- Freeradius-Users - lists.freeradius.org

Dropping requests when no authentication possible
by Chris Phillips 15 Mar '09

15 Mar '09

Hi, I've set up a 2.1.4 server, and working pretty well with authentication against LDAP alone. What I've noticed though is that if the LDAP server is down on the same box then the LDAP module, rightfully, fails. However whilst this leaves the service unable to authenticate the user, it still replies back with a REJECT packet to the client. As such the client switch / router whatever, doesn't try the next server in it's config, as it's had a valid RADIUS response. Is there any way to force a logic whereby if the ldap module fails, it would drop the RADIUS request on the floor, to make it look like a service failure to the client? Kinda wrecks our resiliency model if not! We're only using a single ldap server per box, but even if we were using other ldap servers on other servers, there still is a logic whereby it may be impossible to reach any LDAP server whilst another FreeRADIUS box can reach one, but is of a lower order of preference so can't be used. Thanks Chris

4 15

Suse rpm in 2.1.4
by Norbert Wegener 14 Mar '09

14 Mar '09

autoreconf on suse does not seem to work and I commented it out in the specfile. otp.conf does not seem to exist any longer, /usr/sbin/raddebug must be applied. With these little modifications of the suse specfile 2.1.4 builds on suse 10.3. bugs.freeradius.org still seems to be unavailable, therefore I post the patch here. # diff -Nru freeradius.spec-org freeradius.spec --- freeradius.spec-org 2009-03-11 13:29:53.000000000 +0100 +++ freeradius.spec 2009-03-11 13:30:02.000000000 +0100 @@ -179,7 +179,7 @@ %build export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing -DLDAP_DEPRECATED -fPIC -DPIC" #export CFLAGS="$CFLAGS -std=c99 -pedantic" -autoreconf +#autoreconf %configure \ --libdir=%{_libdir}/freeradius \ @@ -332,7 +332,7 @@ %attr(640,-,radiusd) %config(noreplace) /etc/raddb/sql/oracle/msqlippool.txt %attr(640,-,radiusd) %config(noreplace) /etc/raddb/users %attr(640,-,radiusd) %config(noreplace) /etc/raddb/experimental.conf -%attr(640,-,radiusd) %config(noreplace) /etc/raddb/otp.conf +#%attr(640,-,radiusd) %config(noreplace) /etc/raddb/otp.conf %dir %attr(750,-,radiusd) /etc/raddb/certs /etc/raddb/certs/Makefile /etc/raddb/certs/README @@ -355,6 +355,7 @@ /usr/sbin/radrelay /usr/sbin/radwatch /usr/sbin/radmin +/usr/sbin/raddebug # man-pages %doc %{_mandir}/man1/* %doc %{_mandir}/man5/* Norbert Wegener

3 3

eap-peap "challenge" error for windows XP clients
by deveshgade 14 Mar '09

14 Mar '09

i want to implement peap for my wifi connection. I have set up the access point(D-Link DWL 2100 AP) for using FreeRADIUS 2.1 For authentication.Whenever i send a request from the client to the server,the server fails to authenticate the client. What happens can be seen in the debug code attached below.The problem may be due to the fact that the server certificate used requires to be signed by special XP extensions but i am not sure about it.I am currently using the default certificates created when FreeRADIUS 2.1 is first installed.Can anyone please tell me why the error is occuring and what the remedy for this is?? I am using Fedora 8 as server. Debug output for FreeRADIUS is as follows: [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.1.250 port 1034 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9927156798250cebdde85f1a77c9228b Finished request 9. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.250 port 1034, id=2, length=290 Message-Authenticator = 0xf65b54a824859ff5858d51b34bb2ea0a Service-Type = Framed-User User-Name = "ITDEPT.COM\\scoe\000" Framed-MTU = 1488 State = 0x9927156798250cebdde85f1a77c9228b Called-Station-Id = "00-17-9A-09-C4-DD:scoeit" Calling-Station-Id = "00-13-02-12-16-6E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0202005019800000004616030100410100003d030149b8c76c86fa22fb3b65c1a3da9d93f69b65a4f9489aaffaa42657f64516c2f600001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.1.250 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ITDEPT.COM\scoe", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 03b0], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.1.250 port 1034 EAP-Message = 0x010303f31900160301002a02000026030149b8c79ad72fa31c2fc8459b30bd15126d3e5d6c74b1cb5228c06435c81fa6440000040016030103b00b0003ac0003a90003a6308203a23082028aa003020102020102300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d EAP-Message = 0x3039303232373139323130325a170d3130303232373139323130325a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ac916a34fdc11effd3bf47f5e73c79237047fe7f11563c666003ddfc4d734778cf075ee5998c76f03bf71fa77f53e08588af1dcb33f926a1404901e5d8008e613952 EAP-Message = 0x979ae3c175d60f86c9c0ae82c554378f11f0cf9302931b3888dc716df066a15c655817bd3cc6617cb6feb8e2f41ad9531b68cddece4f8ebe50581111d673463cd9a00198eb4d43adefaa1322618e20d7fe3c5408d3a2329be135a664bf99f281b2b8c1810be4fb1b0cee61b7f943e9eac630a69865faeba4a4206f4bb89c8b27ecbd8e9545615a030151559b539a8c533f5b9779d1c4eb22279c0b5409eb2e242878bff8ac400c10f0fd81e15e246f85d940182be0a60a4a4399cc0bd0a70203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003820101001b2311c96ac3ee97d6ecfd99e8 EAP-Message = 0x0adfa8b3b89b7481c139127c0a69572763e40b467f29150c33c33ac9a582fe1c591bd4150d769c0e35195182835bc301441bbb8235a3cdcabf877b8652ce74782d0045114312dd6c214e67adc2ebc59b7330e5fdba13a5e28be5cfdaa4d2e5eaa84e5c500df001989d673ec3ee37cd4b2404722233d2f5ab442e691ff244653402d1b22260370262bee269a518e02bb0b47452aeb51465d047fc83f9075914ba86efbc202b60d5e9ce652ce28561edb25ec4e49cae1a3762672a85ad2bc11efc117481b7de96613d83438a712c589b5f6aef84c695f516c87a6b1f17bfe69446e4e9e7b03fe9f5553486e8dd1aa28d6b36a47216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x992715679b240cebdde85f1a77c9228b Finished request 10. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.250 port 1034, id=3, length=532 Message-Authenticator = 0xc54164092ed8dc2f09a7418d5560f076 Service-Type = Framed-User User-Name = "ITDEPT.COM\\scoe\000" Framed-MTU = 1488 State = 0x992715679b240cebdde85f1a77c9228b Called-Station-Id = "00-17-9A-09-C4-DD:scoeit" Calling-Station-Id = "00-13-02-12-16-6E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0203014019800000013616030101061000010201000c969749c74343d53a00c5cd79f5301ddf1fdc7283cd04a8f1083c17e1944c5c7cbed10b12ee27e4b5d4eb1430e87e9f739302bc725d88acd7f03e5db8b5cd7d9d89cd283ade84801b26aa4e337d4b31589f1bf73c906348443555a170e26ba0ec25df48d057c543282027d39982bfd922e3efc5fea974147b2a1439ef3be601084102ab0c4974ef2dde486b00c9b5110a812bf2a4913ed711ae9b749c45779344535984212c852b5bc1056d1389d51ae647fe6341fcc24109f379da2762aa8def42675dc0472220927b6b0b3f93082ab8ab06df5dfb76e4645dda6ddd2c588229ad183ca921501b EAP-Message = 0xa3bbac963e046ef6c7c96392af28b267d494957e189efda814030100010116030100201f15bf9882f5f81840a2f0b88eacf2b32487bec7a66273e6bae9f5899090f568 NAS-IP-Address = 192.168.1.250 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ITDEPT.COM\scoe", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 3 to 192.168.1.250 port 1034 EAP-Message = 0x01040031190014030100010116030100204c2d5ce111b4cf1d8484d0a7b0bc663743b67f0dfcf3bc69dfa62631fd9d3e30 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x992715679a230cebdde85f1a77c9228b Finished request 11. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.250 port 1034, id=4, length=216 Message-Authenticator = 0xfb5cafdd0840b6ccedd584509afb6159 Service-Type = Framed-User User-Name = "ITDEPT.COM\\scoe\000" Framed-MTU = 1488 State = 0x992715679a230cebdde85f1a77c9228b Called-Station-Id = "00-17-9A-09-C4-DD:scoeit" Calling-Station-Id = "00-13-02-12-16-6E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400061900 NAS-IP-Address = 192.168.1.250 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ITDEPT.COM\scoe", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 4 to 192.168.1.250 port 1034 EAP-Message = 0x0105002019001703010015b1bb8da1accb8c051e43c474f0b25b6888371dafd2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x992715679d220cebdde85f1a77c9228b Finished request 12. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.250 port 1034, id=5, length=253 Message-Authenticator = 0x559b57aca5bffa7b01a186f5ae288fc8 Service-Type = Framed-User User-Name = "ITDEPT.COM\\scoe\000" Framed-MTU = 1488 State = 0x992715679d220cebdde85f1a77c9228b Called-Station-Id = "00-17-9A-09-C4-DD:scoeit" Calling-Station-Id = "00-13-02-12-16-6E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0205002b19001703010020a690881c896db8f3366ba3ee32944a59d4b9fea829756099f89ed10931342409 NAS-IP-Address = 192.168.1.250 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ITDEPT.COM\scoe", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - ITDEPT.COM\scoe [peap] Got tunnled request EAP-Message = 0x02050014014954444550542e434f4d5c73636f65 server (null) { PEAP: Got tunneled identity of ITDEPT.COM\scoe PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to ITDEPT.COM\scoe Sending tunneled request EAP-Message = 0x02050014014954444550542e434f4d5c73636f65 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ITDEPT.COM\\scoe" Service-Type = Framed-User Framed-MTU = 1488 Called-Station-Id = "00-17-9A-09-C4-DD:scoeit" Calling-Station-Id = "00-13-02-12-16-6E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" NAS-IP-Address = 192.168.1.250 NAS-Port = 1 NAS-Port-Id = "STA port # 1" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "ITDEPT.COM\scoe", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 5 length 20 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010600291a01060024100063da3b7cc3f43eabec58facf4e1a544954444550542e434f4d5c73636f65 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5dac34625daa2ecf48629eb40108d58e [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010600291a01060024100063da3b7cc3f43eabec58facf4e1a544954444550542e434f4d5c73636f65 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5dac34625daa2ecf48629eb40108d58e [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 5 to 192.168.1.250 port 1034 EAP-Message = 0x01060040190017030100352c6462427fabed095dd20eb0a27126d825f307f85f0ecd4fd26ae52617d9731aa14fcadeb19fac8fc0d0137ed2f8014bf4ef79384e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x992715679c210cebdde85f1a77c9228b Finished request 13. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.250 port 1034, id=6, length=307 Message-Authenticator = 0xa39a6fe70736fcc5f6106730554498e1 Service-Type = Framed-User User-Name = "ITDEPT.COM\\scoe\000" Framed-MTU = 1488 State = 0x992715679c210cebdde85f1a77c9228b Called-Station-Id = "00-17-9A-09-C4-DD:scoeit" Calling-Station-Id = "00-13-02-12-16-6E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0206006119001703010056ef7f7df93da28d67e1bb560078a1f55a38558fc7fe965a4d12729fedfd5978ea7678f294285464c7a58049a65ac6bfed51f72f89937a6275d512063adefe77cd4a4866c11af7b1d49e60f77003a2581559e005a77732 NAS-IP-Address = 192.168.1.250 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ITDEPT.COM\scoe", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 97 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunnled request EAP-Message = 0x0206004a1a02060045315c0291fe1459500e2ea66e03781a141b0000000000000000a1f11ae4843edcb38707bda4af4252c47ea544de54571725004954444550542e434f4d5c73636f65 server (null) { PEAP: Setting User-Name to ITDEPT.COM\scoe Sending tunneled request EAP-Message = 0x0206004a1a02060045315c0291fe1459500e2ea66e03781a141b0000000000000000a1f11ae4843edcb38707bda4af4252c47ea544de54571725004954444550542e434f4d5c73636f65 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ITDEPT.COM\\scoe" State = 0x5dac34625daa2ecf48629eb40108d58e Service-Type = Framed-User Framed-MTU = 1488 Called-Station-Id = "00-17-9A-09-C4-DD:scoeit" Calling-Station-Id = "00-13-02-12-16-6E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" NAS-IP-Address = 192.168.1.250 NAS-Port = 1 NAS-Port-Id = "STA port # 1" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "ITDEPT.COM\scoe", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 6 length 74 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] NT Domain delimeter found, should we have enabled with_ntdomain_hack? [mschap] Told to do MS-CHAPv2 for ITDEPT.COM\scoe with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.1.250 port 1034 EAP-Message = 0x010700261900170301001b0b161d0dbb31d7d3cd65286f7aa084ee8708935bed2bc963e60797 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x992715679f200cebdde85f1a77c9228b Finished request 14. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.250 port 1034, id=7, length=248 Message-Authenticator = 0x5b1ec30419fb1addf07d5979c76176e0 Service-Type = Framed-User User-Name = "ITDEPT.COM\\scoe\000" Framed-MTU = 1488 State = 0x992715679f200cebdde85f1a77c9228b Called-Station-Id = "00-17-9A-09-C4-DD:scoeit" Calling-Station-Id = "00-13-02-12-16-6E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020700261900170301001b01aef267bca260c0c202dbaad96a2914551d213d9a74266916a21a NAS-IP-Address = 192.168.1.250 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ITDEPT.COM\scoe", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ITDEPT.COM\scoe attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 15 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 15 Sending Access-Reject of id 7 to 192.168.1.250 port 1034 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 8 ID 0 with timestamp +558 Cleaning up request 9 ID 1 with timestamp +558 Cleaning up request 10 ID 2 with timestamp +559 Cleaning up request 11 ID 3 with timestamp +559 Cleaning up request 12 ID 4 with timestamp +559 Cleaning up request 13 ID 5 with timestamp +559 Cleaning up request 14 ID 6 with timestamp +559 Waking up in 1.0 seconds. Cleaning up request 15 ID 7 with timestamp +559 Ready to process requests. -- View this message in context: http://www.nabble.com/eap-peap-%22challenge%22-error-for-windows-XP-clients… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Reloading CRL for EAP-TLS
by Jan Tomasek 13 Mar '09

13 Mar '09

Hi, I'm trying implement freeRadius for users using EAP-TLS. My eap.conf: > eap { > ... > > tls { > private_key_file = /etc/ssl/private/radius.etest.cesnet.cz.key.pem > certificate_file = /etc/ssl/certs/radius.etest.cesnet.cz.crt.pem > > CA_path = /etc/ssl/certs/ > > fragment_size = 1024 > > include_length = yes > > check_crl = yes > } > When CRL is changed on disk during freeRadius is running it never notices changed version and still uses older cached. This behavior come from OpenSSL I guess. For my implementation is this serious problem. Complete restart of freeRadius will break ongoing EAP sessions and introduce random problems with service for users I found mailing list post: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg31354.… When I try send HUP signal to running freeRadius it crashes with return code 1 in case it didn't process any request. Log output is in file crash1.log When I send HUP signal to running freeRadius which processed several requests it survive and crash with segfault after receiving first request after the HUP signal. Log output is in crash2.log I was testing with freeRadius version 1.1.4 and 1.1.7 both with same result. Is there chance to get this fixed? Best regards -- ----------------------- Jan Tomasek aka Semik http://www.tomasek.cz/

4 6

Help setting up machine auth with peap
by Josh Hiner 13 Mar '09

13 Mar '09

Have a radius box setup and am using ntlm_auth to authenticate peapv0 with mschapv2 in the inner tunnel off a samba pdc. All normal users authenticate fine. When I try to authenticate using the machine account I get this: eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for host/cc20000 with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=cc20000$ [mschap] setting NT-Domain to same as machine name [mschap] expand: --domain=%{mschap:NT-Domain:-ISD} -> --domain=cc20000 [mschap] mschap2: bc [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=857e792244c9e024 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0e44e0288f3f64004f58718f93e09c629670ab97d1e997bf Exec-Program output: Must change password (0xc0000224) Exec-Program-Wait: plaintext: Must change password (0xc0000224) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [host/cc20000] (from client CCISD-REMC-Radius port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 71 to 172.17.10.108 port 1033 EAP-Message = 0x010900261900170301001b34bc45f7fbc2e102f7ec6da756ce808f27d99f1074294fb3b5b69c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb410f68ebc19efa88b187555f468f0ff Finished request 18. I do see the "Exec-Program output: Must change password (0xc0000224)" which to me means the computer account password has expired? I tried removing and re-adding the computer to the domain but get the same error. Any ideas? Anyone else successfully doing peapv0 auth with machine accounts and ntlm_auth? Thanks for any help.

2 2

FW: Help to by a NAS
by Leonardo Mártyres 13 Mar '09

13 Mar '09

Hi, Could someone suggest some AP models to buy? I want to do account properly with freeradius. Thanks _________________________________________________________________ Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx…

1 0

Re: Error in authentication
by Jaswinder Kaur 13 Mar '09

13 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Alan, I have found the problem with my radius authentication. My CA certificate had expired, which was the root of the issue. But its been sorted now. Cheers, JK -----BEGIN PGP SIGNATURE----- Version: PGP Universal 2.9.0 (Build 472) Charset: US-ASCII wsBVAwUBSbpWVvsvZpRjP72bAQg+JwgAqfLJyQth+oNaZDadrTUT8M6GO1bFGF+g WDDvb3p9woJhyhg2opG63/i0MdVJBC2AAUI8NwBFCGCOKIf5G2szarF5PVN/cvRJ bWJjQm1fhUg3M8FS6EgMsg1C2KwKY0Gef5Qcd0NnW33MuOA+BwwAmCD+zRNbNVnv 9mfYjZZoifjBvLq1/p0VrKNszf3IrAoaxQVKN00qE9Wg73NwYoHJlMaxxYkZr56s FjoR9jGfR4r8uM1N1rYUH3wjKB+r3jpbts/xLkGCEVet1NY3c13bNAiy+hO3dzKL lRsjf7HPrg1HnvNECw2Rk+g5JDpo3lYdr14B+6bfNH5mDIMGq0Z7Jw== =Tgav -----END PGP SIGNATURE----- Access your county council services online 24 hours a day, 7 days a week at www.northyorks.gov.uk. WARNING Any opinions or statements expressed in this e-mail are those of the individual and not necessarily those of North Yorkshire County Council. This e-mail and any files transmitted with it are confidential and solely for the use of the intended recipient. If you receive this in error, please do not disclose any information to anyone, notify the sender at the above address and then destroy all copies. North Yorkshire County Council�s computer systems and communications may be monitored to ensure effective operation of the system and for other lawful purposes. Although we have endeavoured to ensure that this e-mail and any attachments are free from any virus we would advise you to take any necessary steps to ensure that they are actually virus free. If you receive an �out of office� notice from the person you are contacting and you wish to request information under either the Freedom of Information Act, the Data Protection Act or the Environmental Information Regulations please forward your request by e-mail to the Data Management Team (datamanagement.officer(a)northyorks.gov.uk) who will process your request. North Yorkshire County Council.

1 0

rlm_ldap: default_profile not expanded
by Giovanni Lovato 13 Mar '09

13 Mar '09

Is the default_profile setting in modules/ldap supposed to expand runtime variables? I tried to set: default_profile = "cn=default,ou=%{Realm},ou=profiles,dc=mc,dc=com" but on the logs I see: rlm_ldap: performing search in cn=default,ou=%{Realm},ou=profiles,dc=mc,dc=com rlm_ldap: object not found If I set: default_profile = "cn=default,ou=company,ou=profiles,dc=mc,dc=com" it works.

2 1

Re: radiusd: symbol lookup error: /usr/lib/rlm_eap_tls-2.1.3.so: undefined symbol
by Peter Param 13 Mar '09

13 Mar '09

>>You have two different versions of OpenSSL installed. I'm really stumped by this. I'm replaced the default debian openssl libraries (as per... ldconfig -v | grep ssl) with openssl 0.9.8.j and am still getting the pesky error, radiusd: symbol lookup error: /usr/lib/rlm_eap_tls-2.1.3.so: undefined symbol: SSL_CTX_set_info_callback Is libgnutls-openssl.so.13 referenced by freeradius? That's the only file I haven't been able to replace. What else can I do? Any help would be greatly appreciated! cheers Peter -X output: FreeRADIUS Version 2.1.3, for host i686-pc-linux-gnu, built on Mar 13 2009 at 09:54:32 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including dictionary file /etc/freeradius/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } radiusd: symbol lookup error: /usr/lib/rlm_eap_tls-2.1.3.so: undefined symbol: SSL_CTX_set_info_callback ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

Accounting server reply
by rosect190＠yahoo.com 13 Mar '09

13 Mar '09

Hi, Does an accounting server reply to a NAS's accounting message? How does an NAS know that the accounting message is lost (due to accounting server failure)? Thanks.

2 1