- Freeradius-Users - lists.freeradius.org

Windows XP SP2 and SP3 EAP problem part #2
by Balgansuren Batsukh 23 May '09

23 May '09

Hello, I described problem previous email. Please find attached Linksys only debug information. 1.Linksys ======== . . . rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=0, length=176 Message-Authenticator = 0x09f3d899800a95c2a2d21b4f2e627112 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020000090174657374 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sending Access-Challenge of id 0 to 10.0.1.254 port 1076 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a0a4be65b7c70cf134208ef5 Sat May 23 06:08:18 2009 : Info: Finished request 55. Sat May 23 06:08:18 2009 : Debug: Going to the next request Sat May 23 06:08:18 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=1, length=297 Message-Authenticator = 0xcf9d263efbdfb5ab9d56e8cc7ec47b7d Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a0a4be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201007019800000006616030100610100005d03014a17224d977e6fe8bb7128bc74538c018dd274e628a268fe0a4b441267a52e7c00003600390038003500160013000a00330032002f0007006600050004006300620061001500120009006500640060001400110008000600030100 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sending Access-Challenge of id 1 to 10.0.1.254 port 1076 EAP-Message = 0x0102040019c000000a67160301002a0200002603014a1722524c9da49788a4d7f63597495a7101f5d24238247830bd681e7d5d3e670000390016030108180b0008140008110003903082038c30820274a003020102020101300d06092a864886f70d0101040500308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a864886f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f72697479301e170d303930353232303131353138 EAP-Message = 0x5a170d3130303532323031313531385a3076310b3009060355040613024d4e310b30090603550408130255423111300f060355040a1308486f6d656e65742e312630240603550403131d54736572656e646f726a20536572766572204365727469666963617465311f301d06092a864886f70d010901161074736565656b407961686f6f2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d307b83ea71ed1c6ee8867dd355590ec1e9d04b2301d284eddf4983dd53bcd1fcc7d219fbacb9deb9ae5f64f1a2d660a15c7ffc995c6a9462a840d452c13676e68ebb427f3f8d4ccbb1141fdb9a6ac9d8027d17b EAP-Message = 0xfe2e02e865530ad0e174d309e79164ce2ab8df0a7c676155022f298a0014bab98b68e23a06cf939d9c6b53fab8cb7b123df2b751a700ae1b12129cd05dcc6110c8b89f9b467142874b7249ae442d1680700f96ea69f511c388f198869375b1e86af0e4320dc81e6ec5dfa88817fef561b6c69561e6200412327b72d5915c9c292eaa2f4914c0ca4a102bd1ba198aa3224e20e8c635f9b4131042955409ab565377e64b005bf7ffd6db0af64f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010015a7d2ade3e88c984c89476f7823e6e178e82374fb9716b8aaae950f1d2040 EAP-Message = 0xca57298fb83500fed0f2c3f575f86cf242cc938cac77017fd0363d7e66618fc097b2221633733ab7e6ca92c5b02a455ef00820b642cfc955226e708f237981d52f4d25f5dbe60d094a22cdc32b2d09cfa4f4f959af0487552edf4835d20109016bbde20a5b79ab4cdc124ad0d6eb269cc6b2409f7f7c7221c6f03593032d7417d946af889568ca0ac8ee94786b8e8046a7e1e2fd93e1256dc4ed5cd62282b6f2cf02c0d5875867f2869c002bac9f7a6ef27e313e44492c04faa7d320ffe47d21e46b179945379d2834b9f23d8391fc44511ab29cb87950aca10042e2ba48fd3e9c00047b308204773082035fa0030201020209008b45c0e25d2e249a30 EAP-Message = 0x0d06092a864886f70d010105 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a1a7be65b7c70cf134208ef5 Sat May 23 06:08:18 2009 : Info: Finished request 56. Sat May 23 06:08:18 2009 : Debug: Going to the next request Sat May 23 06:08:18 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=2, length=191 Message-Authenticator = 0x4dbbc0fe7dca23743b20d9a862ccf0a0 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a1a7be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sending Access-Challenge of id 2 to 10.0.1.254 port 1076 EAP-Message = 0x010303fc19400500308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a864886f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f72697479301e170d3039303532323031313530345a170d3130303532323031313530345a308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a8648 EAP-Message = 0x86f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100f5a581f6620f0dc9f19e0eb69943d39130695d3ac1cb6ce54907a7c67f6a0dcc674e78bf6fb8167ea02010a34035f5ba9ab8e5c494e49cf1d907db59e4e178dcb8e858cc2bd488f90a7339ea1526cd187b4eee2e4fdf6d121d1b49921fb8c7b17e11f89ae43e1179874cfbaba3407dfeea6b8ff0698b8dcfbd38ca6236bf1bff2e5fbe46d408b7f14cd35caa7ed972abf3f5ee12d07cd464fcecde6a475188b0e692dfad59 EAP-Message = 0xf670d03d01a26a8d469a6578ac0a59843565e53b2bc145919c3fef40c0e693645c644f50111f489d8115bf19af99a870c42ef8f0bea4df4e2b334460f6925eb73aff6c4ad2e4a9219005f57df0b5452229e337f2ef420d7c8dce8b0203010001a381eb3081e8301d0603551d0e041604140692c35ad5374aa0aca7a7407f0d255ed0719d303081b80603551d230481b03081ad80140692c35ad5374aa0aca7a7407f0d255ed0719d30a18189a48186308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a86 EAP-Message = 0x4886f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f726974798209008b45c0e25d2e249a300c0603551d13040530030101ff300d06092a864886f70d010105050003820101007675cc71a220f326022857ac3670dd7540d9159c200dff570f331034e690b1418f2444083524b298ee48192da8f172a324574953c06149e4cb94dd89a2142e621d6ffafb7a815fbb417112fcd4ab2a0ed4645407be28896a6ba6b22cd7389ba79420ea233305c88be323a9e122761b27f747119a35714822d0b4ae66c3d7ecceb0594fe9c830de22a08a8b05cda84cc1b5c792089a309014 EAP-Message = 0xe78e4d77cbec2fb9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a2a6be65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 57. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=3, length=191 Message-Authenticator = 0xfda5026403bab578a19ced16bfb4ca06 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a2a6be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300061900 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 3 length 6 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Info: [peap] Received TLS ACK Sat May 23 06:08:19 2009 : Info: [peap] ACK handshake fragment handler Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 1 Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 13 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_HANDLED Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 3 to 10.0.1.254 port 1076 EAP-Message = 0x010402811900dffe3ea966d2f1d6b3f53ff8d7aca3209d32404ff2ea681dfe4e453405f0b9de3eee8c146c2e3ba3dcae73743550c267bc22ca8c9cb6da0d1b78606e707f17f535a4fda33aa48734e794b5e8c345dbe48a9715de963d83ae51473edcafff79bf160301020d0c0002090080c8659d434cd62c0eaec8d1eaef67094fc7dd52c72dc7e38e55ad4d74d9f14735cd89c320acef6ce8c251a50e943f4e92727f9f34bd997db7c16d1785e8b25d750946d21dae73209f0e41991b36edb184e1e3c475b9fbacab20ff57693c64007781193881c119dcee954c563c5e032929289a129de77e748167d2afd7982af81b000102008088a93c29af03b5 EAP-Message = 0x5fc69caa012ef601c99b04c0672b22de6742aadecbf90cffe8e72a8052520debf89eb6cd8670a01f24f744663c24a2542f6760179db8707c675018a7705fd89056403a5bd856f61a8e9d180866cb4320c3dccfff6efc269c09cca5a525c6216f2aa6708fe9c8bc2ce58583f492af5d9448665b22af5b298237010027fe410d157789a34a6cc996af6047db475d5bebfceb9072e29e95397474334b6b67d8621fedcefc52683efb363faf096749d20218cf92c08aa558e874782c9b9e199e274eb9b2eae0d9b6a407bf01a5acef8ae7161cb3736839567b3cc6b3729a5ce4b98447230fde4ed918f9e9b2028f0f414ba0887f748936e6f2181e73618ce5 EAP-Message = 0xb74090f454843a8d02d6a9a7ce694c91cd8d3f7f6bf965d5dca7ac9170a50c2d67e0ba8576b73d2fc9d6d1334998b14b35c0aa4773e2e1f3df4d4e14c0cfa9892dfed0f4fee4dbd560d8f17754af49b93f49b37179109914e794073a19a4f2d2381c269aae135e089f898d558f9246c1be2a5d0cf827201eb9872293417b16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a3a1be65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 58. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=4, length=393 Message-Authenticator = 0xc3dbc64530ddfbf01b82be637c015e3e Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a3a1be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400d01980000000c616030100861000008200803c767a3bed3fa96f9349bab37ac44b5db38abeda92b001fe54413b595317420c1f681027b921a78213f080ef59a208541ee5f780b2606acae7bb215bb7c483063a15271ddf202abbe73d3bda20d5dfb82277821f8f625c9c20e1cea7d21b23a32536dd5abffcb1aabf61cfc383d03d881847338bd7075f5f9ab02980ab2fc6051403010001011603010030b0b61396697f5ee1d3de6866e00912a6fbd0d339d13218b5661affca34fed8c08b17970c93036f1677ab3e5e55e88af9 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 4 length 208 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Debug: TLS Length 198 Sat May 23 06:08:19 2009 : Info: [peap] Length Included Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 11 Sat May 23 06:08:19 2009 : Info: [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange Sat May 23 06:08:19 2009 : Info: [peap] TLS_accept: SSLv3 read client key exchange A Sat May 23 06:08:19 2009 : Info: [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] Sat May 23 06:08:19 2009 : Info: [peap] <<< TLS 1.0 Handshake [length 0010], Finished Sat May 23 06:08:19 2009 : Info: [peap] TLS_accept: SSLv3 read finished A Sat May 23 06:08:19 2009 : Info: [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] Sat May 23 06:08:19 2009 : Info: [peap] TLS_accept: SSLv3 write change cipher spec A Sat May 23 06:08:19 2009 : Info: [peap] >>> TLS 1.0 Handshake [length 0010], Finished Sat May 23 06:08:19 2009 : Info: [peap] TLS_accept: SSLv3 write finished A Sat May 23 06:08:19 2009 : Info: [peap] TLS_accept: SSLv3 flush data Sat May 23 06:08:19 2009 : Info: [peap] (other): SSL negotiation finished successfully Sat May 23 06:08:19 2009 : Debug: SSL Connection Established Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 13 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_HANDLED Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 4 to 10.0.1.254 port 1076 EAP-Message = 0x0105004119001403010001011603010030d14fffc16a5e0f7ba751a28eea1437de326ad1de3376133498aad572a5a52f4e9ef40b2ecae959253f8d6c3a811bf528 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a4a0be65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 59. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.2 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=5, length=191 Message-Authenticator = 0x81bcaeac15608ae8414a0b28c31dcba6 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a4a0be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020500061900 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 5 length 6 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Info: [peap] Received TLS ACK Sat May 23 06:08:19 2009 : Info: [peap] ACK handshake is finished Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 3 Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 3 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_SUCCESS Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 5 to 10.0.1.254 port 1076 EAP-Message = 0x0106002b190017030100205765bd754394302906d7c5624244577db1c773bf6abb0da3dffcf7a11364c46c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a5a3be65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 60. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.2 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=6, length=265 Message-Authenticator = 0x87072a36bbcda8c50e9e7f0b602aa9d6 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a5a3be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0206005019001703010020529fd268b46c8afb5e648ce6a6aaa6927f8d8d55c1f63a091da6dfe631d717491703010020716f10f05b5a400b73c2a7fc8df3e15e905a78d6e3ab16f2681b1827456051a9 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 6 length 80 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 7 Sat May 23 06:08:19 2009 : Info: [peap] Done initial handshake Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 7 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_OK Sat May 23 06:08:19 2009 : Info: [peap] Session established. Decoding tunneled attributes. Sat May 23 06:08:19 2009 : Info: [peap] Identity - test Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled request EAP-Message = 0x020600090174657374 server { Sat May 23 06:08:19 2009 : Debug: PEAP: Got tunneled identity of test Sat May 23 06:08:19 2009 : Debug: PEAP: Setting default EAP type for tunneled EAP session. Sat May 23 06:08:19 2009 : Debug: PEAP: Setting User-Name to test Sending tunneled request EAP-Message = 0x020600090174657374 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test" server { Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 6 length 9 Sat May 23 06:08:19 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat May 23 06:08:19 2009 : Info: ++[eap] returns updated Sat May 23 06:08:19 2009 : Info: ++[unix] returns notfound Sat May 23 06:08:19 2009 : Info: [files] users: Matched entry test at line 206 Sat May 23 06:08:19 2009 : Info: ++[files] returns ok Sat May 23 06:08:19 2009 : Info: ++[expiration] returns noop Sat May 23 06:08:19 2009 : Info: ++[logintime] returns noop Sat May 23 06:08:19 2009 : Info: [pap] Found existing Auth-Type, not changing it. Sat May 23 06:08:19 2009 : Info: ++[pap] returns noop Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] EAP Identity Sat May 23 06:08:19 2009 : Info: [eap] processing type mschapv2 Sat May 23 06:08:19 2009 : Debug: rlm_eap_mschapv2: Issuing Challenge Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled } # server Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled reply code 11 EAP-Message = 0x0107001e1a01070019105f46841a680c134eddbe469043e1685174657374 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e30cf7b0e37d5e801a16cd8c930d971 Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0107001e1a01070019105f46841a680c134eddbe469043e1685174657374 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e30cf7b0e37d5e801a16cd8c930d971 Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled Access-Challenge Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 6 to 10.0.1.254 port 1076 EAP-Message = 0x0107003b19001703010030e809ae694f14c8efbd16e0d03b4c55cbf81f3243b615a861b4523023daaed42cd0dd3d640345670b99ed665cba080847 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a6a2be65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 61. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=7, length=313 Message-Authenticator = 0xa3dfa44b322c9de16003e32d951586e3 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a6a2be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0207008019001703010020df2362ed683aee9de5839bc43dfc36437f17cd3bba1672507087fe1f40c3a56f1703010050e584e37541e957f87c03300682884fd5cce115d8d84e7f654fdb97c35b2b09bf394e7b7ae815d8c6915a0aebdbb7cc081ef0c81c72f3779903ae486c58edb6288709ebdc48101909aa03f9ea6dc2d2b3 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 7 length 128 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 7 Sat May 23 06:08:19 2009 : Info: [peap] Done initial handshake Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 7 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_OK Sat May 23 06:08:19 2009 : Info: [peap] Session established. Decoding tunneled attributes. Sat May 23 06:08:19 2009 : Info: [peap] EAP type mschapv2 Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled request EAP-Message = 0x0207003f1a0207003a3191cc1a9946c6cfba2be8580af0c5cf500000000000000000afb10f6969c8a441a65674cb1b11bf2dd60e1b11800a2ac20074657374 server { Sat May 23 06:08:19 2009 : Debug: PEAP: Setting User-Name to test Sending tunneled request EAP-Message = 0x0207003f1a0207003a3191cc1a9946c6cfba2be8580af0c5cf500000000000000000afb10f6969c8a441a65674cb1b11bf2dd60e1b11800a2ac20074657374 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test" State = 0x0e30cf7b0e37d5e801a16cd8c930d971 server { Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 7 length 63 Sat May 23 06:08:19 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat May 23 06:08:19 2009 : Info: ++[eap] returns updated Sat May 23 06:08:19 2009 : Info: ++[unix] returns notfound Sat May 23 06:08:19 2009 : Info: [files] users: Matched entry test at line 206 Sat May 23 06:08:19 2009 : Info: ++[files] returns ok Sat May 23 06:08:19 2009 : Info: ++[expiration] returns noop Sat May 23 06:08:19 2009 : Info: ++[logintime] returns noop Sat May 23 06:08:19 2009 : Info: [pap] Found existing Auth-Type, not changing it. Sat May 23 06:08:19 2009 : Info: ++[pap] returns noop Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/mschapv2 Sat May 23 06:08:19 2009 : Info: [eap] processing type mschapv2 Sat May 23 06:08:19 2009 : Info: [mschapv2] +- entering group MS-CHAP {...} Sat May 23 06:08:19 2009 : Info: [mschap] Told to do MS-CHAPv2 for test with NT-Password Sat May 23 06:08:19 2009 : Info: [mschap] adding MS-CHAPv2 MPPE keys Sat May 23 06:08:19 2009 : Info: ++[mschap] returns ok Sat May 23 06:08:19 2009 : Debug: MSCHAP Success Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled } # server Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled reply code 11 EAP-Message = 0x010800331a0307002e533d38344635463445433735394531344635423138394545443141303541323245304139413446443439 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e30cf7b0f38d5e801a16cd8c930d971 Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d38344635463445433735394531344635423138394545443141303541323245304139413446443439 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e30cf7b0f38d5e801a16cd8c930d971 Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled Access-Challenge Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 7 to 10.0.1.254 port 1076 EAP-Message = 0x0108005b190017030100503f57f777451ccf96321b7674ea98d1ed79cde7eadb49087cf14047b05967ddd8d16c97f78c0062637b910c880d0ef9602ae33a26201f8e0c41d8c4f6ac646c37df62fb3d1d4bc766bab1a80515ca52ea Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a7adbe65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 62. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=8, length=265 Message-Authenticator = 0x9e4f07f9de3e3e39fe346941a2ef4f37 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a7adbe65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0208005019001703010020c8092f2cb2ce2a55c1998c54dc28298f4d569ce89c5922c9271c2c2228e406a91703010020daa06674ef244c479b08189b459f73773c7977fa57afe0e7ff7dbffca6af39a3 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 8 length 80 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 7 Sat May 23 06:08:19 2009 : Info: [peap] Done initial handshake Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 7 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_OK Sat May 23 06:08:19 2009 : Info: [peap] Session established. Decoding tunneled attributes. Sat May 23 06:08:19 2009 : Info: [peap] EAP type mschapv2 Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled request EAP-Message = 0x020800061a03 server { Sat May 23 06:08:19 2009 : Debug: PEAP: Setting User-Name to test Sending tunneled request EAP-Message = 0x020800061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test" State = 0x0e30cf7b0f38d5e801a16cd8c930d971 server { Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 8 length 6 Sat May 23 06:08:19 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat May 23 06:08:19 2009 : Info: ++[eap] returns updated Sat May 23 06:08:19 2009 : Info: ++[unix] returns notfound Sat May 23 06:08:19 2009 : Info: [files] users: Matched entry test at line 206 Sat May 23 06:08:19 2009 : Info: ++[files] returns ok Sat May 23 06:08:19 2009 : Info: ++[expiration] returns noop Sat May 23 06:08:19 2009 : Info: ++[logintime] returns noop Sat May 23 06:08:19 2009 : Info: [pap] Found existing Auth-Type, not changing it. Sat May 23 06:08:19 2009 : Info: ++[pap] returns noop Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/mschapv2 Sat May 23 06:08:19 2009 : Info: [eap] processing type mschapv2 Sat May 23 06:08:19 2009 : Info: [eap] Freeing handler Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Auth: Login OK: [test/<via Auth-Type = EAP>] (from client home-ap port 0 via TLS tunnel) Sat May 23 06:08:19 2009 : Info: +- entering group post-auth {...} Sat May 23 06:08:19 2009 : Info: ++[exec] returns noop } # server Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled reply code 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" Sat May 23 06:08:19 2009 : Info: [peap] Tunneled authentication was successful. Sat May 23 06:08:19 2009 : Info: [peap] SUCCESS Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 8 to 10.0.1.254 port 1076 EAP-Message = 0x0109002b1900170301002009170dedd3f16e1a5db03f10fd34f3821b56dea549adec30b66acf406f2d4d5f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a8acbe65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 63. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=9, length=265 Message-Authenticator = 0x1bdfaa9f02815052e1c90d8bda0ad5f8 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a8acbe65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02090050190017030100201180bbdd1c0f51172eb6b157872924324c0fcbb2ba6232c881ae1eeac3b452ec1703010020ff76e4fb0e8a899a41b84b2078f1b6343f4b785038d1f41200a4b9ee8d69934a NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 9 length 80 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 7 Sat May 23 06:08:19 2009 : Info: [peap] Done initial handshake Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 7 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_OK Sat May 23 06:08:19 2009 : Info: [peap] Session established. Decoding tunneled attributes. Sat May 23 06:08:19 2009 : Info: [peap] Received EAP-TLV response. Sat May 23 06:08:19 2009 : Info: [peap] Success Sat May 23 06:08:19 2009 : Info: [eap] Freeing handler Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Auth: Login OK: [test/<via Auth-Type = EAP>] (from client home-ap port 1 cli 00-18-F8-44-15-C0) Sat May 23 06:08:19 2009 : Info: +- entering group post-auth {...} Sat May 23 06:08:19 2009 : Info: ++[exec] returns noop Sending Access-Accept of id 9 to 10.0.1.254 port 1076 MS-MPPE-Recv-Key = 0xaee5abfa28444c372e4d93cb2143a55070b1571d659e6092782a7be2c21f1987 MS-MPPE-Send-Key = 0x025d7567a09cc9c1c513ca98c1d87b10b375e63f8c9d41db3f486f116864e131 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" Sat May 23 06:08:19 2009 : Info: Finished request 64. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.0 seconds. Sat May 23 06:08:23 2009 : Info: Cleaning up request 55 ID 0 with timestamp +434 Sat May 23 06:08:23 2009 : Info: Cleaning up request 56 ID 1 with timestamp +434 Sat May 23 06:08:23 2009 : Debug: Waking up in 0.5 seconds. Sat May 23 06:08:24 2009 : Info: Cleaning up request 57 ID 2 with timestamp +435 Sat May 23 06:08:24 2009 : Info: Cleaning up request 58 ID 3 with timestamp +435 Sat May 23 06:08:24 2009 : Debug: Waking up in 0.1 seconds. Sat May 23 06:08:24 2009 : Info: Cleaning up request 59 ID 4 with timestamp +435 Sat May 23 06:08:24 2009 : Info: Cleaning up request 60 ID 5 with timestamp +435 Sat May 23 06:08:24 2009 : Info: Cleaning up request 61 ID 6 with timestamp +435 Sat May 23 06:08:24 2009 : Info: Cleaning up request 62 ID 7 with timestamp +435 Sat May 23 06:08:24 2009 : Info: Cleaning up request 63 ID 8 with timestamp +435 Sat May 23 06:08:24 2009 : Info: Cleaning up request 64 ID 9 with timestamp +435 Sat May 23 06:08:24 2009 : Debug: Ready to process requests. Thanks, Balgaa

1 0

Windows XP SP2 and SP3 EAP problem
by Balgansuren Batsukh 23 May '09

23 May '09

Hello, I am new to Freeradius world. Last two days trying to use Freeradius + Alcon AP WPA-Enterprise + Windows XP. I installed FreeBSD 7.2-STABL with Freeradius 2.1.4 and configured it. I followed instruction on http://wiki.freeradius.org/index.php?title=EAP-PEAP&redirect=no and http://ubuntuforums.org/showthread.php?t=478804 I have 2 WLAN card on my Windows XP laptop. After successfully install,configure freebsd/freeradius/AP and Windows XP. 1.My Linksys WPC300N WLAN card can connect to AP using PEAP/MS-CHAPv2. 2.But Intel PRO/Wireless 3945ABG card can't get connect, I tried many different way. First I tried Windows XP with SP2, then installed SP3 and all time same result. I captured Freeradius debugging information. 1.Linksys ======== Please find second my email. Because maximum mailing-list size is 100K. 2.Intel PRO/Wireless 3945ABG ======================= .rad_recv: Access-Request packet from host 10.0.1.254 port 1077, id=0, length=176 Message-Authenticator = 0xa0ca47a1b7294a8b23ae201660398ec5 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-1B-77-3D-97-CB" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020000090174657374 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:12:59 2009 : Info: +- entering group authorize {...} Sat May 23 06:12:59 2009 : Info: ++[preprocess] returns ok Sat May 23 06:12:59 2009 : Info: ++[chap] returns noop Sat May 23 06:12:59 2009 : Info: ++[mschap] returns noop Sat May 23 06:12:59 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:12:59 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:12:59 2009 : Info: ++[suffix] returns noop Sat May 23 06:12:59 2009 : Info: [eap] EAP packet type response id 0 length 9 Sat May 23 06:12:59 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat May 23 06:12:59 2009 : Info: ++[eap] returns updated Sat May 23 06:12:59 2009 : Info: ++[unix] returns notfound Sat May 23 06:12:59 2009 : Info: [files] users: Matched entry test at line 206 Sat May 23 06:12:59 2009 : Info: ++[files] returns ok Sat May 23 06:12:59 2009 : Info: ++[expiration] returns noop Sat May 23 06:12:59 2009 : Info: ++[logintime] returns noop Sat May 23 06:12:59 2009 : Info: [pap] Found existing Auth-Type, not changing it. Sat May 23 06:12:59 2009 : Info: ++[pap] returns noop Sat May 23 06:12:59 2009 : Info: Found Auth-Type = EAP Sat May 23 06:12:59 2009 : Info: +- entering group authenticate {...} Sat May 23 06:12:59 2009 : Info: [eap] EAP Identity Sat May 23 06:12:59 2009 : Info: [eap] processing type tls Sat May 23 06:12:59 2009 : Info: [tls] Initiate Sat May 23 06:12:59 2009 : Info: [tls] Start returned 1 Sat May 23 06:12:59 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 0 to 10.0.1.254 port 1077 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab2d012bab2c18f6df82958be47c8d15 Sat May 23 06:12:59 2009 : Info: Finished request 65. Sat May 23 06:12:59 2009 : Debug: Going to the next request Sat May 23 06:12:59 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1077, id=1, length=265 Message-Authenticator = 0xf38fba12d0d8983cafc03c4357006b1b Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xab2d012bab2c18f6df82958be47c8d15 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-1B-77-3D-97-CB" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201005019800000004616030100410100003d03014a17236630b686d1813e3c6999ff6c9c2bb7411a01b4b1b77582d0dd45012ae300001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:12:59 2009 : Info: +- entering group authorize {...} Sat May 23 06:12:59 2009 : Info: ++[preprocess] returns ok Sat May 23 06:12:59 2009 : Info: ++[chap] returns noop Sat May 23 06:12:59 2009 : Info: ++[mschap] returns noop Sat May 23 06:12:59 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:12:59 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:12:59 2009 : Info: ++[suffix] returns noop Sat May 23 06:12:59 2009 : Info: [eap] EAP packet type response id 1 length 80 Sat May 23 06:12:59 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:12:59 2009 : Info: ++[eap] returns ok Sat May 23 06:12:59 2009 : Info: Found Auth-Type = EAP Sat May 23 06:12:59 2009 : Info: +- entering group authenticate {...} Sat May 23 06:12:59 2009 : Info: [eap] Request found, released from the list Sat May 23 06:12:59 2009 : Info: [eap] EAP/peap Sat May 23 06:12:59 2009 : Info: [eap] processing type peap Sat May 23 06:12:59 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:12:59 2009 : Debug: TLS Length 70 Sat May 23 06:12:59 2009 : Info: [peap] Length Included Sat May 23 06:12:59 2009 : Info: [peap] eaptls_verify returned 11 Sat May 23 06:12:59 2009 : Info: [peap] (other): before/accept initialization Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: before/accept initialization Sat May 23 06:12:59 2009 : Info: [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: SSLv3 read client hello A Sat May 23 06:12:59 2009 : Info: [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: SSLv3 write server hello A Sat May 23 06:12:59 2009 : Info: [peap] >>> TLS 1.0 Handshake [length 0818], Certificate Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: SSLv3 write certificate A Sat May 23 06:12:59 2009 : Info: [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: SSLv3 write server done A Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: SSLv3 flush data Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A Sat May 23 06:12:59 2009 : Debug: In SSL Handshake Phase Sat May 23 06:12:59 2009 : Debug: In SSL Accept mode Sat May 23 06:12:59 2009 : Info: [peap] eaptls_process returned 13 Sat May 23 06:12:59 2009 : Info: [peap] EAPTLS_HANDLED Sat May 23 06:12:59 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 1 to 10.0.1.254 port 1077 EAP-Message = 0x0102040019c000000855160301002a0200002603014a17236b41fb4453090eaddd0875ba0824f11887113654d3439aaabac6b367d70000040016030108180b0008140008110003903082038c30820274a003020102020101300d06092a864886f70d0101040500308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a864886f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f72697479301e170d303930353232303131353138 EAP-Message = 0x5a170d3130303532323031313531385a3076310b3009060355040613024d4e310b30090603550408130255423111300f060355040a1308486f6d656e65742e312630240603550403131d54736572656e646f726a20536572766572204365727469666963617465311f301d06092a864886f70d010901161074736565656b407961686f6f2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d307b83ea71ed1c6ee8867dd355590ec1e9d04b2301d284eddf4983dd53bcd1fcc7d219fbacb9deb9ae5f64f1a2d660a15c7ffc995c6a9462a840d452c13676e68ebb427f3f8d4ccbb1141fdb9a6ac9d8027d17b EAP-Message = 0xfe2e02e865530ad0e174d309e79164ce2ab8df0a7c676155022f298a0014bab98b68e23a06cf939d9c6b53fab8cb7b123df2b751a700ae1b12129cd05dcc6110c8b89f9b467142874b7249ae442d1680700f96ea69f511c388f198869375b1e86af0e4320dc81e6ec5dfa88817fef561b6c69561e6200412327b72d5915c9c292eaa2f4914c0ca4a102bd1ba198aa3224e20e8c635f9b4131042955409ab565377e64b005bf7ffd6db0af64f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010015a7d2ade3e88c984c89476f7823e6e178e82374fb9716b8aaae950f1d2040 EAP-Message = 0xca57298fb83500fed0f2c3f575f86cf242cc938cac77017fd0363d7e66618fc097b2221633733ab7e6ca92c5b02a455ef00820b642cfc955226e708f237981d52f4d25f5dbe60d094a22cdc32b2d09cfa4f4f959af0487552edf4835d20109016bbde20a5b79ab4cdc124ad0d6eb269cc6b2409f7f7c7221c6f03593032d7417d946af889568ca0ac8ee94786b8e8046a7e1e2fd93e1256dc4ed5cd62282b6f2cf02c0d5875867f2869c002bac9f7a6ef27e313e44492c04faa7d320ffe47d21e46b179945379d2834b9f23d8391fc44511ab29cb87950aca10042e2ba48fd3e9c00047b308204773082035fa0030201020209008b45c0e25d2e249a30 EAP-Message = 0x0d06092a864886f70d010105 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab2d012baa2f18f6df82958be47c8d15 Sat May 23 06:12:59 2009 : Info: Finished request 66. Sat May 23 06:12:59 2009 : Debug: Going to the next request Sat May 23 06:12:59 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1077, id=2, length=191 Message-Authenticator = 0xe998fa0f52f462e1a8b21e3ec7f5c049 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xab2d012baa2f18f6df82958be47c8d15 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-1B-77-3D-97-CB" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:12:59 2009 : Info: +- entering group authorize {...} Sat May 23 06:12:59 2009 : Info: ++[preprocess] returns ok Sat May 23 06:12:59 2009 : Info: ++[chap] returns noop Sat May 23 06:12:59 2009 : Info: ++[mschap] returns noop Sat May 23 06:12:59 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:12:59 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:12:59 2009 : Info: ++[suffix] returns noop Sat May 23 06:12:59 2009 : Info: [eap] EAP packet type response id 2 length 6 Sat May 23 06:12:59 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:12:59 2009 : Info: ++[eap] returns ok Sat May 23 06:12:59 2009 : Info: Found Auth-Type = EAP Sat May 23 06:12:59 2009 : Info: +- entering group authenticate {...} Sat May 23 06:12:59 2009 : Info: [eap] Request found, released from the list Sat May 23 06:12:59 2009 : Info: [eap] EAP/peap Sat May 23 06:12:59 2009 : Info: [eap] processing type peap Sat May 23 06:12:59 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:12:59 2009 : Info: [peap] Received TLS ACK Sat May 23 06:12:59 2009 : Info: [peap] ACK handshake fragment handler Sat May 23 06:12:59 2009 : Info: [peap] eaptls_verify returned 1 Sat May 23 06:12:59 2009 : Info: [peap] eaptls_process returned 13 Sat May 23 06:12:59 2009 : Info: [peap] EAPTLS_HANDLED Sat May 23 06:12:59 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 2 to 10.0.1.254 port 1077 EAP-Message = 0x010303fc19400500308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a864886f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f72697479301e170d3039303532323031313530345a170d3130303532323031313530345a308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a8648 EAP-Message = 0x86f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100f5a581f6620f0dc9f19e0eb69943d39130695d3ac1cb6ce54907a7c67f6a0dcc674e78bf6fb8167ea02010a34035f5ba9ab8e5c494e49cf1d907db59e4e178dcb8e858cc2bd488f90a7339ea1526cd187b4eee2e4fdf6d121d1b49921fb8c7b17e11f89ae43e1179874cfbaba3407dfeea6b8ff0698b8dcfbd38ca6236bf1bff2e5fbe46d408b7f14cd35caa7ed972abf3f5ee12d07cd464fcecde6a475188b0e692dfad59 EAP-Message = 0xf670d03d01a26a8d469a6578ac0a59843565e53b2bc145919c3fef40c0e693645c644f50111f489d8115bf19af99a870c42ef8f0bea4df4e2b334460f6925eb73aff6c4ad2e4a9219005f57df0b5452229e337f2ef420d7c8dce8b0203010001a381eb3081e8301d0603551d0e041604140692c35ad5374aa0aca7a7407f0d255ed0719d303081b80603551d230481b03081ad80140692c35ad5374aa0aca7a7407f0d255ed0719d30a18189a48186308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a86 EAP-Message = 0x4886f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f726974798209008b45c0e25d2e249a300c0603551d13040530030101ff300d06092a864886f70d010105050003820101007675cc71a220f326022857ac3670dd7540d9159c200dff570f331034e690b1418f2444083524b298ee48192da8f172a324574953c06149e4cb94dd89a2142e621d6ffafb7a815fbb417112fcd4ab2a0ed4645407be28896a6ba6b22cd7389ba79420ea233305c88be323a9e122761b27f747119a35714822d0b4ae66c3d7ecceb0594fe9c830de22a08a8b05cda84cc1b5c792089a309014 EAP-Message = 0xe78e4d77cbec2fb9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab2d012ba92e18f6df82958be47c8d15 Sat May 23 06:12:59 2009 : Info: Finished request 67. Sat May 23 06:12:59 2009 : Debug: Going to the next request Sat May 23 06:12:59 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1077, id=3, length=191 Message-Authenticator = 0xdd87b957079c3f4f81b4c7a5ba4be6d6 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xab2d012ba92e18f6df82958be47c8d15 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-1B-77-3D-97-CB" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300061900 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:12:59 2009 : Info: +- entering group authorize {...} Sat May 23 06:12:59 2009 : Info: ++[preprocess] returns ok Sat May 23 06:12:59 2009 : Info: ++[chap] returns noop Sat May 23 06:12:59 2009 : Info: ++[mschap] returns noop Sat May 23 06:12:59 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:12:59 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:12:59 2009 : Info: ++[suffix] returns noop Sat May 23 06:12:59 2009 : Info: [eap] EAP packet type response id 3 length 6 Sat May 23 06:12:59 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:12:59 2009 : Info: ++[eap] returns ok Sat May 23 06:12:59 2009 : Info: Found Auth-Type = EAP Sat May 23 06:12:59 2009 : Info: +- entering group authenticate {...} Sat May 23 06:12:59 2009 : Info: [eap] Request found, released from the list Sat May 23 06:12:59 2009 : Info: [eap] EAP/peap Sat May 23 06:12:59 2009 : Info: [eap] processing type peap Sat May 23 06:12:59 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:12:59 2009 : Info: [peap] Received TLS ACK Sat May 23 06:12:59 2009 : Info: [peap] ACK handshake fragment handler Sat May 23 06:12:59 2009 : Info: [peap] eaptls_verify returned 1 Sat May 23 06:12:59 2009 : Info: [peap] eaptls_process returned 13 Sat May 23 06:12:59 2009 : Info: [peap] EAPTLS_HANDLED Sat May 23 06:12:59 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 3 to 10.0.1.254 port 1077 EAP-Message = 0x0104006f1900dffe3ea966d2f1d6b3f53ff8d7aca3209d32404ff2ea681dfe4e453405f0b9de3eee8c146c2e3ba3dcae73743550c267bc22ca8c9cb6da0d1b78606e707f17f535a4fda33aa48734e794b5e8c345dbe48a9715de963d83ae51473edcafff79bf16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab2d012ba82918f6df82958be47c8d15 Sat May 23 06:12:59 2009 : Info: Finished request 68. Sat May 23 06:12:59 2009 : Debug: Going to the next request Sat May 23 06:12:59 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1077, id=4, length=191 Message-Authenticator = 0x1a9c69cd9f1a6a400346442e1b1da646 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xab2d012ba82918f6df82958be47c8d15 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-1B-77-3D-97-CB" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400061900 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:12:59 2009 : Info: +- entering group authorize {...} Sat May 23 06:12:59 2009 : Info: ++[preprocess] returns ok Sat May 23 06:12:59 2009 : Info: ++[chap] returns noop Sat May 23 06:12:59 2009 : Info: ++[mschap] returns noop Sat May 23 06:12:59 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:12:59 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:12:59 2009 : Info: ++[suffix] returns noop Sat May 23 06:12:59 2009 : Info: [eap] EAP packet type response id 4 length 6 Sat May 23 06:12:59 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:12:59 2009 : Info: ++[eap] returns ok Sat May 23 06:12:59 2009 : Info: Found Auth-Type = EAP Sat May 23 06:12:59 2009 : Info: +- entering group authenticate {...} Sat May 23 06:12:59 2009 : Info: [eap] Request found, released from the list Sat May 23 06:12:59 2009 : Info: [eap] EAP/peap Sat May 23 06:12:59 2009 : Info: [eap] processing type peap Sat May 23 06:12:59 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:12:59 2009 : Info: [peap] Received TLS ACK Sat May 23 06:12:59 2009 : Info: [peap] ACK handshake fragment handler Sat May 23 06:12:59 2009 : Info: [peap] eaptls_verify returned 1 Sat May 23 06:12:59 2009 : Info: [peap] eaptls_process returned 13 Sat May 23 06:12:59 2009 : Info: [peap] EAPTLS_HANDLED Sat May 23 06:12:59 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 4 to 10.0.1.254 port 1077 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab2d012baf2818f6df82958be47c8d15 Sat May 23 06:12:59 2009 : Info: Finished request 69. Sat May 23 06:12:59 2009 : Debug: Going to the next request Sat May 23 06:12:59 2009 : Debug: Waking up in 4.9 seconds. Sat May 23 06:13:04 2009 : Info: Cleaning up request 65 ID 0 with timestamp +715 Sat May 23 06:13:04 2009 : Info: Cleaning up request 66 ID 1 with timestamp +715 Sat May 23 06:13:04 2009 : Info: Cleaning up request 67 ID 2 with timestamp +715 Sat May 23 06:13:04 2009 : Info: Cleaning up request 68 ID 3 with timestamp +715 Sat May 23 06:13:04 2009 : Info: Cleaning up request 69 ID 4 with timestamp +715 Sat May 23 06:13:04 2009 : Debug: Ready to process requests. 3.site-enabled/default ================ authorize { preprocess chap mschap eap { ok = return } files pap authenticate . . . Auth-Type MS-CHAP { mschap } 4.eap.conf ======== eap { default_eap_type = peap . . . tls { . . } check_cert_cn = %{User-Name} peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } } 5.users ====== test Cleartext-Password := "test" Is there anything wrong with configuration or? My guess is Windows XP wireless client sofware didn't respond to Freeradius Access-Challenge request, but Linksys client software doing well. Any suggestion? Thanks, Balgaa

1 0

Re: must i use rlm_ldap to use groups/ou via winbind/Active Directory?
by john 23 May '09

23 May '09

. > > That depends on capabilities of your equipment. This how Cisco implements it: > > www.cisco.com/univercd/cc/td/doc/solution/macauthb.pdf > > Other vendors have more on less the same. It is enabled on some models and > not on others. Thanks for this. > >> So this policy would check the huntgroup that the NAS was a member of >> and then go on to check if the users was part of the proper >> Ldap-Group and assuming that both were true then access would be >> granted. I am still not clear how some hunt groups will always >> require a host cert and others never will. Is this set in the hunt >> group? > > No, on the equipment. Your setup is such that you have to enforce > (enable/disable) it on hardware. If you would require certificates for > access to all hardware you could enforce it with AD Group Policy. Like > this students don't need machine certificates for wireless access. So, you > should enable mac auth bypass on your student APs. Most APs should have > such feature.You should make students register mac address of their > wireless equipment if they want to connect. Hmm. I don't think I like this approach for a couple of reasons, perhaps you can let me know if I am thinking about this incorrectly. We already use mac address as an auth scheme and I want to move away from this because of the ease of mac spoofing in a wireless environment. That's why I hoped to move to username/password authentication with WPA2 that was centrally managed via freeradius <=> Active Directory. I currently have a fairly central way to manage access by mac, but I would have to give that up if I had to maintain a mac address table on each NAS. I guess I could add a list of allowed mac addresses in the freeradius/users file and maintain it from there? Just so I understand you clearly, we can't have 1 class of users who must use host certs via NAS A and another class of uses who never have to use certs via NAS B on the same freeradius server? If that is the case I think I might want to set up a second instance of Freeradius and point the NAS that don't require host certs at that one. I could simply mint another virtual freeradius instance in freeradius/sites-enabled couldn't I? If I have this all muddled up, I hope you'll straighten me out. Thanks for all of your help. John

2 1

freeRADIUS + POPTOP
by Neville 22 May '09

22 May '09

Firstly, let me apologies now for asking what is most probably a simple question to you long standing veterans of freeRADIUS. I've search the INTERNET for 5 days now and late into the evening, but I'm totally stumped in resolving my problem, so I would appreciate any guidance from the experts. I've configured as per the many guides I've found and have a basic understanding of how this all works, but there is no information anywhere on how to setup the Users / Client details for freeRADIUS. I've been using poptop (pptpd) server for several weeks, with great success, but now I wish to introduce freeRADIUS. The problem, I'm facing is the allocation of IP address / GW / DNS by freeRADIUS for the VPN connections coming onto my server. my service PrivateIP address is 19x.xxx.xxx.190 I've iptables setup to forward all NAT traffic through the PRIVATEIP, but allocation of a GW of 10.0.0.1 and a Client IP of 10.0.0.200 However, when I connect and freeRADIUS authenticates me SUCCESSFULLY. I get given a IP of 192.168.2.82 from the test_pool, but pool range-start = 10.0.0.100 range-stop = 10.0.0.199 which is totally different to the address allocated by the pool. ANY IDEAS? /var/log/messages May 22 21:49:13 server pppd[765]: MPPE 128-bit stateless compression enabled May 22 21:49:15 server pppd[765]: Cannot determine ethernet address for proxy ARP May 22 21:49:15 server pppd[765]: local IP address 10.0.0.1 May 22 21:49:15 server pppd[765]: remote IP address 192.168.2.82 radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 34510, id=245, length=133 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test1" MS-CHAP-Challenge = 0xd4fd1b2f3b03fa424ae2ccc6dcd11029 MS-CHAP2-Response = 0x87001d6e9a747c3545dd123d19c410c037be00000000000000002b9c7e96783abd1954a72ae8f4bc4733b1470477ba725366 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090522 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090522 [auth_log] expand: %t -> Fri May 22 22:46:15 2009 ++[auth_log] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 70 [files] users: Matched entry test1 at line 77 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for test1 with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok +- entering group post-auth {...} [test_pool] expand: %{NAS-IP-Address} %{NAS-Port} -> 127.0.0.1 0 [test_pool] MD5 on 'key' directive maps to: ee0282d57992a30bce29ea43d092ac16 [test_pool] Searching for an entry for key: 'ee0282d57992a30bce29ea43d092ac16' rlm_ippool: Allocating ip to key: 'ee0282d57992a30bce29ea43d092ac16' [test_pool] num: 1 [test_pool] Allocated ip 192.168.2.82 to client key: ee0282d57992a30bce29ea43d092ac16 ++[test_pool] returns ok ++[exec] returns noop Sending Access-Accept of id 245 to 127.0.0.1 port 34510 Service-Type = Framed-User Session-Timeout = 65000 Framed-Protocol = PPP Framed-MTU = 1400 MS-CHAP2-Success = 0x87533d46313037374533443535323430343534463737333338463639364534383642374434433244333842 MS-MPPE-Recv-Key = 0x5a21400d6e5601f9c7201a94d401eefb MS-MPPE-Send-Key = 0x14eadb5ada027ccdd63a6cf372f0defd MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Framed-IP-Address = 192.168.2.82 Framed-IP-Netmask = 255.255.255.0 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 43515, id=246, length=97 Acct-Session-Id = "4A172B390A9300" User-Name = "test1" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 192.168.2.82 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "4A172B390A9300",User-Name = "test1"' [acct_unique] Acct-Unique-Session-ID = "29e101f9a598e8fe". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/detail-20090522 [detail] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/detail-20090522 [detail] expand: %t -> Fri May 22 22:46:17 2009 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> test1 ++[radutmp] returns ok [test_pool] This is not an Accounting-Stop. Return NOOP. ++[test_pool] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> test1 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 246 to 127.0.0.1 port 43515 Finished request 1. Cleaning up request 1 ID 246 with timestamp +44 Going to the next request Waking up in 2.9 seconds. Cleaning up request 0 ID 245 with timestamp +42 Ready to process requests. freeRADIUS Configurations users DEFAULT Pool-Name := test_pool Fall-Through = Yes test1 Cleartext-Password := "test1" Service-Type = Framed-User, Session-Timeout = 65000, Framed-Protocol = PPP, Framed-MTU = 1400, ippool module ippool test_pool { range-start = 10.0.0.100 range-stop = 10.0.0.199 netmask = 255.255.255.0 cache-size = 800 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = no maximum-timeout = 0 #key = "%{NAS-IP-Address} %{NAS-Port}" } POPTOP Configuration Files /etc/ppp/options.pptpd name pptpd #chapms-strip-domain refuse-pap refuse-chap refuse-mschap require-mschap-v2 require-mppe-128 ms-dns 208.67.222.222 ms-dns 208.67.222.220 proxyarp debug dump lock nobsdcomp novj novjccomp noipv6 noipx nologfd plugin radius.so plugin radattr.so /etc/pptpd.conf ppp /usr/sbin/pppd option /etc/ppp/options.pptpd debug noipparam #logwtmp #bcrelay eth1 delegate connections 100 localip 10.0.0.1

2 1

must i use rlm_ldap to use groups/ou via winbind/Active Directory?
by john 22 May '09

22 May '09

Hi all, I am gradually refining my thinking thanks to help from Ivan and others on the list. I am using the current freeradius stable along with Active Directory to provide dot1x based access for our school district. Our test setup looks like this: active directory <=>winbind<=> Freeradius<=>NAS<=>supplicant Problem: I want to enforce different access policies for users depending on who they are and where they try to authenticate. (1) If students or teachers try to authenticate on the wired lan I want my dot1x capable NAS to provide access only if they user has a computer cert and valid domain credentials (2) If students try to connect via the student wireless lan they must only receive access if they are a member of the Active Directory based "student wireless users group", e.g. no staff member should be able to join. (3) If teachers try to connect via the teacher wireless lan, I want them to connect only if they HAVE a computer cert AND they have valid credentials. e.g only members of the Active Directoy based "staff group" using computers with a valid host credential may receive access. One solution would be two have two different radius servers, and point different NAS clients at the appropriate server, but I this is probably not the "right" way to do this. Ideally, I should be able to do it all from a single radius server with appropriate controls. I see that in the past folks have done similar things with openLdap and freeradius. But I think that using winbind may have changed this for users of Active Directly. I am not sure how to proceed. I would appreciate any guidance you wish to share. Thanks! John

4 7

Additional thread
by James Devine 22 May '09

22 May '09

Is it possible for me to spin off my own thread to do background work separate from individual requests in a module? I am trying to start a thread from the instantiate call and then rejoin on the detach, this seems to work when I run radius -X, but something is happening when radius is not in debug so that it gets stuck or killed somehow, the log statement is only logged once. All I have is a while loop with a log and sleep statement in it as shown below. It is not getting stuck in the log call as even without that, sending a sigterm to the process still hangs. #include <freeradius/ident.h> RCSID("$Id$") #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <pthread.h> #include <freeradius-devel/radiusd.h> #include <freeradius-devel/modules.h> typedef struct rlm_gwis_t { int shutdown; pthread_t p_thread; } gw_config; const CONF_PARSER module_config[] = { { NULL, -1, 0, NULL, NULL } /* end the list */ }; void *gwis__background__start(void *data) { gw_config *gwd = data; if(!gwd) return NULL; while(!gwd->shutdown) { radlog(L_ERR, "Background process, shutdown %d", gwd->shutdown); sleep(1); } return NULL; } static int gwis_detach(void *gwd) { if(gwd) { ((gw_config *)gwd)->shutdown = 1; pthread_join(((gw_config *)gwd)->p_thread, NULL); free(gwd); } return RLM_MODULE_OK; } static int gwis_instantiate(CONF_SECTION *conf, void **gwd) { gw_config *tmp_gwd; tmp_gwd = rad_malloc(sizeof(gw_config)); if(!tmp_gwd) { return RLM_MODULE_FAIL; } memset(tmp_gwd, 0, sizeof(gw_config)); if(cf_section_parse(conf, tmp_gwd, module_config) < 0) { free(tmp_gwd); return RLM_MODULE_FAIL; } tmp_gwd->shutdown = 0; if(pthread_create(&tmp_gwd->p_thread, NULL, gwis__background__start, tmp_gwd)) { gwis_detach(tmp_gwd); return -1; } *gwd = tmp_gwd; return RLM_MODULE_OK; } static int gwis_preacct(void *gwd, REQUEST *request) { return RLM_MODULE_OK; } module_t rlm_gwis = { RLM_MODULE_INIT, "gwis", RLM_TYPE_THREAD_SAFE, gwis_instantiate, gwis_detach, { NULL, NULL, gwis_preacct, NULL, NULL, NULL, NULL, NULL }, };

2 2

clients
by jon jon 22 May '09

22 May '09

hello, I am new to Freeradius, I am trying to use NTRadPing testing tool to send packets to my Freeradius server. I keep getting Ignoring request to authentication address * port 1812 from unknow client error message. So, the question you will ask me is did I add the client to the client.conf file. I thought I did but maybe not corectly. this is what I added to my client.conf file client ip address { secretname = testing123 shortname = private-network } is this correct?

2 2

Rewriting User-Name in pre-proxy
by William Taylor 22 May '09

22 May '09

Im currently using freeradius 2.1.4 I need to lookup a username in a dbm and rewrite it before sending off the proxy request. I have achieved this by using the below method. But I was wondering if there was a better way. It would seem that invoking perl with every auth request might be bad. Thanks in advance! -William In: /etc/raddb/dictionary ATTRIBUTE My-Local-String 3000 string In: sites-available/default pre-proxy { rewrite update proxy-request { User-Name := "%{proxy-request:My-Local-String}" } } In: /etc/raddb/modules/rewrite exec rewrite { wait = yes program = "/etc/raddb/rewriteusername.pl %{User-Name} %{Stripped- User-Name} %{Realm}" input_pairs = proxy-request output_pairs = proxy-request shell_escape = yes } In: /etc/raddb/rewriteusername.pl #!/usr/bin/perl use strict; use DB_File; my %h; tie %h, "DB_File", "/etc/raddb/rewritemap.db", O_RDONLY, 0444, $DB_HASH or die "Cannot open file rewritemap.db: $!\n"; my $fuser = $ARGV[0]; my $suser = $ARGV[1]; my $realm = $ARGV[2]; if($realm eq "foobee.net") { if($h{$suser}) { print "My-Local-String=" . $h{$suser}; } else { print "My-Local-String=$suser"; } } else { print "My-Local-String=$suser"; } exit 0;

2 5

Re: Freeradius and WiMAX Access Point
by Ming-Ching Tiew 22 May '09

22 May '09

--- On Fri, 5/22/09, Ivan Kalik <tnt(a)kalik.net> wrote: > Well, if the name is recongnizable ... Just return > Acct-Interim-Interval = > let's say 600 in the Access-Accept packet and see what > happens. That > should send updates every 10 minutes. Maybe trained talking > monkeys from > technical support don't know how it's done. > That's a good suggestion. Will give this a try when there is chance. Regards.

1 0

Re: accounting with 802.1X: some clients trigger multiple starts at a time
by Sam Hooker 22 May '09

22 May '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alan DeKok wrote: > My $0.02 is that the NAS is broken (big surprise). It's likely > doing DHCP snooping to determine session IP address. Interesting. I suppose this would be the least of several evils, if they can't be guaranteed to be in the same Ethernet broadcast domain as the supplicant stations. Is there a better way? > Remember: The NAS sends accounting packets whenever it wants. The > contents of the accounting packets are determined SOLELY by the NAS. I hadn't consciously recognized it was that arbitrary; makes sense, though. > The clients MAY be requesting those IPs. e.g. The user takes a > laptop home, it gets a private IP. When he shows back up at work, the OS > may try to first renew that IP... and when it gets no response, ask for a > different IP. Yeah, that was one of my early theories, when I started noticing this (and before realizing the preponderance of *ahem* "unofficial" networks). > So the big question is: what NAS is causing the problem? Cisco LWAPP controllers. > The detail module doesn't care about the contents of the packet. > The SQL module does. If it doesn't like the contents, it won't log it. Important safety tip: thanks, Egon. ;-) > Maybe suppress multiple accounting starts in the same second? This sounds promising: How would you recommend doing it? I'm still new to the manipulation of RADIUS conversations, so hints are most welcome. > Tell the rogue department to buy an AP that works. Well, they're using a client bridge (and must be NATting), so no rogue AP...at least not in this particular case. Although there are plenty of those, too. Thanks, Alan! Cheers, - -sth sam hooker|sth@noiseplant.com|http://www.noiseplant.com Are you satisfied? ([y]/n): -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Use GnuPG with Firefox : http://getfiregpg.org (Version: 0.7.5) iEYEARECAAYFAkoWqjgACgkQX8KByLv3aQ0MWwCfaK3kcKJDj+OeQ/3wi/mIzlxf y9kAnjjXCNMPguX3bJkkK67WDaCt5AdI =yJVA -----END PGP SIGNATURE-----

2 1