- Freeradius-Users - lists.freeradius.org

EAP-MSCHAP-V2 - [mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
by bmano 06 Oct '10

06 Oct '10

Hello, I am trying to Implement EAP-ttls and MSCHAP(V2). I tried all the forums to solutions. I am getting the following error. [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for john with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect below is the Radius information: FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 5 2010 at 02:49:11 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { allow_core_dumps = yes } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 127.0.0.1 { require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } client 5.5.5.101/24 { require_message_authenticator = no secret = "secret" shortname = "private-network-1" } client 192.168.0.0/16 { require_message_authenticator = no secret = "secret" shortname = "private-network-1" } client 10.0.0.0/8 { require_message_authenticator = no secret = "secret" shortname = "private-network-1" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "crypt" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/root/server_key.pem" certificate_file = "/root/server_cert.pem" CA_file = "/root/ca_cert.pem" private_key_password = "whatever" dh_file = "/dev/null" random_file = "/dev/urandom" fragment_size = 500 include_length = yes check_crl = no cache { enable = no lifetime = 24 max_entries = 255 } } WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! WARNING: Fix this by running the OpenSSL command listed in eap.conf Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes include_length = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.0.151 port = 0 } listen { type = "acct" ipaddr = 192.168.0.151 port = 0 } Listening on authentication address 192.168.0.151 port 1812 Listening on accounting address 192.168.0.151 port 1813 Listening on proxy address 192.168.0.151 port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=0, length=116 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000009016a6f686e Message-Authenticator = 0x63345840c269c1b54fb17e2e2137cdb8 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.0.177 port 58989 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e297084136bafa60810ea244249 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=1, length=131 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060315 State = 0x70851e297084136bafa60810ea244249 Message-Authenticator = 0x704f97c360d41603d551267a2a606547 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.0.177 port 58989 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e2971870b6bafa60810ea244249 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=2, length=219 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202005e150016030100530100004f03014caaabcb897edcddb6e87019dafef307071a0b69b3b6320ebe5ee47115c46ed200002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100 State = 0x70851e2971870b6bafa60810ea244249 Message-Authenticator = 0x763cd104835060737d3e97197682e6de +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 94 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0053], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 06d7], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.0.177 port 58989 EAP-Message = 0x010301f415c000000714160301002a0200002603014caaabcd3694a1eea025793dc8efac1460a8fe1589ebad434ea5d0a0064bfe8b0000350016030106d70b0006d30006d00002da308202d63082023fa003020102020102300d06092a864886f70d01010405003081ab310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f0603550407130853616e204a6f73653111300f060355040a1308576963686f727573310c300a060355040b1303456e67311f301d06035504030c16776963686f7275735f726f6f7443415f676368656e673132303006092a864886f70d0109011623776963686f7275735f726f EAP-Message = 0x6f7443415f676368656e6740776963686f7275732e636f6d301e170d3038303531323231313432395a170d3138303531303231313432395a30819c310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f0603550407130853616e204a6f73653111300f060355040a1308576963686f727573310d300b060355040b1304456e6767311730150603550403140e64736861685f7365727665725f32312a302806092a864886f70d010901161b64736861685f7365727665725f3240776963686f7275732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100b4cc27 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e2972860b6bafa60810ea244249 Finished request 2. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=3, length=131 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061500 State = 0x70851e2972860b6bafa60810ea244249 Message-Authenticator = 0x444c552d039d79bf7b6763fb8a91ecdb +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 192.168.0.177 port 58989 EAP-Message = 0x010401f415c0000007140b8841d4dac7027a6813c7a611bca71603326411eb6fa08837767df699faf74b2a8f056feee9e9ffa990f4b41014f59ed1bcb85aed3026235df4fbdeca8def862015a5386c3d109c30c3a884cf6f83f7162543a9a61dbc3fd75119b4160c83451699ede9167aba5889f16a6461264c50d92c496799ccfc44e189e887870203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a77640e1c7f72e1499bcc1cda2a0d443c880db7ef1436d441b07f801608bbd1d88ba15c816f01eef6fa85b08e961958225385fbe79b9fc7fc5b33004a77b7c1e67704bc05 EAP-Message = 0x357dcf0bccca40f004504648c02ec1df9f6e91e7600f90669fb3385b64ea4ff1880def479e02f66c4620d448606e623b967e370814fd1f5d512cca0003f0308203ec30820355a0030201020209009c1418fe79618077300d06092a864886f70d01010505003081ab310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f0603550407130853616e204a6f73653111300f060355040a1308576963686f727573310c300a060355040b1303456e67311f301d06035504030c16776963686f7275735f726f6f7443415f676368656e673132303006092a864886f70d0109011623776963686f7275 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e2973810b6bafa60810ea244249 Finished request 3. Going to the next request Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=4, length=131 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400061500 State = 0x70851e2973810b6bafa60810ea244249 Message-Authenticator = 0x140b333768c76c631cabee64dfef9fee +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 4 to 192.168.0.177 port 58989 EAP-Message = 0x010501f415c000000714735f726f6f7443415f676368656e6740776963686f7275732e636f6d301e170d3038303531323230353935335a170d3138303531303230353935335a3081ab310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f0603550407130853616e204a6f73653111300f060355040a1308576963686f727573310c300a060355040b1303456e67311f301d06035504030c16776963686f7275735f726f6f7443415f676368656e673132303006092a864886f70d0109011623776963686f7275735f726f6f7443415f676368656e6740776963686f7275732e636f6d30819f300d06092a86 EAP-Message = 0x4886f70d010101050003818d0030818902818100a35084afbdc782cb1111d16f11d6372c4aac07118813f2d55b0a52a3df951f961530fd4694defb94981e172e46e25e7fb7925a86975a933cb8761c243575b397abde2a6133b294b1b3bd1ef6a62a6882bdd7761d7942a77cf43422b526742dd45c4cf6cd167e43b8e256778e097490fdf0ce872e23c310806e68f16b32167e290203010001a382011430820110301d0603551d0e04160414d34f52eabf21357fb1085256754198a926aab1723081e00603551d230481d83081d58014d34f52eabf21357fb1085256754198a926aab172a181b1a481ae3081ab310b3009060355040613 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e2974800b6bafa60810ea244249 Finished request 4. Going to the next request Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=5, length=131 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061500 State = 0x70851e2974800b6bafa60810ea244249 Message-Authenticator = 0x6a3bdc1ff10f32916a28e534be84ff3d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 5 to 192.168.0.177 port 58989 EAP-Message = 0x01060160158000000714025553311330110603550408130a43616c69666f726e69613111300f0603550407130853616e204a6f73653111300f060355040a1308576963686f727573310c300a060355040b1303456e67311f301d06035504030c16776963686f7275735f726f6f7443415f676368656e673132303006092a864886f70d0109011623776963686f7275735f726f6f7443415f676368656e6740776963686f7275732e636f6d8209009c1418fe79618077300c0603551d13040530030101ff300d06092a864886f70d01010505000381810086c1ee74467f2615a8d5fe190ff44735bbcb3efe675302d5d0f881fc3c7a5c6395d7ccc5d7b5 EAP-Message = 0x23ce6ff7e87fcd4a52df7ec5b518b687912c535d1f4b875542b1c49997ad16b4408ea16a423ad1e504eab9d6bd33aa4c1b6c1cea5cee6b52dcb7dd251f0a20aac54e0ef046f1d41d62a6f31c8f1c75c6ce9b1a74633147671b5016030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e2975830b6bafa60810ea244249 Finished request 5. Going to the next request Waking up in 4.0 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=6, length=329 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020600cc150016030100861000008200801dd452024420fce1efff4fdf3553a914faf288e5aa0a5c3a1c38ddf96cd6e626efee41762495b18e7768d44cc9128088ba76483ceaf73cb746f3fc785c3298321053c6b90276eec623eeefa2648c8d2ec1e96a1005c262c91f10d6faa3eb55768e46dc7e35978325d5f7b6857a75fe48322dcec2e17bab2af4d6d4de0bd696d81403010001011603010030c4f83f149442210cb5d56e073822928b7eb57cd891c3e934f01f4e55b1161dc00bcb5316e6e0fb3cb888a15dc739ea36 State = 0x70851e2975830b6bafa60810ea244249 Message-Authenticator = 0x88fab0713d28fae91f143a8e06f7a508 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.0.177 port 58989 EAP-Message = 0x0107004515800000003b14030100010116030100307f9a14be792d03d1f03354c1fca77fe40b4c45ca62ca82615333432f0690a6d70f619ae59a7b3f675013ebf231abc2c5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e2976820b6bafa60810ea244249 Finished request 6. Going to the next request Waking up in 3.9 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=7, length=221 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02070060150017030100202abf4899df6abcd33096f265cdd16e719635702bf38ce8f880b7e0fb959799051703010030d2669fb2fb2f436aa094debcdb79518f4c0ee3f33e2877a4a44f3a446ccc10c64a542bb3b5378c56b5418653b3164466 State = 0x70851e2976820b6bafa60810ea244249 Message-Authenticator = 0x1e478f10f4bab4278b9faf92ba4d5b0d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x02000009016a6f686e FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Got tunneled identity of john [ttls] Setting default EAP type for tunneled EAP session. [ttls] Sending tunneled request EAP-Message = 0x02000009016a6f686e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "john" server { +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled } # server [ttls] Got tunneled reply code 11 EAP-Message = 0x010100160410e04582c33411dfd2af929b709cc23601 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb0ed2c00b0ec285c05125915d24f2066 [ttls] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 7 to 192.168.0.177 port 58989 EAP-Message = 0x0108004f1580000000451703010040a13a91a48ddd4ed8d7e4b2cfb5e0b567a38096afc082a654395446250099e84d5d5e952f3e2875e15e3e18ca6b750ad68395704ca589b175659d71ddbfc8c29f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e29778d0b6bafa60810ea244249 Finished request 7. Going to the next request Waking up in 3.8 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=8, length=221 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02080060150017030100208dddbae8a2d00c011b90a2f31006dcde6475e6e38ef85fc464516e9080f6d72617030100309d5904194f3b071d1e938c302c13147ca9db0230e7ae163df618f510286caf2c01d77224032f091cf153429ab9707d97 State = 0x70851e29778d0b6bafa60810ea244249 Message-Authenticator = 0xe690ad1ec9220fb4e4d1bd78cec8e20a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x02010006031a FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x02010006031a FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "john" State = 0xb0ed2c00b0ec285c05125915d24f2066 server { +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/mschapv2 [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server [ttls] Got tunneled reply code 11 EAP-Message = 0x0102001e1a01020019102959e603f5ec55fc4d3b4d1e6cdfb4626a6f686e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb0ed2c00b1ef365c05125915d24f2066 [ttls] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 8 to 192.168.0.177 port 58989 EAP-Message = 0x0109004f158000000045170301004000f2d6ff37bd5591853aac3b581da2ef6734c26110f9a51dabcbba3d31640c1dbf58e744e564b57c15209c7f26b384d6f91de9623bdc2c9c4671f9ae0f60f00f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x70851e29788c0b6bafa60810ea244249 Finished request 8. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 192.168.0.177 port 58989, id=9, length=269 User-Name = "john" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020900901500170301002059b68674bd770cdb478dc184ed5ed0ba3d492448af8b1f4eb868a73db5c164901703010060b6dd122a70a4b877fd516c218f952adf2a645b4c942718926f817788a5682539e3e1498d33b9ba76d3f14a3185140df1e4f89583990dbd365c432a7f0ebcc5b2af9a7762688a2318f7c972f3055bcdee12b2d334d3e233d4a1ee57ff15ef61c0 State = 0x70851e29788c0b6bafa60810ea244249 Message-Authenticator = 0x03d36e4152a4b579117dbbcded472d58 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x0202003f1a0202003a313040f71ffff45932c78288172e36d8020000000000000000fed561ff311854eb54e8dbc91a6c84a5461735610fc0a048006a6f686e FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x0202003f1a0202003a313040f71ffff45932c78288172e36d8020000000000000000fed561ff311854eb54e8dbc91a6c84a5461735610fc0a048006a6f686e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "john" State = 0xb0ed2c00b1ef365c05125915d24f2066 server { +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 63 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for john with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server [ttls] Got tunneled reply code 3 MS-CHAP-Error = "\002E=691 R=1" EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user john [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> john attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 9 to 192.168.0.177 port 58989 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 2.4 seconds. Cleaning up request 0 ID 0 with timestamp +173 Cleaning up request 1 ID 1 with timestamp +173 Waking up in 0.6 seconds. Cleaning up request 2 ID 2 with timestamp +173 Cleaning up request 3 ID 3 with timestamp +174 Waking up in 0.1 seconds. Cleaning up request 4 ID 4 with timestamp +174 Cleaning up request 5 ID 5 with timestamp +174 Waking up in 0.1 seconds. Cleaning up request 6 ID 6 with timestamp +174 Waking up in 0.1 seconds. Cleaning up request 7 ID 7 with timestamp +174 Waking up in 0.1 seconds. Cleaning up request 8 ID 8 with timestamp +174 Waking up in 1.2 seconds. Cleaning up request 9 ID 9 with timestamp +174 Ready to process requests. Thanks, BMano -- View this message in context: http://freeradius.1045715.n5.nabble.com/EAP-MSCHAP-V2-mschap-FAILED-No-NT-L… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

Half OT: Windows XP won't connect
by Sergio Belkin 05 Oct '10

05 Oct '10

Hi, I have a freeradius with LDAP, supplicants use either EAP-PEAP or EAP-TTLS. Sometimes, Windows (mainly XP) systems won't connect, packages arrive only to Access Point but no to radius server. Generally, solution is rebooting the AP but I wonder if I need to tweak something on AP, this the result from tcpdump: 12:45:07.808808 00:22:5f:43:f4:31 (oui Unknown) > Broadcast Null Unnumbered, xid, Flags [Response], length 6: 01 00 12:45:07.815594 02:25:9c:14:06:6e (oui Unknown) > 00:25:9c:14:06:6e (oui Unknown), ethertype Unknown (0x886c), length 94: 0x0000: 8001 007a 0000 1018 0001 0001 0000 0000 ...z............ 0x0010: 0008 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 0016 0022 5f43 f431 776c 3000 0000 0000 ..."_C.1wl0..... 0x0030: 0000 0000 0000 0000 3014 0100 000f ac02 ........0....... 0x0040: 0100 000f ac04 0100 000 ac01 0000 0000 ................ 12:45:07.819711 EAPOL start (1) v1, len 0 12:45:07.825580 02:25:9c:14:06:6e (oui Unknown) > 00:25:9c:14:06:6e (oui Unknown), ethertype Unknown (0x886c), length 77: 0x0000: 8001 0069 0000 1018 0001 0001 0000 0000 ...i............ 0x0010: 0019 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 0005 0022 5f43 f431 776d 3000 0000 0000 ..."_C.1wl0..... 0x0030: 0000 0000 0000 0000 0101 0000 0000 00 ............... 12:45:18.821489 IP 192.168.188.131.17500 > 192.168.188.255.17500: UDP, length 127 12:45:20.417512 ARP, Request who-has 192.168.188.1 (00:25:9c:14:06:6c (oui Unknown)) tell 192.168.188.187, length 28 12:45:20.417682 ARP, Reply 192.168.188.1 is-at 00:25:9c:14:06:6c (oui Unknown), length 28 12:45:28.095608 ARP, Request who-has 192.168.188.131 tell 192.168.188.1, length 28 12:45:28.098097 ARP, Reply 192.168.188.131 is-at 00:1f:5b:bb:77:f2 (oui Unknown), length 28 12:45:31.165528 ARP, Request who-has 192.168.188.187 tell 192.168.188.1, length 28 12:45:31.169815 ARP, Reply 192.168.188.187 is-at 00:25:d3:74:49:ac (oui Unknown), length 28 12:45:48.919456 ARP, Request who-has 192.168.188.1 (00:25:9c:14:06:6c (oui Unknown)) tell 192.168.188.187, length 28 12:45:48.919612 ARP, Reply 192.168.188.1 is-at 00:25:9c:14:06:6c (oui Unknown), length 28 12:46:04.655521 ARP, Request who-has 192.168.188.187 tell 192.168.188.1, length 28 12:46:04.656464 ARP, Reply 192.168.188.187 is-at 00:25:d3:74:49:ac (oui Unknown), length 28 12:46:09.114950 EAPOL start (1) v1, len 0 12:46:09.115553 02:25:9c:14:06:6e (oui Unknown) > 00:25:9c:14:06:6e (oui Unknown), ethertype Unknown (0x886c), length 77: 0x0000: 8001 0069 0000 1018 0001 0001 0000 0000 ...i............ 0x0010: 0019 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 0005 0022 5f43 f431 776d 3000 0000 0000 ..."_.1wl0..... 0x0030: 0000 0000 0000 0000 0101 0000 0000 00 ............... 12:46:14.920025 ARP, Request who-has 192.168.188.1 (00:25:9c:14:06:6c (oui Unknown)) tell 192.168.188.187, length 28 12:46:14.920228 ARP, Reply 192.168.188.1 is-at 00:25:9c:14:06:6c (oui Unknown), length 28 Thanks in advance! -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

FW: Session Resumption fails
by Panagiotis Georgopoulos 05 Oct '10

05 Oct '10

Hello all, I am resending this to the list as the debugging output was more than 100KB and the message was rejected. Alexander who was copied in my email, kindly provided feedback already. In short, "use_tunneled_reply = yes" should be able to solve the problem with session resumption in FR 2.1.10, although I understand that break the end client's privacy as it reveals its identity to the NAS. When I test it I'll get back to you as I am guessing this interests more people. Cheers, Panos Debug output here : http://pastebin.com/7u1tjbYE > -----Original Message----- > From: Panagiotis Georgopoulos [mailto:panos@comp.lancs.ac.uk] > Sent: Friday, September 24, 2010 04:17 > To: 'FreeRadius users mailing list'; 'Alexander Clouter' > Subject: RE: Session Resumption fails > > Hi Alexander, all > > Thanks a lot for your reply, it helped my understanding of what is > occurring. Please see below for my comments. > > > > > Panagiotis Georgopoulos <panos(a)comp.lancs.ac.uk> wrote: > > > > > > I have a client machine that authenticates to FreeRadius using > > > EAP-TTLS over Access_Point_1 just fine. When I roam the client to > > > Access_Point_2 and tries to authenticate again to FreeRadius, > > > session resumption seems to be failing with the following error. > > > > > > [snipped] > > > > > > One thing to note on the above is that there is no cached > > information, > > > which seems strange as the client was authenticated some minutes > > > over Access_Point_1. The other thing is that user authentication > > > fails completely and the client resides to restart EAP-TTLS from the > > > start that finishes successfully. > > > > > The session cache stores what is in the *reply* packet of the inner > > request (if that makes sense). > > > > In your eap.conf file, you refer to a virtual server to palm off > > requests to once the EAP layer has been peeled off. In that virtual > > server say in the authorize{} section: > > ---- > > update reply { > > User-Name := "%{request:User-Name}" > > } > > ---- > > > > Now you will find on resumption the username appears magically; > > session resumption is a feature of SSL/TLS and so the user-name is not > > accessible; hence the need to dig into the cache. > > > > I also recommend that you also do: > > ---- > > update outer.request { > > User-Name := "%{request:User-Name}" > > } > > ---- > > I am afraid your suggestion though to add the above in my inner-tunnel virtual > server didn't solve the problem. After having searched the archives of the > list, I found out that this is an OpenSSL bug and there is a fix in FreeRadius > 2.1.10 for it. > > I just compiled 2.1.10 and I verify that I don't see resuming sessions failing > with this no information in the cache : > > Info: [ttls] Skipping Phase2 due to session resumption > Info: [ttls] WARNING: No information in cached session! > > However, I am not seeing the correct behaviour either :-/ > > I am seeing the server adding information in the cache : > > - Debug: SSL: adding session > 1d6029bbddba233cd443d692b968df093237d9ad982f9ccc8a2defcd3edeb243 to cache > - Info: [ttls] (other): SSL negotiation finished successfully > - Debug: SSL Connection Established > > .. but it *never* says that it tries to e.g. skip phase 2 and try resumption > (as I was seeing with FR 2.1.8). > > However in some occasions it says : > > - Info: [ttls] WARNING: No information to cache: session caching will be > disabled for this session. > - Debug: SSL: Removing session > 69c204b29e84878591c19645ed74c1ff4b656c30f66adad78d268df65d2e1d14 from the > cache > > Does anyone have any pointers/suggestions? Anyone who managed to do session > resumption with 2.1.10? > > Thanks a lot in advance, > Panos > > > Ps. By the way, you can find attached my radiusd debugging output with a > client trying to authenticate over different NASs. All authentications > succeed, and info in the cache is stored, but FR never resumes a session. > (nb. in the attached debug, I am restarting my NASs first before the client > starts roaming from one NAS to the other using EAP-TTLS) >

2 8

Freeradius Attribute Subtypes
by Kevin Baier 04 Oct '10

04 Oct '10

Hi List, My freeradius version is 2.0.4 shipped with standard debian lenny package. I have to implement some special attribute to control the users bandwidth on an Special NAS. Here ist the attribute: Type: 26 Length = 12 Vendor ID: 3902 Vendor-Type = 3 Vendor-Length = 14 Sub-Type = 1 Forward maximum gross aggregate bandwidth value Length = 6 Vendor-Value = 1 – 2**32 -1(binary value of the gross aggregate bandwidth for the user, in bits per second) Sub-Type = 2 Reverse maximum gross aggregate bandwidth value Length = 6 Vendor-Value = 1 – 2**32 -1(binary value of the gross aggregate bandwidth for the user, in bits per second) As I can see the attribute itself has two subtyped values. How can I declare them in the dictionary file? Thank you for your help! -- Kevin Baier

2 2

unlang post-auth group-name
by Cameron Wood 02 Oct '10

02 Oct '10

Hi I'm trying to obtain the Group-Name for the requested user and use it with unlang in the Post-Auth section of my sites-available/default config. This hasn't work thus far, and I have tried a number of other ideas, such as getting it whilst in the Authorize section and creating new variable to hold it there and then referencing that, but still with no success. Can someone tell me how I can accomplish this, below is a snippet of my config so you can see what I am trying to accomplish, any help would be greatly appreciated. post-auth { > switch "%{client:vendor}" { > > case adva { > switch "%{Group-Name}" { > > case net_ro { > update reply { > ADVA-UUM-User-Level := "Monitor" > } > } > > case net_rw { > update reply { > ADVA-UUM-User-Level := "Admin" > } > } > > case net_su { > update reply { > ADVA-UUM-User-Level := "Root" > } > } > } > } > > case cisco { > ... > } > > case netscreen { > ... > } > } > } > Cheers Cam. --

6 26

Wipe existing reply attributes in rlm_files
by Brian Candler 02 Oct '10

02 Oct '10

Hello, I'm using freeradius 2.1.7. I would like to know if there's a simple way, within a users file, to *replace* the entire set of reply attributes with some others. For example, NONE Foo = "bar", Baz = "bap" # FIXME: delete all reply attributes which have accumulated so far Framed-IP-Address = 1.1.1.1 The idea is that I've already done a database dip using something like rlm_sql, which may have added some reply attributes; but then later logic requires that I need to remove those reply attributes and replace them with a different set (e.g. to L2TP tunnel them somewhere else) I know I could remove specific attributes using -=, but I don't know which attributes might have been added by this point. My current solution is very messy, using two users files. Firstly I set a temporary control list attribute: NONE Foo = "bar", Baz = "bap", Postauth-Action := "XXX" and then next in the authorize { } config I have: if ("%{control:PostAuth-Action}" =~ /./) { deleteall # invoke custom module to clear reply list postauth_attrs # invoke second users file } and finally, in a second users file, I add the new attributes: XXX Framed-IP-Address = 1.1.1.1 I can't even use the standard attr_filter module to delete the existing reply attributes, because when it's invoked in the authorize { } section it acts on the request list, not the reply list. Have I missed an easier way to do this? Thanks, Brian.

3 4

Unfinished Request no Database
by João Romariz 01 Oct '10

01 Oct '10

Hi, We are facing a strange issue with freeradius 2.1.9 running in a VM with Fedora Core 13. As soon as we start the server we get around 30 anthentication requests per second from a client. The first 30 to 40 request get a quick reply but from there on only very few replies are seen on the log file, all the other requests get this error: Fri Oct 1 05:06:28 2010 : Error: Discarding duplicate request from client GGs port 65035 - ID: 117 due to unfinished request 4 Searching the mailing list I found lots of references to this error as cause by "slow database server". The problem here is that we are not using any database on this server, we authenticate any user and don´t care for username or password. The server assigns IP addresses to the users by an ippool. Any ideas of what could be the causing the problem? Thanks for any help. Regards, Joao.

2 1

FreeRADIUS ECCN code ?
by Fabrizio Rossi 01 Oct '10

01 Oct '10

Hi all, Is somewhere declared the FreeRADIUS ECCN code ? (http://en.wikipedia.org/wiki/ECCN) I've looked in the WIKI and in the mailing list archives but I could not find this info. Thanks, Fabrizio

3 7

Freeradius + EAP_TLS + Cisco AP
by Esteban TALAVERA 01 Oct '10

01 Oct '10

Hi I configured a freeradius server with EAP_TLS to authenticate clients that connects to Cisco AP. When I run freeradius -X I got a lot of activity output but the client is still trying to authenticate I post last lines from the server's output I see the port of Access-request es 1645 but I did configure 1812 in both server and Cisco AP The line "[tls] eaptls_process returned 13 " means something wrong? What should be the correct output when successful authentication occurs? Thanks ==== rad_recv: Access-Request packet from host 192.168.X.X port 1645, id=51, length=143 User-Name = "etalaveran" Framed-MTU = 1400 Called-Station-Id = "aca0.16ba.89f2" Calling-Station-Id = "0021.63ca.fdbe" Service-Type = Login-User Message-Authenticator = 0x32824bc17cf2b4b4920577cc57e00177 EAP-Message = 0x020700060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 285 NAS-Port-Id = "285" State = 0x732b0744702c0abef63c2dd8a2b9de35 NAS-IP-Address = 192.168.1.82 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "etalaveran", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry etalaveran at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 51 to 192.168.X.X port 1645 EAP-Message = 0x0108000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x732b074477230abef63c2dd8a2b9de35 Finished request 19. Going to the next request Waking up in 4.8 seconds. Cleaning up request 15 ID 47 with timestamp +117 Cleaning up request 16 ID 48 with timestamp +117 Cleaning up request 17 ID 49 with timestamp +117 Cleaning up request 18 ID 50 with timestamp +117 Cleaning up request 19 ID 51 with timestamp +117 Ready to process requests. ================= -- *Esteban Talavera*

3 7

Install FR 2.1.10 on OS X 10.4.11
by Wolfgang Burger 01 Oct '10

01 Oct '10

Hello, I´m using version of 1.1.7 on a production system and it was working quite well for me. For severall reasons I want to update my setup now. When I startet to try the new versions some days ago, the "Frontpage"- Version was 2.1.9. I'm running my server under Mac OS X 10.4.11 PPC. 2.1.9 was building nicely but I was suffering the bug mentioned here: http://lists.freeradius.org/mailman/htdig/freeradius-users/2010-June/msg001… I tried to install the newest git version or the 2.1.10 release on this system, but failed. Part of output, created by "make" below. More on request. Is there a way to install 2.1.10 on this system? Thank you very much. Best regards, Wolfgang Making all in main... /usr/bin/make -C main all /Users/system/Desktop/freeradius-server-2.1.10/libtool --mode=link gcc -o radsniff radsniff.lo /Users/system/Desktop/freeradius- server-2.1.10/src/lib/libfreeradius-radius.la -framework DirectoryService -lresolv -lpthread -lpcap gcc -o radsniff radsniff.o -framework DirectoryService /Users/system/ Desktop/freeradius-server-2.1.10/src/lib/.libs/libfreeradius-radius.a - lresolv -lpthread -lpcap /usr/libexec/gcc/powerpc-apple-darwin8/4.0.1/ld: Undefined symbols: _pcap_dump_fopen _pcap_fopen_offline collect2: ld returned 1 exit status make[4]: *** [radsniff] Error 1 make[3]: *** [main] Error 2 make[2]: *** [all] Error 2 make[1]: *** [src] Error 2 make: *** [all] Error 2

2 2