- Freeradius-Users - lists.freeradius.org

Freeradius problem, EAP-TTLS works fine, EAP-PEAP does not
by Jean-Yves Avenard 31 Aug '10

31 Aug '10

Following on an earlier thread: http://lists.freeradius.org/pipermail/freeradius-users/2010-June/msg00116.h… Of which I couldn't get any answer unfortunately.. I am experiencing a similar problem. I am running freeradius that comes installed and configured with MacOS 10.6 server. A Windows XP can connect just fine using Microsoft Protected EAP. iPhone, mac os client connect just fine using EAP-TTLS Windows 7 will connect fine using Securew2 EAP-TTLS supplicant ; but not with the default build-in PEAP. I have modified module/mschap as followed, as per various instructions: # Microsoft CHAP authentication # # This module supports MS-CHAP and MS-CHAPv2 authentication. # It also enforces the SMB-Account-Ctrl attribute. # mschap { # # If you are using /etc/smbpasswd, see the 'passwd' # module for an example of how to use /etc/smbpasswd authtype = MS-CHAP # if use_mppe is not set to no mschap will # add MS-CHAP-MPPE-Keys for MS-CHAPv1 and # MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2 # use_mppe = yes # if mppe is enabled require_encryption makes # encryption moderate # require_encryption = yes # require_strong always requires 128 bit key # encryption # require_strong = yes # Windows sends us a username in the form of # DOMAIN\user, but sends the challenge response # based on only the user portion. This hack # corrects for that incorrect behavior. # with_ntdomain_hack = yes # The module can perform authentication itself, OR # use a Windows Domain Controller. This configuration # the "best" user name for the request. # ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } In the log, when connecting using Windows XP I would see: Thu Aug 26 02:04:20 2010 : Info: rlm_sql_sqlite: sqlite3_open() = 0 Thu Aug 26 02:04:20 2010 : Info: rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #4 Thu Aug 26 02:04:20 2010 : Info: rlm_sql_sqlite: sqlite3_open() = 0 Thu Aug 26 02:04:20 2010 : Info: Ready to process requests. Thu Aug 26 02:07:43 2010 : Auth: rlm_opendirectory: User <jean-yves.avenard> is authorized. When connecting with Windows 7, I would read: Thu Aug 26 02:21:52 2010 : Auth: rlm_opendirectory: Could not get the user's uuid. Thu Aug 26 02:21:53 2010 : Error: rlm_mschap: getUserNodeRef(): dsGetRecordList() status = 0, recCount=0 Any hint about what I should be looking at? Mind new, I'm a complete noob when it comes to radius, I only started playing with it 2 days ago. Thank you for your help troubleshooting this matter. Regards Jean-Yves

5 16

deleteing attribute
by Alexandre Chapellon 31 Aug '10

31 Aug '10

Hello, I want to delete an attribute I send to NASes in Access-reply, regardless of its value. Apparently I cannot use '!*' operator which is only for check items, and '-=' doesn't support wilcards (unless i mistaken) How can I do it? Am using freeradius 2.1.6 on Debian x86_64 P.S: of course I can't change the attributes returned in the authorized section. :)

3 3

newbie need help!
by gahn 31 Aug '10

31 Aug '10

Hi gurus: i followed the advice to sue "radiusd -X" and here is what i got: rad_recv: Access-Request packet from host 192.168.255.138 port 65267, id=176, length=53 User-Name = "glu" User-Password = "12345678" NAS-Identifier = "r8" NAS-IP-Address = 10.100.11.3 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "glu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry glu at line 199 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> glu attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 176 to 192.168.255.138 port 65267 Waking up in 4.9 seconds. Cleaning up request 0 ID 176 with timestamp +13 Ready to process requests. here is my config for "users": glu Auth-Type := Local Cleartext-Password := "12345678", Juniper-Local-User-Name = "tester" anyone knows what the problems are? Thanks...

2 1

PEAP + MSCHAPv2 reject and re-connect loop
by John Mok 30 Aug '10

30 Aug '10

Hi, I have successfully setup a FreeRADIUS 1.1.7 running on Ubuntu 8.0.4 LTS. Users used their own Windows ID and password to connect Wi-Fi network. The problem was that, after connected for a few hours, some of the Wi-Fi clients were disconnected from the Wi-Fi AP, and engaged in a loop of reject-and-reconnect (see below debug log). === begin of debug log === Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{Stripped-User-Name:-%{mschap:User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/riga-key.pem" tls: certificate_file = "/etc/freeradius/certs/riga-cert.pem" tls: CA_file = "/etc/freeradius/certs/cacert.pem" tls: private_key_password = "sunciti" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.144.1.98:4856, id=0, length=206 Message-Authenticator = 0x4cd73215c49f3987204f5ef273507560 Service-Type = Framed-User User-Name = "SUNCITI\\John" Framed-MTU = 1488 Called-Station-Id = "00-24-73-50-BC-00:SML" Calling-Station-Id = "1C-AF-F7-69-D9-0E" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020000110153554e434954495c4a6f686e NAS-IP-Address = 10.144.1.98 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "SUNCITI\John", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 10.144.1.98 port 4856 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x15ebf04bc8167b343a19fb5bd85b283a Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.144.1.98:4856, id=1, length=287 Message-Authenticator = 0x4a4bc5faffd04175071a46875bc23bfe Service-Type = Framed-User User-Name = "SUNCITI\\John" Framed-MTU = 1488 State = 0x15ebf04bc8167b343a19fb5bd85b283a Called-Station-Id = "00-24-73-50-BC-00:SML" Calling-Station-Id = "1C-AF-F7-69-D9-0E" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201005019800000004616030100410100003d03014c7326dd1216c6f5f26cff850377f6bd79386ec9d61e01a1c719ec41d4f2a58700001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 10.144.1.98 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "SUNCITI\John", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 099e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 10.144.1.98 port 4856 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0102040a19c0000009fb160301004a0200004603014c7326dd03c7c91064289ee5da309623bdf57372695234091aea47c2a904c110204421bce21492aa223b24da4ebaa83f6e16a0e8a9aaa6285864d9a2e7a5672467000400160301099e0b00099a000997000466308204623082034aa003020102020111300d06092a864886f70d01010505003081bd310b300906035504061302484b3119301706035504081310486f6e67204b6f6e6720532e412e522e3112301006035504071309486f6e67204b6f6e6731233021060355040a131a53756e63697469204d616e75666163747572657273204c74642e31243022060355040b131b534d4c20436572 EAP-Message = 0x74696669636174696f6e20417574686f72697479310f300d06035504031306534d4c2043413123302106092a864886f70d0109011614636140736d6c2e636974697a656e2e636f2e6a70301e170d3130303731363038343930345a170d3230303731333038343930345a3081a8310b300906035504061302484b3119301706035504081310486f6e67204b6f6e6720532e412e522e31233021060355040a131a53756e63697469204d616e75666163747572657273204c74642e3111300f060355040b130857692d4669204341311f301d06035504031316726967612e736d6c2e636974697a656e2e636f2e6a703125302306092a864886f70d010901 EAP-Message = 0x16166a6f686e40736d6c2e636974697a656e2e636f2e6a7030819f300d06092a864886f70d010101050003818d0030818902818100a6d9f1b00c69db93583c8e434b3d1a79a70327b6ba826fb862c6ced61450da9b9419775b223f953e2840605a010c9c755a000ffc7b5598d320ab1fa580d982b06a67892d6e8a8787a09f9e0061e2dcced2daa30e8c90a99b30a4c83afb94936ee6d890e86244f8958dc42a0c205b0bf32d8a8e62d496b5340898f6d588b7d8130203010001a38201023081ff300c0603551d13040530030101ff302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465 EAP-Message = 0x301d0603551d0e0416041481bbaebcfb867498cfc97345cd31814f079acdb5301f0603551d2304183016801447e7f27138f072413b70c06738f2a81016b9c534300b0603551d0f0404030205e030740603551d11046d306b8269696d61702e736d6c2e636974697a656e2e636f2e6a7020444e533a736d74702e736d6c2e636974697a656e2e636f2e6a7020444e533a6c6461702e736d6c2e636974697a656e2e636f2e6a7020444e533a7261646975732e736d6c2e636974697a656e2e636f2e6a70300d06092a864886f70d010105050003820101008857e23dcbfe4cfe1aaf5bac29bcc890357dfba960c0606476135027e11df4231e53825dbd08 EAP-Message = 0xb3b4ab10f1ce37c387843b2c2bc634035b7f913e94ca Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3968cdb160476e2f78f70a4395e1c2c9 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.144.1.98:4856, id=2, length=213 Message-Authenticator = 0x392d8ea72ce3b1d7b536448e82f0edcd Service-Type = Framed-User User-Name = "SUNCITI\\John" Framed-MTU = 1488 State = 0x3968cdb160476e2f78f70a4395e1c2c9 Called-Station-Id = "00-24-73-50-BC-00:SML" Calling-Station-Id = "1C-AF-F7-69-D9-0E" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 NAS-IP-Address = 10.144.1.98 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "SUNCITI\John", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 2 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 2 to 10.144.1.98 port 4856 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010304061940765295f4bccb21264f6a1d3f2a8547384a60b039c2180233d6ed2de88fc646a2f00fb97a516aae47a2abe2b94783b8ac6125d04c8361997cb553a8a26404b2d8a91dd4206b5eb9c9451aab45aebd76bd3f88b854ac8881488dac2ddaf501fd91777062f0109f887abd1029e9ecb723277db3c278e1f00deda538bc35ddb157dbeccd20dd6dd3abe6e95f44245b442379268df0b762f77e1e03c121259d976bf6303e452eddcb9de45d6d4766cefc613042d1ab07504e4e1344cf553461109aa57dc93a7b00052b308205273082040fa00302010202090099158bade43392a9300d06092a864886f70d01010505003081bd310b30090603 EAP-Message = 0x5504061302484b3119301706035504081310486f6e67204b6f6e6720532e412e522e3112301006035504071309486f6e67204b6f6e6731233021060355040a131a53756e63697469204d616e75666163747572657273204c74642e31243022060355040b131b534d4c2043657274696669636174696f6e20417574686f72697479310f300d06035504031306534d4c2043413123302106092a864886f70d0109011614636140736d6c2e636974697a656e2e636f2e6a70301e170d3038303230353032353930385a170d3333303230353032353930385a3081bd310b300906035504061302484b3119301706035504081310486f6e67204b6f6e672053 EAP-Message = 0x2e412e522e3112301006035504071309486f6e67204b6f6e6731233021060355040a131a53756e63697469204d616e75666163747572657273204c74642e31243022060355040b131b534d4c2043657274696669636174696f6e20417574686f72697479310f300d06035504031306534d4c2043413123302106092a864886f70d0109011614636140736d6c2e636974697a656e2e636f2e6a7030820122300d06092a864886f70d01010105000382010f003082010a0282010100dd8e75cabd77e33175d820426d8dc5b814c31a4394762dab9f24b5380b6cfb2b19e5948503bb863ebcba82a5c7704cbfbe0fbfe20b2efc201c0bc23f321fd7992679 EAP-Message = 0x44f1d9f7d43479009ca214fbd69e8797a403116e67b1098d0450911ebe71ddc212fe7a0f1fee7c66048cfcbe819c6f60aa903842981689737f700b1225283ef5197573960854ae58d0d4f76cf64da0b65a4892edc94faf522755cfd7c0b060ff8f7e3f716c98304ca0e59732b084d85cc547e590a01806b35c9c77df6ed7aacc03c631ede5bc40526bb542e31f637104c03a192542544a69dbbdbcd1621b84be9b6816e73c3429eafc97ee582d7631d43d5fd07f01045d37fec1bbee192d0203010001a382012630820122301d0603551d0e0416041447e7f27138f072413b70c06738f2a81016b9c5343081f20603551d230481ea3081e7801447e7f2 EAP-Message = 0x7138f072413b70c06738f2a81016b9c534a1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf2da980a8b5336a38e34151bb7389396 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.144.1.98:4856, id=3, length=213 Message-Authenticator = 0x51cbe89ff574fe4490d66bde616f1506 Service-Type = Framed-User User-Name = "SUNCITI\\John" Framed-MTU = 1488 State = 0xf2da980a8b5336a38e34151bb7389396 Called-Station-Id = "00-24-73-50-BC-00:SML" Calling-Station-Id = "1C-AF-F7-69-D9-0E" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300061900 NAS-IP-Address = 10.144.1.98 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "SUNCITI\John", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 3 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 3 to 10.144.1.98 port 4856 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x01040201190081c3a481c03081bd310b300906035504061302484b3119301706035504081310486f6e67204b6f6e6720532e412e522e3112301006035504071309486f6e67204b6f6e6731233021060355040a131a53756e63697469204d616e75666163747572657273204c74642e31243022060355040b131b534d4c2043657274696669636174696f6e20417574686f72697479310f300d06035504031306534d4c2043413123302106092a864886f70d0109011614636140736d6c2e636974697a656e2e636f2e6a7082090099158bade43392a9300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100b7fa7749ad EAP-Message = 0x54eca03713da96db7a1ab05daa84134d5442d1c1439701ea55c4b1519d8fb9a649c3c6b9407d29545f24c1e2459f9796475e677c57e34a3ed605c932c7a504191bd7796b1dbabc88fb2816269f003968f3b13bca0b326c2ebdb8a907550794f66014430a1954267ba3c6420494d45fec758ef5065dddabba7f59dea14adf1e39cdc10f4ea3ce56e3391694c8cbee219a7715c6019fe6b6e9ef82eaee60a0ccd4f7601c358abc41aa0c0e6d575c7025ba57408d42a535ad9aaf9b4b1ea2559dfdd74d0cda4276d599de067a280831ed942d391428ea82445c8e56c5eb27b21c2e5dd47458bdf7b3b9c09caad6c0094fd86583b37ca882b8792bf73c1603 EAP-Message = 0x0100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4f5a891fd588b4466da2de0e77d8e466 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.144.1.98:4856, id=4, length=399 Message-Authenticator = 0x7e63ed463255a51ccc8a3bbe24f57501 Service-Type = Framed-User User-Name = "SUNCITI\\John" Framed-MTU = 1488 State = 0x4f5a891fd588b4466da2de0e77d8e466 Called-Station-Id = "00-24-73-50-BC-00:SML" Calling-Station-Id = "1C-AF-F7-69-D9-0E" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400c01980000000b616030100861000008200806a6b66e0f95058b01d56baaf089d579377c191430e3878b247ba56a38a476dd0b494e1902413b60830538bc9f2ec7a8454ca113f64279e0fd37177cdbe824ad39a855f5efd4909bc5897bfbad8a88e6c2ec581b99ea84e6b93cdfb6e6a180dfed4ae58dd923982e615d2ab7c987d7fef5e97adec39eadc4d5383e791fbe122fc14030100010116030100200519772fdc3e2d0d196c2c0a2b18e3a7c5164871277f1d844716e95899717176 NAS-IP-Address = 10.144.1.98 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "SUNCITI\John", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 4 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 4 to 10.144.1.98 port 4856 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0105003119001403010001011603010020ada22380d7205f4e4e7bd7c63c65815a5580610793f930788e213e7d8604a1cc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x23b30b87c57b405aee0914da2609bedb Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.144.1.98:4856, id=5, length=213 Message-Authenticator = 0xb216b3fbc01801639d48f96ca79ce232 Service-Type = Framed-User User-Name = "SUNCITI\\John" Framed-MTU = 1488 State = 0x23b30b87c57b405aee0914da2609bedb Called-Station-Id = "00-24-73-50-BC-00:SML" Calling-Station-Id = "1C-AF-F7-69-D9-0E" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020500061900 NAS-IP-Address = 10.144.1.98 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "SUNCITI\John", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 5 to 10.144.1.98 port 4856 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010600201900170301001549f53272b418e7f139196a3aafbc48571f30318ae8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1f66af663db654beaf9423d52876463 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.144.1.98:4856, id=6, length=247 Message-Authenticator = 0x1b4288c2341daf9bf0f5bf1ff0f31e49 Service-Type = Framed-User User-Name = "SUNCITI\\John" Framed-MTU = 1488 State = 0xf1f66af663db654beaf9423d52876463 Called-Station-Id = "00-24-73-50-BC-00:SML" Calling-Station-Id = "1C-AF-F7-69-D9-0E" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020600281900170301001d84583efaee4e63a35637e9c4847c097a93c046d9a4774fe8c3ff4c68ef NAS-IP-Address = 10.144.1.98 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "SUNCITI\John", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 40 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 6 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - SUNCITI\John rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020600110153554e434954495c4a6f686e PEAP: Got tunneled identity of SUNCITI\John PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to SUNCITI\John PEAP: Sending tunneled request EAP-Message = 0x020600110153554e434954495c4a6f686e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "SUNCITI\\John" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "SUNCITI\John", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 6 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010700261a010700211098fca94b1bd9ecfaf714ea0b15b9ddff53554e434954495c4a6f686e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x361f2d0180f35e68a619343737a09599 PEAP: Processing from tunneled session code 0xb7826db8 11 EAP-Message = 0x010700261a010700211098fca94b1bd9ecfaf714ea0b15b9ddff53554e434954495c4a6f686e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x361f2d0180f35e68a619343737a09599 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 6 to 10.144.1.98 port 4856 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0107003d1900170301003238c86dcd7fd2caccad5310cf37c0f0c78193982d4c00322a1f70e9750fb6e394661028b7c0d3907687f61ea67d4b762c4486 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1c777b509b952ca92b89af252c4d4f92 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.144.1.98:4856, id=7, length=301 Message-Authenticator = 0xdad04f6062f34f55ac565c1d06086fe8 Service-Type = Framed-User User-Name = "SUNCITI\\John" Framed-MTU = 1488 State = 0x1c777b509b952ca92b89af252c4d4f92 Called-Station-Id = "00-24-73-50-BC-00:SML" Calling-Station-Id = "1C-AF-F7-69-D9-0E" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0207005e190017030100536d8a2ef3473c173a53dce9dac6ef084b13930bc1492f59123c9c663bfb1d089ef3c3b6434495216db8068f4fe68ce4e54e06547b4cb07eeeb23a4fa51ea75a618551d55142c9469e146a041db7ac3898267191 NAS-IP-Address = 10.144.1.98 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "SUNCITI\John", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 94 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 7 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020700471a0207004231896d97db189a9706086e2d85c476046a0000000000000000b8a0dd95d15570322f85cfeadcdc587d7724463bf5b9fd180053554e434954495c4a6f686e PEAP: Setting User-Name to SUNCITI\John PEAP: Adding old state with 36 1f PEAP: Sending tunneled request EAP-Message = 0x020700471a0207004231896d97db189a9706086e2d85c476046a0000000000000000b8a0dd95d15570322f85cfeadcdc587d7724463bf5b9fd180053554e434954495c4a6f686e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "SUNCITI\\John" State = 0x361f2d0180f35e68a619343737a09599 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "SUNCITI\John", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 71 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 7 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for John with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: '--domain=SUNCITI' radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=John' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 98 radius_xlat: '--challenge=0a50110ecf0f3539' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=b8a0dd95d15570322f85cfeadcdc587d7724463bf5b9fd18' Exec-Program output: Named pipe dicconnected (0xc00000b0) Exec-Program-Wait: plaintext: Named pipe dicconnected (0xc00000b0) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: leaving group MS-CHAP (returns reject) for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: leaving group authenticate (returns reject) for request 7 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0xb7800c20 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 7 to 10.144.1.98 port 4856 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010800261900170301001bcd91f9e138df313e16c573f5d3b8d9444394d120ed0466b815ca44 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe1af7f7cc28ed1bf8ed6e1ef5ff8589b Finished request 7 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.144.1.98:4856, id=8, length=245 Message-Authenticator = 0x3757d2a50dc975d9c34e987c74a26151 Service-Type = Framed-User User-Name = "SUNCITI\\John" Framed-MTU = 1488 State = 0xe1af7f7cc28ed1bf8ed6e1ef5ff8589b Called-Station-Id = "00-24-73-50-BC-00:SML" Calling-Station-Id = "1C-AF-F7-69-D9-0E" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800261900170301001bf95870254776d76ebf45ce86e353b346472601edc96d717b90bd31 NAS-IP-Address = 10.144.1.98 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "SUNCITI\John", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 8 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: leaving group authenticate (returns invalid) for request 8 auth: Failed to validate the user. Delaying request 8 for 1 seconds Finished request 8 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.144.1.98:4856, id=8, length=245 Sending Access-Reject of id 8 to 10.144.1.98 port 4856 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Access-Request packet from host 10.144.1.98:4858, id=0, length=206 Message-Authenticator = 0x84bbf500f51ef55f836a9d02b51b9ec4 Service-Type = Framed-User User-Name = "SUNCITI\\John" Framed-MTU = 1488 Called-Station-Id = "00-24-73-50-BC-00:SML" Calling-Station-Id = "1C-AF-F7-69-D9-0E" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020000110153554e434954495c4a6f686e NAS-IP-Address = 10.144.1.98 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "SUNCITI\John", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 0 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 9 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 9 modcall: leaving group authenticate (returns handled) for request 9 Sending Access-Challenge of id 0 to 10.144.1.98 port 4858 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x25c5a25f128cb79234a39a94d568049f Finished request 9 Going to the next request Waking up in 2 seconds... rad_recv: Access-Request packet from host 10.144.1.98:4858, id=1, length=287 Message-Authenticator = 0x7786e11bc108cadb68208de0b7782b48 Service-Type = Framed-User User-Name = "SUNCITI\\John" Framed-MTU = 1488 State = 0x25c5a25f128cb79234a39a94d568049f Called-Station-Id = "00-24-73-50-BC-00:SML" Calling-Station-Id = "1C-AF-F7-69-D9-0E" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201005019800000004616030100410100003d03014c7326e1ade72fa1567f7a01dbe24108c1e28a748612120241f1d08d41d79b2f00001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 10.144.1.98 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf === end of debug log === If the client manually disconnected from the AP, wait a few seconds, then re-connect again and it succeeded. I hope someone could point what went wrong, and how to solve the problem. Thanks a lot. John Mok

1 0

Freeradius and client certificate support
by Graham Leggett 30 Aug '10

30 Aug '10

Hi all, I would like to configure an access point to accept client certificates only, with no usernames and passwords. As a understand, what I am looking for is EAP-TLS, and I have attempted to configure it against a mikrotik routerboard. I see the radius packet entering the server, with the User-Name set to the MAC address of the incoming client (mikrotik default behaviour). My next step is to suitably configure freeradius to accept the login based on the attributes within the client certificate, and to accept any User-Name, however I can find no documentation how to do this. Ideally, I would like the effective freeradius login name to be the DN of the client certificate. Does anyone know whether this is possible, and if so, what I need to tell freeradius to make this happen? I am using freeradius-1.1.3-1.5.el5_4 (on an RHEL5 system). Regards, Graham --

2 9

questions about RADIUS-LDAP integrations
by matteo＠crs4.it 30 Aug '10

30 Aug '10

Hello list, I'm using freeradius since 1 month. I'm running freeradius 2.1.9 on fedora 13 with EAP-TTLS and PAP inside the tunnel. The users are authenticated against OpenLDAP. Even if the password is cleartext (PAP), it should be protected by the crypted tunnel. Then the first question is: Is this mechanism quite secure or do you suggest using another mechanism? If I'm not wrong, there should be two different methods to get authentication with LDAP as backend. The first is just pass the credentials to the ldap server and try to authenticate. The second is freeradius obtain the password from ldap, strip the header (i.e {crypt} ), take the first two characters of the salt and use it to crypt the password sent by the . If the two hash are the same, the user is authenticated. In this case wich is the best method and how the relevant files have to be modified? Should I modify also ldap.attmap? Thanks a lot. Matteo ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

Re: Re: FreeRADIUS VLAN Attributes per Certificate, not user.
by Бисер Миланов 30 Aug '10

30 Aug '10

Splendid, thank you. I assume the feature will be documented, right? > > You will need to install 2.1.10 for that, which will be released >sometime very soon. > > Alan DeKok. >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

FreeRADIUS VLAN Attributes per Certificate, not user.
by Бисер Миланов 30 Aug '10

30 Aug '10

Greeting all! With the "users" file you can add three attributes that the RADIUS server passes to a switch and the switch dynamically assigns a VLAN to the port. However, can this be done when the client is authenticated via a certificate? Where can I specify these three attributes for the ceritifcate? I'm on FreeRADIUS 2.1.x (x is most probably 3)

2 1

Re: Freeradius-Users Digest, Vol 64, Issue 114
by wlanmac 30 Aug '10

30 Aug '10

The JRadius libraries are released as LGPL. On Mon, 2010-08-30 at 12:00 +0200, > They don't wont that the final product under GPL. They don't wont to give > the code of the product release > > 2010/8/27 Marinko Tarlac <mangia81(a)gmail.com> > > > I agree :) > > > > > > On 8/27/2010 8:42 PM, Alan Buxey wrote: > > > >> ts a little ridiculous as a standpoint - what about if it > >> can give you a competitive edge? surely business is about profits > >> and returns to eg shareholders...not about some kneee jerk reaction to > >> software licencing models? > >> > >>

1 0

use freeRadius client to connect a java application
by Noura Kossentini 30 Aug '10

30 Aug '10

Hi, In our company it's forbidden to use products with GPL License. So I ca not use Jradius client to connect my client application to a radius server. Since that FreeRadius is distributed under BSD, it's allowed to me to use this library. My queqtion is can you help me on how can I connect and authenticate my java application to a radius server using FreeRadius client?? Thanks in advance Regards Noura

4 4