- Freeradius-Users - lists.freeradius.org

XP SP3 an EAP-TLS partly solution
by Alexandros Gougousoudis 29 Jan '09

29 Jan '09

Hi, I'am still having some problems using EAP-TLS with SP3 on XP. Though I have a partly solution, after excessive googeling. I will provide it here, because I think a lot of people must have the same problems and if they're using Freeradius, they will probably look here. I found that you can't use a registry patch anymore to enable a machine-based authentification. You need to use XML Files to make a profile and load it within XP. MS explained that very well in: http://support.microsoft.com/?scid=kb%3Ben-us%3B929847&x=16&y=10 You need to do it that way, regardless if you have a wired or wlan setup. So I was very excited, but it's still not working. My radiusd -X -A shows exactly nothing, if XP reboots, there is no ongoing conversation or an error. So I enabled debug logging in xp and found some interessting lines. I thought, because radius isn't writing anything to the screen, that XP isn't sending anything that was wrong. OneXModule.LOG says (only quoting lines with "error"): [1516] 01-22 14:19:31:093: Port(2): 802.1X authentication failed with reason = "Empfang eines expliziten Eap-Fehlers" and error code = 0x40420110 ... [1516] 01-22 14:19:31:109: (MarshallEapError:1392) Allocated memory 000E1E00, size = 432 ... [1512] 01-22 14:19:31:109: (FreeEapError:1302) Freed memory 000CA730 [1512] 01-22 14:19:31:109: (FreeEapError:1303) Freed memory 000CCFC0 [1512] 01-22 14:19:31:109: (FreeEapError:1304) Freed memory 000CAC60 ... [1904] 01-22 14:19:49:250: Port(3): Received a failure indication from the local Eap dll with error code 0x40420110 and reason code 0x40420110 [1904] 01-22 14:19:49:250: Port(3): Eap error info contains winError=0x40420110, reasonCode=0x40420110, EapMethod(Type=0), rootCauseString=Fehler bei der Authentifizierung, weil ein Problem mit dem Benutzerkonto besteht. [1904] 01-22 14:19:49:250: (DuplicateEapError:1320) Allocated memory 000C6290, size = 80 The rootCauseString means: "Error with authentification, because there is a problem with the useraccount". The errorcode is unkown to google. EAPOL.LOG says: [1148] 14:18:17:781: ElRegistryUpdateXPBeta2: Error in RegOpenKeyEx for base key, 2 [1148] 14:18:17:828: ElUpdateRegistry: ElRegistryUpdateXPBeta2 failed with error 2 [1148] 14:18:17:828: QEC Init succeeded with dwRetCode = 0 [1148] 14:18:17:828: ElMediaInit: Entered [1148] 14:18:17:828: ElReadGlobalRegistryParams: Error in RegQueryValueEx for cwszSupplicantMode, 2, InfoSize=4 [1148] 14:18:17:828: ElReadGlobalRegistryParams: Error in RegQueryValueEx for cwszPMKCacheMode, 2, InfoSize=4 [1148] 14:18:17:828: ElReadGlobalRegistryParams: Error in RegQueryValueEx for cwszPMKCacheTTL, 2, InfoSize=4 [1148] 14:18:17:828: ElReadGlobalRegistryParams: Error in RegQueryValueEx for cwszPMKCacheSize, 2, InfoSize=4 [1148] 14:18:17:828: ElReadGlobalRegistryParams: Error in RegQueryValueEx for PreauthMode, 2, InfoSize=4 [1148] 14:18:17:828: ElReadGlobalRegistryParams: Error in RegQueryValueEx for PreauthTimeout, 2, InfoSize=4 [1148] 14:18:17:828: ElReadGlobalRegistryParams: Error in RegQueryValueEx for cwszPreauthThrottle, 2, InfoSize=4 ... [1148] 14:18:17:921: ElGetWinStationUserToken: GetWinStationUserToken failed for SessionId (0) with error (1702) [1148] 14:18:17:921: ElGetWinStationUserToken: GetCurrentUserTokenW failed with error (1245) ... So whats the problem? Is there some kine of Registry hassle? I took a new PC with a new XP Pro (inkl. SP3) installed. There are no old leftovers. So eap looks very buggy and beta. The certs are ok, they work with XP SP2, so why doesn't want SP3 it? I'am using now Freeradius 1.1.6 (I had 1.1.0) and made no changes to my setup or config files, since XP SP2, Win2000 and Linux authenticate without problems. Do I have to change something in Freeradius to make it work, beside upgrade the version? Is anyone around here doing an EAP-TLS with XP SP3 machines? Please give a hint. I'd love to owe you a beer. :-) TIA Alex

4 9

RE: Calling-Station-Id Check Erroring
by Eric Geier 29 Jan '09

29 Jan '09

> Try SELECT * FROM radcheck WHERE value='00-1C-B3-B1-3E-07' and see if > that line gets listed. You might have white space around it. It should > match. > > Ivan Kalik > Kalik Informatika ISP That correctly returns it: 7 eric1328 Calling-Station-Id == 00-1C-B3-B1-3E-07 I've tried many things. Do you have any other ideas? I have 2.1.3-1.fc10 installed on Fedora 10. I'm using a hosted MySQL DB at the moment, from my web hosting co. Thanks! Eric

2 1

Hosts restriction with FreeRadius and OpenLDAP
by scouffa7 29 Jan '09

29 Jan '09

Hello everybody, I'm setting up a freeradius configuration for authenticating users on a number of technologies (pix, nokia, ...). Users accounts are stored in a backend OpenLDAP. I'm willing to allow users to authenticate to specific machines, that I would like to choose and administrer from the accounts on the LDAP server (in a centralized manner). Is this possible, and how could I implement it? Thx for help, -- View this message in context: http://www.nabble.com/Hosts-restriction-with-FreeRadius-and-OpenLDAP-tp2172… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

RE: Calling-Station-Id Check Erroring
by Eric Geier 29 Jan '09

29 Jan '09

> >When I try to do MAC auth, it shows No User, though it works fine when > I > >remove the Calling-Station-Id check item from MySQL. Debug shows > quotes > >around MAC.I put MAC in database with and without quotes and still > errors. > > > > No quotes. > > >Any ideas? > > Log into your database and post here the result of this query: > > >-> SELECT id, username, attribute, value, op FROM radcheck > >WHERE username = 'eric1328' ORDER BY id > > Ivan Kalik > Kalik Informatika ISP Here's the result, Ivan: 5 eric1328 Cleartext-Password PASSWORD := 7 eric1328 Calling-Station-Id 00-1C-B3-B1-3E-07 == Thanks!

2 1

[ Re: eap-ttls failing]
by Josh Hiner 29 Jan '09

29 Jan '09

-------- Original Message -------- Subject: Re: eap-ttls failing Date: Tue, 27 Jan 2009 11:58:54 -0500 From: Josh Hiner <josh(a)remc1.org> To: Josh Hiner <josh(a)remc1.org> References: <O6ukdVry.1233065929.9664600.tnt(a)kalik.net> <497F230B.1050103(a)remc1.org> <497F237C.7020306(a)remc1.org> Josh Hiner wrote: > Josh Hiner wrote: >> tnt(a)kalik.net wrote: >>>> Whoops, I thought I solved this but I didnt. I tried setting up >>>> eap-tls >>>> on a few different laptops each using windows xp to configure eap-tls >>>> (not the wireless card client). I get the same results there. I have >>>> nothing in my /etc/raddb/users file. I tried putting: >>>> josh Auth-Type := eap >>>> Auth-Type := Accept >>>> >>> >>> Don't do that. Don't force Auth-Type. It's not going to help and it >>> will break everything else. >>> >>> >>>> On the XP client I also notice that even though I have the Certificate >>>> Authority installed, the client certificate reports: Windows does not >>>> have enough information to verify this certificate. >>>> >>>> I figured that the certificate chain was broken. As a test, I imported >>>> the server certificate and stuck it in the Trusted root authorities >>>> section. This completed the chain (since the client cert was signed >>>> off >>>> the server cert which is what the make client does in >>>> /etc/raddb/certs). >>>> But, of course, the server cert is not meant to be a cert authority so >>>> windows xp complains about this. >>>> >>> >>> That is the problem. Windows won't recongnize server certificate as >>> intermediate ca any more. The "cure" is to try signing client >>> certificates with ca certificate instead. I have posted to the list an >>> altered Makefile with make caclient.pem command added a few days >>> ago. If >>> you can't find it I will post another one this evening. >>> >>> Ivan Kalik >>> Kalik Informatika ISP >>> >> I did find the Makefile. Thanks! I tried to do a make caclient.pem >> but it threw this error: >> >> openssl req -new -out caclient.csr -keyout caclient.key -config >> ./client.cnf >> Generating a 2048 bit RSA private key >> ...........+++ >> .......+++ >> writing new private key to 'caclient.key' >> ----- >> openssl ca -batch -keyfile ca.key -cert ca.pem -in caclient.csr -key >> `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out >> caclient.crt -extensions xpclient_ext -extfile xpextensions -config >> ./client.cnf >> Using configuration from ./client.cnf >> wrong number of fields on line 1 (looking for field 6, got 1, '' left) >> make: *** [caclient.crt] Error 1 >> >> I dont need to re-do my CA and server cert prior to making the client >> certs do I? > Ha, never mind. My index.txt file was messed up. -josh > Ok, made new client cert and now it shows valid and displays "Provides your identity to a remote Computer" as the intended purpose and on the Details tab displays the correct info etc... The Certification Path displays valid. Still same problem though (exact same problem) of just sitting there at "Attempting to authenticate". Here is what just loops over and over: Ready to process requests. rad_recv: Access-Request packet from host 172.17.10.108 port 1027, id=66, length=172 User-Name = "josh" NAS-IP-Address = 172.17.10.108 NAS-Identifier = "00:1f:41:3a:82:f9" NAS-Port = 1 Called-Station-Id = "00-1F-41-3A-82-F9:CCISD-REMC1" Calling-Station-Id = "00-16-B6-5C-AC-DD" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02050009016a6f7368 Message-Authenticator = 0x864461492a35fa412e30d0f27ea0cbf3 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "josh", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "josh", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 5 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 66 to 172.17.10.108 port 1027 EAP-Message = 0x010600060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xca0fec0fca09e1323ddcba98066d48ce Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.10.108 port 1027, id=67, length=261 User-Name = "josh" NAS-IP-Address = 172.17.10.108 NAS-Identifier = "00:1f:41:3a:82:f9" NAS-Port = 1 Called-Station-Id = "00-1F-41-3A-82-F9:CCISD-REMC1" Calling-Station-Id = "00-16-B6-5C-AC-DD" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020600500d800000004616030100410100003d0301497f27683f3a7573ff79fcadddfc58dc798d58ccc564e5c7b41ce43a496553e400001600040005000a000900640062000300060013001200630100 State = 0xca0fec0fca09e1323ddcba98066d48ce Message-Authenticator = 0x05b1b4bffe53467521d36730cbdcb0c5 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "josh", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "josh", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 6 length 80 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 70 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0041], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 0846], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00a3], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 67 to 172.17.10.108 port 1027 EAP-Message = 0x010704000dc000000922160301002a020000260301497f275f1e637695516efe671e6034f85e39ab843b20fc5997cd278f000000000000040016030108460b00084200083f0003a4308203a030820288a003020102020101300d06092a864886f70d0101050500308191310b30090603550406130255533111300f060355040813084d6963686967616e3110300e0603550407130748616e636f636b310e300c060355040a130552454d43313120301e06092a864886f70d0109011611737570706f72744072656d63312e6e6574312b30290603550403132252454d43312052616469757320436572746966696361746520417574686f72697479301e EAP-Message = 0x170d3039303132373034313133385a170d3239303132323034313133385a307c310b30090603550406130255533111300f060355040813084d6963686967616e310e300c060355040a130552454d4331312830260603550403131f52454d433120526164697573205365727665722043657274696669636174653120301e06092a864886f70d0109011611737570706f72744072656d63312e6e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100df5db79ac92e13bb06dd2458db371fa0c22ebd220440aa0747e98a13d64027fa10720c69b224d607bfd2a7b2836c224cefca5113d0c56cf7d97d25703bb05f8b EAP-Message = 0xff12c9dfc2fd602271f2e9200e9c196d6e9018840e69c6c82a62e77d946ad60562c576c4b7206c8d2d378a7c84f99fb64dfa51a87021ccf234c76e91159c2dfbbeb1095cc81ea26d39dc0a078011b3c70bdd11f0800f8391737591b7bf005551bc4ba051cf7e83d2d883c946372059167cabb6514ab5068c7274662639825e37d705d415cb370df3aa1088e87d8c3bf7df5116dd61d589831dfe2e0d347ae15227c48900964d24fa574dab1166e4d5a100741f7cf4088e3e47ae88ae3793f7990203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003820101003730d65b9ae051938bdd36 EAP-Message = 0x33b834dd5cef73a38bf01b1e9dead12841c954d04cb564c884b4529af0faf9a71b46ac5f554fcbe64e9c5be604392e8fd0b5f62aab2fe7155e828bb06e456fc26c30a90b417cb6b6fa68eda56eb29653514ba78c0f0852a7c17ade33eb38f9edf423f9d1fc72bba6549c3c4bf20bec437fcdca0d16a8f4e4bab8c8f82eddd48878165d383ea8291d4f0e922cdd4871ea92f72340e930efc3bb6ab917bccd92c95ec69575bde85e5bbd3e3c52285345881f4e758074df363d49dc044abd145ebc070aeec28dfb36341146c52a152bbd80a8833599c35caa44ed4c38ea2e6fecbadb59d0f487777f7d0bcec13bbb19bb93492b99e1c70004953082049130 EAP-Message = 0x820379a00302010202010030 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xca0fec0fcb08e1323ddcba98066d48ce Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.10.108 port 1027, id=68, length=187 User-Name = "josh" NAS-IP-Address = 172.17.10.108 NAS-Identifier = "00:1f:41:3a:82:f9" NAS-Port = 1 Called-Station-Id = "00-1F-41-3A-82-F9:CCISD-REMC1" Calling-Station-Id = "00-16-B6-5C-AC-DD" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020700060d00 State = 0xca0fec0fcb08e1323ddcba98066d48ce Message-Authenticator = 0x9799f67311b1f6aef50af33fc748ba4e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "josh", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "josh", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 68 to 172.17.10.108 port 1027 EAP-Message = 0x010804000dc0000009220d06092a864886f70d0101040500308191310b30090603550406130255533111300f060355040813084d6963686967616e3110300e0603550407130748616e636f636b310e300c060355040a130552454d43313120301e06092a864886f70d0109011611737570706f72744072656d63312e6e6574312b30290603550403132252454d43312052616469757320436572746966696361746520417574686f72697479301e170d3039303132373034313131325a170d3239303132323034313131325a308191310b30090603550406130255533111300f060355040813084d6963686967616e3110300e0603550407130748616e EAP-Message = 0x636f636b310e300c060355040a130552454d43313120301e06092a864886f70d0109011611737570706f72744072656d63312e6e6574312b30290603550403132252454d43312052616469757320436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100b49dd90b47ecf8f3f0cd3c5c925e8891da336543215709231a08521a69e856b5e1a5061417fc7b859738da4d81033c6b6149535830a03c2b4554a71d67c5e0694ad03f0708c818ebcb596cce15740a0053a7e41b24551c63efeb928664aadb3cbce4ada1867ef56926909bf1c5914b0463f681a8ce59283ba5 EAP-Message = 0x2316add0dfd36901ec2b2da655be187efe786c36cd9c9a09a51a065333dff65e991e3b88bd826f9f07b5c7bf0366dfaf1fd44870e4c8df99a987dab4d955c104ea5fb3a0dedaed2e758a75508b4a5bb88f06c9f80c5d4633057f6624247230a9ff3bf64adc9853f366f9d7c487825be1b0b5137b85a8ee4b07af87b6cfb8341fe5ff4b7780677d0203010001a381f13081ee301d0603551d0e04160414b0af659819810e066c1fae3a2f9a9fc3377af5693081be0603551d230481b63081b38014b0af659819810e066c1fae3a2f9a9fc3377af569a18197a48194308191310b30090603550406130255533111300f060355040813084d696368696761 EAP-Message = 0x6e3110300e0603550407130748616e636f636b310e300c060355040a130552454d43313120301e06092a864886f70d0109011611737570706f72744072656d63312e6e6574312b30290603550403132252454d43312052616469757320436572746966696361746520417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d010104050003820101007cac0b9cc3c3cb9405ff81979b7d8d746e09761c5f85ca3d313e8c2fe2faa361556fb274dc24f45e7573f78fe061582266430cc381196b92e326f2cf5ba7625549f2a9708e8150129eca8e033ecce9acdf069eb1615a3088039cd0dda72e7d73e7f5bd60a8a5 EAP-Message = 0xcbdf5f73170cd3ed1a52364e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xca0fec0fc807e1323ddcba98066d48ce Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.17.10.108 port 1027, id=69, length=187 User-Name = "josh" NAS-IP-Address = 172.17.10.108 NAS-Identifier = "00:1f:41:3a:82:f9" NAS-Port = 1 Called-Station-Id = "00-1F-41-3A-82-F9:CCISD-REMC1" Calling-Station-Id = "00-16-B6-5C-AC-DD" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020800060d00 State = 0xca0fec0fc807e1323ddcba98066d48ce Message-Authenticator = 0x07dba943335930dd66ff91cc53f3a302 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "josh", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "josh", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 8 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 69 to 172.17.10.108 port 1027 EAP-Message = 0x010901400d8000000922101bd464323e493c6bc2a2d48f905e1afede5f663de695fede560cd70864dca08c7078aec5299f07dcf4fb24c0274678071ce5a15b8e28b322b12b665ed600b782c6eefc624e851ac89390f929f19a7e26d494e730702c031e47e5f7dca498859b2c634abc1807eedcff4a5be51fed6c56c2ffb2db730e219cdc535d563752f23011f00d8bbb819fbb1e4a3cd14d16030100a30d00009b02010200960094308191310b30090603550406130255533111300f060355040813084d6963686967616e3110300e0603550407130748616e636f636b310e300c060355040a130552454d43313120301e06092a864886f70d01090116 EAP-Message = 0x11737570706f72744072656d63312e6e6574312b30290603550403132252454d43312052616469757320436572746966696361746520417574686f726974790e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xca0fec0fc906e1323ddcba98066d48ce Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 66 with timestamp +18 Cleaning up request 1 ID 67 with timestamp +18 Cleaning up request 2 ID 68 with timestamp +18 Cleaning up request 3 ID 69 with timestamp +18 Ready to process requests.

4 12

Access-Challenge authentication via both LDAP and SecurID
by Amy Hawke 29 Jan '09

29 Jan '09

Hi, I'm trying to implement two factor authentication using a CISCO VPN device, freeRADIUS, and RSA SecurID tokens. We would like to utilise existing username/password infrastructure by performing this part of the authentication on the LDAP directories and then the username/token-code authentication to occur via the RSA product. The initial LDAP authentication has been implemented correctly. Is it possible to use FreeRADIUS to perform an initial authentication Username/Password and respond with an Access-Challenge and then when the the second Access-Request comes through, proxy it through to the RSA Authentication Manager? And if so, what is the best approach to take to implement this? Thanks for your help with this, Amz _________________________________________________________________ It's simple! Sell your car for just $40 http://a.ninemsn.com.au/b.aspx?URL=http%3A%2F%2Fsecure%2Dau%2Eimrworldwide%…

3 6

Calling-Station-Id Check Erroring
by Eric Geier 28 Jan '09

28 Jan '09

When I try to do MAC auth, it shows No User, though it works fine when I remove the Calling-Station-Id check item from MySQL. Debug shows quotes around MAC.I put MAC in database with and without quotes and still errors. Any ideas? Thanks! Eric SQL DATABASE: DEFAULT Fall-Through = Yes eric1328 Cleartext-Password := PASSWORD eric1328 Calling-Station-Id == 00-1C-B3-B1-3E-07 DEBUG: ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "eric1328", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 164 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 98 to 192.168.0.1 port 21693 EAP-Message = 0x01a503fc194000f5762e66fa9d8422300d06092a864886f70d0101050500308193310b3009 060355040613024652310f300d06035504081306526164697573311230100603550407130953 6f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a 864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d 4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303131 313139303133315a170d3130303131313139303133315a308193310b30090603550406130246 52310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120 301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603 550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122 300d06092a864886f70d01010105000382010f003082010a0282010100f1cbee04f9676e1c96 ebbe8d583605ad2deaf236abc16a11249f38d1677d43ea83dcceace1271e165fa2c7371e02c0 94dfdd082f17cfee16d6fb6a75e828d4e46437e8850eea413de14cc89d420c8fd641bec5b836 f93376071d6fc38250efcc850cfdf79e26a92c3909faa42cc2ef EAP-Message = 0x3b6535fd406d7a979ac98783eb6945a286d076aa1408b0c7de16e0ae23c70711049e7727c1 ff4a6c8f4854a6a278308de17d3175d2a4ba9d2f96278f84b96e8446bba5947820790093a125 a06bcc8f958f75027aa07da3463fadbd8c94b9c005a95a8308fda13544df89c4a00b9c762837 16be460a0d2ccf10bbd253047e0517a3be0598567f7828a42a2f49c22d4b8fcb0203010001a3 81fb3081f8301d0603551d0e04160414f95bfae9eee917ed848faa188aea05423fc10a2d3081 c80603551d230481c03081bd8014f95bfae9eee917ed848faa188aea05423fc10a2da18199a4 8196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d6577686572653115301306035504 0a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e40 6578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963 61746520417574686f72697479820900f5762e66fa9d8422300c0603551d13040530030101ff 300d06092a864886f70d01010505000382010100514f7f2cb414fdba2fdf77e4f29fe5d7697f 933a0b6e5dd85355df5d1979147096260545f3dc2faf8e127292456eca6accb00a2a855ba96b 9a31fdd1fec998ac5028ad5bfb02ce0cc69d5a39ce28a8d3ae92 EAP-Message = 0xd12dca84626e1183 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a9af390993fea28ebd7065f57cfd5e2 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 21693, id=99, length=105 User-Name = "eric1328" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x9a9af390993fea28ebd7065f57cfd5e2 EAP-Message = 0x02a500061900 Message-Authenticator = 0x6b08abda82ea369fb42a1c300666c8a9 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.1/auth-detail-20090128 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.1/auth-detail-20090128 [auth_log] expand: %t -> Wed Jan 28 10:08:48 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "eric1328", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 165 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 99 to 192.168.0.1 port 21693 EAP-Message = 0x01a600b519003c63087fd1ffa76eaead2ddca3501c2b0ad762482215581804242c0e3fa523 9347513a5fecb4860e64aa93af7b78509316c260bee87d3d9c71d5ff981dddbdee561dd35a9d 863bbb97ea2bcc7bf5be923833eba09620f3055eb4977d217781f01b5777e4dd4f0a3e8fad4b 98ac4f35519c4400deb13a663737e330dcc81852b807c34b8f287727394e8873b08059bebd25 26fc9af290c4b50f460db89aeb2ef70709904d86db16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a9af3909e3cea28ebd7065f57cfd5e2 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 21693, id=100, length=437 User-Name = "eric1328" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x9a9af3909e3cea28ebd7065f57cfd5e2 EAP-Message = 0x02a60150198000000146160301010610000102010015e07115bcb9fbbc93abce7a91dd7369 ef22d52495326fa65147364304dbd31e06605bb2bf682c0d3504ec792f6eab09a924a2435e7a ae281d151de03c5fcc0e1d99cdcaa52e7fcc6e99228f299f974c0f3d769177a06d742493c06d 310bdf90212c49fedf90bd4d32156b5e1a64810144509c3cf29348dbe46888e4f349b486c6cc 545d8772004ef7299fb826e344364df4af4c06310581e58a96593935c8f3f13ef760497af2d6 a6467772f3eb116034298138b99bfd2cac344f5b70f094cf8c29c0c4d53e4d233be0688a20c4 4063f32857a137435819cb143926bf536a649fee46875dc8e428 EAP-Message = 0x1a91222d5ca7bf781c16628bf635acfbf1f5846c199745b61403010001011603010030be3c f7249124fb25b03a11b76b5fc07a589275055940a5d801209c599ae0de7b7e6bd7e15fb5d245 1ac2cd632ac23179 Message-Authenticator = 0xee555d72422495de2fbb5c975552cc09 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.1/auth-detail-20090128 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.1/auth-detail-20090128 [auth_log] expand: %t -> Wed Jan 28 10:08:48 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "eric1328", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 166 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 100 to 192.168.0.1 port 21693 EAP-Message = 0x01a7004119001403010001011603010030c9a77ba3f2ef8689c1c1f357506c8ed32a474d47 36624bf52da7ad3e4d1025c601676fba45daafde076e8baf1ecbbb8a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a9af3909f3dea28ebd7065f57cfd5e2 Finished request 5. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 21693, id=101, length=105 User-Name = "eric1328" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x9a9af3909f3dea28ebd7065f57cfd5e2 EAP-Message = 0x02a700061900 Message-Authenticator = 0x65fe256227f65fdf404f4543848b95af +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.1/auth-detail-20090128 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.1/auth-detail-20090128 [auth_log] expand: %t -> Wed Jan 28 10:08:48 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "eric1328", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 167 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 101 to 192.168.0.1 port 21693 EAP-Message = 0x01a8002b19001703010020bf063ab4620738f9eedd92219d0bece9fbeb543f33752c0e7f44 8525350354f0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a9af3909c32ea28ebd7065f57cfd5e2 Finished request 6. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 21693, id=102, length=142 User-Name = "eric1328" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x9a9af3909c32ea28ebd7065f57cfd5e2 EAP-Message = 0x02a8002b19001703010020eccc437b43dd6a7c42d2de8276631dc72127ab1f9e42ff311be2 f1374d595f2a Message-Authenticator = 0xb1dd21f5d4c56f8e9deeea2a74b188c2 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.1/auth-detail-20090128 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.1/auth-detail-20090128 [auth_log] expand: %t -> Wed Jan 28 10:08:48 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "eric1328", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 168 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - eric1328 [peap] Got tunneled request EAP-Message = 0x02a8000d016572696331333238 server { PEAP: Got tunneled identity of eric1328 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to eric1328 Sending tunneled request EAP-Message = 0x02a8000d016572696331333238 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "eric1328" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "eric1328", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 168 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> eric1328 [sql] sql_set_user escaped user --> 'eric1328' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'eric1328' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'eric1328' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User eric1328 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x01a900221a01a9001d10505da5e75208728e4183ed570f1f71476572696331333238 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbae8d73eba41cd116372880e81164985 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x01a900221a01a9001d10505da5e75208728e4183ed570f1f71476572696331333238 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbae8d73eba41cd116372880e81164985 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 102 to 192.168.0.1 port 21693 EAP-Message = 0x01a9004b19001703010040d087142a3fe21435656348569a3b0e0c5ea4bff508b77bec644a 0d94edc3c0e0e70e5000b9d27d965b670cd1894dd78f8b0609441c64bb5804bc092ee9b5cda5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a9af3909d33ea28ebd7065f57cfd5e2 Finished request 7. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 21693, id=103, length=206 User-Name = "eric1328" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x9a9af3909d33ea28ebd7065f57cfd5e2 EAP-Message = 0x02a9006b190017030100603aee6bf19ded97d3b37a40a5de93b752ddc952a08cd203826107 234fe48d6c3f06259ab839dc022c651d85faeba18ea1a372f7beb5b7e0879ab851a19a349418 2cc1af62c02a209d4c5fd21be0f2631b5aa8197cf039805b8660b038a1366dd6 Message-Authenticator = 0x892144a42db4aad9a9a8376fcf99ee31 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.1/auth-detail-20090128 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.1/auth-detail-20090128 [auth_log] expand: %t -> Wed Jan 28 10:08:48 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "eric1328", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 169 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x02a900431a02a9003e31af02a5a673cf93e8cf0f0180c90d630e0000000000000000922331 ae61edd2595c25e9db4613992ef9e8124dc11ed2eb006572696331333238 server { PEAP: Setting User-Name to eric1328 Sending tunneled request EAP-Message = 0x02a900431a02a9003e31af02a5a673cf93e8cf0f0180c90d630e0000000000000000922331 ae61edd2595c25e9db4613992ef9e8124dc11ed2eb006572696331333238 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "eric1328" State = 0xbae8d73eba41cd116372880e81164985 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "eric1328", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 169 length 67 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> eric1328 [sql] sql_set_user escaped user --> 'eric1328' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'eric1328' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'eric1328' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User eric1328 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for eric1328 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [eric1328] (from client private-network-1 port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\251E=691 R=1" EAP-Message = 0x04a90004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\251E=691 R=1" EAP-Message = 0x04a90004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 103 to 192.168.0.1 port 21693 EAP-Message = 0x01aa002b1900170301002048fa64ef04156959ee63b45c4fcc4e12accaaab2a60a2394ca2a 760f2e507884 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a9af3909230ea28ebd7065f57cfd5e2 Finished request 8. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 21693, id=104, length=142 User-Name = "eric1328" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x9a9af3909230ea28ebd7065f57cfd5e2 EAP-Message = 0x02aa002b190017030100202916f6564d6d9ba431acbff58f2f080c7400122e76e082424a7e e58e8e031db5 Message-Authenticator = 0xa714f18d12ee34c613cf1ca4610a715a +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.1/auth-detail-20090128 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.1/auth-detail-20090128 [auth_log] expand: %t -> Wed Jan 28 10:08:48 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "eric1328", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 170 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [eric1328] (from client private-network-1 port 0 cli 00-1C-B3-B1-3E-07) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> eric1328 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 104 to 192.168.0.1 port 21693 EAP-Message = 0x04aa0004 Message-Authenticator = 0x00000000000000000000000000000000

2 1

AUTO: Freitag, Thoralf is out of the office. (returning 02.02.2009)
by Thoralf Freitag 28 Jan '09

28 Jan '09

I am out of the office until 02.02.2009. In urgent cases contact HSS via eMail admin(a)ews.biotronik.de, or via telephone -4616. Note: This is an automated response to your message "Re: rlm_sql ignoring fall-through attripute in radreply" sent on 1/28/09 19:37:05. This is the only notification you will receive while this person is away.

1 0

calling-station-id replace and md5 problem
by hege 28 Jan '09

28 Jan '09

Hi I have a problem: 1. The ldap don't replace(expand) the calling-station-id to the mac address, just one time(first) first time: [ldap] expand: (&(employeeType=TRUE)(cn=%{Stripped-User-Name:-%{User-Name}})(macAddress=%{Calling-Station-Id})) -> (&(employeeType=TRUE)(cn=test)(macAddress=0000.a8bb.4444)) next time: [ldap] expand: (&(employeeType=TRUE)(cn=%{Stripped-User-Name:-%{User-Name}})(macAddress=%{Calling-Station-Id})) -> (&(employeeType=TRUE)(cn=test)(macAddress=)) no mac address expanded I have tried %i, but not worked (expanded it to macAddress=_ ??? 2. If i use EAP-PEAP + LDAP(cleartext password) works everything. (def_eap_type=peap) but I want to store the password md5 format in the ldap, what have to change, what is the solution? Really thank you! Gabor here is the debug: rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=186, length=128 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0x062b1cef262b3e644dc7ccf73c2 EAP-Message = 0x0202000174657374 NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "AP-******" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [ldap] performing user authorization for test [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(employeeType=TRUE)(cn=%{Stripped-User-Name:-%{User-Name}})(macAddress=%{Calling-Station-Id})) -> (&(employeeType=TRUE)(cn=test)(macAddress=0000.a8bb.4444)) [ldap] expand: ou=users,ou=wireless,dc=test,dc=hu -> ou=users,ou=wireless,dc=test,dc=hu rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: bind as cn=admin,dc=test,dc=hu to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,ou=wireless,dc=test,dc=hu, with filter (&(employeeType=TRUE)(cn=test)(macAddress=0000.a8bb.4444)) [ldap] Added User-Password = test in check items [ldap] looking for check items in directory... rlm_ldap: macAddress -> Calling-Station-Id == "0000.a8bb.4444" [ldap] looking for reply items in directory... [ldap] user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 186 to 192.168.1.22 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21edcefb21eed7bf189571f209151db8 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=187, length=217 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0x34321379ca3695c51b5ebd770 EAP-Message = 0x0203005019800000004616030100410d030149804ef1e846e0c547f88e3054cbee268ce2b4178c7bc8134b949771a2debdae00001600040005000a0009640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 State = 0x21edcefb21eed7bf189571f209151db8 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "AP-******" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 187 to 192.168.1.22 port 1645 EAP-Message = 0x0104040019c00000089b160301002a02000026030149804eb2858d10f17f4191308ec2be88f30915e2fcd1a2e391f4914c7c6d10ff000004001603010b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c457861706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303132373136323631305a170d3130303132373136323631305a307c310b3009060355040613024652310f300d06035504081306526164697573311530130655040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c652053657276657220436576669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a2dd30f783fedc0ebb06606a9b8ae089768200bf67c5bf9c11f4cb6ceb75e791b149f370e491be2231ad424449e2c78bdb8d38c1159f78dedfb3507346b9 EAP-Message = 0x2072ee1914779b5c41ef3e1655241282fcb585ceb610d2805cf17cf804618d5817af59bebd15600037f728a8ee77bb037f86ef8ee833fc752992dae041cc7ccceef1c68fe577273ab4890ba75b1cc5a681609187ea3d0adb654c5ca4651af30c925cadb2efb859f696f8e53969b8f30379fe1095bfcb6713d750b9fc3a775b0f2531e6a9705400d00ec85e690fe7a7682290c5588ba15bc3da2a4b4ff8141c168c98ab79615734eb0e2e1e26769c0e22581f4eda365fba7701caadd6a5bbbe73490203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100cf12958cc07c7de95c EAP-Message = 0xd176d4d452bdd684a169b50b57a247bdf802a7ff11955f409c7668f5565e369af83ea738359a3bb15e5a40dc7794084cddab8743d7cbe7f0ad93e6672279c25640a575482b5591366cac64e3ec424c2679a0a4d59d2727f3bc4bf68b113d4e4edfee756b077fc7e51222fb4d7e6be43cb2b306ff561e69075a3d70560c90ece9970cc1bb230c450e77db5e0c1c164aa0b4be10c3f7226361f491b7171fc2dd07948d0c634751d2d3700ac600be9969e3f6a05c8bef043cd2035410ad4a96fcd7dfd46f70b803907c8c976b39a01f8c7eb961b4015415b533b749ee5e7c711192f06506190eedcd6c46d08bc062ee9ed071c50004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21edcefb20e9d7bf189571f209151db8 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=188, length=143 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0x6bb7e77a4ec227c2822c42f2b1e6fb EAP-Message = 0x02040061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 State = 0x21edcefb20e9d7b9571f209151db8 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "AP-******" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 188 to 192.168.1.22 port 1645 EAP-Message = 0x010503fc194000e9429c938605a22c300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d06035504081306526164697573311230106035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043657274696669636174417574686f72697479301e170d3039303132373136323631305a170d3130303132373136323631305a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a64886f70d01010105000382010f003082010a0282010100f2747f57bce4bf59d6cc942ac7387d2f81376ad5816d04c8d1ab6091430e895910745313f01c53f4720d43c05ac1287ea26d475826eac158d43a21767296fdd0349d9de9ada5083ff3ee31a254b1f993b21d1e1bed840b241b803bc13546c1789cab52f5865ca4084b74bffe5c1de3 EAP-Message = 0xa3dd190a240f1d1f2104a24e12cb39294ff54a637067da075784279d43072f8e2fe418393ac9f88027076446e612a7dccf08d7cc5d94b9a66ba49d2adb50d1535e6a2389170972f6e66aa09171c47628b409efbe0b0bfcccf8046847b789d80e1f5e1138b7392298b137e6cbb6c8f56952763ce06db19da6cca226cf535352b098764f6ee6bd59ac4ed1ac77909a370203010001a381fb3081f8301d0603551d0e041604140f3428d285dfc3e4e181d546dd066bd5453011b83081c80603551d230481c03081bd80140f3428d285dfc3e4e181d546dd066bd5453011b8a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043657274696669636146520417574686f72697479820900e9429c938605a22c300c0603551d13040530030101ff300d06092a864886f70d010105050003820106c25ddea16db6b8d5117091ec64bd79f6c19096eade754cd0d43e34b4883ff7b82b90e9eaf308ed2e362c077a2578f101f024417255592904c8e8111c05e663eb76192d39e9b28facdef1e303f846edd7901 EAP-Message = 0x0b07e3d810b8d8c2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21edcefb23e8d7bf189571f209151db8 Finished request 2. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=189, length=143 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0x226fc7ada2d285c32d24f720d407d7e EAP-Message = 0x02050001900 NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 State = 0x21edcefb23e8d7bf189571209151db8 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "*******" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 189 to 192.168.1.22 port 1645 EAP-Message = 0x010600b519003c537c032bb8e8953323bf2374ab386acf14170329724c3d9d72cf93b571123a19fa0b46a87f35e95604131e43eb082e5c7c546f948a8ef904f192ad2d93a6b5dabf5ff168241cdc993ad54d976fac81ac947960a16e88ec141447d5dcd5c79a79b0d2ab3104d3362b2c5f8ff3ce42b764d8a9ca3afa2eb0428df7f12202e89964afc55771f78990d0064be81a844c38d19802bdacc6c5dbfd07bad558ab25778082a5216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21edcefb22ebd7bf189571f209151db8 Finished request 3. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=190, length=459 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0xcfe5abdbf0680775672a33a6bef960df EAP-Message = 0x020601401980000001361603010106100001020100436c901d963c492c7126dcf2905925f1f95b5603f7f35425d54e4ae49498269e741de850e38fceedd56d39f39be7c801b9da1b4b1a5f9659e5cb8c38bd22386b370bd7ee0129d83f8e292d576e00ea268bd316e4dcc26e7350f7ca207518e587a006c7f02c57f5d45a3322d1864861e09f489809447afd3a64318438e28700d3ef5fdbe0c41d2e5b66d97bbb398c8fd96919c622e7838f471be47afe0246e3bffbfdc47729dc02d48fbe954a3da20c8f9aecba1911ce290f9edcbd2222cc95437e988ef47ada57df84d30d6a9612475633e0a69626f5ea77fbec9fac499a82b3d7f5d7c731538 EAP-Message = 0x101284b8f3ca2a43d3211ade7b0df34add279c4f1ebc8514030100010116030100203292e0157ed35685cc9b7f7171db2186455072f09696152447fd775064ef5c75 NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 State = 0x21edcefb22ebd7bf189571f209151db8 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "AP-C1231G" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 190 to 192.168.1.22 port 1645 EAP-Message = 0x01070031190014030100010116030100208216893c34c5a181fba86ab16939b371b832cdbcc9790fc9a323e8b7b831d205 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21edcefb25ead7bf189571f209151db8 Finished request 4. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=191, length=143 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0xef924dab21994165f9c7f26bcc9c74 EAP-Message = 0x0207061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 State = 0x21edcefb25ead7bf189571f209151db8 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "AP-C1231G" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 191 to 192.168.1.22 port 1645 EAP-Message = 0x01080020190003010015411f57ba89d6fd6a04a64468de35f449bfb3723b9d Message-Authenticator = 0x000000000000000000000000000000 State = 0x21edcefb24e5d7bf189571f209151db8 Finished request 5. Going to the next request Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=192, length=169 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0xc06d4852b31e35efeba025235c053 EAP-Message = 0x0208002019001703311c3baa66e04048fec693e9893f1a7e211aaa805a NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 State = 0x21edcefb24e5d7bf189571f209151db8 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "AP-C1231G" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 32 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - test [peap] Got tunneled request EAP-Message = 0x020800090174657374 server { PEAP: Got tunneled identity of test PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to test Sending tunneled request EAP-Message = 0x020800090174657374 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test" server { +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [ldap] performing user authorization for test [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(employeeType=TRUE)(cn=%{Stripped-User-Name:-%{User-Name}})(macAddress=%{Calling-Station-Id})) -> (&(employeeType=TRUE)(cn=test)(macAddress=)) [ldap] expand: ou=users,ou=wireless,dc=test,dc=hu -> ou=users,ou=wireless,dc=test,dc=hu rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,ou=wireless,dc=test,dc=hu, with filter (&(employeeType=TRUE)(cn=test)(macAddress=)) rlm_ldap: object not found or got ambiguous search result [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop

3 4

Is it possible to have eap-peapv0 connect before xp shows logon box?
by Josh Hiner 28 Jan '09

28 Jan '09

So, I was going to use eap-tls to have the windows xp workstations sign into the wireless network before the user logs on (by assigning a cert to the machine account) but tls is not working for users or machines and I would like to have a backup. I have eap-peopv0 and eap-ttls working fine but they require a client username and password to connect and those are not supplied until the user logs in. We have many clients here on roaming profiles, so their profiles time out if I set them to peap or ttls since the wireless doesnt fire up in time after they log in. Is there a way to get peap or ttls (with ttls I use the SecureW2 client) to connect before the user logs on? I know that sounds lame because peap and ttls need a username and password... but maybe we can assign it statically in the background to the machine account or something? What are others doing? I really dont want wpa2-aes with a psk. Thanks for any ideas. Hopefully I can get the eap-tls thing sorted out with help but would like a backup plan. -Josh

1 0