- Freeradius-Users - lists.freeradius.org

Request for opinion - central admin user server LDAP+FreeRADIUS
by Andres Kaaber 15 Aug '09

15 Aug '09

Hello all I'm assigned with a project to make a central admin user database for all kind of servers / devices you can imagine (routers, switches, firewalls, linux servers, windows servers, databases, etc.). The point is that when a news employee arrives you just make him a user in this database, maybe check which type of devices he can and all the devices are configured to authenticate users against this db. We have over 200 switches alone in our company so making user accounts in every single one of them and when this dude leaves to disable all of them is huge (or impossible) work. So I thought a linux server LDAP+FreeRADIUS for authentication sounds quick, easy and good solution, or not? There is no problem with servers Linux and Windows servers can authenticate against radius. Most popular DB -s can do this also (Oracle, MySQL, PostgresSQL). I don't know about Cisco switches and roters but as far I found in google there should be no problems the same goes for juniper devices. So what do you think? Or maybe you know a free software solution for this kind of problem already? Sun identity management is one that i checked out but it seems too bloated and complicated. So what are your thoughts? -- Andres Kaaber

5 5

radius.log with timestamp in filename
by RadiusGuy 15 Aug '09

15 Aug '09

Hi all, I'm using FreeRADIUS Version 2.0.4 and i would like to have timestamps within the filename of the radius.log, i.e. radius.log-20090804. For the other logfiles, like the detailfile, this is the default setting in the radiusd.conf: detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d In good faith I have tried the same thing with the radius.log... file = ${logdir}/radius.log-%Y%m%d but it didn't work. Freeradius then creates a logfile with the explicit name radius.log-%Y%m%d, but not with the timestamp of the actual day. Can anyone help? Thanks in advance! -- View this message in context: http://www.nabble.com/radius.log-with-timestamp-in-filename-tp24804436p2480… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

MSCHAP Authentication Issue
by Garber, Neal 15 Aug '09

15 Aug '09

I realize that this issue has been brought up many times in the past. However, I believe I have new information that I haven't seen reported before.. I'm having a problem with Windows XP supplicant authenticating to FR with PEAP/MSCHAPv2 where authentication fails "sometimes" depending upon various factors. The same device I'm using to test wireless authentication, never has an issue authenticating to my old dain-bramaged Cisco ACS servers. As a result, I decided to investigate what might be different about FreeRadius (perhaps Samba I thought, but didn't want to make assumptions). I don't profess to be an MS-CHAP expert, so what I'm about to say may be completely off-base.. After performing many tests (see below) and reviewing RFC2579 and the code in rlm_mschap.c, I'm hypothesizing that the problem is with how rlm_mschap calculates the challenge hash that is passed to ntlm_auth. Specifically, rlm_mschap uses the User-Name attribute as part of the calculation of the hash. What I'm finding is that, in some cases, the User-Name attribute doesn't match the case of the Name field in the MS-CHAP response (i.e., the userid is the same, it just differs in case). In the tests I've performed, when these userids don't match in case, I get a Logon Failure from ntlm_auth. I'd really like this to "just work" as is commonly said around these parts without additional gymnastics (such as changing all userids to lowercase). Does this seem like a plausible explanation for what's happening? If not, does anyone have any other ideas? I need to resolve this in order to retire two old and cranky (and fairly useless because they don't really do authorization) ACS servers! I'm going to try a change to rlm_mschap so it passes the Name field from the MS-CHAP response to the challenge_hash function (as opposed to the User-Name attribute) to see if that resolves the issue. I realize that ultimately it's Windows fault that it doesn't pass the userid with consistent case (i.e., Identity vs. MS-CHAP response); but, I don't want the ACS server to be seen as a better, more tolerant solution. So, it would be great to make FR more tolerant of this aberrant behaviour. Thanks in advance for any advice/help/suggestions you can provide.. Here's what I tested and what I observed that caused me to draw the above conclusion: Background: Windows XP SP3 laptop using std. Windows wireless supplicant EAP/PEAP/MS-CHAPv2 -> Cisco 1232AP -> FR 2.1.6 (with rlm_perl patch) running on FreeBSD 7.2. In all the tests below, the same SSID, wireless network configuration on the laptop, AP, userid and password were used (the domain and user listed below are contrived, but are representative of the case I saw in the debug output). Laptop Logon Method Wireless Credentials Passed Man/Auto MS-CHAP Response Packet Name field User-Name Request Attribute ntlm_auth Authentication Result Domain logon (via Ethernet) with all lowercase userid entered on gina Manually entered all lowercase userid when supplicant prompted MYDOMAIN\myuser MYDOMAIN\myuser SUCCESS Domain logon (via Ethernet) with all lowercase userid entered on gina Supplicant configured to auto. pass Windows credentials MYDOMAIN\MyuseR MYDOMAIN\myuser Logon failure (0xc000006d) Locally cached credentials (on laptop) with all lowercase userid entered on gina Manually entered all uppercase userid when supplicant prompted MYUSER MYUSER SUCCESS Locally cached credentials (on laptop) with all lowercase userid entered on gina Manually entered all lowercase userid when supplicant prompted myuser myuser SUCCESS Locally cached credentials (on laptop) with all lowercase userid entered on gina Supplicant configured to auto. pass Windows credentials MYDOMAIN\MyuseR MYDOMAIN\MyuseR SUCCESS

3 6

Authentication with Active Directory with CHAP Passwords
by Luiz Gustavo de Villa Scandelari 15 Aug '09

15 Aug '09

Hello everyone, I would like to receive some help on authentication with AD using CHAP Passwords. I´ve already configured the radius (v 2.1.6) to authenticate in the AD (Microsoft) using LDAP and clear-text passwords, until now it works perfectly, but in the radius debug appear the following message: rad_recv: Access-Request packet from host 192.168.0.100 port 64871, id=7, length=50 User-Name = "1000700025" User-Password = "123456" +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "1000700025", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ldap] performing user authorization for 1000700025 [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=1000700025) [ldap] expand: dc=pedagogico,dc=net -> dc=pedagogico,dc=net rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 172.17.16.4:389, authentication 0 rlm_ldap: bind as wni@pedagogico.net/wni@2009 to 172.17.16.4:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=pedagogico,dc=net, with filter (sAMAccountName=1000700025) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... è WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? ç [ldap] Setting Auth-Type = LDAP [ldap] user 1000700025 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = LDAP +- entering group LDAP {...} [ldap] login attempt by "1000700025" with password "123456" [ldap] user DN: CN=LUIZ RICARDO DE VILLA SCANDELARI,OU=Users,OU=UNIFAE,OU=Users and Computers,DC=PEDAGOGICO,DC=NET rlm_ldap: (re)connect to 172.17.16.4:389, authentication 1 rlm_ldap: bind as CN=LUIZ RICARDO DE VILLA SCANDELARI,OU=Users,OU=UNIFAE,OU=Users and Computers,DC=PEDAGOGICO,DC=NET/123456 to 172.17.16.4:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldap] user 1000700025 authenticated succesfully ++[ldap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 7 to 192.168.0.100 port 64871 Finished request 0. I suppose that happens because I cannot read the AD user password, right? The important is that works with LDAP authentication. The problem is that I have a system that sends Access-Requests with Username and CHAP-Passwords (CoovaChilli), so radius authorize the user but cannot authenticate it. I´ve already read the Allan´s webpage (http://deployingradius.com/documents/configuration/active_directory.html) about integration of AD and RADIUS but I still have some questions. Can I use CHAP with SAMBA ntlm_auth method or should i need to change the password encryption to another protocol such as PAP or MS-CHAP? If I modify the coovachilli to send PAP passwords, am I going to be able to use ldap for authorization and authentication or do I need just plain? I hope somebody can help me. Thanks, LUIZ GUSTAVO SCANDELARI Skype: luiz.gustavo.wni

2 1

PEAP / mschapv2 Error Messages
by Michael Bryant 14 Aug '09

14 Aug '09

Hi, Using the default eap/peap & inner-tunnel configuration, a failure gives rise to this: Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled How can I take that MS-Chap-Error attribute and pass it back in the final access-reject, as a Reply-Message attribute for example. Cheers --Mike

5 5

Problem with MAC authorization..(again)
by Sunardo Panjaitan 14 Aug '09

14 Aug '09

i'm sos sorry to ask again.. This problem 've already discussed in FreeRadius MAC address authorization (http://lists.cistron.nl/pipermail/freeradius-users/2008-August/msg00155.html) I'm using Fedora core 6, freeRadius 2.1.3 (installed from source code tarball)And use linksys WAP4400 as Access Point. i got guide from http://wiki.freeradius.org/Mac-Auth.... this is my configuration raddb/policy.conf rewrite_calling_station_id { if("%{request:Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i){ update request { Calling-Station-Id := "%{1}%{2}%{3}%{4}%{5}%{6}" } } else { noop } } raddb/client.conf client 10.1.0.6 { secret = testing123 nastype = other shortname = tk03 } client 10.1.0.0/24 { # # secret and password are mapped through the "secrets" file. secret = testing123 nastype = other shortname = tk03 } client silimbat.win2k.del.ac.id{ secret = testing123 shortname = tk03 } raddb/modules/mschap Ganti nilai use_mppe = no menjadi use_mppe = yes. Uncomment require_encryption = yes dan require_strong = yes. mschap { use_mppe = yes require_encryption = yes require_strong = yes } raddb/modules/file # files authorized_macs files { # The default key attribute to use for matches. The content # of this attribute is used to match the "name" of the # entry. key = "%{Calling-Station-ID}" usersfile = ${confdir}/authorized_macs # If you want to use the old Cistron 'users' file # with FreeRADIUS, you should change the next line # to 'compat = cistron'. You can the copy your 'users' # file from Cistron. compat = no } raddb/sites-available/default authorize{} # # (Optional) May help if your NAS doesn't let you specify separators for the User-Name value # #rewrite_calling_station_id # # Machine (Calling-Station-ID based) authentication # # RFC 2865 says that a Service-Type value of Call Check is used # to specify this kind of authentication (though were now dealing with ethernet ports instead of lines). # if(Service-Type == 'Call-Check'){ update control { Auth-Type = 'CSID' } } raddb/sites-available/default authenticate{} # # Authentication based on Calling-Station-ID # # Calling-Station-ID authentication is usually done by comparing normalised # forms of the Calling-Station-ID and User-name fields. # Auth-Type CSID { if(User-Name =~ /^%{Calling-Station-ID}$/i){ # # Optionally a CHAP-Password attribute is included which is # md5(ChapID + Calling-Station-ID + Request Authenticator). # if(Chap-Password){ update control { Cleartext-Password := "%{User-Name}" } chap } else{ ok } } else{ reject } } raddb/sites-available/default post-auth{} if("%{control:Auth-Type}" == 'CSID'){ # Authorization happens here authorized_macs.authorize if(notfound){ reject } } raddb/authorized_macs # MAC_address Auth-Type 00-1C-BF-10-EA-34 Auth-Type := Accept 00-1E-E5-9D-64-32 Auth-Type := Accept 00-1D-E0-5E-E2-3B Auth-Type := Accept 00-1B-9E-32-E4-DE Auth-Type := Accept This the output of radiusd -X : rad_recv: Access-Request packet from host 10.1.0.6 port 1024, id=5, length=139 NAS-IP-Address = 10.1.0.6 NAS-Port = 0 Called-Station-Id = "00-1E-E5-9D-64-B1:TK_03" Calling-Station-Id = "00-1B-9E-32-E4-DE" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201000501 Message-Authenticator = 0x60827fcdaecda43af294e5ad9cc9fc5e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Proxy reply, or no User-Name. Ignoring. ++[suffix] returns ok [eap] EAP packet type response id 1 length 5 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns noop [files] expand: %{Calling-Station-ID} -> 00-1B-9E-32-E4-DE [files] users: Matched entry 00-1B-9E-32-E4-DE at line 4 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [<no User-Name attribute>/<via Auth-Type = Accept>] (from client tk03 port 0 cli 00-1B-9E-32-E4-DE) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 5 to 10.1.0.6 port 1024 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 5 with timestamp +23 But the client can't connect.Anybody can help me???

3 2

ERROR 734
by Danie J. Steenkamp 14 Aug '09

14 Aug '09

Hi, I have loaded Freeradius 2.1.6 on a Centos 5.3 server with Mysql. The server is responding perfectly to any Authentication. >From a Windows XP it connects, verifies the username, password & Calling-Station-ID. It then immediately disconnects with Error 734: The PPP link control protocol was terminated. In the log on the Radius server it shows that the connection was OK: Thu Aug 13 09:40:39 2009 : Auth: Login OK: [Danie1234/xxxx] (from client MTN-RB-J20 port 24329888 cli 27XXXXXXXXX) Using NTRadPING, authentication is successful. However, using "Accounting Start" on NTRadPING it sends the accounting packet through to the server and can clearly be seen when using debug mode: "rad_recv: Accounting-Request packet from host 10.18.205.5 port 4923, id=4, length=56 User-Name = "Danie1234" Acct-Status-Type = Start Acct-Session-Id = "2120" Calling-Station-Id = "27833873873" Finished request 5." NTRadPING reports back that there is no response from the server. Under Listen in radiusd.conf I have the following: listen { ipaddr = * port = 1813 type = acct } Under site-enabled/default I have the following: accouting { detail sql } I will appreciate any help in solving this issue. __________ Information from ESET NOD32 Antivirus, version of virus signature database 4314 (20090807) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com (GAAP DISCLAIMER) The above message and all attachments may contain privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from your computer. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the view of the entity transmitting the message. UCS Group Limited and all of its subsidiary companies hereby distance themselves from and accept no liability in respect of the unauthorised use of its e-mail facility or the sending of e-mail communications for other than strictly business purposes. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 5

how i can match the number that is calling to me
by Magui 14 Aug '09

14 Aug '09

Hello I am new with freeradius ,I wan to know if is posible to restrict an acces to the network using the telelephon number of who is calling for the acces to the network by the ppp conection How I can use radius for match user password and telephone number combination as conditions for acces to my network I will be very grateful if somebody can help me -- Este mensaje le ha llegado mediante el servicio de correo electronico que ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema Nacional de Salud. La persona que envia este correo asume el compromiso de usar el servicio a tales fines y cumplir con las regulaciones establecidas Infomed: http://www.sld.cu/

1 0

MS-CHAP cannot login
by Sanhenra Sinaga 13 Aug '09

13 Aug '09

Dear all, I have configure freeradius with MSCHAP but, access point cannot connect Can someone help me please? w.regards, sanhenra FreeRADIUS Version 2.1.3, for host i686-pc-linux-gnu, built on Aug 7 2009 at 00:48:57 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.1.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "tk03" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = no require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. rad_recv: Access-Request packet from host 10.1.0.6 port 1026, id=0, length=177 User-Name = "anonymous(a)myabc.com" NAS-IP-Address = 10.1.0.6 NAS-Port = 0 Called-Station-Id = "00-1E-E5-9D-64-B1:TK_03" Calling-Station-Id = "00-19-D2-70-08-2B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001801616e6f6e796d6f7573406d796162632e636f6d Message-Authenticator = 0x110e4163a62ce3abf65b337f2e05cbd4 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] Looking up realm "myabc.com" for User-Name = "user" [suffix] No such realm "myabc.com" ++[suffix] returns noop [eap] EAP packet type response id 0 length 24 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 10.1.0.6 port 1026 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8d84cdac8d85d49d7d142920e89fc0d6 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.0.6 port 1026, id=1, length=273 User-Name = "anonymous(a)myabc.com" NAS-IP-Address = 10.1.0.6 NAS-Port = 0 Called-Station-Id = "00-1E-E5-9D-64-B1:TK_03" Calling-Station-Id = "00-19-D2-70-08-2B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100661900160301005b0100005703014a839a34df0167a8634667662e83cfe285386fe662fbfd6c5649649633e7a4a600003000390038003500160013000a00330032002f0066000500040065006400630062006000150012000900140011000800030100 State = 0x8d84cdac8d85d49d7d142920e89fc0d6 Message-Authenticator = 0xbdc03befd1b9693416b2d8af238f6150 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] Looking up realm "myabc.com" for User-Name = "user" [suffix] No such realm "myabc.com" ++[suffix] returns noop [eap] EAP packet type response id 1 length 102 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005b], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 1 to 10.1.0.6 port 1026 EAP-Message = 0x0102040019c000000aad160301002a0200002603014a7c61bdb86192b4665e77116f9d70d6d63a69e6b029fe8b25600b4088c9be7d00003900160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303830373135333033385a170d3130303830373135333033385a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100f4f7554d96b68c28d08f20fe8c4aeaf485901add31d376b60614fc6d199a39417b511fb646ab99ab98092dabf42032664808e5176fdac33c9a6d80ce969d EAP-Message = 0x8b8cd4722c5b285b6c7010acd41448a9f67e40e0874653a5d9bc6a293f936c8571b16710ff8167c14d696c50f70ab5b347455d4ade920dc72a171e226f8a28c2c37bad8263570733029466c88046e725aa3b1dd2fadc03ca0b0f66d834abdbe48808169bbff4dc21ec6803cad76a1f60cc2af2b54980c490a3bf66fca712bb7dbdc3cd9b27c959d6ec9e015eac3f004825338d0d649dd6c0da4dd01c524b890e80e4104b30a5eca858da534a136320f2eb1d347caf9156b9c209985e17136268df690203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003820101003f3cd0e7cffdead4da EAP-Message = 0x7bc82ad0d3b816bee2345d836bc4b50553b0dc71fb7a08aab0c29a2b5fc16d2fdbb68b57bb43007100d7680ef3f1e122aa8e895a42061870966b0c9a62c8a81b8b6b6173f0b23a0b700b360ad23765a3ca9e10266a8da89c7c44db360154cc6ad88cfc59ab7633695fec225e75f3e4f3a85bd8ec9d3d580d9c9a176f4b150e42b2890e2d61365fd14f749ae60f530859deadd761785421feef0b7464365cf7792cfd6da1cbaeb44529559b096a683cc0cf784c623a83c5bf2454fca6bc9fb09e1ccf98a165b7cc7a3e3ccbd87f21a08462a3531bcd23d330d2d86f67e59a3e5b1410a5d9869703ff317f8f6710c447a2cbf40007d324030004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8d84cdac8c86d49d7d142920e89fc0d6 Finished request 1. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.0.6 port 1026, id=2, length=177 User-Name = "anonymous(a)myabc.com" NAS-IP-Address = 10.1.0.6 NAS-Port = 0 Called-Station-Id = "00-1E-E5-9D-64-B1:TK_03" Calling-Station-Id = "00-19-D2-70-08-2B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200061900 State = 0x8d84cdac8c86d49d7d142920e89fc0d6 Message-Authenticator = 0xaf1d69f5dcafbd63b81a62ca05b78514 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] Looking up realm "myabc.com" for User-Name = "user" [suffix] No such realm "myabc.com" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to 10.1.0.6 port 1026 EAP-Message = 0x010303fc194000b9fd1ba4bb10bece300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303830373135323931365a170d3130303830373135323931365a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100e6802b0a258ceb479d70667cb1479725d5a642f2762669cb02bde1279df272527a685a01a7b507abe05d0eb637ac7d98dde9bf95b86b5510d233f11467f96d906c864e8a0b6a583a3fe6779198aa431cc40f5aa72b1d9e28ba20351895ea53fb1561399ede30aaa276b5075ece9b2a EAP-Message = 0xf174b9155e9fd2c4126b59583c8b3b6e6f83ef15555971669d352c8c0ddd86a00b187019ec68db2314b6c5ebf3b9275293a39386ae2dbe252837d1b865568918ca3d6deed78807b4933a60309cd9fe2948fca1be4b152685328caf6787caa45b3300789f11111e166bf765fa77501b1db616f665bd8d7d6b19a6f25f7b62d99a4c173ba82bd92879e0c0975494feb770f10203010001a381fb3081f8301d0603551d0e041604145f7337d65e14639cff59e73d837c59af9e4420833081c80603551d230481c03081bd80145f7337d65e14639cff59e73d837c59af9e442083a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900b9fd1ba4bb10bece300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100c14f22a918fef7588d3498336eda0d13b0302858ed33e6a67a82d077bf449864da9028f246a41cfb80564b08d3560160aa0c0cfe63531d181026475145129cf15e77093dc9654a263e24ead865e32b6a9fe0 EAP-Message = 0xb9274f65eec7e2df Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8d84cdac8f87d49d7d142920e89fc0d6 Finished request 2. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.0.6 port 1026, id=3, length=177 User-Name = "anonymous(a)myabc.com" NAS-IP-Address = 10.1.0.6 NAS-Port = 0 Called-Station-Id = "00-1E-E5-9D-64-B1:TK_03" Calling-Station-Id = "00-19-D2-70-08-2B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0x8d84cdac8f87d49d7d142920e89fc0d6 Message-Authenticator = 0xfcb3ad5d3cd92cea16a30413df67748a +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] Looking up realm "myabc.com" for User-Name = "user" [suffix] No such realm "myabc.com" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 3 to 10.1.0.6 port 1026 EAP-Message = 0x010402c719005150f237184e6fa1c6141a1ce4d69263b3ae49314836f58f9314a93a4e3e27c1f609b499bc5820f6b49f389d3458700083201dffaba83a15803ed755d15e95386eb34b3dacb87b1de51abcd53a9ff5b91827d87b77f02bd97a41b8d5c687854dc11dda9dca985758821843a088797cc25a65ca4834afd5d414d497372886e0e1ae089119f8fd4f6a3e9e39a8536aab8648b935709054546ddd6f6c2593cb4ea809258d6a4a2d160301020d0c0002090080a223f662135e788597859fda12d27e93466cfa2c637aa1006994a051e671701ca34d895f3d9863a75cb986c48597a7e2c3db9cc3a80238573c0e0fd59aec1174530932693b59 EAP-Message = 0xd734d1526eedefcd40e3ccb7f4195f273cb1251df59434a21a80c70f63475e57ddbc4ff2c6f05a66a170f6c7026a126c8c1fe4cc3364b75369f3000102008055452bdcabc92319551c3b20fb2e5c08384335e73076630e571f864bf1d7af1c2015bdc01e1e0a27b789ce10eab86f9ca8c43c80d20d1a5fee04197142bf2d82634fd4437b0ef6aaddaa30ef5d6a316769b85b248b58510167320b974b5c587f7850d169dae4accfb99a0ffc9911fa9fb9e8ac3b11cba3d93e8308b9c1606142010098fe473014df2531224ff78bb4eaaa67cc18ebb338bf2261e2a92e33899f7301683c04861be050705db6657aa7a425079cb1badab308147cd464cd2c EAP-Message = 0x509c8560ddd977adc6a1656de5d9eaac11a6ade86886394b37a4d2b8ce2b28006380e201219433f560414e50edbb417f8d39676e871aceb34752f6694f2b63ebed5bb5ea307a5d40cb630f0cd81aa7d671823fdfba795dffff6f9c568070feec72d605181d758edd6c12a43ddeebd1ba1e90328b9117597e8af2717bbf8609ee6c9625a8aa769d654b65767816e998fd25dd2cb7c6b40bb358c3a132b0287ef3a2c88f27f61ed2a572524ecd3eaefd076ffcfbdd3824c590d84fec1c021bd26b6c84925f16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8d84cdac8e80d49d7d142920e89fc0d6 Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.0.6 port 1026, id=4, length=184 User-Name = "anonymous(a)myabc.com" NAS-IP-Address = 10.1.0.6 NAS-Port = 0 Called-Station-Id = "00-1E-E5-9D-64-B1:TK_03" Calling-Station-Id = "00-19-D2-70-08-2B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0204000d19001503010002022a State = 0x8d84cdac8e80d49d7d142920e89fc0d6 Message-Authenticator = 0x42af6cb33ca2efc174909d180290b109 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] Looking up realm "myabc.com" for User-Name = "user" [suffix] No such realm "myabc.com" ++[suffix] returns noop [eap] EAP packet type response id 4 length 13 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.8 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 4 to 10.1.0.6 port 1026 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. Cleaning up request 0 ID 0 with timestamp +5462 Waking up in 0.1 seconds. Cleaning up request 1 ID 1 with timestamp +5462 Cleaning up request 2 ID 2 with timestamp +5462 Cleaning up request 3 ID 3 with timestamp +5462 Waking up in 1.0 seconds. Cleaning up request 4 ID 4 with timestamp +5462 Ready to process requests.

3 2

Problem configuring CoA
by DILLIOTT Tony 13 Aug '09

13 Aug '09

Hi * I am trying to get COA server running with 2.1.6. After downloading and successfully installing on Redhat Linux setup, I have not been able to get COA to work at all. After a lot of investigation, I have found a discrepency with the clients.conf file in the tar file I downloaded in 2.1.6 and a version I see on the -net. Specifically, the following lines are missing from the file in the tar file compared to an example I found on the web: # A pointer to the "home_server_pool" OR a "home_server" # section that contains the CoA configuration for this # client. For an example of a coa home server or pool, # see raddb/sites-available/originate-coa # coa_server = coa } After going through the C source code I see that this missing coa_server pointer is in fact referenced in the source code. I have now added this, but still I have issues. I originally commented out the coa pool because I don't want pools for now. SO, my problem is that even after adding the following line to my clients.conf file to match the pointer file to the example host_server config in originate-coa file,: coa_server = localhost-coa I still get the following error when I run radiusd -Xx : /usr/local/etc/raddb/clients.conf[30]: No such home_server or home_server_pool "localhost-coa" So now I uncomment the stuff to do the coa pool, and now I get the following debug output ### Loading Realms and Home Servers ###### : proxy server { [stuff] } home_server localhost { [stuff] } home_server_pool my_auth_failover { [stuff] } realm example.com { [stuff] } realm LOCAL { } /usr/local/etc/raddb/site-enabled/originate-coa[121]: home_server "localhost-coa" does not exist. Given the file discrepency I have already uncovered, I assume I must be missing something else but I cannot find out what. I appreciate any help as soon as possible. thanks. tony

3 5