- Freeradius-Users - lists.freeradius.org

wpa_supplicant(eapol_test) with freeradius: error coming in TLS
by Gaurav Kansal 21 Oct '08

21 Oct '08

Hi I am trying to use EAP-TLS between wpa_supplicant and freeradius. I created the certificates (ca/server/client) as mentioned in freeradius-server-2.0.5/raddb/certs/README. In freeradius-server-2.0.5/raddb/users, following line is added at end: testuser Cleartext-Password := "password" On wpa_supplicant-0.5.10, created eapol_test.conf.tls with following contents: network={ eap=TLS eapol_flags=0 key_mgmt=IEEE8021X identity="testuser" ca_cert="/usr/local/etc/raddb/certs/ca.pem" client_cert="/usr/local/etc/raddb/certs/testuser(a)example.com.pem" private_key="/usr/local/etc/raddb/certs/client.key" private_key_passwd="whatever" } Executed wpa_supplicant (eapol_test) with following command (wpa_supplicant side logs are after radius logs at end): eapol_test -c eapol_test.conf.tls -a127.0.0.1 -p1812 -stesting123 -r1 On executing /usr/local/sbin/radiusd -X, I get following log and error too: rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=0, length=124 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000d017465737475736572 Message-Authenticator = 0x0e5f593f30507d677e8d7e68b072b55f +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 127.0.0.1 port 32770 EAP-Message = 0x01010016041017695d19037d705af68ca37a7262ddcb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x267673582677771a69809cb3876d58ea Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=1, length=135 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02010006030d State = 0x267673582677771a69809cb3876d58ea Message-Authenticator = 0x6dd1d34467725c79f19b72ff9612e3ce +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/tls rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 127.0.0.1 port 32770 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2676735827747e1a69809cb3876d58ea Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=2, length=236 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202006b0d0016030100600100005c03014874ff7ae4659071f23a8aac506f1f25b7c9f1272eca 77a38aaea1b9788b532d00003400390038003500160013000a00330032002f006600050004006300 62006100150012000900650064006000140011000800060003020100 State = 0x2676735827747e1a69809cb3876d58ea Message-Authenticator = 0x1a18c152c7a7d0032d7876c2e02214d3 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 107 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0060], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a7], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 127.0.0.1 port 32770 EAP-Message = 0x010304000dc000000b70160301004a0200004603014874ff7af840e0ce0c0562387841cbf363e6 be64f8dd2def0915579fb271a7d320bc89e200ccdb1ad9ae9498442013c69878623fb1e470357891 b9df6651cbf029003901160301085e0b00085a0008570003a6308203a23082028aa0030201020201 01300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d06035504 0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c 4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d70 6c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d303830 3730393138313131375a170d3039303730393138313131375a307c310b3009060355040613024652 310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e 312330210603550403131a4578616d706c6520536572766572204365727469666963617465312030 1e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a 864886f70d01010105000382010f003082010a0282010100c296eb2d169b654435a174fd8ead1b26 d65b1298d9a7bcc561a051d2b667 EAP-Message = 0x28a6c693620ce3c06c032ebe4dbeedff9020f24d06430433091b7e9762575c12fdb988ad5d6dfe e570df9a0aa1ce55de2d308c162bbcf917c8441071ea895cfb102721f2a5059f402317457a104650 b4fea1975e04fb83fc4d0a2cf72167830d5281398c981ac2f27370a34aa49b07e007fa955ebf187a 8fd476174e7493ffa02bf466b07846382b4eaf03551fef5ca60ab3fc3aa19983aeb5015147ed3317 f659f0355a43091eb19ab0c4a8d07651627d1fad596cc5ee44fa2ccfcd92d6c63d778a9d958a6ca4 a02409c546d3b8400928e1b635c26ef5ab7fc54b68b8aa2e98b2830203010001a317301530130603 551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d01010405000382010100095935837d63c395fca941ae947c03fa c66f843b37c9969c2f46cb8b26348bfbd6348ac0d13b6a752886f1e83579122942dd8d0ab6b27578 49735dccfd82d06d3a07d1a2de3097c76cbb431042062e26df240d5d40ada6bc999bade14ebc0661 362f9a7f8644943e78a29e329c67ec32cf393205408021e56e461ce3320127b27df474f4c37be7cc cf46754c32ee8243500a194759ba6c5b2fcd563117b2ea94b9c63eb1678ff836afd92118a98b93fc 51992e9de619a9c7576fe3cae6a1e9988a2b10b0685ca7e58e5b100ec0817d511f34f59f794bcde2 5c247259a57ab8b1d686fce7c7cd EAP-Message = 0x3f8d16472d4a3eb1ee492fd3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2676735824757e1a69809cb3876d58ea Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=3, length=135 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300060d00 State = 0x2676735824757e1a69809cb3876d58ea Message-Authenticator = 0x86f3e31b265162f7716d461a9aae98f2 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 127.0.0.1 port 32770 EAP-Message = 0x010404000dc000000b70bf312a81c68194ac03b073abf2410004ab308204a73082038fa0030201 02020900ac4ad85feeea230a300d06092a864886f70d0101050500308193310b3009060355040613 024652310f300d060355040813065261646975733112301006035504071309536f6d657768657265 31153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d0109011611 61646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043657274 6966696361746520417574686f72697479301e170d3038303730393138313131325a170d30383038 30383138313131325a308193310b EAP-Message = 0x3009060355040613024652310f300d060355040813065261646975733112301006035504071309 536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a86 4886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d457861 6d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d 01010105000382010f003082010a0282010100ccff47e75ebf3d06a9472810c0352b254cca71cbb5 2cb8202d29ae967c715640e4d2b6c3e60641c4d54fdc03fe6ebdfb1953dc1b8c1f44202cf488249d 37f2b7902efdf546fabb283a9653 EAP-Message = 0xfa065f9b063843f36456ac437df7cefeaad4d44004939d63ae9c4df03f1b856d8340ab4e6317a1 11aecfd860639f0056069404c4d2f9f10e9048b10f4bd65dfe2a61470543b7b323895dfbb54053f8 4cb0417f5eafdf8aa236a2afea06047be624e1f7b85e757be3749e6946439ad4e85de0d4f66f35e1 a4ee8258727033035877b43232c0697a2baf3d09e8aa337366b1cbbccf72a509b977d426d546c7b1 65f873308f0a6964f430ee01b74cc0a561d9869fd84f0203010001a381fb3081f8301d0603551d0e 041604141c71c3ab8dbd86f36bbf4b24d5b72d291bc88aaf3081c80603551d230481c03081bd8014 1c71c3ab8dbd86f36bbf4b24d5b7 EAP-Message = 0x2d291bc88aafa18199a48196308193310b3009060355040613024652310f300d06035504081306 5261646975733112301006035504071309536f6d65776865726531153013060355040a130c457861 6d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e 636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72 697479820900ac4ad85feeea230a300c0603551d13040530030101ff300d06092a864886f70d0101 05050003820101005925971768cfc1bb8f4b1dd4b9d0abd84cca91dc19d344451da159ae0925f192 4022b20ea548d56947a26c987dc0 EAP-Message = 0xfb36d1078bef2f36de91d2b5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2676735825727e1a69809cb3876d58ea Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=4, length=135 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400060d00 State = 0x2676735825727e1a69809cb3876d58ea Message-Authenticator = 0xd88cda63a2776910572007659978dff0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 4 to 127.0.0.1 port 32770 EAP-Message = 0x0105038e0d8000000b7083ce8bd2a2e5a3df721979638d83518a19e079bf804773b82753a039b6 b053a357acb9d1954ecb25330390d4d54583a6fdeb74f039f492238f8d93bdc53d3acc2366af2771 253c218dbc3a006b911f1e4bb6fd491b99ed05b1520cf14d08d12119b177f754cae89d065edb4868 0f35d8df3c0e7fcec9c6e84d52a1136f7a56a90f539addc1ad3c44e25de731f0443844dbfe83d043 2ad61f7ed89184a407e0b41a9ffbc0389637071d937e63e136311e467b914839fd7382c216734b1d e93368e4fb6b2303f4160301020d0c0002090080b3afe7fd33f61741e813a2a82d3e2e44f4e3a6cb a8ba274ff2a14cdee764e7ec4e45 EAP-Message = 0x4df9c4b18aa0bb45b4dcbe5022790ed79559ec10e6b017165192ca92ee664df49dd6de389d1eba 0400804b550239ffca80cdd27f3cc0ce1fc851463b672a8e260e415d3d3a40e8ae5102105bddc30b 8c1a3031af0bc0a78b4ea69f5e66630001020080a0cc4357af8865d129c3e7c20c4283e7a4a4c522 e23e0f3cb9b462c2923ea92c3a2781665e6d1fe4096f9832e39c33424106d2429f569da06ac67c9b 0800351a1b7c512cd541edf0a135330412dbccd37885e35ce75111476fe045e0a85c70abf40a3008 9c4d4302179e1f084bffe853b1845c99010515a1970a03a87449615a010060149cd09ea980ec82c5 5cfe09857dbb7c5811f45c64e0fe EAP-Message = 0x9d59d03e704806e99f1cb29f0286c1015c81d7824e617a53bd69dacefe51425fec76315ad4861b 81d8aff93491a3b7a18988a9a9ee16acba071272b143c7bb8106d29ac8e6087a066498b3f47cf216 fb2a96f19d7ccd8459646ed27ce02852c2c402000778e68ec419b9f14059fea1eaaad700a5c1d71f 8ba516d820a6b0520e9a808736de80b97588f6b72b6b405b1f8a5a8779e01cd882c352aabb41e4a6 0fd2e4c64382e2a12deb09e8fb2caaa26a86aec4606044a283b9d20b0bf2637a953e8716d0b90958 aebeb9995898714edb927fb52e51c4a1a2ff1157ae26402265dbbbb03f99e23f2416030100a70d00 009f040304010200980096308193 EAP-Message = 0x310b3009060355040613024652310f300d06035504081306526164697573311230100603550407 1309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e0609 2a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d45 78616d706c6520436572746966696361746520417574686f726974790e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2676735822737e1a69809cb3876d58ea Finished request 4. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=5, length=1532 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020505710d0016030103950b00039100038e00038b308203873082026fa003020102020102300d 06092a864886f70d0101040500307c310b3009060355040613024652310f300d0603550408130652 616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a45 78616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901 161161646d696e406578616d706c652e636f6d301e170d3038303730393138313132345a170d3039 303730393138313132345a3079310b3009060355040613024652310f300d06035504081306526164 69757331153013060355040a130c EAP-Message = 0x4578616d706c6520496e632e311d301b060355040314147465737475736572406578616d706c65 2e636f6d3123302106092a864886f70d01090116147465737475736572406578616d706c652e636f 6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100b510efbf58ad 201585beac3f327bba71b761612df254a3e44ffe4f5a182852e2a64d11912ca27013be01dae059ef 3d8a9b2ca7a81c9da01b2291b6e38f07339c7668c6b7ce6c936bef181c33c16d5c34e17b0c878648 bb73199645bb81febb577aff69f4881080ea593f31b5efcccebd3772dda5666a5e139a38e89b9ca1 3712462098dbfc5c526253985609 EAP-Message = 0x583e54d9d74b9b263cda9647c523d9922c1992736d176c3b869b373a9824a8c046dfd49118a90d 5c8e9504cae9209d8254c31f98c3979a307f0515e88e820c29c9092c0de6c9af76c9a1bc8eee37ae a8d047bf8c1af257f42b550932995e5083364a7e185a62de08976e2ca45d334231109eeaf7020301 0001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010104 0500038201010085cf673c6dd1deb8648e0589573c0e55e286ba9f3ef23a3882fbe024a5c54aeef5 10e96f36291f0172deb8bcf2b8ce9e6517a143c658e8fb24c80a7936138c5e6f7dda3ca8b33e4600 a1cb92c2f079793304c0ddc296c4 EAP-Message = 0x015d6d73cdae8f32eea68667d9cf33a6ad8c5e38a0ffbda541b5b789ffd0cd2b4de23592384ee2 3e154ea629f1a3743fcba443f8e6d355411d310f787d6551c413af2eccfabc2b28e9e786fd78cb32 50a0ca2cd0adf11d8045d03ea0cca6b28d5c498c0965a238b05ccf7cadc3946ee0c42d65594ca337 8ecd205c74b42b5f9c060287639e4cf76f5003ec0d3723abd391f4693556553f5aaac2684a2bb808 e2a2cf16b425c9736e1c16030100861000008200803d7d38a765634fe46cd97911bbb0826fd6bb31 7dc04dbb7ca60c2d352f4a9be2f147f261ccf2d7c5e05b85783810260ddaed3c3772fcceab264dd8 daf8a4467e6a6729a7152dabe5a4 EAP-Message = 0x4c2375c148a15096de5c28842d80507318656b36edc71772326fd6fddbc6dbb9d5476332d561de 95d1a40b59779113ada15e6b466977eb16030101060f00010201003fcdbdf9a53a3f14ce87dbc345 68e1cc53d78b24457c12a7be38fc6e07932f6a253fc07cf73579bc7dbb98eeaf91076ba912ff6fe2 f6bfc1d2803974757922cd8fa5142f870aae126053adf7b4c7456bb431a174446775b7e9f78fcfb0 925edee9a12cf5a76fc6ef7fdf983adeb3ec234d89af9e7298602df31a4febaa1c9aa039c3142ec5 7416c3771b1ae8934b1444dda9e28b932ae8ff1a22aae98ceb9f2d7a9caac9efb16c01a4cd3dadda 86513428a3bd3a11b262eaa750dc EAP-Message = 0xd50749f461997927394171b785ff74c98d883674fc8035287993a279f1ffa72b9c4cbc6b96fcaa d6e5daaca7bd9aca988c6a8b3c487bd1e5cc73dd3c3c59f8ec39549ebeb614030100010116030100 30f1c1d6ee34104fca2869c989529493079d85690315b83299b5d9567823fea467b507af2267dd69 305c7d35d7809adf12 State = 0x2676735822737e1a69809cb3876d58ea Message-Authenticator = 0xcc6ace4662072c78666cb7d873d7a354 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Handshake [length 0395], Certificate --> verify error:num=20:unable to get local issuer certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 5 to 127.0.0.1 port 32770 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 5. Going to the next request Waking up in 4.4 seconds. Cleaning up request 0 ID 0 with timestamp +4 Cleaning up request 1 ID 1 with timestamp +4 Cleaning up request 2 ID 2 with timestamp +4 Cleaning up request 3 ID 3 with timestamp +4 Waking up in 0.1 seconds. Cleaning up request 4 ID 4 with timestamp +4 Waking up in 0.2 seconds. Cleaning up request 5 ID 5 with timestamp +5 Ready to process requests. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ wpa_supplicant logs (copying only FAILURE logs seen at end) ++++++++++++++++++++++++++++++++++++++++++++++++++++++ EAPOL: SUPP_BE entering state RECEIVE Received 44 bytes from RADIUS server Received RADIUS message RADIUS message: code=3 (Access-Reject) identifier=5 length=44 Attribute 79 (EAP-Message) length=6 Value: 04 05 00 04 Attribute 80 (Message-Authenticator) length=18 Value: 7a 61 25 5b 8e cd 44 3b 18 b1 af e3 82 fd 32 5d STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=4 id=5 len=4) from RADIUS server: EAP Failure EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state FAILURE CTRL-EVENT-EAP-FAILURE EAP authentication failed EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: success=0 EAP: deinitialize previously used EAP method (13, TLS) at EAP deinit ENGINE: engine deinit MPPE keys OK: 0 mismatch: 2 FAILURE Regards, Gaurav Kansal

3 5

Fwd: recover lvm
by Graeme Crawford 21 Oct '08

21 Oct '08

dude, can you forward this to scott, i dont have any of his emails in gmail for some strange reason. shot, g. ---------- Forwarded message ---------- From: Christo Smith (C) <SmithC(a)telkom.co.za> Date: Tue, Oct 21, 2008 at 8:52 AM Subject: RE: recover lvm To: Graeme Crawford <graeme.crawford(a)gmail.com> Hi Grame, Please send this to Scott Christo Smith Telkom - ISP Tel: 012 680 7001 Fax: 088 012 324 5693 (please use the fine option) eMail:* **smithc(a)telkom.co.za* TelkomInternet technical support center 10215 or support(a)telkomsa.net TelkomInternet commercial - iDirect 10215 CyberTrade support center 0800578578 ------------------------------ *From:* Graeme Crawford [mailto:graeme.crawford@gmail.com] *Sent:* 20 October 2008 06:46 PM *To:* Francois Pieterse (F); erick(a)staff.telkomsa.net; Christo Smith (C) *Subject:* recover lvm Hi, dd if=/dev/null of=/block/device bs=512 count=1, then run restore, then rescan your luns that should sort you out, first test this though ie: pv, vg,lv with data then parted the disk, then try recover, we did this not to long ago at a client and it sorted their issue out. lemme know if your try it. g. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This e-mail is subject to the Telkom SA electronic communication legal notice, available at : http://www.telkom.co.za/TelkomEMailLegalNotice.PDF ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

EAP bypass
by Danny Paul 21 Oct '08

21 Oct '08

I'm getting ready to implement EAP-TLS for 802.1x port authentication. Everything works great in my testing environment and I'm very happy with it. However, before we roll it out into production, I must write a set of recovery procedures. In these procedures I need to include a section on the (admittedly very rare) chance that authentications start failing across the board for some reason - for example, if we accidently let a bunch of the user certificates expire, all of those machines will fail port-authentication until the certificates are replaced. My management would like a way to force authorization to succeed even if EAP has actually failed. My thought is to use a module that really does nothing but authenticate and authorize everything it sees. I've investigated the rlm_always, rlm_exec and rlm_perl modules but I can't seem to figure out how to do anything but report "handled" or "ok." This does not seem to result in an Access-Accept message being sent. Any suggestions? I'm using the latest FreeRadius 2 - the config files are unchanged except for the eap.conf (to specify the Root cert and server cert) and I am using a sparse sites-enabled file: client x.x.x.x { secret = secret server = EAP_Server } server EAP_Server { authorize { eap } authenticate { eap }

7 22

Radius Proxy for Authorization
by Lutrika Mufti Rachmat 21 Oct '08

21 Oct '08

Hi, I am very new to radius and need help to confirm the following. I have an existing radius server running on Cisco ACS 4.2. In the current configuration, all users are configured using priv ID 15. I wanted to setup a proxy radius, where the proxy will relay an authentication and authorization request to the Cisco ACS, but when relaying back the authentication and authorization message back to the clients, I want to overwrite the priv ID with something other than 15 (for eg, user XXX -> priv 14, user YYY -> priv10, etc). Is there a way for me to do that? Or is this behavior is actually prohibited by the standards? Thanks in advance, LMR

2 1

Question on implementing Vendor-Specific Attributes
by A BlueCoder 21 Oct '08

21 Oct '08

Hi Ivan, Actually there are two attributes, and the values of attributes are not static - they vary based on the NAS-IDentifider attribute values. (I can set up VSA to send static values - just the dynamic part, I dont have good ideas). Thanks for the help. BC <freeradius-users(a)lists.freeradius.org> >If it's just one attribute why bother with VSA. Use Reply-Message. >Create DEFAULT entries in users file to send replies. >Ivan Kalik >Kalik Informatika ISP Dana 20/10/2008, "A BlueCoder" <[EMAIL PROTECTED]> piše: >On Mon, Oct 20, 2008 at 12:09 AM, A BlueCoder <[EMAIL PROTECTED]>wrote: > >> Hi, >> >> I have a need to implement Vendor-Specific Attributes using a FreeRadius >> approach (version 0.9.3 on Solaris). >> >> I understand probably rewriting a rml module would solve this problem and >> probably the most effective way. However, given the shortage of time, i >> would like to explore configuration options (without code writing) if >> possible. >> >> Here are the requirements: >> >> 1. Access-Request Requests; >> >> 2. Request Attributes -- with VSA (implemented with a Vendor-specific >> dictionary). >> >> 3. Response Attributes -- with VSA (implemented with a Vendor-specific >> dictionary). >> >> 4. There is a map from attributes in (2) to (3), which is what i am trying >> to implement. >> >> e.g. >> >> If the request NAS-IP-Address = 111.111.111.111, i would like to response >> with attribute: VSA1 = 10000001, >> If the request NAS-IP-Address = 111.111.111.112, i would like to >> response with attribute: VSA1 = 10000002, >> If the request NAS-IP-Address = 111.111.111.113, i would like to >> response with attribute: VSA1 = 10000003, >> If the request NAS-IP-Address = 111.111.111.114, i would like to >> response with attribute: VSA1 = 10000004, >> >> etc.... >> >> What's the best way which i can configur without writing a full-fledge rlm >> module? >> >> Thanks in advance, >> >> BC >> >> >> >> > >

2 1

group variable
by Alexandre Chapellon 21 Oct '08

21 Oct '08

Hy all I would like to use the name of the group a user is member of to update the check item list. I though using unlang to do so, and an update directive but icannot find the variable name (if any) to use for the name of the group. I have "%{Group}" "%{Group-Name}" "%{SQL-GROUP}" but no success: expansions always gives me an empty string. The groups are stored in MySQL database. the update directive is at the end of the autorize section.... Does anyone knows how to refer to the group?

2 5

Multiple groups
by Jørn Kostøl 20 Oct '08

20 Oct '08

I'm trying to add multiple groups to a user, but only the group with the highest priority (lowest number) is being processed. I've tried this on Freeradius 1.1.7, 2.0.4 and 2.1.1. When I set the priorities different only the first is processed. If I set the priority to the same level only the first entry in the database is processed. Do I need to enable this feature somewhere, or what? Cheers, Jørn

2 1

Error in the negotiations certificates
by Martin Silvero 20 Oct '08

20 Oct '08

ok, this is out when i write "radiusd -X -x" : Mon Oct 20 12:08:36 2008 : Info: FreeRADIUS Version 2.0.5, for host x86_64-unknown-linux-gnu, built on Sep 3 2008 at 17:32:08 Mon Oct 20 12:08:36 2008 : Info: Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. Mon Oct 20 12:08:36 2008 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Mon Oct 20 12:08:36 2008 : Info: PARTICULAR PURPOSE. Mon Oct 20 12:08:36 2008 : Info: You may redistribute copies of FreeRADIUS under the terms of the Mon Oct 20 12:08:36 2008 : Info: GNU General Public License v2. Mon Oct 20 12:08:36 2008 : Info: Starting - reading configuration files ... Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/snmp.conf Mon Oct 20 12:08:36 2008 : Debug: including files in directory /usr/local/etc/raddb/modules/ Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/files Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/always Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Mon Oct 20 12:08:36 2008 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Mon Oct 20 12:08:36 2008 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Mon Oct 20 12:08:36 2008 : Debug: main { Mon Oct 20 12:08:36 2008 : Debug: prefix = "/usr/local" Mon Oct 20 12:08:36 2008 : Debug: localstatedir = "/usr/local/var" Mon Oct 20 12:08:36 2008 : Debug: logdir = "/usr/local/var/log/radius" Mon Oct 20 12:08:36 2008 : Debug: libdir = "/usr/local/lib" Mon Oct 20 12:08:36 2008 : Debug: radacctdir = "/usr/local/var/log/radius/radacct" Mon Oct 20 12:08:36 2008 : Debug: hostname_lookups = no Mon Oct 20 12:08:36 2008 : Debug: max_request_time = 30 Mon Oct 20 12:08:36 2008 : Debug: cleanup_delay = 5 Mon Oct 20 12:08:36 2008 : Debug: max_requests = 1024 Mon Oct 20 12:08:36 2008 : Debug: allow_core_dumps = no Mon Oct 20 12:08:36 2008 : Debug: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Mon Oct 20 12:08:36 2008 : Debug: checkrad = "/usr/local/sbin/checkrad" Mon Oct 20 12:08:36 2008 : Debug: debug_level = 0 Mon Oct 20 12:08:36 2008 : Debug: proxy_requests = yes Mon Oct 20 12:08:36 2008 : Debug: log { Mon Oct 20 12:08:36 2008 : Debug: stripped_names = no Mon Oct 20 12:08:36 2008 : Debug: auth = no Mon Oct 20 12:08:36 2008 : Debug: auth_badpass = no Mon Oct 20 12:08:36 2008 : Debug: auth_goodpass = no Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: client 10.0.31.40 { Mon Oct 20 12:08:36 2008 : Debug: require_message_authenticator = no Mon Oct 20 12:08:36 2008 : Debug: secret = "testing123" Mon Oct 20 12:08:36 2008 : Debug: shortname = "ap2" Mon Oct 20 12:08:36 2008 : Debug: nastype = "other" Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: radiusd: #### Loading Realms and Home Servers #### Mon Oct 20 12:08:36 2008 : Debug: proxy server { Mon Oct 20 12:08:36 2008 : Debug: retry_delay = 5 Mon Oct 20 12:08:36 2008 : Debug: retry_count = 3 Mon Oct 20 12:08:36 2008 : Debug: default_fallback = no Mon Oct 20 12:08:36 2008 : Debug: dead_time = 120 Mon Oct 20 12:08:36 2008 : Debug: wake_all_if_all_dead = no Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: home_server localhost { Mon Oct 20 12:08:36 2008 : Debug: ipaddr = 127.0.0.1 Mon Oct 20 12:08:36 2008 : Debug: port = 1812 Mon Oct 20 12:08:36 2008 : Debug: type = "auth" Mon Oct 20 12:08:36 2008 : Debug: secret = "testing123" Mon Oct 20 12:08:36 2008 : Debug: response_window = 20 Mon Oct 20 12:08:36 2008 : Debug: max_outstanding = 65536 Mon Oct 20 12:08:36 2008 : Debug: zombie_period = 40 Mon Oct 20 12:08:36 2008 : Debug: status_check = "status-server" Mon Oct 20 12:08:36 2008 : Debug: ping_check = "none" Mon Oct 20 12:08:36 2008 : Debug: ping_interval = 30 Mon Oct 20 12:08:36 2008 : Debug: check_interval = 30 Mon Oct 20 12:08:36 2008 : Debug: num_answers_to_alive = 3 Mon Oct 20 12:08:36 2008 : Debug: num_pings_to_alive = 3 Mon Oct 20 12:08:36 2008 : Debug: revive_interval = 120 Mon Oct 20 12:08:36 2008 : Debug: status_check_timeout = 4 Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: home_server_pool my_auth_failover { Mon Oct 20 12:08:36 2008 : Debug: type = fail-over Mon Oct 20 12:08:36 2008 : Debug: home_server = localhost Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: realm example.com { Mon Oct 20 12:08:36 2008 : Debug: auth_pool = my_auth_failover Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: realm LOCAL { Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: radiusd: #### Instantiating modules #### Mon Oct 20 12:08:36 2008 : Debug: instantiate { Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_exec, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_exec Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating exec Mon Oct 20 12:08:36 2008 : Debug: exec { Mon Oct 20 12:08:36 2008 : Debug: wait = no Mon Oct 20 12:08:36 2008 : Debug: input_pairs = "request" Mon Oct 20 12:08:36 2008 : Debug: shell_escape = yes Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_expr, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_expr Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating expr Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_expiration, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_expiration Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating expiration Mon Oct 20 12:08:36 2008 : Debug: expiration { Mon Oct 20 12:08:36 2008 : Debug: reply-message = "Password Has Expired " Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_logintime, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_logintime Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating logintime Mon Oct 20 12:08:36 2008 : Debug: logintime { Mon Oct 20 12:08:36 2008 : Debug: reply-message = "You are calling outside your allowed timespan " Mon Oct 20 12:08:36 2008 : Debug: minimum-timeout = 60 Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: radiusd: #### Loading Virtual Servers #### Mon Oct 20 12:08:36 2008 : Debug: server inner-tunnel { Mon Oct 20 12:08:36 2008 : Debug: modules { Mon Oct 20 12:08:36 2008 : Debug: Module: Checking authenticate {...} for more modules to load Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_pap, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_pap Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating pap Mon Oct 20 12:08:36 2008 : Debug: pap { Mon Oct 20 12:08:36 2008 : Debug: encryption_scheme = "auto" Mon Oct 20 12:08:36 2008 : Debug: auto_header = no Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_chap, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_chap Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating chap Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_mschap, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_mschap Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating mschap Mon Oct 20 12:08:36 2008 : Debug: mschap { Mon Oct 20 12:08:36 2008 : Debug: use_mppe = yes Mon Oct 20 12:08:36 2008 : Debug: require_encryption = no Mon Oct 20 12:08:36 2008 : Debug: require_strong = no Mon Oct 20 12:08:36 2008 : Debug: with_ntdomain_hack = no Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_unix, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_unix Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating unix Mon Oct 20 12:08:36 2008 : Debug: unix { Mon Oct 20 12:08:36 2008 : Debug: radwtmp = "/usr/local/var/log/radius/radwtmp" Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_eap, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_eap Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating eap Mon Oct 20 12:08:36 2008 : Debug: eap { Mon Oct 20 12:08:36 2008 : Debug: default_eap_type = "md5" Mon Oct 20 12:08:36 2008 : Debug: timer_expire = 60 Mon Oct 20 12:08:36 2008 : Debug: ignore_unknown_eap_types = no Mon Oct 20 12:08:36 2008 : Debug: cisco_accounting_username_bug = no Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to sub-module rlm_eap_leap Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating eap-leap Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to sub-module rlm_eap_gtc Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating eap-gtc Mon Oct 20 12:08:36 2008 : Debug: gtc { Mon Oct 20 12:08:36 2008 : Debug: challenge = "Password: " Mon Oct 20 12:08:36 2008 : Debug: auth_type = "PAP" Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:37 2008 : Debug: Module: Linked to sub-module rlm_eap_tls Mon Oct 20 12:08:37 2008 : Debug: Module: Instantiating eap-tls Mon Oct 20 12:08:37 2008 : Debug: tls { Mon Oct 20 12:08:37 2008 : Debug: rsa_key_exchange = no Mon Oct 20 12:08:37 2008 : Debug: dh_key_exchange = yes Mon Oct 20 12:08:37 2008 : Debug: rsa_key_length = 512 Mon Oct 20 12:08:37 2008 : Debug: dh_key_length = 512 Mon Oct 20 12:08:37 2008 : Debug: verify_depth = 0 Mon Oct 20 12:08:37 2008 : Debug: pem_file_type = yes Mon Oct 20 12:08:37 2008 : Debug: private_key_file = "/usr/local/etc/raddb/certs/server.pem" Mon Oct 20 12:08:37 2008 : Debug: certificate_file = "/usr/local/etc/raddb/certs/server.pem" Mon Oct 20 12:08:37 2008 : Debug: CA_file = "/usr/local/etc/raddb/certs/ca.pem" Mon Oct 20 12:08:37 2008 : Debug: private_key_password = "testing123" Mon Oct 20 12:08:37 2008 : Debug: dh_file = "/usr/local/etc/raddb/certs/dh" Mon Oct 20 12:08:37 2008 : Debug: random_file = "/usr/local/etc/raddb/certs/random" Mon Oct 20 12:08:37 2008 : Debug: fragment_size = 1024 Mon Oct 20 12:08:37 2008 : Debug: include_length = yes Mon Oct 20 12:08:37 2008 : Debug: check_crl = no Mon Oct 20 12:08:37 2008 : Debug: cipher_list = "DEFAULT" Mon Oct 20 12:08:37 2008 : Debug: } Mon Oct 20 12:08:37 2008 : Debug: Module: Linked to sub-module rlm_eap_peap Mon Oct 20 12:08:37 2008 : Debug: Module: Instantiating eap-peap Mon Oct 20 12:08:37 2008 : Debug: peap { Mon Oct 20 12:08:37 2008 : Debug: default_eap_type = "mschapv2" Mon Oct 20 12:08:37 2008 : Debug: copy_request_to_tunnel = no Mon Oct 20 12:08:37 2008 : Debug: use_tunneled_reply = no Mon Oct 20 12:08:37 2008 : Debug: proxy_tunneled_request_as_eap = yes Mon Oct 20 12:08:37 2008 : Debug: virtual_server = "inner-tunnel" Mon Oct 20 12:08:37 2008 : Debug: } Mon Oct 20 12:08:37 2008 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Mon Oct 20 12:08:37 2008 : Debug: Module: Instantiating eap-mschapv2 Mon Oct 20 12:08:37 2008 : Debug: mschapv2 { Mon Oct 20 12:08:37 2008 : Debug: with_ntdomain_hack = no Mon Oct 20 12:08:37 2008 : Debug: } Mon Oct 20 12:08:37 2008 : Error: rlm_eap: No such sub-type for default EAP type md5 Mon Oct 20 12:08:37 2008 : Error: /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" Mon Oct 20 12:08:37 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". Mon Oct 20 12:08:37 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Mon Oct 20 12:08:37 2008 : Debug: } Mon Oct 20 12:08:37 2008 : Debug: } Mon Oct 20 12:08:37 2008 : Error: Errors initializing modules

2 1

understanding FreeRADIUS
by Tom D. Davidson 20 Oct '08

20 Oct '08

Hello, I have some usage questions about FreeRADIUS that I am not finding answers for on the wiki. Can FR: * Place user/device in VLAN based on authentication? AAA 802.1q-in-q? I guess this would be FR telling a router/switch to push or pop the tag based on policy? * Other than VLAN in priority queues, can RF AAA any QoS technologies? can it do the priority queues for VLANs? * AAA VPN - both client and server? * Rate limit? Distinquish committed rate, burst rate, and best effort? * AAA firewall ports? * Implement "walled gardens" on users and devices? Is this only for http(s), what about email, ftp, ect...? * AAA IP address assignment? No sure how this works, but device/user request an IP DHCP server checks auth before issuing one? could it change IP address on existing connection? * Account network usage per user per device per interface? FR architecture: * Does being a WPA user make a difference to any of these questions? What about being a device rather than a user? * Authorization policies are not "in" radius, but in the db or directory correct? So to change policy for a user or device, the change would be done through the data store and not through radius? But the policy logic would need to exists in FR (ie modules?)? OR does the policy logic come form the data store as well? * Is there an OS API or does all the direction come through the data store? * Is there any reason why FR couldnt be used as an all encompassing NAC (for WAN)? * Do my questions clearly demostrat that I do not understand FR? :) FR 2.0: Is 2.0 a move to DIAMETER or is DIA not evolutionary? Is 2.0 recommended for production or should operators stick with 1.x? Thank you for your help, tom

3 9

Freeradius not to read radgroupcheck table from MSSQL
by Xiaochen Jing 20 Oct '08

20 Oct '08

Hello, My Freeradius seems only to read radcheck table, not to read radgroupcheck table from MS SQL. Here is my settings: In /mssql/dialup.conf, I edit two queries for authorized_check_query and authorize_group_check_query, instead of using the default ones. Doing this is easy for our database programming. authorize_check_query = "RADIUS_authorize_check_query '%{SQL-User-Name}'" authorize_group_check_query = "RADIUS_authorize_group_check_query '%{SQL-User-Name}'" in sql.conf, read_group is set to yes. Then I suppose Freeradius should start to read group tables. When I test a user whose username is associated to a group name and pool-name, Freeradius returns only authentication successful, but no group info or IP is returned. Here is the debug: rad_recv: Access-Request packet from host 172.16.1.5 port 1723, id=20, length=57 User-Name = "dr.julien.olivier" User-Password = "acdq" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "dr.julien.olivier", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> dr.julien.olivier rlm_sql (sql): sql_set_user escaped user --> 'dr.julien.olivier' rlm_sql (sql): Reserving sql socket id: 2 expand: RADIUS_authorize_check_query '%{SQL-User-Name}' -> RADIUS_authorize_check_query 'dr.julien.olivier' query: RADIUS_authorize_check_query 'dr.julien.olivier' rlm_sql (sql): User found in radcheck table expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'dr.julien.olivier' ORDER BY id query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'dr.julien.olivier' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "acdq" rlm_pap: Using clear text password "acdq" rlm_pap: User authenticated successfully ++[pap] returns ok +- entering group post-auth rlm_ippool: Could not find Pool-Name attribute. ++[netplus] returns noop rlm_ippool: Could not find Pool-Name attribute. ++[staffnet] returns noop rlm_ippool: Could not find Pool-Name attribute. ++[julienne] returns noop rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> dr.julien.olivier rlm_sql (sql): sql_set_user escaped user --> 'dr.julien.olivier' ++[sql] returns noop Sending Access-Accept of id 20 to 172.16.1.5 port 1723 Finished request 122. Going to the next request Waking up in 4.9 seconds. Cleaning up request 122 ID 20 with timestamp +79236 Ready to process requests. I don't know where I set it wrong or anything I miss to configure. I mean if radcheck table works, it means at least the query that I changed is working. So I don't know with the same idea, why radgroupcheck does not work. Could anyone give me some ideas? Thanks so much XJ

3 6