- Freeradius-Users - lists.freeradius.org

Error in the negotiations
by Martin Silvero 06 Oct '08

06 Oct '08

This is the error when the user tries to connect seems an error of certificates but are well installed: thanks!!! Going to the next request Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=68, length=144 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9200" Calling-Station-Id = "001f.3c22.44e5" Service-Type = Login-User Message-Authenticator = 0xb7ec9c58aef5995fa1beeaf9fb22d535 EAP-Message = 0x0201000d016d73696c7665726f NAS-Port-Type = Wireless-802.11 NAS-Port = 278 NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 68 to 10.0.31.40 port 1645 EAP-Message = 0x0102001604100150e2e5a3af2f9bf6b494482cd5b15c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c4703a0f252b64ab3b8aac1c Finished request 63. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=69, length=155 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e01" Calling-Station-Id = "001f.3c22.44c1" Service-Type = Login-User Message-Authenticator = 0x32c823b2ce943c46fe0003306353f899 EAP-Message = 0x02020006030d NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c4703a0f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/tls rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 69 to 10.0.31.40 port 1645 EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c571330f252b64ab3b8aac1c Finished request 64. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=70, length=259 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9100" Calling-Station-Id = "001f.3c22.44e5" Service-Type = Login-User Message-Authenticator = 0x81272adb33bde6be5f5504b71ab4a408 EAP-Message = 0x0203006e0d8000000064160301005f0100005b030148e6393e196c12f7838dcd0d7a1694260cf59192b892175d80ab559c8c0d2a2c00003400390038003500160013000a00330032002f006600050004006500640063006200610060001500120009001400110008000600030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c571330f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 110 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 100 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 005f], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 084d], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a4], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 70 to 10.0.31.40 port 1645 EAP-Message = 0x010404000dc000000b5c160301004a02000046030148e6393f8cf1a3361f16721360b5d45888974900d9d8b23589586a54fe51948e20d797947a00be4bc79252c1053e25d5fce0cedf6011d6ec9db492fd852b63101f003900160301084d0b00084900084600039e3082039a30820282a003020102020101300d06092a864886f70d0101040500308190310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e30 EAP-Message = 0x1c06035504031315436572746966696361746520417574686f72697479301e170d3038303931313139333132345a170d3039303931313139333132345a3077310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c060355040a130549504c414e311b3019060355040313125365727665722043657274696669636174653124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e617230820122300d06092a864886f70d01010105000382010f003082010a0282010100cb176f82821ac53bae0ad6d892dc2fbc02bd709cfd64b2f81bf01398427a953dc2b95534af53 EAP-Message = 0xad5703b2d29b3907f7024d696fe1052b8a17e4e75a68ddaa7c71cae9e65a97275165e2c70edcaa483683b0dcd11b16eb3390c227d7dd513bcd994aae66c7edd36e527c7252c9100d6393d6f61b8a3f3a33bc2f010bd55f4d235582390de19faeb2c875d8d16abe3fc6c7ad9584c90f14e921e374873ab54996ae6e1e913105cccd7b3b17d9b7549e763a5e1a2bd5275bdb2a22326801738ef91eebe62254ed7169c4e228001e2632103b1f38440018088f1eaf6a67c4aa787e0b7742fd4b079bb054222f70b468d2beeed58097b09b1431aa547805ca87260e090203010001a317301530130603551d25040c300a06082b06010505070301300d06092a EAP-Message = 0x864886f70d0101040500038201010006bd989e695b4fc7051fed5d91b62cf1a0d75072e293faf15aa1b638ef07fecded678c1b5533c133c1a0ee2ee602a00def36556a8949260a6772f910c440a42fac024f1827575721130d2f6b5cedd85e0340439a0f651d2c9467054fb89817af3aef0d8a2a41168ff857d047d8ff5e9803dadd7f7946106856fc04fb9f38ff21bd3ff5999113806e7d01669f0e27c1e6be50228a4151e3d39acdc5a6c29ec9b9730055cca50e4d33f8a1c071d84d5df62823125a61a4e3c4d958e83c9218b2a6c3635da4e41c12e403ded5b2c2450e8f04ca53684d2e64cbbc6ccb2351e38207a19f7a9352bec178c892deace531 EAP-Message = 0x99099dcd2c06b6668361b45a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c676330f252b64ab3b8aac1c Finished request 65. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=71, length=155 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9100" Calling-Station-Id = "001f.3c22.44e5" Service-Type = Login-User Message-Authenticator = 0xb611e618564f594f59b8a57688c4fc6a EAP-Message = 0x020400060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c676330f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 71 to 10.0.31.40 port 1645 EAP-Message = 0x010504000dc000000b5ce3115e02e0670004a23082049e30820386a003020102020900d9dcff3987698a72300d06092a864886f70d0101050500308190310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f72697479301e170d3038303931313139323934345a170d3038313031313139323934345a308190310b3009060355040613024152 EAP-Message = 0x311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100b326eafca1440742350e357c49fc3ee99823cf82af887f2dab58faf782484e2b9a485b317ded6bd95fa746ef0432c96862dccbaad3d3a619da14c1cf684e530ca3003e18d9ab94284e31330b287dfe3e008c9ac54abc5acde9 EAP-Message = 0x1c85dd20c770467b546d8318c8d17e35709e704dec48b86afca059031c13a2130af97820bd7cfe73ab906acf847bc711184d0e9fba4377647754f6ab75717a7eda6ecc046bda89a0b147271fcdb84b094da53e168e2f83710e72f79fb4a4153ead2b7548dcf5f9d9789b3e0a46f21540659a9b30e834d5ab33184feec0ded43ba366d7b45bf5dec22d5670a7e8c34eb55aa593fc9021c7ec114a6bc0e116711efa8d39ec5617e90203010001a381f83081f5301d0603551d0e04160414783ebd2ad86bb68a828aa2e0b63806cfd5bf7ab03081c50603551d230481bd3081ba8014783ebd2ad86bb68a828aa2e0b63806cfd5bf7ab0a18196a481933081 EAP-Message = 0x90310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f72697479820900d9dcff3987698a72300c0603551d13040530030101ff300d06092a864886f70d010105050003820101001ec43670817b76126b2433fb85bf51d67870b4c4d7e6774e3c5f450c8d1e5d0d7a878812c09decd07d3aa00386d7e9a3f0ff78015767d94a7063fbc62418fc EAP-Message = 0x66d1badfb2f5a6654185c9e8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c777330f252b64ab3b8aac1c Finished request 66. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=72, length=155 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9100" Calling-Station-Id = "001f.3c22.44e5" Service-Type = Login-User Message-Authenticator = 0x2851fcc991a9202cc513a5ad8b42d88d EAP-Message = 0x020500060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c777330f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 72 to 10.0.31.40 port 1645 EAP-Message = 0x0106037a0d8000000b5c84d54ba8eb7d1802bb33ae272c6ae33a1f371394cacbfdc36c0dd90cd2a45b27e851fa308b5afba9c3084e6fe8eb04a2c296f328c401c5fd131e275d36db6fe471266bac60ac03bc52671946d3813931fa806d21dd0ad1bf1d243efb8c87cfac21b3bc3f6388cee5f661fcbc6f4f101d4e70989b243cb7a2612249a8918caef66497b10c9d61628506926941bd2d114d976fb8cbe71258686aaea6a0bb5e5c1527ec23b08c068a530e03a74878d6865971666abb10160301020d0c0002090080ad2df571269b93a787f80235487c28f730b4907620fed69ef713bb4f43d3579e11b02fbf45ab4e74cf79b5d447af0fe6805157 EAP-Message = 0x482f2b5f8185c4cc59061e6882ab9e4dd6def0736c0583158ab64a30e9a2de020c5e4f7a41b4c58149a9b110a6d3b521f30e96e82b2b43f2d0d1a699b6484f8c814f72d4fe8fc11d7943f2c6a300010200807eb17e2cd3bfe68954119040daeedff8b2dc0f3023ecc737b3a453b849a6725a6a17f801675e8821a4fc4cddb378120790c895fe52327e02e8f9c6e8f9ec839f7defbb6ff24ce37109716f9036c08068ff8831d267f1bad81afb6e34b1bf3311e69fece8ba8a23f36cd8d30950fb02bf350c76523ca7648447a0cf838438d6230100a9bd246a3c125ff2d25837a5df1922c8e4e41cc543755bee745d052ab78c4166ba6f335041d76861c5 EAP-Message = 0xc740bad59cc9d2b8901fba33e059f7f57eee59d50dff516179b5711c69c66b23f84f4c23976bfcb43b165784d36e4cdf6fae15d73158919ac4399fa34e7d072443949445c14474daa34cf2879b6af859b0ae20854b3b884baa36d9a3efa6ba97011e1d1f7b4807341d9386dc3d6047ed366d83a9c5b511071cc08bc7fa680064cad079a244fed8702ff7176d54f3de6a49fa7de1724dfa657681c3a762f16e264bfe145511225959cbe539409a8cfe85d4bb384d1a05e928d5de903c99dd5da60549dcbd39bba7953a3ead5575372e0f37f8ebf688e82516030100a40d00009c040304010200950093308190310b300906035504061302415231153013 EAP-Message = 0x0603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311e301c06035504031315436572746966696361746520417574686f726974790e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc4723e07c074330f252b64ab3b8aac1c Finished request 67. Going to the next request Waking up in 2.5 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=73, length=1539 User-Name = "msilvero" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9100" Calling-Station-Id = "001f.3c22.44e5" Service-Type = Login-User Message-Authenticator = 0xab3523198d100765a920a24032159941 EAP-Message = 0x020605640d800000055a16030103840b00038000037d00037a308203763082025ea003020102020102300d06092a864886f70d01010405003077310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c060355040a130549504c414e311b3019060355040313125365727665722043657274696669636174653124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172301e170d3038303931313139333731355a170d3039303931313139333731355a306d310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c0603 EAP-Message = 0x55040a130549504c414e3111300f060355040313086d73696c7665726f3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e617230820122300d06092a864886f70d01010105000382010f003082010a0282010100df4cf6b433a99e968c3032dc86887f26d20b302e996519460cd0c816fe3b4513794e0dd0c40ad573e59684615ab282db1af575f30ab44493abfeaf28154490523082d8531d282d79b4074aae96899c864baf660ebffe60ce1321de0a92cd6fc39b068e068195e4c9e6796de0c812420773f104d59b68f4e2ebc62ac86c02fdc22be08f0da9f12fece103fcaf1d3b45f0c63a0fa55da1aeeb26 EAP-Message = 0x9abff0c6a02984eaea3005d9b8e5c7e1c8bf191f326dd809ea05de48f245223e1ba582587119ded08144006ab2601daf6a405720ed912c9fa976bf8c3450f9a343ffd630530f144dca9e338915de3c1bee28a4d62142bc12541caeb7e6f5315da70fa7879fd79d0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d01010405000382010100c7b5c38930036400b1bba7dc9dcceef40b155059e124b445dd9600c8a00bab47396d76f2f9c42f40ae4a799dd9ef67169d7d748f6967f0474f46366ae80b325dad23879616f8889a5e182d89bdab15e1bbbf6b708054059e55e21eceab9115bc7d494753 EAP-Message = 0xfdcd0cb2c1323d872065465f112d9faabf1ebaef18cb615b818523e10b1c097b9dd4e170c9520bbf3e38e07c4001f6636739e2a756ccd7fc92d180edd66d493dc87a351b4f9203d8c9c034a1efc4b735727b7d04d3e9192ac68a4b33179eb1d2c671486551668a27d712e315aa7cd3f1d2ab328d89a41ccb3404435a493d644b67e64696d642c01c06f54f872d6a8744c6478cfd22f42d42b4021be3160301008610000082008009d50971946c422ae7a50a343bf17f7e5fc6097c5f8cddde0c246670bdd56771841c746db55bd3b8c450850b9ad84e4a99aea116ef578aed3102a603be729aef0fdc879a7578b5a98d94549f9810d1be6a06113673a2 EAP-Message = 0x30e516579b67463d93e885e58c9adced68eecb9f106a7b1554c83307f5b993acf3beb4b9016ef5a19fa116030101060f0001020100a6276e0d6682c25fe886c3d80cb517f574b630e6d1ffc2cf8a90b699b8a0c98e7317b6b4a391330a221c1c23717d9fce471df755ddcb5a49e3ad3417d096dda1d8f55fdb80fe095e7f50e950d66b1be490f52fc97e3c47364cac2391e25d24f196ea4d57e7059dae449cd52c47d3b660b49f5d3b180956a56d9897c46e61f5a9ea862b89807f1ce792ce5b9f99d8be3126eabbbb4fb6fbb93e13223c203ccd159c43afd3bce3538b22d4187c31f4a7cb583efa74a34bf2ce2d22bb7f455ad67b2a9928e0b5deb8d2 EAP-Message = 0x2c8c0542ba87680a7062650816c023c0f3c1fdfa5f1aa4d89030a65b59673d6b9990835818a5ad2d986f3ee9732c6c73bbd24646007fc2ef140301000101160301003029d9e8b20a09e539534830d4eaa73fc19de54c7b9ed0d2586ac9c1adda6438ef3ba746c7c1fa18ad064d0a222d1489ce NAS-Port-Type = Wireless-802.11 NAS-Port = 278 State = 0xc4723e07c074330f252b64ab3b8aac1c NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "msilvero", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry msilvero at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 1370 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0384], Certificate --> verify error:num=20:unable to get local issuer certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> msilvero attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 73 to 10.0.31.40 port 1645 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000

1 0

Re: Problem with EAP-TLS
by Guk Victor 06 Oct '08

06 Oct '08

1 0

Some recent changes...
by Alan DeKok 06 Oct '08

06 Oct '08

I've moved git head to using the latest libtool (2.2.4). This MAY cause issues, or it MAY solve problems that people have. There's really no way to tell until it's tested on a wide variety of systems. I've put some effort into fixing the "bind to privileged port" issues. It's possible to run the server as an unprivileged user. In this case, it will temporarily drop permissions when it starts up, "su" to root to bind to the ports, and then permanently drop permissions after that. This helps the server run with the minimum number of permissions. I've also moved about 20% of the server code out of src/main, and into src/modules. See src/modules/frs_*. What are the new modules? Well... they implement the server code that handles incoming packets. when the server sees a "listen" section saying "type = foo", it tries to load a module "frs_foo". This works for auth, acct, control sockets, proxy, "detail" file readers, DHCP, and VMPS. The nice thing about this is that the "weird" code like DHCP && VMPS is now located only in frs_dhcp && frs_vmps. i.e. Neither the server core, nor the RADIUS library know anything about DHCP or VMPS. This makes the server core simpler and easier to understand. The next step is to move much of the RADIUS state machine code from src/main to frs_auth && frs_acct. It's may be a little difficult to do, but I think it will be worth it in the end. Why was this done? For one, src/main/ was getting big. The addition of new protocols like VMPS && DHCP made the build system && internal server code more complicated. This change simplifies it again. As a side effect, it may make it easier to add new protocols... like an ARP watch daemon, or pretty much anything else UDP related. Alan DeKok.

1 0

Doubt about default and inner-tunnel
by Giovanni Lovato 05 Oct '08

05 Oct '08

I use FR 2.1.1 for WPA authentication, using TTLS+MSCHAPv2 and LDAP to store users and passwords (in LM/NT hash format). I tried several configurations: Configuration 1: - no changes in sites-enabled/default; - in sites-enabled/inner-tunnel uncommented "ldap" in authorize and "Auth-Type LDAP" in authenticate. Result: users get access even with an incorrect password. Why? Configuration 2: - in sites-enabled/default uncommented "ldap" in authorize and "Auth-Type LDAP" in authenticate; - no changes in sites-enabled/inner-tunnel. Result: users aren't authenticated. Configuration 3: - in sites-enabled/default uncommented "Auth-Type LDAP" in authenticate; - in sites-enabled/inner-tunnel uncommented "ldap" in authorize. Result: it seems to work correctly, users get access only with a correct password. I can't understand well the flow of the process between the two virtual servers :(

2 1

IPv6 question, plus changelog not accessible?
by Karl Auer 05 Oct '08

05 Oct '08

Hi there. I'm interesting in using FreeRADIUS with IPv6 (not as a RADIUS transport, but in an IPv6-enabled environment). Looking at the roadmap for version 2, there is this little snippet, under the heading "Done": IPv6 (not IPv6 home server & realms, Raghu has a patch) What does "not IPv6 home server & realms" mean? I tried to find out more by looking at the change log, but the wiki wants me to log in to look at it; I don't have an account and can't see how to create one. The change log would be interesting for another reason too - I need to upgrade a server from 2.0.x to 2.1.1 sometime, and need to know if I can just install over the top or not. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28

2 1

Easy way to Convert Config
by Marcel Grandemange 05 Oct '08

05 Oct '08

I have a working FreeRadius Version 1.1.7 setup and would like to change over to version 2. Is there an easy way to do this upgrade?

3 2

Not authenticating after adding attributes
by Karl Auer 05 Oct '08

05 Oct '08

After spending two days gettig a suitable virtual machine operational (!) I have finally managed to get back to what I was actually trying to do, namely come to grips with FreeRADIUS! At the moment, a simple user entry in my database works; when I add attributes, the entry stops working. I have a feeling I am missing something embarrassingly obvious... Details below; any ideas appreciated. Regards, K. Here is the first attempt, starting from an empty database (no data in any tables): mysql> insert into radcheck (username, attribute, op, value) value ("test1", "Cleartext-Password", ":=", "blather") ; Query OK, 1 row affected (0.00 sec) mysql> quit Bye kauer@ubuntu:/usr/local/etc/raddb$ radtest test1 blather 127.0.0.1 1812 testing123 Sending Access-Request of id 79 to 127.0.0.1 port 1812 User-Name = "test1" User-Password = "blather" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=79, length=20 ******* that worked. Then I added a few reply attributes so that the user looked like this: mysql> select * from radcheck ; +----+----------+--------------------------+----+----------------------+ | id | username | attribute | op | value | +----+----------+--------------------------+----+----------------------+ | 1 | test1 | Cleartext-Password | := | blather | | 2 | test1 | Tunnel-Client-Endpoint:0 | = | 2406:a000::6:4 | | 3 | test1 | Tunnel-Server-Endpoint:0 | = | 2406:a000::6:5 | | 4 | test1 | Framed-IPv6-Prefix | = | 2406:a000:0:100::/64 | +----+----------+--------------------------+----+----------------------+ 4 rows in set (0.01 sec) mysql> quit Bye kauer@ubuntu:/usr/local/etc/raddb$ radtest test1 blather 127.0.0.1 1812 testing123 Sending Access-Request of id 220 to 127.0.0.1 port 1812 User-Name = "test1" User-Password = "blather" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=220, length=20 ****************** That did not work. Here is the debug output from the first (successful) attempt: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 59653, id=79, length=57 User-Name = "test1" User-Password = "blather" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> test1 [sql] sql_set_user escaped user --> 'test1' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test1' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "blather" [pap] Using clear text password "blather" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> test1 [sql] sql_set_user escaped user --> 'test1' [sql] expand: %{User-Password} -> blather [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test1', 'blather', 'Access-Accept', '2008-10-06 02:43:41') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test1', 'blather', 'Access-Accept', '2008-10-06 02:43:41') rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 79 to 127.0.0.1 port 59653 Finished request 3. ************** Here is the debug output from the later (unsuccessful) attempt: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 58059, id=220, length=57 User-Name = "test1" User-Password = "blather" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> test1 [sql] sql_set_user escaped user --> 'test1' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test1' ORDER BY priority rlm_sql (sql): Released sql socket id: 0 [sql] User test1 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 11 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 11 Sending Access-Reject of id 220 to 127.0.0.1 port 58059 Waking up in 4.9 seconds. Cleaning up request 11 ID 220 with timestamp +6643 Ready to process requests. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28

2 2

FR 2.1.1 --enable-developer core dump
by Chris Howley 05 Oct '08

05 Oct '08

Hello Alan, FR 2.1.1 and Solaris 10 x86 1. ./configure --enable-developer --without-rlm_perl 2. radtest test test localhost 0 testing123 Core dump created when running server with default configuration. Chris Howley FreeRADIUS Version 2.1.1, for host i386-pc-solaris2.10, built on Sep 25 2008 at 12:42:55 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 32843, id=73, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 129.11.59.97 NAS-Port = 0 +- entering group authorize {...} Segmentation Fault (core dumped) <<<<<<<< Output from gdb >>>>>>>>> * 1 process 77776 0xd0b60d3d in rad_mangle (data=0x818f720, request=0xd11e0b00) at rlm_preprocess.c:219 Thread 1 (process 77776 ): #0 0xd0b60d3d in rad_mangle (data=0x818f720, request=0xd11e0b00) at rlm_preprocess.c:219 namepair = (VALUE_PAIR *) 0x8196238 request_pairs = (VALUE_PAIR *) 0xd13e5f4e tmp = (VALUE_PAIR *) 0x0 #1 0xd0b61303 in preprocess_authorize (instance=0x818f720, request=0x8196238) at rlm_preprocess.c:524 r = 135853856 #2 0x08063c44 in modcall (component=1, c=0x0, request=0x8196238) at modcall.c:285 myresult = 6 stack = {pointer = 1, priority = {0, 0, 1769107551, 134506096, -784525670, -784850519, -784850519, 134506168, -784399592, -784349160, -784399592, -784852616, -784857896, -784854152, 134506328, 134506312, 12, 0, 2147483647, 1, 0, 0, -784349160, 0, -784533850, -784339816, 134506168, 0, 0, 12, -784350580, 0}, result = {6, 6, 134506400, 134506396, 1, 1, 0, 1, 0, 0, 134506348, 0, 97, 134506336, -784843282, 0, 0, 134506356, -784842758, 0, 0, 286553246, 0, 0, 0, 1, 1, 0, 0, -784767474, 134506481, -784819192}, children = {0x8190b28, 0x8190ae0, 0x8046770, 0x8046770, 0x8046ceb, 0x8046758, 0xd1387665, 0x80467f0, 0x8046788, 0xd1020744, 0xd1396610, 0x1, 0x1, 0xd0ff460b, 0x8046ceb, 0x80467f0, 0x1, 0x80467f0, 0x81966e8, 0xd13a89a0, 0x8046ceb, 0x8046c08, 0xd1389f94, 0x8046ceb, 0x80467f0, 0x3f5, 0x1, 0x80467f0, 0x808f268, 0x80467f0, 0x805ab9b, 0x0}, start = {0xd13ce332, 0x8190ae0, 0x8062163, 0xd13fd010, 0xd0d10308, 0x80470b8, 0xd13a89a0, 0x818f008, 0xd13a9110, 0x8046808, 0xd138ec57, 0x8046840, 0x818e698, 0xd13fc16c, 0xd138ec2e, 0x2e390030, 0x352e3131, 0x37392e39, 0xd13a89a0, 0x8196238, 0x1, 0x8046828, 0xd138ece6, 0x81464c0, 0x8046840, 0xd13f00c0, 0x80468bc, 0xa, 0x808f268, 0x8046858, 0x806289e, 0x81464c0}} parent = (modcallable *) 0x8190b28 child = (modcallable *) 0x8190ae0 if_taken = 0 was_if = 0 #3 0x0806298f in indexed_modcall (comp=1, idx=0, request=0x8196238) at modules.c:541 rcode = 0 this = (indexed_modcallable *) 0x0 list = (modcallable *) 0x8190b28 #4 0x080636ec in module_authorize (autz_type=0, request=0x8196238) at modules.c:1196 No locals. #5 0x080564c8 in rad_authenticate (request=0x8196238) at auth.c:550 namepair = (VALUE_PAIR *) 0xd13d3a13 check_item = (VALUE_PAIR *) 0x80468f4 auth_item = (VALUE_PAIR *) 0x8196488 module_msg = (VALUE_PAIR *) 0x0 tmp = (VALUE_PAIR *) 0x0 result = 0 autz_retry = 0 '\0' autz_type = 0 #6 0x0806dfb3 in radius_handle_request (request=0x8196238, fun=0x80563c4 <rad_authenticate>) at event.c:3027 No locals. #7 0x080681f8 in thread_pool_addrequest (request=0x8196238, fun=0x80563c4 <rad_authenticate>) at threads.c:843 now = 1223025080 #8 0x0806f39e in event_socket_handler (xel=0x8191d70, fd=6, ctx=0x8196238) at event.c:2668 fun = (RAD_REQUEST_FUNP) 0x80563c4 <rad_authenticate> request = (REQUEST *) 0x8196238 #9 0xd13943de in fr_event_loop (el=0x8191d70) at event.c:400 i = 1 rcode = 135863676 when = {tv_sec = 0, tv_usec = 0} wake = (struct timeval *) 0x8191d7c read_fds = {fds_bits = {64, 0 <repeats 31 times>}} #10 0x0806fb25 in radius_event_process () at event.c:3014 No locals. #11 0x0806621b in main (argc=2, argv=0x8047458) at radiusd.c:397 rcode = 0 argval = 0 spawn_flag = 0 dont_fork = 1 flag = 0 act = {sa_flags = 0, _funcptr = {_handler = 0x80664bc <sig_fatal>, _sigaction = 0x80664bc <sig_fatal>}, sa_mask = {__sigbits = {0, 0, 0, 0}}, sa_resv = {0, 0}}

2 1

FreeRADIUS and Novell universal password
by Jason Brown 05 Oct '08

05 Oct '08

I am seeing issues with users not authenticating correctly to our Novell eDirectory server. When some users try to authenticate they are denied access due to errors with their universal password. We have other systems that do not have this problem and am not sure why. Is there a way to configure this to use the NDS password instead of the universal password? Thanks. Jason Brown Systems Administrator Enterprise Technology Services Ferris State University (231) 591-2687

2 1

freeradius and active directory
by Vieri 05 Oct '08

05 Oct '08

Hi, I noticed that some freeradius.org howtos suggest to specify a "password server" in Samba when using ads security: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO http://deployingradius.com/documents/configuration/active_directory.html Why should one do that, especially if the samba docs say "Use password server option only with security = server"? Besides, if I comment out "password server =", specify "realm = MYDOMAIN.ORG" and then define the AD servers in krb5.conf one per line: kdc = server1.MYDOMAIN.ORG:88 kdc = server2.MYDOMAIN.ORG:88 then authentication via AD is as expected. I'm just curious to know why these howtos suggest to specify a password server when using ads security in Samba. Thanks, Vieri

2 1