- Freeradius-Users - lists.freeradius.org

Re: Conf PEAP
by Martin Silvero 18 Dec '08

18 Dec '08

>>[peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca >>TLS Alert read:fatal:unknown CA >> TLS_accept:failed in SSLv3 read client certificate A >But your problem has nothing to do with the user. You haven't imported >the ca certificate onto the users machine. At least not the correct one. but, if I want the user´s don´t use certificates and only use "user & pass" whit PEAP ¿is posible?

2 1

Basic question on rlm_perl
by al pat 18 Dec '08

18 Dec '08

hi, I am building freeradius 2.1.3 on ubuntu (configure/make/make install) I am trying to use perl module, but when I can't start my server. I have put "perl" as a module in my radiusd.conf file. I don't file the rlm_perl*.so file in /usr/local/lib/ where all the other rlm_*.so files are located. What am I missing? I also tried to configure with the experimental modules flag. Thanks -a

3 3

Conf PEAP
by Martin Silvero 18 Dec '08

18 Dec '08

Hello gentlemen I am configuring PEAP and there is not much information about it, Should I add a user in the user file alone? If default is configured with EAP, what should I modify another file? thanks. logout: rad_recv: Access-Request packet from host 10.10.1.21 port 1645, id=220, length=156 User-Name = "DOMINIO\\msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x8cc6da388d8df7f5ec4355457fe64969 EAP-Message = 0x020100130149504c414e5c6d73696c7665726f NAS-Port-Type = Wireless-802.11 NAS-Port = 474 NAS-IP-Address = 10.10.1.21 NAS-Identifier = "ap-ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DOMINIO\msilvero", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 220 to 10.10.1.21 port 1645 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x34d23a2734d023bc90d78d0fbe96492c Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.1.21 port 1645, id=221, length=263 User-Name = "DOMINIO\\msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x3491a2750461cd5efdc8648bf46aa49a EAP-Message = 0x0202006c190016030100610100005d030149493f85acfcc0f2c2c47fe6fa7a57d6e421cff26116506231b3776199ed10e200003600390038003500160013000a00330032002f0007006600050004006300620061001500120009006500640060001400110008000600030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 474 State = 0x34d23a2734d023bc90d78d0fbe96492c NAS-IP-Address = 10.10.1.21 NAS-Identifier = "ap-ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DOMINIO\msilvero", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 108 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0061], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 221 to 10.10.1.21 port 1645 [...] Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 220 with timestamp +68 Waking up in 0.1 seconds. Cleaning up request 1 ID 221 with timestamp +68 Ready to process requests. rad_recv: Access-Request packet from host 10.10.1.21 port 1645, id=222, length=156 User-Name = "DOMINIO\\msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x862b4eedab979983e604c4836e8ac526 EAP-Message = 0x020100130149504c414e5c6d73696c7665726f NAS-Port-Type = Wireless-802.11 NAS-Port = 475 NAS-IP-Address = 10.10.1.21 NAS-Identifier = "ap-ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DOMINIO\msilvero", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 222 to 10.10.1.21 port 1645 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8f11b52d8f13ac786b16694f681d2fd0 Finished request 2. [...] [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 223 to 10.10.1.21 port 1645 [...] Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.10.1.21 port 1645, id=224, length=161 User-Name = "DOMINIO\\msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x9f0db2567149250ed92295734e004b44 EAP-Message = 0x020300061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 475 State = 0x8f11b52d8e12ac786b16694f681d2fd0 NAS-IP-Address = 10.10.1.21 NAS-Identifier = "ap-ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DOMINIO\msilvero", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 224 to 10.10.1.21 port 1645 [...] Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.10.1.21 port 1645, id=225, length=161 User-Name = "DOMINIO\\msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x65d2bab3cdae40b237ce9837d9a3eacf EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 475 State = 0x8f11b52d8d15ac786b16694f681d2fd0 NAS-IP-Address = 10.10.1.21 NAS-Identifier = "ap-ap" [...] Sending Access-Challenge of id 225 to 10.10.1.21 port 1645 [...] Finished request 5. Going to the next request waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.10.1.21 port 1645, id=226, length=168 User-Name = "DOMINIO\\msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xcb5badb43459e8a2770683bef095543b EAP-Message = 0x0205000d190015030100020230 NAS-Port-Type = Wireless-802.11 NAS-Port = 475 State = 0x8f11b52d8c14ac786b16694f681d2fd0 NAS-IP-Address = 10.10.1.21 NAS-Identifier = "ap-ap" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DOMINIO\msilvero", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 13 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> DOMINIO\msilvero attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 226 to 10.10.1.21 port 1645 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. Cleaning up request 2 ID 222 with timestamp +74 Waking up in 0.1 seconds. Cleaning up request 3 ID 223 with timestamp +74 Cleaning up request 4 ID 224 with timestamp +74 Cleaning up request 5 ID 225 with timestamp +74 Waking up in 1.0 seconds. Cleaning up request 6 ID 226 with timestamp +74 Ready to process requests.

3 2

PEAP with Windows supplicant, Automatically use my windows credentials
by splintered thoughts 18 Dec '08

18 Dec '08

Hello, I've configured a PEAP with the Windows SP3 supplicant with freeradius 2.1.3, and the authentication succeeds when "Automatically use my windows logon name and password (and domain if any)" is unselected, which forces a manual logon. However, when "Automatically use my ..." is selected with the same user name/domain, the authentication fails. May I have some insight into any issue(s) on how to resolve this? Here is the debug log for the failed request: Wed Dec 17 09:07:24 2008 : Debug: expand: %{debug:2} -> 2 Wed Dec 17 09:07:24 2008 : Debug: ++[control] returns notfound Wed Dec 17 09:07:24 2008 : Debug: ++[preprocess] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[chap] returns noop Wed Dec 17 09:07:24 2008 : Debug: ++[mschap] returns noop Wed Dec 17 09:07:24 2008 : Debug: [realmpercent] No '%' in User-Name = "TPW5\administrator", skipping NULL due to config. Wed Dec 17 09:07:24 2008 : Debug: ++[realmpercent] returns noop Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Looking up realm "TPW5" for User-Name = "TPW5\administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Found realm "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Stripped-User-Name = "administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Realm = "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Authentication realm is LOCAL. Wed Dec 17 09:07:24 2008 : Debug: ++[ntdomain] returns ok Wed Dec 17 09:07:24 2008 : Debug: [suffix] Request already proxied. Ignoring. Wed Dec 17 09:07:24 2008 : Debug: ++[suffix] returns ok Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP packet type response id 0 length 23 Wed Dec 17 09:07:24 2008 : Debug: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns updated Wed Dec 17 09:07:24 2008 : Debug: ++[files] returns noop Wed Dec 17 09:07:24 2008 : Debug: Found Auth-Type = EAP Wed Dec 17 09:07:24 2008 : Debug: +- entering group authenticate {...} Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP Identity Wed Dec 17 09:07:24 2008 : Debug: [eap] processing type md5 Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns handled Wed Dec 17 09:07:24 2008 : Debug: Sending Access-Challenge packet to host 10.12.18.4 port 1812, id=120, length=0 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x01010016041090013f5c9305706c9dc6340df1142df1 Wed Dec 17 09:07:24 2008 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Wed Dec 17 09:07:24 2008 : Debug: State = 0xd0cf07f0d0ce03f56f2a90dc8079ccda Wed Dec 17 09:07:24 2008 : Debug: Finished request 0. Wed Dec 17 09:07:24 2008 : Debug: expand: %{debug:2} -> 2 Wed Dec 17 09:07:24 2008 : Debug: ++[control] returns notfound Wed Dec 17 09:07:24 2008 : Debug: ++[preprocess] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[chap] returns noop Wed Dec 17 09:07:24 2008 : Debug: ++[mschap] returns noop Wed Dec 17 09:07:24 2008 : Debug: [realmpercent] No '%' in User-Name = "TPW5\administrator", skipping NULL due to config. Wed Dec 17 09:07:24 2008 : Debug: ++[realmpercent] returns noop Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Looking up realm "TPW5" for User-Name = "TPW5\administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Found realm "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Stripped-User-Name = "administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Realm = "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Authentication realm is LOCAL. Wed Dec 17 09:07:24 2008 : Debug: ++[ntdomain] returns ok Wed Dec 17 09:07:24 2008 : Debug: [suffix] Request already proxied. Ignoring. Wed Dec 17 09:07:24 2008 : Debug: ++[suffix] returns ok Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP packet type response id 1 length 6 Wed Dec 17 09:07:24 2008 : Debug: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns updated Wed Dec 17 09:07:24 2008 : Debug: ++[files] returns noop Wed Dec 17 09:07:24 2008 : Debug: Found Auth-Type = EAP Wed Dec 17 09:07:24 2008 : Debug: +- entering group authenticate {...} Wed Dec 17 09:07:24 2008 : Debug: [eap] Request found, released from the list Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP NAK Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP-NAK asked for EAP-Type/peap Wed Dec 17 09:07:24 2008 : Debug: [eap] processing type tls Wed Dec 17 09:07:24 2008 : Debug: [tls] Initiate Wed Dec 17 09:07:24 2008 : Debug: [tls] Start returned 1 Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns handled Wed Dec 17 09:07:24 2008 : Debug: Sending Access-Challenge packet to host 10.12.18.4 port 1812, id=121, length=0 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x010200061920 Wed Dec 17 09:07:24 2008 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Wed Dec 17 09:07:24 2008 : Debug: State = 0xd0cf07f0d1cd1ef56f2a90dc8079ccda Wed Dec 17 09:07:24 2008 : Debug: Finished request 1. Wed Dec 17 09:07:24 2008 : Debug: expand: %{debug:2} -> 2 Wed Dec 17 09:07:24 2008 : Debug: ++[control] returns notfound Wed Dec 17 09:07:24 2008 : Debug: ++[preprocess] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[chap] returns noop Wed Dec 17 09:07:24 2008 : Debug: ++[mschap] returns noop Wed Dec 17 09:07:24 2008 : Debug: [realmpercent] No '%' in User-Name = "TPW5\administrator", skipping NULL due to config. Wed Dec 17 09:07:24 2008 : Debug: ++[realmpercent] returns noop Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Looking up realm "TPW5" for User-Name = "TPW5\administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Found realm "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Stripped-User-Name = "administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Realm = "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Authentication realm is LOCAL. Wed Dec 17 09:07:24 2008 : Debug: ++[ntdomain] returns ok Wed Dec 17 09:07:24 2008 : Debug: [suffix] Request already proxied. Ignoring. Wed Dec 17 09:07:24 2008 : Debug: ++[suffix] returns ok Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP packet type response id 2 length 80 Wed Dec 17 09:07:24 2008 : Debug: [eap] Continuing tunnel setup. Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[files] returns noop Wed Dec 17 09:07:24 2008 : Debug: Found Auth-Type = EAP Wed Dec 17 09:07:24 2008 : Debug: +- entering group authenticate {...} Wed Dec 17 09:07:24 2008 : Debug: [eap] Request found, released from the list Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP/peap Wed Dec 17 09:07:24 2008 : Debug: [eap] processing type peap Wed Dec 17 09:07:24 2008 : Debug: [peap] processing EAP-TLS Wed Dec 17 09:07:24 2008 : Debug: [peap] Length Included Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_verify returned 11 Wed Dec 17 09:07:24 2008 : Debug: [peap] (other): before/accept initialization Wed Dec 17 09:07:24 2008 : Debug: [peap] TLS_accept: before/accept initialization Wed Dec 17 09:07:24 2008 : Debug: [peap] TLS_accept: SSLv3 read client hello A Wed Dec 17 09:07:24 2008 : Debug: [peap] TLS_accept: SSLv3 write server hello A Wed Dec 17 09:07:24 2008 : Debug: [peap] TLS_accept: SSLv3 write certificate A Wed Dec 17 09:07:24 2008 : Debug: [peap] TLS_accept: SSLv3 write server done A Wed Dec 17 09:07:24 2008 : Debug: [peap] TLS_accept: SSLv3 flush data Wed Dec 17 09:07:24 2008 : Debug: [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_process returned 13 Wed Dec 17 09:07:24 2008 : Debug: [peap] EAPTLS_HANDLED Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns handled Wed Dec 17 09:07:24 2008 : Debug: Sending Access-Challenge packet to host 10.12.18.4 port 1812, id=122, length=0 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x0103040019c00000072c160301002a020000260301494923bcedc987028a2352b84271936aea53e99fb623ca257536e883442ea95c0000040016030106ef0b0006eb0006e80002cb308202c7308202300205122935480a300d06092a864886f70d01010505003081b8310b3009060355040613025553310b300906035504081302434f311430120603550407130b576573746d696e73746572312b3029060355040a132254697070696e67506f696e7420496e632c204469766973696f6e206f662033436f6d31173015060355040b130e53656c66205369676e6564204341311730150603550403130e546f70206c6576656c20436572743127302506 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x092a864886f70d01090116187461636d61696c4074697070696e67706f696e742e636f6d301e170d3038313231353135323635305a170d3333313230393135323635305a30819a310b3009060355040613025553310b300906035504081302434f311430120603550407130b576573746d696e73746572310d300b060355040a130433436f6d31153013060355040b130c54697070696e67506f696e7431193017060355040313106a6967356e70732e747077352e636f6d3127302506092a864886f70d01090116187461636d61696c4074697070696e67706f696e742e636f6d30819f300d06092a864886f70d010101050003818d00308189028181 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x00dd03f09559ddc6ea8bc0a9206d40657f7d12b2f29f283bd0d84eb2904e2720592bb18ec971bfc20f93916df7dcfd35848be2946eb2683ae6fd3ff715e95f33594ec1888038961f2561389160afa4c1ef47e3f88e935340b19ec897d4b599f927b9d878e386267b573dba0ed413a1431d63ee4e7fe9dd70f055b8d2521a9e3ad90203010001300d06092a864886f70d010105050003818100509c6044c7e7d3b2d9a7fb62c035a65361dcb0ba148aaadfd1272a65f267f913b210faf39afa24658788cb651bce6f704a528e4e63d2613de5c967dc2d904f70852412e2371a556fa69194d4f16bddf641c1397c0947ebd36b851b8d57add0f78335d369 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x67c9080e362b607959f63dcd7f5fd80b46f31faa05b59853d8541166000417308204133082037ca003020102020900f90e79cfb7d27aab300d06092a864886f70d01010505003081b8310b3009060355040613025553310b300906035504081302434f311430120603550407130b576573746d696e73746572312b3029060355040a132254697070696e67506f696e7420496e632c204469766973696f6e206f662033436f6d31173015060355040b130e53656c66205369676e6564204341311730150603550403130e546f70206c6576656c20436572743127302506092a864886f70d01090116187461636d61696c4074697070696e67706f696e74 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x2e636f6d301e170d30383132 Wed Dec 17 09:07:24 2008 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Wed Dec 17 09:07:24 2008 : Debug: State = 0xd0cf07f0d2cc1ef56f2a90dc8079ccda Wed Dec 17 09:07:24 2008 : Debug: Finished request 2. Wed Dec 17 09:07:24 2008 : Debug: expand: %{debug:2} -> 2 Wed Dec 17 09:07:24 2008 : Debug: ++[control] returns notfound Wed Dec 17 09:07:24 2008 : Debug: ++[preprocess] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[chap] returns noop Wed Dec 17 09:07:24 2008 : Debug: ++[mschap] returns noop Wed Dec 17 09:07:24 2008 : Debug: [realmpercent] No '%' in User-Name = "TPW5\administrator", skipping NULL due to config. Wed Dec 17 09:07:24 2008 : Debug: ++[realmpercent] returns noop Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Looking up realm "TPW5" for User-Name = "TPW5\administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Found realm "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Stripped-User-Name = "administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Realm = "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Authentication realm is LOCAL. Wed Dec 17 09:07:24 2008 : Debug: ++[ntdomain] returns ok Wed Dec 17 09:07:24 2008 : Debug: [suffix] Request already proxied. Ignoring. Wed Dec 17 09:07:24 2008 : Debug: ++[suffix] returns ok Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP packet type response id 3 length 6 Wed Dec 17 09:07:24 2008 : Debug: [eap] Continuing tunnel setup. Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[files] returns noop Wed Dec 17 09:07:24 2008 : Debug: Found Auth-Type = EAP Wed Dec 17 09:07:24 2008 : Debug: +- entering group authenticate {...} Wed Dec 17 09:07:24 2008 : Debug: [eap] Request found, released from the list Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP/peap Wed Dec 17 09:07:24 2008 : Debug: [eap] processing type peap Wed Dec 17 09:07:24 2008 : Debug: [peap] processing EAP-TLS Wed Dec 17 09:07:24 2008 : Debug: [peap] Received TLS ACK Wed Dec 17 09:07:24 2008 : Debug: [peap] ACK handshake fragment handler Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_verify returned 1 Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_process returned 13 Wed Dec 17 09:07:24 2008 : Debug: [peap] EAPTLS_HANDLED Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns handled Wed Dec 17 09:07:24 2008 : Debug: Sending Access-Challenge packet to host 10.12.18.4 port 1812, id=123, length=0 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x0104033c190031353135323634395a170d3333313230393135323634395a3081b8310b3009060355040613025553310b300906035504081302434f311430120603550407130b576573746d696e73746572312b3029060355040a132254697070696e67506f696e7420496e632c204469766973696f6e206f662033436f6d31173015060355040b130e53656c66205369676e6564204341311730150603550403130e546f70206c6576656c20436572743127302506092a864886f70d01090116187461636d61696c4074697070696e67706f696e742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100f2d90d0838cf63 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x4d183710d46cfc788f079ffc59ce0a3009acca61148dcc9051e40bd73a175cfcb9f8de7eabe56d45aa18e32a7d37d7659d98362853f2c210fb4c440f0275d2ce8aac8ca7b0ab55079af4b0ac72a32bc2e12a15624417ac8b9aa7a8cfbd50c501d039eb85e9f34eae97a89da8bebbcaccabaeb4b82c175ba58b0203010001a38201213082011d301d0603551d0e041604143e3c0f897946ed4d56f53c5eafa4c3313648c8de3081ed0603551d230481e53081e280143e3c0f897946ed4d56f53c5eafa4c3313648c8dea181bea481bb3081b8310b3009060355040613025553310b300906035504081302434f311430120603550407130b576573746d69 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x6e73746572312b3029060355040a132254697070696e67506f696e7420496e632c204469766973696f6e206f662033436f6d31173015060355040b130e53656c66205369676e6564204341311730150603550403130e546f70206c6576656c20436572743127302506092a864886f70d01090116187461636d61696c4074697070696e67706f696e742e636f6d820900f90e79cfb7d27aab300c0603551d13040530030101ff300d06092a864886f70d0101050500038181002b6008a9eb5028afb1f6aff39e7488b9dcb5200691065670c2d984d3f8a1111603dc17fabd80051fc81837d4617951d9a684c4f5b5e6d065c89b58348c144582c5166e1b Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x4488dbe4da43d384404835ce3e3b7d985c02c1a476ac1f65fc0874553af77c4f62ad840a40ccc26bb55fc2859a0347241a56ed096ebc6c081de2d60216030100040e000000 Wed Dec 17 09:07:24 2008 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Wed Dec 17 09:07:24 2008 : Debug: State = 0xd0cf07f0d3cb1ef56f2a90dc8079ccda Wed Dec 17 09:07:24 2008 : Debug: Finished request 3. Wed Dec 17 09:07:24 2008 : Debug: expand: %{debug:2} -> 2 Wed Dec 17 09:07:24 2008 : Debug: ++[control] returns notfound Wed Dec 17 09:07:24 2008 : Debug: ++[preprocess] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[chap] returns noop Wed Dec 17 09:07:24 2008 : Debug: ++[mschap] returns noop Wed Dec 17 09:07:24 2008 : Debug: [realmpercent] No '%' in User-Name = "TPW5\administrator", skipping NULL due to config. Wed Dec 17 09:07:24 2008 : Debug: ++[realmpercent] returns noop Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Looking up realm "TPW5" for User-Name = "TPW5\administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Found realm "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Stripped-User-Name = "administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Realm = "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Authentication realm is LOCAL. Wed Dec 17 09:07:24 2008 : Debug: ++[ntdomain] returns ok Wed Dec 17 09:07:24 2008 : Debug: [suffix] Request already proxied. Ignoring. Wed Dec 17 09:07:24 2008 : Debug: ++[suffix] returns ok Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP packet type response id 4 length 192 Wed Dec 17 09:07:24 2008 : Debug: [eap] Continuing tunnel setup. Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[files] returns noop Wed Dec 17 09:07:24 2008 : Debug: Found Auth-Type = EAP Wed Dec 17 09:07:24 2008 : Debug: +- entering group authenticate {...} Wed Dec 17 09:07:24 2008 : Debug: [eap] Request found, released from the list Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP/peap Wed Dec 17 09:07:24 2008 : Debug: [eap] processing type peap Wed Dec 17 09:07:24 2008 : Debug: [peap] processing EAP-TLS Wed Dec 17 09:07:24 2008 : Debug: [peap] Length Included Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_verify returned 11 Wed Dec 17 09:07:24 2008 : Debug: [peap] TLS_accept: SSLv3 read client key exchange A Wed Dec 17 09:07:24 2008 : Debug: [peap] TLS_accept: SSLv3 read finished A Wed Dec 17 09:07:24 2008 : Debug: [peap] TLS_accept: SSLv3 write change cipher spec A Wed Dec 17 09:07:24 2008 : Debug: [peap] TLS_accept: SSLv3 write finished A Wed Dec 17 09:07:24 2008 : Debug: [peap] TLS_accept: SSLv3 flush data Wed Dec 17 09:07:24 2008 : Debug: [peap] (other): SSL negotiation finished successfully Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_process returned 13 Wed Dec 17 09:07:24 2008 : Debug: [peap] EAPTLS_HANDLED Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns handled Hello, I've configured a PEAP with the Windows SP3 supplicant with freeradius 2.1.3, and the authentication succeeds when "Automatically use my windows logon name and password (and domain if any)" is unselected, which forces a manual logon. However, when "Automatically use my ..." is selected with the same user name/domain, the authentication fails. May I have some insight into any issue(s) on how to resolve this? Here is the debug log for the failed request: Wed Dec 17 09:07:24 2008 : Debug: Sending Access-Challenge packet to host 10.12.18.4 port 1812, id=124, length=0 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x0105003119001403010001011603010020b483b6c6e83bf8a59f0ee6e6ad24591bc46e1e77319dacdc1a29479e8c664888 Wed Dec 17 09:07:24 2008 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Wed Dec 17 09:07:24 2008 : Debug: State = 0xd0cf07f0d4ca1ef56f2a90dc8079ccda Wed Dec 17 09:07:24 2008 : Debug: Finished request 4. Wed Dec 17 09:07:24 2008 : Debug: expand: %{debug:2} -> 2 Wed Dec 17 09:07:24 2008 : Debug: ++[control] returns notfound Wed Dec 17 09:07:24 2008 : Debug: ++[preprocess] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[chap] returns noop Wed Dec 17 09:07:24 2008 : Debug: ++[mschap] returns noop Wed Dec 17 09:07:24 2008 : Debug: [realmpercent] No '%' in User-Name = "TPW5\administrator", skipping NULL due to config. Wed Dec 17 09:07:24 2008 : Debug: ++[realmpercent] returns noop Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Looking up realm "TPW5" for User-Name = "TPW5\administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Found realm "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Stripped-User-Name = "administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Realm = "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Authentication realm is LOCAL. Wed Dec 17 09:07:24 2008 : Debug: ++[ntdomain] returns ok Wed Dec 17 09:07:24 2008 : Debug: [suffix] Request already proxied. Ignoring. Wed Dec 17 09:07:24 2008 : Debug: ++[suffix] returns ok Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP packet type response id 5 length 6 Wed Dec 17 09:07:24 2008 : Debug: [eap] Continuing tunnel setup. Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[files] returns noop Wed Dec 17 09:07:24 2008 : Debug: Found Auth-Type = EAP Wed Dec 17 09:07:24 2008 : Debug: +- entering group authenticate {...} Wed Dec 17 09:07:24 2008 : Debug: [eap] Request found, released from the list Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP/peap Wed Dec 17 09:07:24 2008 : Debug: [eap] processing type peap Wed Dec 17 09:07:24 2008 : Debug: [peap] processing EAP-TLS Wed Dec 17 09:07:24 2008 : Debug: [peap] Received TLS ACK Wed Dec 17 09:07:24 2008 : Debug: [peap] ACK handshake is finished Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_verify returned 3 Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_process returned 3 Wed Dec 17 09:07:24 2008 : Debug: [peap] EAPTLS_SUCCESS Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns handled Wed Dec 17 09:07:24 2008 : Debug: Sending Access-Challenge packet to host 10.12.18.4 port 1812, id=125, length=0 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x01060020190017030100159a18b32d1ce86335fa6dae97724c1bd44689df8454 Wed Dec 17 09:07:24 2008 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Wed Dec 17 09:07:24 2008 : Debug: State = 0xd0cf07f0d5c91ef56f2a90dc8079ccda Wed Dec 17 09:07:24 2008 : Debug: Finished request 5. Wed Dec 17 09:07:24 2008 : Debug: expand: %{debug:2} -> 2 Wed Dec 17 09:07:24 2008 : Debug: ++[control] returns notfound Wed Dec 17 09:07:24 2008 : Debug: ++[preprocess] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[chap] returns noop Wed Dec 17 09:07:24 2008 : Debug: ++[mschap] returns noop Wed Dec 17 09:07:24 2008 : Debug: [realmpercent] No '%' in User-Name = "TPW5\administrator", skipping NULL due to config. Wed Dec 17 09:07:24 2008 : Debug: ++[realmpercent] returns noop Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Looking up realm "TPW5" for User-Name = "TPW5\administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Found realm "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Stripped-User-Name = "administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Realm = "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Authentication realm is LOCAL. Wed Dec 17 09:07:24 2008 : Debug: ++[ntdomain] returns ok Wed Dec 17 09:07:24 2008 : Debug: [suffix] Request already proxied. Ignoring. Wed Dec 17 09:07:24 2008 : Debug: ++[suffix] returns ok Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP packet type response id 6 length 46 Wed Dec 17 09:07:24 2008 : Debug: [eap] Continuing tunnel setup. Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[files] returns noop Wed Dec 17 09:07:24 2008 : Debug: Found Auth-Type = EAP Wed Dec 17 09:07:24 2008 : Debug: +- entering group authenticate {...} Wed Dec 17 09:07:24 2008 : Debug: [eap] Request found, released from the list Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP/peap Wed Dec 17 09:07:24 2008 : Debug: [eap] processing type peap Wed Dec 17 09:07:24 2008 : Debug: [peap] processing EAP-TLS Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_verify returned 7 Wed Dec 17 09:07:24 2008 : Debug: [peap] Done initial handshake Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_process returned 7 Wed Dec 17 09:07:24 2008 : Debug: [peap] EAPTLS_OK Wed Dec 17 09:07:24 2008 : Debug: [peap] Session established. Decoding tunneled attributes. Wed Dec 17 09:07:24 2008 : Debug: [peap] Identity - TPW5\administrator Wed Dec 17 09:07:24 2008 : Debug: +- entering group authorize {...} Wed Dec 17 09:07:24 2008 : Debug: expand: %{debug:2} -> 2 Wed Dec 17 09:07:24 2008 : Debug: ++[control] returns notfound Wed Dec 17 09:07:24 2008 : Debug: ++[preprocess] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[chap] returns noop Wed Dec 17 09:07:24 2008 : Debug: ++[mschap] returns noop Wed Dec 17 09:07:24 2008 : Debug: [realmpercent] No '%' in User-Name = "TPW5\administrator", skipping NULL due to config. Wed Dec 17 09:07:24 2008 : Debug: ++[realmpercent] returns noop Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Looking up realm "TPW5" for User-Name = "TPW5\administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Found realm "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Stripped-User-Name = "administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Realm = "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Authentication realm is LOCAL. Wed Dec 17 09:07:24 2008 : Debug: ++[ntdomain] returns ok Wed Dec 17 09:07:24 2008 : Debug: [suffix] Request already proxied. Ignoring. Wed Dec 17 09:07:24 2008 : Debug: ++[suffix] returns ok Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP packet type response id 6 length 23 Wed Dec 17 09:07:24 2008 : Debug: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns updated Wed Dec 17 09:07:24 2008 : Debug: ++[files] returns noop Wed Dec 17 09:07:24 2008 : Debug: Found Auth-Type = EAP Wed Dec 17 09:07:24 2008 : Debug: +- entering group authenticate {...} Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP Identity Wed Dec 17 09:07:24 2008 : Debug: [eap] processing type mschapv2 Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns handled Wed Dec 17 09:07:24 2008 : Debug: [peap] Got tunneled Access-Challenge Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns handled Wed Dec 17 09:07:24 2008 : Debug: Sending Access-Challenge packet to host 10.12.18.4 port 1812, id=126, length=0 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x010700431900170301003811ae41236e0a12fe5eeebc960c1f43fa29230d104856932a1007ce0b69a15a2a6ab8c8ffc8cc7f299de595c6450ce1c411633de75c334f1a Wed Dec 17 09:07:24 2008 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Wed Dec 17 09:07:24 2008 : Debug: State = 0xd0cf07f0d6c81ef56f2a90dc8079ccda Wed Dec 17 09:07:24 2008 : Debug: Finished request 6. Wed Dec 17 09:07:24 2008 : Debug: expand: %{debug:2} -> 2 Wed Dec 17 09:07:24 2008 : Debug: ++[control] returns notfound Wed Dec 17 09:07:24 2008 : Debug: ++[preprocess] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[chap] returns noop Wed Dec 17 09:07:24 2008 : Debug: ++[mschap] returns noop Wed Dec 17 09:07:24 2008 : Debug: [realmpercent] No '%' in User-Name = "TPW5\administrator", skipping NULL due to config. Wed Dec 17 09:07:24 2008 : Debug: ++[realmpercent] returns noop Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Looking up realm "TPW5" for User-Name = "TPW5\administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Found realm "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Stripped-User-Name = "administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Realm = "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Authentication realm is LOCAL. Wed Dec 17 09:07:24 2008 : Debug: ++[ntdomain] returns ok Wed Dec 17 09:07:24 2008 : Debug: [suffix] Request already proxied. Ignoring. Wed Dec 17 09:07:24 2008 : Debug: ++[suffix] returns ok Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP packet type response id 7 length 100 Wed Dec 17 09:07:24 2008 : Debug: [eap] Continuing tunnel setup. Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[files] returns noop Wed Dec 17 09:07:24 2008 : Debug: Found Auth-Type = EAP Wed Dec 17 09:07:24 2008 : Debug: +- entering group authenticate {...} Wed Dec 17 09:07:24 2008 : Debug: [eap] Request found, released from the list Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP/peap Wed Dec 17 09:07:24 2008 : Debug: [eap] processing type peap Wed Dec 17 09:07:24 2008 : Debug: [peap] processing EAP-TLS Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_verify returned 7 Wed Dec 17 09:07:24 2008 : Debug: [peap] Done initial handshake Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_process returned 7 Wed Dec 17 09:07:24 2008 : Debug: [peap] EAPTLS_OK Wed Dec 17 09:07:24 2008 : Debug: [peap] Session established. Decoding tunneled attributes. Wed Dec 17 09:07:24 2008 : Debug: [peap] EAP type mschapv2 Wed Dec 17 09:07:24 2008 : Debug: +- entering group authorize {...} Wed Dec 17 09:07:24 2008 : Debug: expand: %{debug:2} -> 2 Wed Dec 17 09:07:24 2008 : Debug: ++[control] returns notfound Wed Dec 17 09:07:24 2008 : Debug: ++[preprocess] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[chap] returns noop Wed Dec 17 09:07:24 2008 : Debug: ++[mschap] returns noop Wed Dec 17 09:07:24 2008 : Debug: [realmpercent] No '%' in User-Name = "TPW5\administrator", skipping NULL due to config. Wed Dec 17 09:07:24 2008 : Debug: ++[realmpercent] returns noop Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Looking up realm "TPW5" for User-Name = "TPW5\administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Found realm "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Stripped-User-Name = "administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Realm = "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Authentication realm is LOCAL. Wed Dec 17 09:07:24 2008 : Debug: ++[ntdomain] returns ok Wed Dec 17 09:07:24 2008 : Debug: [suffix] Request already proxied. Ignoring. Wed Dec 17 09:07:24 2008 : Debug: ++[suffix] returns ok Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP packet type response id 7 length 77 Wed Dec 17 09:07:24 2008 : Debug: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns updated Wed Dec 17 09:07:24 2008 : Debug: ++[files] returns noop Wed Dec 17 09:07:24 2008 : Debug: Found Auth-Type = EAP Wed Dec 17 09:07:24 2008 : Debug: +- entering group authenticate {...} Wed Dec 17 09:07:24 2008 : Debug: [eap] Request found, released from the list Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP/mschapv2 Wed Dec 17 09:07:24 2008 : Debug: [eap] processing type mschapv2 Wed Dec 17 09:07:24 2008 : Debug: [mschapv2] +- entering group MS-CHAP {...} Wed Dec 17 09:07:24 2008 : Debug: [mschap] No Cleartext-Password configured. Cannot create LM-Password. Wed Dec 17 09:07:24 2008 : Debug: [mschap] No Cleartext-Password configured. Cannot create NT-Password. Wed Dec 17 09:07:24 2008 : Debug: [mschap] Told to do MS-CHAPv2 for administrator with NT-Password Wed Dec 17 09:07:24 2008 : Debug: [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Wed Dec 17 09:07:24 2008 : Debug: [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-%{mschap:User-Name}}} -> --username=administrator Wed Dec 17 09:07:24 2008 : Debug: [mschap] mschap2: e0 Wed Dec 17 09:07:24 2008 : Debug: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=469478f224b67ca3 Wed Dec 17 09:07:24 2008 : Debug: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=c2abbe21274fad45cdcbf7db8de7de2a5be037e56415b6bc Wed Dec 17 09:07:24 2008 : Debug: [mschap] External script failed. Wed Dec 17 09:07:24 2008 : Debug: [mschap] FAILED: MS-CHAP2-Response is incorrect Wed Dec 17 09:07:24 2008 : Debug: ++[mschap] returns reject Wed Dec 17 09:07:24 2008 : Debug: [eap] Freeing handler Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns reject Wed Dec 17 09:07:24 2008 : Debug: Failed to authenticate the user. Wed Dec 17 09:07:24 2008 : Debug: [peap] Tunneled authentication was rejected. Wed Dec 17 09:07:24 2008 : Debug: [peap] FAILURE Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns handled Wed Dec 17 09:07:24 2008 : Debug: Sending Access-Challenge packet to host 10.12.18.4 port 1812, id=127, length=0 Wed Dec 17 09:07:24 2008 : Debug: EAP-Message = 0x010800261900170301001b902fbf59b723a82af254f787d0adeb8f35a0e9dac511954bb0ef19 Wed Dec 17 09:07:24 2008 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Wed Dec 17 09:07:24 2008 : Debug: State = 0xd0cf07f0d7c71ef56f2a90dc8079ccda Wed Dec 17 09:07:24 2008 : Debug: Finished request 7. Wed Dec 17 09:07:24 2008 : Debug: expand: %{debug:2} -> 2 Wed Dec 17 09:07:24 2008 : Debug: ++[control] returns notfound Wed Dec 17 09:07:24 2008 : Debug: ++[preprocess] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[chap] returns noop Wed Dec 17 09:07:24 2008 : Debug: ++[mschap] returns noop Wed Dec 17 09:07:24 2008 : Debug: [realmpercent] No '%' in User-Name = "TPW5\administrator", skipping NULL due to config. Wed Dec 17 09:07:24 2008 : Debug: ++[realmpercent] returns noop Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Looking up realm "TPW5" for User-Name = "TPW5\administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Found realm "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Stripped-User-Name = "administrator" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Adding Realm = "tpw5" Wed Dec 17 09:07:24 2008 : Debug: [ntdomain] Authentication realm is LOCAL. Wed Dec 17 09:07:24 2008 : Debug: ++[ntdomain] returns ok Wed Dec 17 09:07:24 2008 : Debug: [suffix] Request already proxied. Ignoring. Wed Dec 17 09:07:24 2008 : Debug: ++[suffix] returns ok Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP packet type response id 8 length 38 Wed Dec 17 09:07:24 2008 : Debug: [eap] Continuing tunnel setup. Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns ok Wed Dec 17 09:07:24 2008 : Debug: ++[files] returns noop Wed Dec 17 09:07:24 2008 : Debug: Found Auth-Type = EAP Wed Dec 17 09:07:24 2008 : Debug: +- entering group authenticate {...} Wed Dec 17 09:07:24 2008 : Debug: [eap] Request found, released from the list Wed Dec 17 09:07:24 2008 : Debug: [eap] EAP/peap Wed Dec 17 09:07:24 2008 : Debug: [eap] processing type peap Wed Dec 17 09:07:24 2008 : Debug: [peap] processing EAP-TLS Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_verify returned 7 Wed Dec 17 09:07:24 2008 : Debug: [peap] Done initial handshake Wed Dec 17 09:07:24 2008 : Debug: [peap] eaptls_process returned 7 Wed Dec 17 09:07:24 2008 : Debug: [peap] EAPTLS_OK Wed Dec 17 09:07:24 2008 : Debug: [peap] Session established. Decoding tunneled attributes. Wed Dec 17 09:07:24 2008 : Debug: [peap] Received EAP-TLV response. Wed Dec 17 09:07:24 2008 : Debug: [peap] Had sent TLV failure. User was rejected earlier in this session. Wed Dec 17 09:07:24 2008 : Debug: [eap] Handler failed in EAP/peap Wed Dec 17 09:07:24 2008 : Debug: [eap] Failed in EAP select Wed Dec 17 09:07:24 2008 : Debug: ++[eap] returns invalid Wed Dec 17 09:07:24 2008 : Debug: Failed to authenticate the user. Wed Dec 17 09:07:24 2008 : Debug: Using Post-Auth-Type Reject Wed Dec 17 09:07:24 2008 : Debug: +- entering group REJECT {...} Wed Dec 17 09:07:24 2008 : Debug: ++[jradius] returns noop Wed Dec 17 09:07:24 2008 : Debug: Delaying reject of request 8 for 1 seconds Wed Dec 17 09:07:25 2008 : Debug: Sending delayed reject for request 8 Wed Dec 17 09:07:25 2008 : Debug: Sending Access-Reject packet to host 10.12.18.4 port 1812, id=128, length=0 Wed Dec 17 09:07:25 2008 : Debug: EAP-Message = 0x04080004 Wed Dec 17 09:07:25 2008 : Debug: Message-Authenticator = 0x00000000000000000000000000000000

2 3

RE: Duplicate IPs for Radius Clients with different secrets - allow any client IP?
by Eric Geier 17 Dec '08

17 Dec '08

Thanks for the info, Anders. Yes, I'm considering security issues. Just would be really great if I could make everything work as I want...with still being secure. > Why bother doing the SQL stuff, if you're going to let anyone use your service anyway? The way I thought it up, it would allow any IP to TRY to run its request to the server...whereas if real client IPs are given, requests are denied before the sever does any work if the client IP isn't on the list. Say I did open up to any IP, the AP's MAC must match one from my list; moreover the hacker must have the shared secret. Plus if I can add to the example SQL statement, I would add to the WHERE clause "and domain =(domain pulled from what's after the username's @ sign). Then the hacker must know a username and domain that matches an acceptable AP, the user's password, that acceptable AP's MAC address, and then finally the shared secret for the AP. What could a hacker do to the server if he can't even get passed returning a correct shared secret? cause DoS attacks? If so, I can try to find something that blocks requests from originating IPs for 5mins after so many requests. What do you think? Thanks for your input, Eric From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On Behalf Of Anders Holm Sent: Wednesday, December 17, 2008 2:55 PM To: FreeRadius users mailing list Subject: Re: Duplicate IPs for Radius Clients with different secrets - allow any client IP? Eric Geier wrote: Thank you for the info, David. I think the following is an example of how this could work, which I googled: client 212.37.57.2 { secret = "%{sql:SELECT secret FROM accesspoints WHERE id = %{raw:NAS-Identifier}}" shortname = "just one of our example networks" } I'm thinking I could even just have one client entry like this...but set to allow any IP. Is that possible? clients.conf client 0.0.0.0/0, shared secret = "open" ... Why bother doing the SQL stuff, if you're going to let anyone use your service anyway? Think about it ... clients.conf controls which APs/NAS' are allowed to send you stuff to process. If your intention is to open it for anyone that can reach your service, why then do the above? The end clients are not what will send you requests, the APs are ....... I think you've missed the point of the IP addressing for the end clients versus how you wish to handle the APs ... And for a service which allows or denies access for your internal users, I wouldn't personally allow anyone from the outside world even get close to that service. You want to understand basic networking and security considerations before seriously contemplating this. Start looking at getting a VPN solution between your offices, or simply just put one FreeRADIUS box in each office. Continue on this path and fairly soon someone will have found your wireless setup and the service which allows clients to authenticate sitting out in the open. You might as well not have anything in place at all then... //anders This would prevent me from having to track Internet IP changes among the multiple offices and locations where these separate WPA-Enterprise networks will be located at. Thanks! Eric -----Original Message----- From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On Behalf Of wlanmac Sent: Wednesday, December 17, 2008 8:42 AM To: freeradius-users(a)lists.freeradius.org Subject: Re: Duplicate IPs for Radius Clients with different secrets It's easy! Just google for rlm_raw and use it with a SQL xlat rule to pick out the shared secret from a database. I have been doing this way for years... in FreeRADIUS v1 and v2. David coova.org Date: Wed, 17 Dec 2008 10:16:17 +0200 From: Johan Meiring <jmeiring(a)pcservices.co.za> Subject: Re: Duplicate IPs for Radius Clients with different secrets To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4948B551.6030406(a)pcservices.co.za> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Eric Geier wrote: If I understand what you said, I would only need one IP entry (the Internet IP) in the config file for each location, right? Most of these locations will be using dynamic Internet IPs; I'm not sure how'd I keep the config updated. Plus this would make each location/network use the same shared secret among all their APs, which I want to prevent. Alan, The Nas-Identifier being available to dynamic clients will also solve Eric's problem. Any update on when it might be available? Thanks! No virus found in this incoming message. Checked by AVG - http://www.avg.com Version: 8.0.176 / Virus Database: 270.9.19/1853 - Release Date: 12/17/2008 8:31 AM

3 2

RE: Duplicate IPs for Radius Clients with different secrets - allow any client IP?
by Eric Geier 17 Dec '08

17 Dec '08

Thank you for the info, David. I think the following is an example of how this could work, which I googled: > client 212.37.57.2 { > secret = "%{sql:SELECT secret FROM accesspoints WHERE id = %{raw:NAS-Identifier}}" > shortname = "just one of our example networks" >} I'm thinking I could even just have one client entry like this...but set to allow any IP. Is that possible? This would prevent me from having to track Internet IP changes among the multiple offices and locations where these separate WPA-Enterprise networks will be located at. Thanks! Eric > -----Original Message----- > From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On > Behalf Of wlanmac > Sent: Wednesday, December 17, 2008 8:42 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Duplicate IPs for Radius Clients with different secrets > > It's easy! Just google for rlm_raw and use it with a SQL xlat rule to > pick out the shared secret from a database. I have been doing this way > for years... in FreeRADIUS v1 and v2. > > David > coova.org > > > Date: Wed, 17 Dec 2008 10:16:17 +0200 > > From: Johan Meiring <jmeiring(a)pcservices.co.za> > > Subject: Re: Duplicate IPs for Radius Clients with different secrets > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <4948B551.6030406(a)pcservices.co.za> > > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > > Eric Geier wrote: > > > > > > If I understand what you said, I would only need one IP entry (the > Internet > > > IP) in the config file for each location, right? > > > > > > Most of these locations will be using dynamic Internet IPs; I'm not > sure > > > how'd I keep the config updated. Plus this would make each > location/network > > > use the same shared secret among all their APs, which I want to > prevent. > > > > > > > > > Alan, > > > > The Nas-Identifier being available to dynamic clients will also solve > > Eric's problem. > > > > Any update on when it might be available? > > > > Thanks! > > > > > > -- > > > > > > Johan Meiring > > Cape PC Services CC > > Tel: (021) 883-8271 > > Fax: (021) 886-7782 > > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > No virus found in this incoming message. > Checked by AVG - http://www.avg.com > Version: 8.0.176 / Virus Database: 270.9.19/1853 - Release Date: > 12/17/2008 8:31 AM

2 1

FW: Working config file for data counter.
by Marcel Grandemange 17 Dec '08

17 Dec '08

>Good Day. >I am still struggling to get a working solution with freeradius and mysql as backend. >What im trying to do simply is have the radius server use data counters instead of time counters. >I want to limit a users collective data to amounts of 1gb,2gb,3gb, all the way up. >And it must be resset on the first of the month. >I have tried many versions of freeradius with many different queries and methods and there is ALWAYS something that doesn't seem to work properly. >With Freeradius 2.1.3 I cannot use anything above 4gb, although I followed instructions on wiki to the tee for overcoming the wrapping problem. (wiki >was outdated, but still tried) >With 1.1.7 I think it was I would simply get arratic responses. Sometimes worked fine with up to 8gb tested, the next month it wouldn't. 2gb limits >would also only sometimes work. >The only one that was consistant was the 1gb option. >Now ive tried so many methods, versions , tricks and wiki's and docs.. It's been years and still I cannot get it working correctly. There is a bit of >a lack of docs on what I would like to do and ive come to the conclusion that if I could see someone elses working config for this sort of setup I >could deduce where im going wrong. >Thank You! Is the only way to get this working to pay someone? If so who can help? Just note this is private and im using this box to teach myself hence I cant offer much... Input? __________ NOD32 3696 (20081216) Information __________ This message was checked by NOD32 antivirus system. http://www.eset.com

2 1

mac2vlan
by alois blasbichler 17 Dec '08

17 Dec '08

Hello list I want to assign a certain vlan to a certain mac of a client-pc. I tried the module mac2vlan - is there a better/other way ? But it does not work. I created the file ${confdir}/mac2vlan with : 00:40:96:B4:5B:0F,TECH-WLAN But normaly a vlan is defined with a number like "155". How should this work ? Am i missind something important ? Wath other steps i have to do ? Thank you luis

2 1

Re: Duplicate IPs for Radius Clients with different secrets
by wlanmac 17 Dec '08

17 Dec '08

It's easy! Just google for rlm_raw and use it with a SQL xlat rule to pick out the shared secret from a database. I have been doing this way for years... in FreeRADIUS v1 and v2. David coova.org > Date: Wed, 17 Dec 2008 10:16:17 +0200 > From: Johan Meiring <jmeiring(a)pcservices.co.za> > Subject: Re: Duplicate IPs for Radius Clients with different secrets > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4948B551.6030406(a)pcservices.co.za> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Eric Geier wrote: > > > > If I understand what you said, I would only need one IP entry (the Internet > > IP) in the config file for each location, right? > > > > Most of these locations will be using dynamic Internet IPs; I'm not sure > > how'd I keep the config updated. Plus this would make each location/network > > use the same shared secret among all their APs, which I want to prevent. > > > > > Alan, > > The Nas-Identifier being available to dynamic clients will also solve > Eric's problem. > > Any update on when it might be available? > > Thanks! > > > -- > > > Johan Meiring > Cape PC Services CC > Tel: (021) 883-8271 > Fax: (021) 886-7782 > >

1 0

IP per user
by Sergio Belkin 17 Dec '08

17 Dec '08

Hi, I wonder if radius force to a given user eg jdoe that only get from an Access Point always the same IP address? Thanks in advance -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 2