- Freeradius-Users - lists.freeradius.org

ERROR! Our request for peap was NAK'd with a request for peap
by Rob Yamry 10 Dec '10

10 Dec '10

I have a HP JetDirect 690n print server that Im trying to authenticate via FreeRadius 2.1.8 for wireless clients to use. If I tell the 690 to use peap then I get the error "ERROR! Our request for peap was NAK'd with a request for peap". If I tell it to use eap-tls I get the error "ERROR! Our request for tls was NAK'd with a request for tls". Also, I have a user setup in the users file, but it still tries to search ldap for that user. I can login fine with the local "ktest" user via radtest or ntradping. Debug log from a peap request is here: Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.1 port 47567, id=80, length=283 User-Name = "ktest" NAS-IP-Address = 10.1.1.1 NAS-Port = 150 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "00:1b:78:eb:c8:1d" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "TEST" Siemens-AP-Serial = "0500010143052305" Siemens-AP-Name = "AP01" Siemens-VNS-Name = "TEST" Siemens-BSSID = "TEST" Siemens-BSS-MAC = "00:1f:45:7f:83:fa" Siemens-Policy = "NonAuth" Siemens-Topology = "Bridged at AP untagged" EAP-Message = 0x0201000a016b74657374 Message-Authenticator = 0xef83aea844bdbfb74c34110c7fafa33f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ktest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry ktest at line 209 ++[files] returns ok [ldap] performing user authorization for ktest [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ktest [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=ktest) [ldap] expand: o=org -> o=org [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.company.com:389, authentication 0 [ldap] setting TLS CACert File to /etc/raddb/certs/ca.pem [ldap] starting TLS [ldap] bind as cn=radmin,o=org/<password> to ldap.company.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in o=org, with filter (cn=ktest) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 80 to 10.1.1.1 port 47567 Filter-Id = "Students" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb21c3f23b21e261bc6f5440efd9d3572 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.1 port 47567, id=80, length=361 Cleaning up request 0 ID 80 with timestamp +53 User-Name = "ktest" NAS-IP-Address = 10.1.1.1 NAS-Port = 150 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "00:1b:78:eb:c8:1d" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "TEST" Siemens-AP-Serial = "0500010143052305" Siemens-AP-Name = "AP01" Siemens-VNS-Name = "TEST" Siemens-BSSID = "TEST" Siemens-BSS-MAC = "00:1f:45:7f:83:fa" Siemens-Policy = "NonAuth" Siemens-Topology = "Bridged at AP untagged" EAP-Message = 0x0202004619800000003c16030100370100003303010000000c2db78264c7293dabf829a390628548921ccd153f66aef981c50d964c00000c0035000a002f0005000400090100 State = 0xb21c3f23b21e261bc6f5440efd9d3572 Message-Authenticator = 0x047a88b42dd297aff674849e11cc719b +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ktest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 70 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 60 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0037], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0b95], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 80 to 10.1.1.1 port 47567 EAP-Message = 0x0103040019c000000bd2160301002a0200002603014cffb1ebbcc5475dcfc501c476c4728d86282b97d10966cfc06dd18a38bbef7f000035001603010b950b000b91000b8e0005b1308205ad30820495a003020102020103300d06092a864886f70d01010505003081c0310b3009060355040613025553310b30090603550408130257493111300f060355040713084b696d6265726c7931263024060355040a131d4b696d6265726c792041726561205363686f6f6c204469737472696374313c303a060355040313334b696d6265726c792041726561205363686f6f6c20446973747269637420436572746966696361746520417574686f72697479 EAP-Message = 0x312b302906092a864886f70d010901161c7765626d6173746572406b696d6265726c792e6b31322e77692e7573301e170d3130303331363133333732345a170d3137303331343133333732345a3081a4310b3009060355040613025553310b30090603550408130257493111300f060355040713084b696d6265726c7931263024060355040a131d4b696d6265726c792041726561205363686f6f6c2044697374726963743120301e060355040313176c6461702e6b696d6265726c792e6b31322e77692e7573312b302906092a864886f70d010901161c7765626d6173746572406b696d6265726c792e6b31322e77692e757330820122300d06092a EAP-Message = 0x864886f70d01010105000382010f003082010a0282010100cad3696f20cbdc165ddd4dfdf8f4a1b96a1d4aca94548853d895b8e72a29d078e7fa69b4962adc66d2b8db9f8bcb9e49df313a06dabdbecca170d1a2a93341b2cffede3c8675053b9617aca00de9c263de036840e0982133f2e7972357662d6acd876ebfce2e14f7dc1408380fc802d6f0100d8014d7e818e59dda1307f59d5bcf2d861a54a28af634697fa10ce3ed1be9a95199a49a94c7fdf0b97a3e2bbc37b5aed07e002035f97d5231ba880ab7022ccf3e9b875654cd2dfde3d75558ad4287a29c74cfef1dfe9354c6a9f904ebff2c9b4d26b5f7ec4ff0da63fc2fe8c8171c029acbd4 EAP-Message = 0x97e9a89184d0bd309837c787de2c0af4f43773ccce11cfdb3aaeb50203010001a38201ca308201c630090603551d1304023000303006096086480186f842010d04231621596153542047656e65726174656420536572766572204365727469666963617465301106096086480186f8420101040403020640300b0603551d0f0404030205a0301d0603551d0e0416041467eabf6541c39d4ed474b25d1d42b4a40641ef053081f50603551d230481ed3081ea8014cb6f25029dcbc68e70aeff2fa9a9baee6af47f77a181c6a481c33081c0310b3009060355040613025553310b30090603550408130257493111300f060355040713084b696d6265726c EAP-Message = 0x7931263024060355040a131d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb21c3f23b31f261bc6f5440efd9d3572 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.1 port 47567, id=80, length=297 Cleaning up request 1 ID 80 with timestamp +54 User-Name = "ktest" NAS-IP-Address = 10.1.1.1 NAS-Port = 150 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "00:1b:78:eb:c8:1d" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "TEST" Siemens-AP-Serial = "0500010143052305" Siemens-AP-Name = "AP01" Siemens-VNS-Name = "TEST" Siemens-BSSID = "TEST" Siemens-BSS-MAC = "00:1f:45:7f:83:fa" Siemens-Policy = "NonAuth" Siemens-Topology = "Bridged at AP untagged" EAP-Message = 0x020300061900 State = 0xb21c3f23b31f261bc6f5440efd9d3572 Message-Authenticator = 0xce8fce3cab0d91febe1a2b82b5f43071 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ktest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 80 to 10.1.1.1 port 47567 EAP-Message = 0x010403fc19404b696d6265726c792041726561205363686f6f6c204469737472696374313c303a060355040313334b696d6265726c792041726561205363686f6f6c20446973747269637420436572746966696361746520417574686f72697479312b302906092a864886f70d010901161c7765626d6173746572406b696d6265726c792e6b31322e77692e7573820900d6d85d886ad5a6f830270603551d110420301e811c7765626d6173746572406b696d6265726c792e6b31322e77692e757330270603551d120420301e811c7765626d6173746572406b696d6265726c792e6b31322e77692e7573300d06092a864886f70d0101050500038201 EAP-Message = 0x01003f8292ee1e98c0595f0da2e0692d632b818fdef25f4ef7e4b6748c075fc7ca14f22ce2de91d9e407ee786de26e2be17f1208470e3480374ef3ba826f5c55a42e1b3e229008322e04b72781f73ef22e2404561731f03da7c07cb80dcabbdcc0bc5c6fd3da0f4f3cfd8a54d17041a4b675a09d99845f6af40ed129299427a11d34c5551142232eef7c36ef1e8d95e695057d6dd7450b27359b5a89663b910934d28977bb80ed5430b4dc92022622f56a00e4143d507701b7dc49ff5bb7e46db5621c0667cc15d480ae1ecb764bb89c0c255d5b874e31e484293b823056cf9cbc8bc94015bb8d99db0571cbbfb49ab775a6de4d98da36df016ac968ff EAP-Message = 0x4b78507d900005d7308205d3308204bba003020102020900d6d85d886ad5a6f8300d06092a864886f70d01010505003081c0310b3009060355040613025553310b30090603550408130257493111300f060355040713084b696d6265726c7931263024060355040a131d4b696d6265726c792041726561205363686f6f6c204469737472696374313c303a060355040313334b696d6265726c792041726561205363686f6f6c20446973747269637420436572746966696361746520417574686f72697479312b302906092a864886f70d010901161c7765626d6173746572406b696d6265726c792e6b31322e77692e7573301e170d31303033313631 EAP-Message = 0x33333331375a170d3230303331333133333331375a3081c0310b3009060355040613025553310b30090603550408130257493111300f060355040713084b696d6265726c7931263024060355040a131d4b696d6265726c792041726561205363686f6f6c204469737472696374313c303a060355040313334b696d6265726c792041726561205363686f6f6c20446973747269637420436572746966696361746520417574686f72697479312b302906092a864886f70d010901161c7765626d6173746572406b696d6265726c792e6b31322e77692e757330820122300d06092a864886f70d01010105000382010f003082010a0282010100d551d5fb EAP-Message = 0xb0e4092778a12e41 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb21c3f23b018261bc6f5440efd9d3572 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.1 port 47567, id=80, length=297 Cleaning up request 2 ID 80 with timestamp +54 User-Name = "ktest" NAS-IP-Address = 10.1.1.1 NAS-Port = 150 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "00:1b:78:eb:c8:1d" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "TEST" Siemens-AP-Serial = "0500010143052305" Siemens-AP-Name = "AP01" Siemens-VNS-Name = "TEST" Siemens-BSSID = "TEST" Siemens-BSS-MAC = "00:1f:45:7f:83:fa" Siemens-Policy = "NonAuth" Siemens-Topology = "Bridged at AP untagged" EAP-Message = 0x020400061900 State = 0xb21c3f23b018261bc6f5440efd9d3572 Message-Authenticator = 0x552a1288d35108114eb710baa5d4e06d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ktest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 80 to 10.1.1.1 port 47567 EAP-Message = 0x010503ec1900659f48472b8d2d5d9a8da76c445e33490bee5c5c155fe88108113ed74335a2ba068e51f7da1fa2c4ac8a156f3c5da7c0e1df69a27b32f3825880b80eff9cd02c2f3beeb9669ae0fea448d28da8498d9d227087fa2199c15dd80e9a6477e64fdb8b138265605f5ad61581084b9d7faa0deb343f6697ace0d0bdd3908736544251650239d0707fedf29c465e4bcecc92034249c23123dea30a5c85ed92f6d0475830555550d0997d1152892bb8ff7d7bd148652d69c1bcc014371df36e2f3a075b1f5f165dcdd816cb5e7750d6f6dd4ed1e4494cb0f050c53c0397f03e195d67f1d2f3dec0fc4a198d32775e34530ccf191e522cb3020301 EAP-Message = 0x0001a38201cc308201c8300f0603551d130101ff040530030101ff302c06096086480186f842010d041f161d596153542047656e657261746564204341204365727469666963617465301106096086480186f8420101040403020106300b0603551d0f040403020106301d0603551d0e04160414cb6f25029dcbc68e70aeff2fa9a9baee6af47f773081f50603551d230481ed3081ea8014cb6f25029dcbc68e70aeff2fa9a9baee6af47f77a181c6a481c33081c0310b3009060355040613025553310b30090603550408130257493111300f060355040713084b696d6265726c7931263024060355040a131d4b696d6265726c792041726561205363 EAP-Message = 0x686f6f6c204469737472696374313c303a060355040313334b696d6265726c792041726561205363686f6f6c20446973747269637420436572746966696361746520417574686f72697479312b302906092a864886f70d010901161c7765626d6173746572406b696d6265726c792e6b31322e77692e7573820900d6d85d886ad5a6f830270603551d110420301e811c7765626d6173746572406b696d6265726c792e6b31322e77692e757330270603551d120420301e811c7765626d6173746572406b696d6265726c792e6b31322e77692e7573300d06092a864886f70d010105050003820101004b96358c5945bbc3937219dc3371b00431ab3b6e EAP-Message = 0x67be20fd70177edba50c23cbe05be70995474416cc6562174c08602e4d075e8fd648a90b72be087d25fba87d2442973a4651da2690b02aab44222cc8336b8acf2d387b7606f5bb7a4f360e9381fc79c28535ff23aab2e3d2f31544a34f8ae2805ac32e6592ab7c9a090ddd1e15f7aba6a3c7758723b634d47dc7109564708bf0b30f04f55a6ea1ab28787407f33e0997412709d970d2fd79a4a5826967c41db74eb68bac6c309d1f1fe2b16fa0d18a5352159ac1bd7c29cbdf787ec92deb3d84cd27c32b351b8023f79f97a5e0b970b9fdb4456a626d87cbe45f1c36d580cbd51ff1572a27f7e5555ef8195e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb21c3f23b119261bc6f5440efd9d3572 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.1 port 47567, id=80, length=297 Cleaning up request 3 ID 80 with timestamp +54 User-Name = "ktest" NAS-IP-Address = 10.1.1.1 NAS-Port = 150 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "00:1b:78:eb:c8:1d" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "TEST" Siemens-AP-Serial = "0500010143052305" Siemens-AP-Name = "AP01" Siemens-VNS-Name = "TEST" Siemens-BSSID = "TEST" Siemens-BSS-MAC = "00:1f:45:7f:83:fa" Siemens-Policy = "NonAuth" Siemens-Topology = "Bridged at AP untagged" EAP-Message = 0x020500060319 State = 0xb21c3f23b119261bc6f5440efd9d3572 Message-Authenticator = 0xbb238eafebdfefd81192fb93cacdb01c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ktest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry ktest at line 209 ++[files] returns ok [ldap] performing user authorization for ktest [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ktest [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=ktest) [ldap] expand: o=org -> o=org [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=org, with filter (cn=ktest) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] ERROR! Our request for peap was NAK'd with a request for peap. Skipping the requested type. [eap] No common EAP types found. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect ( [ldap] User not found): [ktest/<via Auth-Type = EAP>] (from client kasd port 150 cli 00:1b:78:eb:c8:1d) Using Post-Auth-Type Reject +- entering group REJECT {...} ++[ldap] returns noop Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 80 to 10.1.1.1 port 47567 Filter-Id = "Students" EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 4 ID 80 with timestamp +56 Ready to process requests.

5 11

ldap - edirectory authentication
by Robert Koskey 10 Dec '10

10 Dec '10

Can anyone help? We are trying to do a ldap authentication from novell's edirectory to an Aruba controller for wireless access. These are the error's we are getting. It used to work perfectly but the original radius server blew up. We installed a new one with the same configuration and it doesn't work. The problem areas are bold'ed. The problem seems to occur after the ldap authentication. I don't think we are entirely clear about the order in which the whole process happens. Any help or suggestions would be greatly appreciated. The set up is: OpenSuse 11.0 FreeRadius 2.0.5 We have tried: OpenSuse 11.3 FreeRadius 2.1.9 (same result) rad_recv: Access-Request packet from host 10.215.10.100 port 34806, id=218, length=199 User-Name = "jordanhkaltenbruner" NAS-IP-Address = 10.200.8.30 NAS-Port = 2 NAS-Identifier = "10.215.10.99" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "78CA39B5D3E5" Called-Station-Id = "000B8661AC58" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x02010018016a6f7264616e686b616c74656e6272756e6572 Aruba-Essid-Name = "SCHS-Student" Aruba-Location-Id = "SpringbankW2-9" Message-Authenticator = 0x4542e9b98b5978ca1ca52b7617910620 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "jordanhkaltenbruner", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for jordanhkaltenbruner WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=jordanhkaltenbruner) expand: ou=springhigh_lab,o=springhigh -> ou=springhigh_lab,o=springhigh rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.215.0.3:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: bind as cn=admin,o=springhigh/???? to 10.215.0.3:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=springhigh_lab,o=springhigh, with filter (uid=jordanhkaltenbruner) rlm_ldap: Added the eDirectory password 51601222 in check items as Cleartext-Password rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jordanhkaltenbruner authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: No clear-text password in the request. Not performing PAP. ++[pap] returns noop auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> jordanhkaltenbruner attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 218 to 10.215.10.100 port 34806 Finished request 0. Robert Koskey, Systems and Network Manager Rocky View Schools Telephone: 403-945-4080 Cell: 403-988-4640 Robert Koskey, Systems and Network Manager Rocky View Schools Telephone: 403-945-4080 Cell: 403-988-4640 _____________________________________________________________________________________ This communication is intended for the use of the recipient to which it is addressed, and may contain confidential, personal, and or privileged information. Please contact us immediately if you are not the intended recipient of this communication, and do not copy, distribute, or take action relying on it. Any communication received in error, or subsequent reply, should be deleted or destroyed.

3 7

WiMAX Home Agent Authentication
by Marck Gorszwick 10 Dec '10

10 Dec '10

Hi All- We're doing some work with integrating FreeRADIUS using EAP-TLS into a network with HItachi ASN-GW and Cisco HA that only uses Mobile-IP. We successfully pass phase-1 authentication, and generate the appropriate keying material for the HA, but at phase-2 authentication we fail, since the MN-hHA-MIP4-KEY is not stored. The rlm_wimax module implies that the HA authentication portion needs to retrieve the MN-hHA-MIP4-KEY from a store based on the SPI in the request, a couple questions: -Does FreeRADIUS have any way of linking the two authentications, and can the TLS session cache can be used to store the TLVs from phase 1 access accept, or does it need to be done externally? If it can be cached within FreeRADIUS, how? -FreeRADIUS complains that this phase-2 authentication has no known Auth-Type. What needs to be done to have FreeRADIUS consider this? Can we just pre-process or HINT the request to accept it with the when we have the appropriate KEY? Phase 1 Access-Accept: Sending Access-Accept of id 227 to 172.17.10.10 port 1814 EAP-Message = 0x030d0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous(a)grid-net.com" WiMAX-IP-Technology = PMIP4 WiMAX-FA-RK-Key = 0x4cf2d4149289d9a0ce8cbeb264cdb41206fc679a Chargeable-User-Identity = "gridnet" WiMAX-NSP-Id = 0x000021 WiMAX-hHA-IP-MIP4 = 172.29.163.6 Service-Type = Framed-User WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Idle-Mode-Notification-Cap = Not-Supported WiMAX-AAA-Session-Id = 0x12346789012345678901 WiMAX-DNS-Server = 1.2.3.4 WiMAX-MSK = 0x4b0b12e1ea34fea4ae762a3d63eda2ed3bbb446bcc46f25af546f35b47a26bc287017df6af42587c4b46cacf960812c00d212635324bca42bd96172b346e56e6 WiMAX-MN-hHA-MIP4-Key = 0x468d6588a03a1096acfd145a946b9dec0b8c44d2 WiMAX-MN-hHA-MIP4-SPI = 754533938 WiMAX-FA-RK-SPI = 754533937 Proxy-State = 0x313630 Wed Dec 8 16:33:45 2010 : Info: Finished request 491. Wed Dec 8 16:33:45 2010 : Debug: Going to the next request Wed Dec 8 16:33:45 2010 : Debug: Waking up in 0.2 seconds. Wed Dec 8 16:33:45 2010 : Info: Cleaning up request 484 ID 191 with timestamp +1844 Wed Dec 8 16:33:45 2010 : Debug: Waking up in 0.2 seconds. Wed Dec 8 16:33:45 2010 : Info: Cleaning up request 485 ID 217 with timestamp +1844 Wed Dec 8 16:33:45 2010 : Debug: Waking up in 0.3 seconds. Wed Dec 8 16:33:46 2010 : Info: Cleaning up request 486 ID 188 with timestamp +1845 Wed Dec 8 16:33:46 2010 : Debug: Waking up in 0.3 seconds. Wed Dec 8 16:33:46 2010 : Info: Cleaning up request 487 ID 111 with timestamp +1845 Wed Dec 8 16:33:46 2010 : Debug: Waking up in 0.4 seconds. Wed Dec 8 16:33:46 2010 : Info: Cleaning up request 488 ID 30 with timestamp +1845 Wed Dec 8 16:33:46 2010 : Debug: Waking up in 2.7 seconds. Wed Dec 8 16:33:49 2010 : Info: Cleaning up request 489 ID 67 with timestamp +1848 Wed Dec 8 16:33:49 2010 : Debug: Waking up in 0.3 seconds. Wed Dec 8 16:33:49 2010 : Info: Cleaning up request 490 ID 35 with timestamp +1848 Wed Dec 8 16:33:49 2010 : Debug: Waking up in 0.3 seconds. Wed Dec 8 16:33:50 2010 : Info: Cleaning up request 491 ID 227 with timestamp +1849 Wed Dec 8 16:33:50 2010 : Info: Ready to process requests. And Phase-2 Access-Request: rad_recv: Access-Request packet from host 172.17.10.10 port 1814, id=168, length=153 WiMAX-HA-IP-MIP4 = 172.29.163.6 WiMAX-NSP-Id = 0x000021 NAS-Identifier = "xxxxx" User-Name = "anonymous(a)grid-net.com" WiMAX-Release = "01.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Not-Supported WiMAX-MN-hHA-MIP4-SPI = 754533938 Chargeable-User-Identity = "" Framed-IP-Address = 10.24.0.100 Message-Authenticator = 0xee2061e520a73223364859f2c0822248 NAS-IP-Address = 172.29.176.37 Proxy-State = 0x313631 Wed Dec 8 16:33:58 2010 : Info: # Executing section authorize from file /opt/local/etc/raddb/sites-enabled/default Wed Dec 8 16:33:58 2010 : Info: +- entering group authorize {...} Wed Dec 8 16:33:58 2010 : Info: ++[preprocess] returns ok Wed Dec 8 16:33:58 2010 : Info: ++[chap] returns noop Wed Dec 8 16:33:58 2010 : Info: ++[mschap] returns noop Wed Dec 8 16:33:58 2010 : Info: ++[wimax] returns ok Wed Dec 8 16:33:58 2010 : Info: [suffix] Looking up realm "grid-net.com" for User-Name = "anonymous(a)grid-net.com" Wed Dec 8 16:33:58 2010 : Info: [suffix] No such realm "grid-net.com" Wed Dec 8 16:33:58 2010 : Info: ++[suffix] returns noop Wed Dec 8 16:33:58 2010 : Info: [eap] No EAP-Message, not doing EAP Wed Dec 8 16:33:58 2010 : Info: ++[eap] returns noop Wed Dec 8 16:33:58 2010 : Info: ++[unix] returns notfound Wed Dec 8 16:33:58 2010 : Info: [files] users: Matched entry DEFAULT at line 34 Wed Dec 8 16:33:58 2010 : Info: ++[files] returns ok Wed Dec 8 16:33:58 2010 : Info: ++[expiration] returns noop Wed Dec 8 16:33:58 2010 : Info: ++[logintime] returns noop Wed Dec 8 16:33:58 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Dec 8 16:33:58 2010 : Info: ++[pap] returns noop Wed Dec 8 16:33:58 2010 : Info: expand: %{request:User-Name} -> anonymous(a)grid-net.com Wed Dec 8 16:33:58 2010 : Info: ++[reply] returns noop Wed Dec 8 16:33:58 2010 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Wed Dec 8 16:33:58 2010 : Info: Failed to authenticate the user. Wed Dec 8 16:33:58 2010 : Auth: Login incorrect: [anonymous(a)grid-net.com/<no User-Password attribute>] (from client winghead port 0) Wed Dec 8 16:33:58 2010 : Info: Using Post-Auth-Type Reject Wed Dec 8 16:33:58 2010 : Info: # Executing group from file /opt/local/etc/raddb/sites-enabled/default Wed Dec 8 16:33:58 2010 : Info: +- entering group REJECT {...} Wed Dec 8 16:33:58 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> anonymous(a)grid-net.com Wed Dec 8 16:33:58 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Dec 8 16:33:58 2010 : Info: ++[attr_filter.access_reject] returns updated Wed Dec 8 16:33:58 2010 : Info: Delaying reject of request 492 for 1 seconds Wed Dec 8 16:33:58 2010 : Debug: Going to the next request Wed Dec 8 16:33:58 2010 : Debug: Waking up in 0.9 seconds. Wed Dec 8 16:33:59 2010 : Info: Sending delayed reject for request 492 Sending Access-Reject of id 168 to 172.17.10.10 port 1814 Proxy-State = 0x313631 Wed Dec 8 16:33:59 2010 : Debug: Waking up in 4.9 seconds. Wed Dec 8 16:34:04 2010 : Info: Cleaning up request 492 ID 168 with timestamp +1862 Wed Dec 8 16:34:04 2010 : Info: Ready to process requests.

2 1

Assign VLAN
by Rangel, Luciano 10 Dec '10

10 Dec '10

Hello Dears, I´m using Freeradius for EAPOL authentication with AD (ntlm). My users file is: more /etc/raddb/users DEFAULT Auth-Type = ntlm_auth Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "200" I Success authentication but the switch not assign vlan 200 to client port as log below: Why the switch taking the VLAN 0? 23:27:44: dot1x-ev:dot1x_vlan_assign_authc_success: Successfully assigned VLAN 0 to interface FastEthernet0/22 23:27:44: dot1x-sm:Posting AUTHC_SUCCESS on Client=1A6F44C 23:27:44: dot1x_auth Fa0/22: during state auth_authc_result, got event 23(authcSuccess) 23:27:44: @@@ dot1x_auth Fa0/22: auth_authc_result -> auth_authz_success 23:27:44: dot1x-sm:Fa0/22:001e.6847.9261:auth_authz_success_enter called 23:27:44: dot1x-ev:dot1x_switch_supplicant_add: Adding 001e.6847.9261 on FastEthernet0/22 in vlan 1, domain is DATA 23:27:44: dot1x-ev:dot1x_switch_addr_add: Added MAC 001e.6847.9261 to vlan 1 on interface FastEthernet0/22 23:27:44: dot1x-ev:dot1x_switch_is_dot1x_forwarding_enabled: Forwarding is disabled on Fa0/22 23:27:44: dot1x-ev:ignored vlan 1 vp is added on interface FastEthernet0/22 23:27:44: dot1x-ev:dot1x_switch_is_dot1x_forwarding_enabled: Forwarding is disabled on Fa0/22 23:27:44: dot1x-ev:dot1x_switch_port_authorized: set dot1x ask handler on interface FastEthernet0/22 23:27:44: dot1x-ev:Received successful Authz complete for 001e.6847.9261 23:27:44: dot1x-sm:Posting AUTHZ_SUCCESS on Client=1A6F44C 23:27:44: dot1x_auth Fa0/22: during state auth_authz_success, got event 26(authzSuccess) 23:27:44: @@@ dot1x_auth Fa0/22: auth_authz_success -> auth_authenticated 23:27:44: dot1x-sm:Fa0/22:001e.6847.9261:auth_authenticated_enter called 23:27:44: dot1x-ev:FastEthernet0/22:Sending EAPOL packet to group PAE address 23:27:44: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/22. 23:27:44: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/22 23:27:45: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to up 23:28:15: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up PS. I tested sending attribute with Cisco ACS and ran Luciano Rangel Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

6 19

pppoe+freeradius+mysql reject user
by S Adrian 09 Dec '10

09 Dec '10

Hey, SO far I got it working alright. The only thing is that I might want to reject a username ( even if the password is ok ) ( for example that username hasn't paid ). I tried inserting into radreply Auth-Type := Reject but it still gets access-accept :/ Any ideas ? Thanks in advance, Adrian

2 2

Oracle OID and FreeRadius
by Robert Masters 08 Dec '10

08 Dec '10

Okay, so we've got the whole ancient version thing sorted out, and we now have things working - sort of. To recap: We've been working on using Freeradius on RHEL5.4 to link a Motorola RFS6000 with Oracle OID. We now have the following situation - and fair warning this is something of an edge-case as far as FreeRadius goes, as the problem appears to be more OID. We can: Use the oracleadmin user to bind to OID and have everything work. This is sub-optimal for more reasons than I care to count, and probably more than I can imagine. We can: Set up an ACL/ACI in OID to allow the purpose-created bind-user to access the userpassword of a specific user. Radius authentication then works for that user. Needless to say, it is impractical to do this for every single user. We cannot: Set up an OID ACL/ACI to allow the purpose created bind-user to access the userpassword of every user. This is where we want to get to. An alternate path would be to convince FreeRadius to obtain the user-supplied password via EAP-GTC *before* connecting to OID to authenticate the user, if that is possible. (None of the doco I have read to date suggests that it is.) Does anyone have any suggestions? Oracle are being questioned on this as well, but are not being particularly helpful yet. -Rob. Unix Systems Administrator Bunnings Group Limited 126 Pilbara Street, Welshpool WA 6106 Locked Bag 20, Welshpool WA 6986 Phone : (08) 9365-1507 Fax : (08) 9358-6054 E-mail : rmasters(a)bunnings.com.au Website : www.bunnings.com.au ************************************************************************ Bunnings Legal Disclaimer: 1) This email is confidential and may contain legally privileged information. If you are not the intended recipient, you must not disclose or use the information contained in it. If you have received this email in error, please notify us immediately by return email and delete the document. 2) All emails sent to and sent from Bunnings Group Limited. are scanned for content. Any material deemed to contain inappropriate subject matter will be reported to the email administrator of all parties concerned. ************************************************************************

2 2

Re: Attribute not passing to NAS?
by Rob Yamry 07 Dec '10

07 Dec '10

Hey Mikkal- Im not sure if my last few emails went through the list... I got a msg stating they were pending approval since they were too long. I kept digging into this and I came across the eapol_test utility: http://deployingradius.com/scripts/eapol_test/ I tried running that to take the client and NAS out of the process. As far as I can tell, it all looks like fine. Even with a default install of 2.1.10 (and another test using new certs with the required OIDs for XP clients: http://www.howtoforge.com/wifi-authentication-accounting-with-freeradius-on…) I still get those 9 requests. Are you using EAP? Is anybody else following this that can/test verify that they get the same responses as I do. Thanks- Rob

2 6

EAP-Type = SIM
by Wagner <D4rkGl0be> Andre 07 Dec '10

07 Dec '10

Hi everybody, I'm trying to configure EAP-SIM test on my FreeRADIUS server, and I would like to know if is possible to validate the parameters by database as setting in the radcheck? I tested validating with the users file and all sounds good, but I'm not having the same results with just database configuration. It not recognises SIM EAP-Type, instead it returns MD5 value. Someone could help me to validate this parameters just using databases attributes? Thanks

1 0

Need help Configuring Radius and Ldap
by James Winter 07 Dec '10

07 Dec '10

My apologies before hand if this is an easy fix, but I have been working on configuring a radius server on and off now for a few weeks. As a note, I have Radius 2.1.10 installed and I am trying to authenticate using Ldap as the user database. I have little to no experience in both Radius and Ldap, but I have been reading up and looking for documents that explain the process well. The majority of documents that I did find were on an older version of radius, or were not pertinent to my situation. The following is a copy of my screen when I try authenticating a remote device to the radius server, please let me know if this helps(or if you would like more information on my config) Thanks in advance, - James # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [files] users: Matched entry DEFAULT at line 58 ++[files] returns ok [ldap] performing user authorization for jwn6657 [ldap] expand: (samaccountname=%{User-Name}) -> (samaccountname=jwn6657) [ldap] expand: cn=Users,dc=ds,dc=saintjoe,dc=edu -> cn=Users,dc=ds,dc=saintjoe,dc=edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=Users,dc=ds,dc=saintjoe,dc=edu, with filter (samaccountname=jwn6657) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user jwn6657 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = ntlm_auth # Executing group from file /etc/raddb/sites-enabled/default +- entering group ntlm_auth {...} [2010/12/03 10:14:58.799575, 1] param/loadparm.c:6494(map_parameter) Unknown parameter encountered: "idmap domains" [2010/12/03 10:14:58.799645, 0] param/loadparm.c:7588(lp_do_parameter) Ignoring unknown parameter "idmap domains" [2010/12/03 10:14:58.799870, 1] param/loadparm.c:6494(map_parameter) Unknown parameter encountered: "master browser" [2010/12/03 10:14:58.799883, 0] param/loadparm.c:7588(lp_do_parameter) Ignoring unknown parameter "master browser" Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 186 to 131.93.254.2 port 4844 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 186 with timestamp +452 Ready to process requests.

3 9

send accounting data
by Sokvantha YOUK 07 Dec '10

07 Dec '10

Dear All, I would like to configure freeradius server to send accounting data to other server. Could any one advice me or show me how can I achieve this method? -- YOUK Sokvantha Tell: (855) 89896589 email: sokvantha(a)gmail.com

1 0