 to 172.16.15.1 port 1027 EAP-Message = 0x04180004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 23. Going to the next request Waking up in 4.8 seconds. Cleaning up request 21 ID 97 with timestamp +108 Cleaning up request 22 ID 98 with timestamp +108 Cleaning up request 23 ID 99 with timestamp +108 Ready to process requests. THANK YOU WITH BEST REGARDS AMIN AHOORA

3 4

Too many open files EAP-TLS
by Jason Englander 04 Jan '11

04 Jan '11

I've got a client's server running FreeRADIUS 2.1.10 from source. Linux kernel 2.6.35.7, heavily customized Slackware 13.0 So far, not using chroot, running as root. It's a EAP-TLS setup with OpenSSL verifying via 'client = ', tmpdir = /tmp/radiusd Everything has been fine for weeks, but this morning: Jan 3 08:04:32 dns1 radiusd[22737]: Invalid user: [xxxxxx/<no User-Password attribute>] (from client xxxx port 0 cli xx-xx-xx-xx-xx-xx) Jan 3 08:04:36 dns1 radiusd[22737]: [auth_log] rlm_detail: Couldn't open file /var/log/radius/radacct/x.x.x.x/auth-detail-20110103: Too many open files I checked 'lsof -p' against the running radiusd and the line count of it's output was 1054. Other than the typical linked libraries, socket, etc. at the top, the rest was "(deleted)" lines like this one: radiusd 22737 root 1022u REG 104,2 1334 404429 /tmp/radiusd/radiusd.client.XXGcdadx (deleted) In the meantime, I raised the limit with ulimit and restarted. I'm open to further (late night) testing, patching, whatever... Thanks, Jason -- Jason Englander <jason(a)englanders.us> 394F 7E02 C105 7268 777A 3F5A 0AC0 C618 0675 80CA

2 3

i have problem with EAP authorization in file or sql mode
by amin ahoora 02 Jan '11

02 Jan '11

Help me i read full documentation of this server but problem remain i send you with last email in sql module log and i this maybe occurs with my sql configuration but in file mode module i have same problem FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Nov 14 2010 at 03:05:12 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/modules/files main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log_auth = no log_auth_badpass = no log_auth_goodpass = no log_stripped_names = no } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client 127.0.0.1 { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "aminahooradkpw" nastype = "other" } client 10.10.10.2 { require_message_authenticator = no secret = "aminahooradkpw" shortname = "SingleRouter" nastype = "mikrotik" } client 192.168.137.2 { require_message_authenticator = no secret = "aminahooradkpw" shortname = "SingleRouter" nastype = "mikrotik" } client 172.16.15.1 { require_message_authenticator = no secret = "dkpw" shortname = "wireless" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/radiusd.conf pap { encryption_scheme = "crypt" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/radiusd.conf Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/radiusd.conf mschap { use_mppe = no require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no check_cert_cn = "%{User-Name}" cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/radiusd.conf acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } } # modules } # server radiusd: #### Opening IP addresses and Ports #### bind_address = * WARNING: The directive 'bind_address' is deprecated, and will be removed in future versions of FreeRADIUS. Please edit the configuration files to use the directive 'listen'. Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. rad_recv: Access-Request packet from host 172.16.15.1 port 1027, id=176, length=127 User-Name = "10" NAS-IP-Address = 172.16.15.1 NAS-Identifier = "aminahoora.home.ir" Framed-MTU = 1496 Called-Station-Id = "40-4a-03-ad-0b-b0" Calling-Station-Id = "00-22-41-7d-9f-91" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02110007013130 Message-Authenticator = 0x04fff75e7f186f6ea10588cb2241d5d2 # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry 10 at line 204 ++[files] returns ok [eap] EAP packet type response id 17 length 7 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/radiusd.conf +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 176 to 172.16.15.1 port 1027 EAP-Message = 0x011200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ca1a80e9cb3b165fbd692931fddb1e7 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.15.1 port 1027, id=177, length=222 User-Name = "10" NAS-IP-Address = 172.16.15.1 NAS-Identifier = "aminahoora.home.ir" Framed-MTU = 1496 Called-Station-Id = "40-4a-03-ad-0b-b0" Calling-Station-Id = "00-22-41-7d-9f-91" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0212005419800000004a16030100450100004103014d150aea2b4d30a28baa51de77dde94e3089e861c19507aeb18d51fae369150b00001a002f000500040035000a000900030008003300390016001500140100 State = 0x9ca1a80e9cb3b165fbd692931fddb1e7 Message-Authenticator = 0x03f021f9c6cb610f8043acacd690bb14 # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry 10 at line 204 ++[files] returns ok [eap] EAP packet type response id 18 length 84 [eap] Continuing tunnel setup. ++[eap] returns ok ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 74 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0045], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 177 to 172.16.15.1 port 1027 EAP-Message = 0x0113040019c00000089b160301002a0200002603014d0d79121f619ae704fedcbf9402c4aed6108b549489614209008236d368e5b700002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039313131323130323732355a170d3130313131323130323732355a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ed4b1ec73b577eb4dd302dc0192331e6e40993f78258093329b68770e5e928e1461a574ce4132402dd833efec617ff947bc6da7606f3ea98e628113ad6cc EAP-Message = 0xabe291939f4b51566ff040429e307a26bea0beaea5ba59ddafe252c9eaee68ec220f0bf86d147dd1d20ba2257c168b0b9b1a4ca74417142b6a9c860552aa014cfd2ac15ec28ad1803eda7fe54e31bcf5fe774c9445337d94fa53a3638936a1edba4cedc9d7715919fade13eba12d84de71550a214ce20f985919cd4e4a3fc555f0117a0137eb93edeb98ff973367e1535737d76a62692870da46bbacd24c1f47a6f95594688a6c76a660e371d0ee68a6714389ee571e02283028d71161aad17aadef0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003820101007348a9f7eb447a0a18 EAP-Message = 0x1a35b4290a56356ef5bdd344c898ae5782513d75d21362e94f76c6adc2c9f119f49e142c786edcc26ffb9e1b9f67013c32f5b289c6963372be252bf780766be2861ec76e3b5afdbe6ff3486bf7ad65079b41c000c72d105b8c95d0bdf2c24553f9578d71beb518892510fc3205ef923fb02ed4ac3d282d8cfa9d173ba5cc3e47949ed06ef6fbc8328a86ff45c50061f0d0d5e41d7712a92a927497e5c9f7c6f5d07ead4e9ffe1a866ffa134d5f5aeae24fb6c9b350a025a0db619e6a2edabac6ef7e80b72ac02c87feea8f951c4ddd3292e087a52a8265e99dcd4cde088847424f21879c6d20f04e412363885aaec4973e7815fcfc53230004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ca1a80e9db2b165fbd692931fddb1e7 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.15.1 port 1027, id=178, length=144 User-Name = "10" NAS-IP-Address = 172.16.15.1 NAS-Identifier = "aminahoora.home.ir" Framed-MTU = 1496 Called-Station-Id = "40-4a-03-ad-0b-b0" Calling-Station-Id = "00-22-41-7d-9f-91" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021300061900 State = 0x9ca1a80e9db2b165fbd692931fddb1e7 Message-Authenticator = 0x1137081fd9ba42765a28a148ee37c3da # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry 10 at line 204 ++[files] returns ok [eap] EAP packet type response id 19 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 178 to 172.16.15.1 port 1027 EAP-Message = 0x011403fc194000dcdbb13f82d4ce56300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039313131323130323732355a170d3130313131323130323732355a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100b4a62d9a3d9c2555520f25042b2a8b08ba1e61f07eee939363de3239d5d522b79938a269dae2eb5881c9e60fba117d1dcdbc83407a13bdde6a5d1ffd630e9613c34fad618dee5733d6ebc5df0ed3a641705baaa7250ce6a558ccef6f7def5f18f99bcc908f5a0e708f158ee77ecddc EAP-Message = 0x8969bdf71edf554961b83f8c719cb533f47a592d81e16e77b201ed464f09be9125da469bbb0e43bc76e23bc01f2eb78c7cca22e50382a384908b7fb1f416503d37b1c955303a144ca270259872f80c44ce20cf11a44e297ca763ac058de9cb83656ec62943d728f2c5499524542f3dbb61051d7e0a9a92d7fe883670624e751d7ec9fedc674cf73f4822361b8f263d2a650203010001a381fb3081f8301d0603551d0e041604146f2687e7262e22aecd2188eb6efb02eba39839fd3081c80603551d230481c03081bd80146f2687e7262e22aecd2188eb6efb02eba39839fda18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900dcdbb13f82d4ce56300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100647c9fcfe32740d5d6df5d621dd28948d3b5ba585446ce00a3f175f3fb60177f372d72b57463fd28220023dcc8873bd56b4bc89c39acdb8e334aaf6ac6009a784d7c780bd79366113bfbdb7d3af852bd2b9d EAP-Message = 0x5759f29e94ec8aef Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ca1a80e9eb5b165fbd692931fddb1e7 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.15.1 port 1027, id=179, length=144 User-Name = "10" NAS-IP-Address = 172.16.15.1 NAS-Identifier = "aminahoora.home.ir" Framed-MTU = 1496 Called-Station-Id = "40-4a-03-ad-0b-b0" Calling-Station-Id = "00-22-41-7d-9f-91" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021400061900 State = 0x9ca1a80e9eb5b165fbd692931fddb1e7 Message-Authenticator = 0x312e182ce06032e4516f6d50a6c4c129 # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry 10 at line 204 ++[files] returns ok [eap] EAP packet type response id 20 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 179 to 172.16.15.1 port 1027 EAP-Message = 0x011500b51900bf21a0b69a3e67caac09ed7c1cfbe98ac4b9e2d992a78310ee9b777b568fc84698be69b725c44305c38668cbfdf2fc4d2bd20a0a2ccca4a713772ac2d5867ce172062d8dba01d5fae9b313874d1eb94c2489edd82862b33ef58e0e0558093917fed55cb1a9b0f8fe70811709ca05d6ed1549e6377527c4a2c68c3ff021ae6f52fa1ba9e4832dad7a71d1f6775fdecb48936a9fff5e5e0910dc5645e144ad54538828a11e269616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ca1a80e9fb4b165fbd692931fddb1e7 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.15.1 port 1027, id=180, length=476 User-Name = "10" NAS-IP-Address = 172.16.15.1 NAS-Identifier = "aminahoora.home.ir" Framed-MTU = 1496 Called-Station-Id = "40-4a-03-ad-0b-b0" Calling-Station-Id = "00-22-41-7d-9f-91" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021501501980000001461603010106100001020100498a4854d4465ef574b4954c3c8ee6b9ae2d8ee5cf9aa79e64d7bc3cf81f0be4ad0a50782e0af7e23c14ba838680fbaf95cd58afe9d8d95d8f0a17cc7278f9841fa2334fab620dee7d4f97675b0d3f729104e25cd46051d0731ead475a45a4d22b9e60f5db2026ffe3a73facda7e5f45715de1560ca853fcf80c89dbf0b8608c5743d86ee6d02605dce1061a91b92be6c1602070ae49b93d48dbef5f41cdd81bf1a0dcbc647f2a3c5658035530d44e222a7659ad7d6a5492d5c39ab5bc75b7cc2b689af8cf9092b92833509df984b19f32d98d5345ad77717505760bdd5ed9295a3ce1da0aff0012 EAP-Message = 0xc119bae4349284a4ad2e9fb29ba4effba1c5e1697194040f1403010001011603010030333c379e1cebfa25f09bdd6df6ea7960b7cfbe9e378b62b682c6d05f0afc08e1b6ae003652ebe60bac4709d46ad0e4ae State = 0x9ca1a80e9fb4b165fbd692931fddb1e7 Message-Authenticator = 0xf40facdf859bf71c40af155b112cbf50 # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry 10 at line 204 ++[files] returns ok [eap] EAP packet type response id 21 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 180 to 172.16.15.1 port 1027 EAP-Message = 0x0116004119001403010001011603010030fb7d3c24d1c65b12dfa94d1ecdc6ddcc9d646faa4ecd36827418b2332203481407386ca214b13d7ab1b8cf9662552c07 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ca1a80e98b7b165fbd692931fddb1e7 Finished request 4. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 172.16.15.1 port 1027, id=181, length=144 User-Name = "10" NAS-IP-Address = 172.16.15.1 NAS-Identifier = "aminahoora.home.ir" Framed-MTU = 1496 Called-Station-Id = "40-4a-03-ad-0b-b0" Calling-Station-Id = "00-22-41-7d-9f-91" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021600061900 State = 0x9ca1a80e98b7b165fbd692931fddb1e7 Message-Authenticator = 0x2f0dd64255b0a8380e6a9b4871dfbdab # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry 10 at line 204 ++[files] returns ok [eap] EAP packet type response id 22 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 181 to 172.16.15.1 port 1027 EAP-Message = 0x0117002b190017030100207a938b37cd6503d215e4414cb1fd370240a2498818dfa70c7edc86e56bac80a1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ca1a80e99b6b165fbd692931fddb1e7 Finished request 5. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 172.16.15.1 port 1027, id=182, length=181 User-Name = "10" NAS-IP-Address = 172.16.15.1 NAS-Identifier = "aminahoora.home.ir" Framed-MTU = 1496 Called-Station-Id = "40-4a-03-ad-0b-b0" Calling-Station-Id = "00-22-41-7d-9f-91" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0217002b19001703010020e7748073d57a68c015f4fe8d1273a2e1212cff4a26e245f4d62330ca0ddca5e2 State = 0x9ca1a80e99b6b165fbd692931fddb1e7 Message-Authenticator = 0xf80a05119c3182a4c5097b214aeb7c37 # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry 10 at line 204 ++[files] returns ok [eap] EAP packet type response id 23 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - 10 [peap] Got inner identity '10' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x02170007013130 server { PEAP: Setting User-Name to 10 Sending tunneled request EAP-Message = 0x02170007013130 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "10" server inner-tunnel { No such virtual server "inner-tunnel" } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 182 to 172.16.15.1 port 1027 EAP-Message = 0x0118002b19001703010020e922ee925838ed77c8b562883e7b7212c98e7180a9a9876b938d9d36de040ecd Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ca1a80e9ab9b165fbd692931fddb1e7 Finished request 6. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 172.16.15.1 port 1027, id=183, length=181 User-Name = "10" NAS-IP-Address = 172.16.15.1 NAS-Identifier = "aminahoora.home.ir" Framed-MTU = 1496 Called-Station-Id = "40-4a-03-ad-0b-b0" Calling-Station-Id = "00-22-41-7d-9f-91" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0218002b1900170301002023f62825916276e5903af5875752449fa84f8fbba2c38c0814de3f094d11738e State = 0x9ca1a80e9ab9b165fbd692931fddb1e7 Message-Authenticator = 0x4271c9b17c0f2c3e8603ec2c6bbbc268 # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry 10 at line 204 ++[files] returns ok [eap] EAP packet type response id 24 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Sending Access-Reject of id 183 to 172.16.15.1 port 1027 EAP-Message = 0x04180004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 7. Going to the next request Waking up in 4.6 seconds. ################################################################################# and this is my radius configuration file prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid #user = freerad #group = freerad max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * #listen { # ipaddr = 172.16.15.1 # port = 1812 # type = auth # virtual_server = one # } port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = before lower_pass = before nospace_user = before nospace_pass = before checkrad = ${sbindir}/checkrad #security { # max_attributes = 200 # reject_delay = 1 # status_server = no #} proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } mschap { authtype = MS-CHAP use_mppe = no #require_encryption = yes #require_strong = yes # authtype = MS-CHAP } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } #$INCLUDE ${confdir}/sql.conf $INCLUDE ${confdir}/eap.conf $INCLUDE ${confdir}/modules/files counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } } instantiate { } authorize { #preprocess chap mschap #sql files eap pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } eap } preacct { acct_unique } accounting { #detail #sql } session { #sql } post-auth { #sql } THANK YOU WITH BEST REGARDS AMIN AHOORA

5 10