- Freeradius-Users - lists.freeradius.org

EAP-TTLS w/PAP using ntlm_auth
by Bram Matthys (Syzop) 29 May '08

29 May '08

While I've EAP-TTLS w/EAP-MSCHAPv2 working now with ntlm_auth, I'd also like to have EAP-TTLS w/PAP working with ntlm_auth (mostly because the client software I use [securew2] does not save user credentials with mschap, and does save them with pap. And just to offer more options to other clients). Anyway, I tried to do it using these suggestions (after previously my own attempt failed): http://lists.cistron.nl/pipermail/freeradius-users/2008-March/070469.html in radiusd.conf: exec ntlm_auth_pap { wait = yes input_pairs = request shell_escape = yes output = none program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYNET --username=%{User-Name} --password=%{User-Password}" } then in sites-enabled/inner-tunnel: authenticate { Auth-Type PAP { ntlm_auth_pap } Actually I did the same in sites-enabled/default as well to see if it helps (didn't matter, of course). Just, for the record, pap is also in the authorize { } section, listed at the end in that block, as recommended. But.. no luck.. it seems the ntlm_auth stuff is not being called at all, and to be honest I'm not even sure if pap is picking things up. I always end up with this: Wed May 28 15:16:08 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 5 Wed May 28 15:16:08 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 5 Wed May 28 15:16:08 2008 : Debug: ++[pap] returns noop Wed May 28 15:16:08 2008 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Wed May 28 15:16:08 2008 : Debug: auth: Failed to validate the user. Wed May 28 15:16:08 2008 : Auth: Login incorrect: [MYNET\\myuser/xxx] (from client localhost port 0 cli 02-00-00-00-00-01 via TLS tunnel) I used this wpa supplicant config for testing with eapol_test: network={ ssid="mynet-test" key_mgmt=WPA-EAP eap=TTLS pairwise=CCMP TKIP group=CCMP TKIP WEP104 WEP40 phase2="auth=PAP" identity="MYNET\myuser" password="xxx" anonymous_identity="anonymous@identity" } I first tried a different aproach, like putting ntlm_auth_pap in the authorize { } section before pap, and then radius *is* calling ntlm_auth, but then it just goes on and complains about not known the Auth-Type. Debug: modsingle[authorize]: calling ntlm_auth_pap (rlm_exec) for request 5 Debug: expand: --username=%{User-Name} -> --username=MYNET\myuser Debug: expand: --password=%{User-Password} -> --password=xxx Debug: Exec-Program output: NT_STATUS_OK: Success (0x0) Debug: Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Debug: Exec-Program: returned: 0 Debug: modsingle[authorize]: returned from ntlm_auth_pap (rlm_exec) for request 5 Debug: ++[ntlm_auth_pap] returns ok Debug: modsingle[authorize]: calling pap (rlm_pap) for request 5 Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 5 Debug: ++[pap] returns noop I've reverted that attempt before trying everything I mentioned earlier, though. Regards, Bram.

3 9

mod_auth_radius bus errors
by Rick 29 May '08

29 May '08

Hi all, I'm attempting to use mod_auth_radius (the cvs string is out-of-date, but it's the latest from freeradius.org for Apache 1.3), to authenticate to a Safeword RADIUS server, but when I authenticate, Apache bus errors - on auth failure, however, it doesn't. There's nothing useful logged, and no core file, basically, the server thinks I've authenticated, and Apache logs: [Date time] [notice] child pid 9819 exit signal Bus Error (10) And the web page I'm trying to access is never displayed (Unable to display web page error.) This is on a Solaris 10 / SPARC box - wondering if there may be some network byte-ordering issue? Anyway, if anyone has seen this before, and know what I'm doing wrong, would appreciate any assistance. Best regards, Rick

2 1

Freeradius 2.0.4 + OpenLDAP Problem (Cleartext-Password)
by German Hernandez 29 May '08

29 May '08

Hello everybody!! I have FreeRADIUS 1.1.7 + openldap using EAP-PEAP authentication, perfectly working. Now, I want to use the same openldap database, but with FreeRADIUS 2.0.4, but I can't get success authentication. is it necesary additional parameters of configuration for Freeradius 2.0.4? How or Where can I configure User-Password instead Cleartext-Password? OpenLDAP database needs changes for FreeRADIUS 2.0.4? ----------------------- Similar error I got, when I configured EAP-PEAP without OpenLDAP database(Using users file), like in FreeRADIUS 1.1.7: "temporal1" User-Password == "temporal1" But, when I changed User-Password with Cleartext-Password: "temporal1" Cleartext-Password := "temporal1" I got success authentication. ----------------------- But,I need to continue using my OpenLDAP database, somebody can help me how to achieve that? Thanks in advance! German --------------------------------- Yahoo! Deportes Beta ¡No te pierdas lo último sobre el torneo clausura 2008! Entérate aquí http://deportes.yahoo.com User-Name = "temporal1" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00-20-a6-53-a6-a0:WLAN" Calling-Station-Id = "00-0e-9b-d3-72-7c" NAS-Identifier = "Avaya-AP-8-53-a6-a0" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202000e0174656d706f72616c31 Message-Authenticator = 0x55f6f02dad97274f983156eb619450fb +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "temporal1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound rlm_ldap: Entering ldap_groupcmp() expand: ou=users,ou=radius,dc=wireless,dc=mired,dc=mx -> ou=users,ou=radius,dc=wireless,dc=mired,dc=mx WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=temporal1) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.1.2:389, authentication 0 rlm_ldap: bind as uid=riu,ou=admin mail,dc=server,dc=mired,dc=mx/mypass to 192.168.1.2:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,ou=radius,dc=wireless,dc=mired,dc=mx, with filter (uid=temporal1) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,ou=radius,dc=wireless,dc=mired,dc=mx, with filter (&(cn=academicos)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=RETY750916,ou=users,ou=radius,dc=wireless,dc=mired,dc=mx, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group academicos rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 139 ++[files] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for temporal1 WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=temporal1) expand: ou=users,ou=radius,dc=wireless,dc=mired,dc=mx -> ou=users,ou=radius,dc=wireless,dc=mired,dc=mx rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,ou=radius,dc=wireless,dc=mired,dc=mx, with filter (uid=temporal1) rlm_ldap: Added User-Password = TEMPORAL1 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user temporal1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3dd6d0a73dd5c9876db8a2af8cd70725 Finished request 0. Going to the next request Waking up in 4.9 seconds. User-Name = "temporal1" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00-20-a6-53-a6-a0:WLAN" Calling-Station-Id = "00-0e-9b-d3-72-7c" NAS-Identifier = "Avaya-AP-8-53-a6-a0" State = 0x3dd6d0a73dd5c9876db8a2af8cd70725 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0203005019800000004616030100410100003d0301483350f485457ef321d7205f1d3f11970f19adf7ebc2d32dd5fe9d61348b073d00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xcdc119224a6d29ca585372b3f0012c87 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "temporal1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled EAP-Message = 0x0104040019c0000008bb160301004a020000460301483351a9de21a09971d6806ac111570bb67068775f5b7cb355d205df07a04a7120c185d9c8284e73c089835ce33f5016d405fa2977103be2fdc67e7f217d14a83d000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038303531393232333931365a170d3039303531393232333931365a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100aefc44eb6a1faf3ffc80b7173e182478cf969ea5a6b85736363a5949f060 EAP-Message = 0xf2d0025f992bebe4372a32e13f3f4dfa44b06bc8557b551c09bd106ab680565a1a89492101573ec0debedb699bf16cee097dd36bd5144121f05bf76f68afba7b03efb9330b5774073da4974d385fc2996956b2a94b9515543523e27e8b5b7d93a01b6288b9b3b1ba65eae13ec1763e8cabb8f5f1ad1643d2c6268dc0cf5afa726dc133a10c34957b5bca0308e88f315966169eae2d2649cf679d017fa786bec3225d47614e15f4ea1e5cfda71ea827d61258fa132f73bddb0eafebc096b89ffa772cfe6aefa2285070a0f6aa850467ccb79c732979e5517ed7126da3787a7e7c77a30203010001a317301530130603551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d01010405000382010100118cb9122ef424f0c7a440f733b07990001c1fb80ac009f9457638ac24564dd4c1731c9b2de99a2706e036b7cdb578847b1a48c88b4f4de9c54c034865788fe3d11269e1e56ae5ea0536aa3f9284fe272eba7d3ae7d5bb5a179a8e44b7f2569bac8a871ecaf3e7978f402f246c847db9ea337182451039bbd64c357af615c2ce2581ff660dcf3e3c1ea423c12081f58da942a5ea7c12a487843398f333f3f45f27042570ca7c5ede5e43a701330ee04970972a0c3df08ae158600d9525478885d53ea753fa3b9e91dccf8b548a1574ff24fb8cf053eb2d7eeeed705ee758769a820ea157b5b4 EAP-Message = 0xa0750995694ed4b3130eea99 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3dd6d0a73cd2c9876db8a2af8cd70725 Finished request 1. Going to the next request Waking up in 4.9 seconds. User-Name = "temporal1" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00-20-a6-53-a6-a0:WLAN" Calling-Station-Id = "00-0e-9b-d3-72-7c" NAS-Identifier = "Avaya-AP-8-53-a6-a0" State = 0x3dd6d0a73cd2c9876db8a2af8cd70725 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0xcc57a33616442858d1ff03ff4d392bf8 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "temporal1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled EAP-Message = 0x010503fc1940b3e10927517142d20aca8b6bfe8d0004ab308204a73082038fa003020102020900ad7745c335b8f9af300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038303531393232333931355a170d3038303631383232333931355a308193310b30090603 EAP-Message = 0x55040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c22b84747eb6dbffd145ad73ea401cadcd70928d7a20dd7ba4753cacad6eadc6723fd2c7fc1974248b66ebd0b760886b8e7e0faf3e88f3b5ca16a4ec5a44706250a8c2740589e7248402167cb6a440 EAP-Message = 0xe501c3dd2db58bac21122ba16db6f31ab3ed57f33fec53d3a7fe2b015be100e4feaa5c4e6d35fdc6a315e0d3297444f41f43116659f383e381c0d0d6d7425f1597699bc535b11f5c6bc3c72c72a8a72947b8e0fd0b0f67e2d43ce8bd3e70a93dababba8070c39e3178762704f42156813672a35f3b306ec994340c5a6290c6ca04ae2ff563b3670d3f898b8526df0ff73dbf470e6fe622db7e5a59fd709dfdb042fe352d1078b693c11b31ccccd5cb68190203010001a381fb3081f8301d0603551d0e04160414586bacb4f8629ef9bdd097817b29a258f15a050f3081c80603551d230481c03081bd8014586bacb4f8629ef9bdd097817b29a258f15a EAP-Message = 0x050fa18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900ad7745c335b8f9af300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100064c7c582032b2416ec0ca9ba609174071748b3a5a4723e8dbdc18c4514fa2f266f306f2c9f46b3bc37378b633045c4296db EAP-Message = 0x9e5ee30aa059fc32 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3dd6d0a73fd3c9876db8a2af8cd70725 Finished request 2. Going to the next request Waking up in 4.9 seconds. User-Name = "temporal1" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00-20-a6-53-a6-a0:WLAN" Calling-Station-Id = "00-0e-9b-d3-72-7c" NAS-Identifier = "Avaya-AP-8-53-a6-a0" State = 0x3dd6d0a73fd3c9876db8a2af8cd70725 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0x19e5d2c0dd47034a67366569932803d9 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "temporal1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled EAP-Message = 0x010600d51900fa20504c21743fdcb28c94527095e4bf87f8c9ebbba34400532e82551128434a2a68843619bcbe798630caaec366ec67991327067eb1777e1bcfc1cccc2fc0ec4b80943004ad7e80b9c4431ef84c990eac035d5f9c74b8555739fec5b1bc985fcd95769e31c854d7d61c2d82d97bdb776a153262f818e15c330b59d6e6c2d44cd2d73ee0fff9c4613d98f474a8555b2921f28181c03f803b8dcf740b18a1c13041a95bb3820bea7dfecffc8145308c5e95d161b51a33645bcaceafcb383c3ce03546e7b657bd16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3dd6d0a73ed0c9876db8a2af8cd70725 Finished request 3. Going to the next request Waking up in 4.8 seconds. User-Name = "temporal1" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00-20-a6-53-a6-a0:WLAN" Calling-Station-Id = "00-0e-9b-d3-72-7c" NAS-Identifier = "Avaya-AP-8-53-a6-a0" State = 0x3dd6d0a73ed0c9876db8a2af8cd70725 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02060140198000000136160301010610000102010088203cd15a638c3638db51513d27aea3f9c5998b101e07924c7d517cd0fab8898daeba330f704bd5b4fa9a8828c7953243d2b783656866a56d7f933e668d74a1252a8d86b817d1b59e1fddc96ba0f5a4949b5b94f75f024e765da8093100aa83f6cc70625c83f10f95836b0c6d4ced72d019a7a39fb09cd599706d993cdbb9c1ba3c5670825c9df790652c28435fd7023ddef755be876e81239e19cf7ee62bff25b5aac2256af336d38e10c4cb8e472564dc5f6f3b4ea012adfdd9101dea6d340581e574633fdb2cbe7204d36e9a027924b9a2955bbdf82204b4a6ef667c885a0a1ce1542ff1a1ff EAP-Message = 0x3bfb40169caae4c580856ad2e941e127bff6a175b3c2a58114030100010116030100209df955e11155d458796366521047a8eaed81de51d31191e76245fc062c8e1b76 Message-Authenticator = 0x79a99d679c69ae0c9e1619f36db388ad +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "temporal1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 253 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 310 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled EAP-Message = 0x0107003119001403010001011603010020f54bae3cd49c93d813734f616a8c3201ebc9c26416e88382fd46c88db64ddc8d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3dd6d0a739d1c9876db8a2af8cd70725 Finished request 4. Going to the next request Waking up in 4.8 seconds. User-Name = "temporal1" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00-20-a6-53-a6-a0:WLAN" Calling-Station-Id = "00-0e-9b-d3-72-7c" NAS-Identifier = "Avaya-AP-8-53-a6-a0" State = 0x3dd6d0a739d1c9876db8a2af8cd70725 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700061900 Message-Authenticator = 0xc88d46fc398be3abf214a9b1eb767756 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "temporal1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 7 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled EAP-Message = 0x01080020190017030100156ea40735a4cf89f4626ce63b4ce1cf092e6ad3eed1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3dd6d0a738dec9876db8a2af8cd70725 Finished request 5. Going to the next request Waking up in 4.8 seconds. User-Name = "temporal1" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00-20-a6-53-a6-a0:WLAN" Calling-Station-Id = "00-0e-9b-d3-72-7c" NAS-Identifier = "Avaya-AP-8-53-a6-a0" State = 0x3dd6d0a738dec9876db8a2af8cd70725 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800251900170301001a4436081b763f21812f4545f999ac3ca58d64fa44bd807dfa391d Message-Authenticator = 0xed2a31854da81f2c2607352f7038f884 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "temporal1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 37 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - temporal1 PEAP: Got tunneled identity of temporal1 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to temporal1 +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "temporal1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 8 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: Entering ldap_groupcmp() expand: ou=users,ou=radius,dc=wireless,dc=mired,dc=mx -> ou=users,ou=radius,dc=wireless,dc=mired,dc=mx WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=temporal1) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,ou=radius,dc=wireless,dc=mired,dc=mx, with filter (uid=temporal1) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,ou=radius,dc=wireless,dc=mired,dc=mx, with filter (&(cn=academicos)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=RETY750916,ou=users,ou=radius,dc=wireless,dc=mired,dc=mx, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group academicos rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 139 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled PEAP: Got tunneled Access-Challenge ++[eap] returns handled EAP-Message = 0x0109003a1900170301002f176828ea998680bf5cbb0a089f240536fd49f7a9984d36023a331abdf4af139efdf8ed5afbadd7ec7b926a1c86d530 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3dd6d0a73bdfc9876db8a2af8cd70725 Finished request 6. Going to the next request Waking up in 4.8 seconds. User-Name = "temporal1" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00-20-a6-53-a6-a0:WLAN" Calling-Station-Id = "00-0e-9b-d3-72-7c" NAS-Identifier = "Avaya-AP-8-53-a6-a0" State = 0x3dd6d0a73bdfc9876db8a2af8cd70725 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0209005b19001703010050056dc48b30e8cfce865753a81c19410868b44ccdc765162103a41cb362cbe3c0c3da3a0ba2e060f77d1914e2bbac6d1528650fa7b33eedd05d30623cd432cf9fb158e4ef5506d7fc6426b4adee4f5b4b Message-Authenticator = 0xc20c98af65ea96e29c26cc568c9b668e +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "temporal1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 9 length 91 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to temporal1 +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "temporal1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 9 length 68 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: Entering ldap_groupcmp() expand: ou=users,ou=radius,dc=wireless,dc=mired,dc=mx -> ou=users,ou=radius,dc=wireless,dc=mired,dc=mx WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=temporal1) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,ou=radius,dc=wireless,dc=mired,dc=mx, with filter (uid=temporal1) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,ou=radius,dc=wireless,dc=mired,dc=mx, with filter (&(cn=academicos)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=RETY750916,ou=users,ou=radius,dc=wireless,dc=mired,dc=mx, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group academicos rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 139 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for temporal1 with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [temporal1/<via Auth-Type = EAP>] (from client WLAN port 0 via TLS tunnel) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled EAP-Message = 0x010a00261900170301001b1eb8a5f200d206368fbae80686e7042566c959114b2868fce2f0e0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3dd6d0a73adcc9876db8a2af8cd70725 Finished request 7. Going to the next request Waking up in 4.8 seconds. User-Name = "temporal1" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00-20-a6-53-a6-a0:WLAN" Calling-Station-Id = "00-0e-9b-d3-72-7c" NAS-Identifier = "Avaya-AP-8-53-a6-a0" State = 0x3dd6d0a73adcc9876db8a2af8cd70725 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020a00261900170301001ba4d540bec66a46cd132819b8612d89fac136ed00afa7a8fd61e51e Message-Authenticator = 0x28a2d71520b5d7318fe1bcb6df931269 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "temporal1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 10 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [temporal1/<via Auth-Type = EAP>] (from client WLAN port 0 cli 00-0e-9b-d3-72-7c) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> temporal1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 232 with timestamp +39 Cleaning up request 1 ID 233 with timestamp +39 Cleaning up request 2 ID 234 with timestamp +39 Cleaning up request 3 ID 235 with timestamp +39 Waking up in 0.1 seconds. Cleaning up request 4 ID 236 with timestamp +39 Cleaning up request 5 ID 237 with timestamp +39 Cleaning up request 6 ID 238 with timestamp +39 Cleaning up request 7 ID 239 with timestamp +39 Waking up in 1.0 seconds. Cleaning up request 8 ID 240 with timestamp +39 Ready to process requests.

4 7

a newbie testing freeradius need help
by jreubens 29 May '08

29 May '08

Hi, I am newbie trying to test free radius for my master thesis, i installed free radius two days ago and did some initial testing, the initial test was through so the radius server is running properly, before i move on i wanted to test the eap modules, so i tried to test with the help of eapol_test tool that comes with the wpasupplicant, i cannot succeed i get failure message. i am really very new to linux and to free radius, can some one help me what i should do, because i can only move one further with my thesis if and only if i figure this out. Thank you for the help, really appreciate any kind of help or suggestion. Thanks once again, below are my conf files and screen output. HERE IS MY SCREEN OUTPUT FROM THE RADIUS SERVER Ready to process requests. User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0x948a064fcafc2f8442938817c4f353d7 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled EAP-Message = 0x010100160410a3803def371cc0ea374b74fd8923747b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x47545c0a47555820cf82ad36ba08594f Finished request 0. Going to the next request Waking up in 4.9 seconds. User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0x47545c0a47555820cf82ad36ba08594f Message-Authenticator = 0x0d125e124530442dfbf043c5d6e55468 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: NAK asked for unsupported type 25 rlm_eap: No common EAP types found. rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [anonymous/<via Auth-Type = EAP>] (from client localhost port 0 cli 02-00-00-00-00-01) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 0 with timestamp +28 Waking up in 0.9 seconds. Cleaning up request 1 ID 1 with timestamp +28 Ready to process requests. User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0xfbfadf8ca2d1f2729ac2cabcc17dee20 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled EAP-Message = 0x010100160410fd28d3fff4edc58e80c666087e278736 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x383b40dc383a4460283057087d150429 Finished request 2. Going to the next request Waking up in 4.9 seconds. User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0x383b40dc383a4460283057087d150429 Message-Authenticator = 0xc4d3cf883588c4ac6c34a66de5a82aa8 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: NAK asked for unsupported type 25 rlm_eap: No common EAP types found. rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [anonymous/<via Auth-Type = EAP>] (from client localhost port 0 cli 02-00-00-00-00-01) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 2 ID 0 with timestamp +154 Waking up in 0.9 seconds. Cleaning up request 3 ID 1 with timestamp +154 Ready to process requests. HERE IS MY SCREEN OUTPUT FROM EAPOL_TEST TOOL Reading configuration file 'eapol_test.conf.peap' Line: 1 - start of a new network block eap methods - hexdump(len=16): 00 00 00 00 19 00 00 00 00 00 00 00 00 00 00 00 eapol_flags=0 (0x0) key_mgmt: 0x8 identity - hexdump_ascii(len=8): 74 65 73 74 75 73 65 72 testuser password - hexdump_ascii(len=8): 70 61 73 73 77 6f 72 64 password ca_cert - hexdump_ascii(len=33): 2f 75 73 72 2f 6c 6f 63 61 6c 2f 65 74 63 2f 72 /usr/local/etc/r 61 64 64 62 2f 63 65 72 74 73 2f 63 61 2e 70 65 addb/certs/ca.pe 6d m phase2 - hexdump_ascii(len=13): 61 75 74 68 3d 4d 53 43 48 41 50 56 32 auth=MSCHAPV2 anonymous_identity - hexdump_ascii(len=9): 61 6e 6f 6e 79 6d 6f 75 73 anonymous Priority group 0 id=0 ssid='' Authentication server 127.0.0.1:1812 EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: KEY_RX entering state NO_KEY_RECEIVE EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 EAPOL: External notification - portEnabled=1 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE Sending fake EAP-Request-Identity EAPOL: Received EAP-Packet frame EAPOL: SUPP_PAE entering state RESTART EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=0 method=1 vendor=0 vendorMethod=0 EAP: EAP entering state IDENTITY CTRL-EVENT-EAP-STARTED EAP authentication started EAP: EAP-Request Identity data - hexdump_ascii(len=0): EAP: using anonymous identity - hexdump_ascii(len=9): 61 6e 6f 6e 79 6d 6f 75 73 anonymous EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=14) TX EAP -> RADIUS - hexdump(len=14): 02 00 00 0e 01 61 6e 6f 6e 79 6d 6f 75 73 Encapsulating EAP message into a RADIUS packet Learned identity from EAP-Response-Identity - hexdump(len=9): 61 6e 6f 6e 79 6d 6f 75 73 Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=0 length=126 Attribute 1 (User-Name) length=11 Value: 'anonymous' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=16 Value: 02 00 00 0e 01 61 6e 6f 6e 79 6d 6f 75 73 Attribute 80 (Message-Authenticator) length=18 Value: fb fa df 8c a2 d1 f2 72 9a c2 ca bc c1 7d ee 20 Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 80 bytes from RADIUS server Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=0 length=80 Attribute 79 (EAP-Message) length=24 Value: 01 01 00 16 04 10 fd 28 d3 ff f4 ed c5 8e 80 c6 66 08 7e 27 87 36 Attribute 80 (Message-Authenticator) length=18 Value: 9c 1e f2 5d 0e 72 cd 49 88 c9 24 f5 2c bc ae 3a Attribute 24 (State) length=18 Value: 38 3b 40 dc 38 3a 44 60 28 30 57 08 7d 15 04 29 STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5 (4) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=1 method=4 vendor=0 vendorMethod=0 EAP: EAP entering state GET_METHOD EAP: configuration does not allow: vendor 0 method 4 EAP: vendor 0 method 4 not allowed EAP: Building EAP-Nak (requested type 4 vendor=0 method=0 not allowed) EAP: allowed methods - hexdump(len=1): 19 EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=6) TX EAP -> RADIUS - hexdump(len=6): 02 01 00 06 03 19 Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=1 length=136 Attribute 1 (User-Name) length=11 Value: 'anonymous' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=8 Value: 02 01 00 06 03 19 Attribute 24 (State) length=18 Value: 38 3b 40 dc 38 3a 44 60 28 30 57 08 7d 15 04 29 Attribute 80 (Message-Authenticator) length=18 Value: c4 d3 cf 88 35 88 c4 ac 6c 34 a6 6d e5 a8 2a a8 Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 44 bytes from RADIUS server Received RADIUS message RADIUS message: code=3 (Access-Reject) identifier=1 length=44 Attribute 79 (EAP-Message) length=6 Value: 04 01 00 04 Attribute 80 (Message-Authenticator) length=18 Value: c2 b7 ec 8f d8 87 c9 c1 77 52 2d 40 8a 9e 9a a5 STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 1.00 sec RADIUS packet matching with station decapsulated EAP packet (code=4 id=1 len=4) from RADIUS server: EAP Failure EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state FAILURE CTRL-EVENT-EAP-FAILURE EAP authentication failed EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: success=0 MPPE keys OK: 0 mismatch: 2 FAILURE root@ozzy3:/home/jreubens/wpa_supplicant-0.5.10# HERE IS MY EAPOL_TEST_PEAP CONF FILE root@ozzy3:/home/jreubens/wpa_supplicant-0.5.10# cat eapol_test.conf.peap network={ eap=PEAP eapol_flags=0 key_mgmt=IEEE8021X identity="testuser" password="password" ca_cert="/usr/local/etc/raddb/certs/ca.pem" phase2="auth=MSCHAPV2" anonymous_identity="anonymous" } HERE IS MY EAP.CONF FILE ON RADDB DIR eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random # fragment_size = 1024 # include_length = yes cipher_list = "DEFAULT" # make_cert_command = "${certdir}/bootstrap" } ttls { default_eap_type = md5 # allowed values: {no, yes} copy_request_to_tunnel = no # allowed values: {no, yes} use_tunneled_reply = no #virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } sorry to ask you some naive question, i am really new to this. and one more question whenever i change something in my eap.conf, users and client.conf file i kill the existing radiusd running and start a new radiusd, is that right or is there anyways to restart the radiusd. Thank you all and thank you for your time, Regards, Jreuben -- View this message in context: http://www.nabble.com/a-newbie-testing-freeradius-need-help-tp16833079p1683… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 16

EAP-TTLS/MSCHAPv2
by sriram 29 May '08

29 May '08

Hi All, I am facing problem using the FreeRadius version 1.1.7 for EAP-TTLS/MSCHAPv2. Always I keep seeing the access-challenge on the radius log. I have attached the eap.conf / wpa_supplicant.conf and radius traces for your reference. Please, let me know If there is anything wrong in my configurations. Thanks & Regards, Sriram

2 1

Freeradius book
by orion 29 May '08

29 May '08

Hi alan. Whats up with your book? When will comes out?

3 2

EAP-TLS -- first timer
by Joseph S. Dietz, Jr. 28 May '08

28 May '08

Hi, I am new to FR... I was able to get freeradius to work with EAP-MD5 passwords using an XP client. I can not seem to get free raidus working with Certs. I need some help debugging the issue. radiusd -v radiusd: FreeRADIUS Version 2.0.1, for host i386-pc-solaris2.9, built on May 1 2008 at 16:01:29 version OpenSSL 0.9.8g 19 Oct 2007 I have patched the XP system per the FR howto... I seem to have certs created right? But no authentication... I've tried googl'n the issue, but I need a little more help understanding what is happening. thanks in advance for your time, Joe Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "abc123" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } ... ... ... rad_recv: Access-Request packet from host 1.2.3.126 port 1024, id=28, length=167 User-Name = "joe" NAS-IP-Address = 1.2.3.126 NAS-Identifier = "00:08:da:57:3f:63" NAS-Port = 0 Called-Station-Id = "00-08-DA-57-3F-61:" Calling-Station-Id = "00-1A-4B-61-9C-C8" Framed-MTU = 1400 NAS-Port-Type = Ethernet Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000c016a73646965747a Message-Authenticator = 0x4f6d8dd3b1012bc9f500b915421a8fe3 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "joe", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rad_recv: Access-Request packet from host 1.2.3.126 port 1024, id=28, length=167 User-Name = "joe" NAS-IP-Address = 1.2.3.126 NAS-Identifier = "00:08:da:57:3f:63" NAS-Port = 0 Called-Station-Id = "00-08-DA-57-3F-61:" Calling-Station-Id = "00-1A-4B-61-9C-C8" Framed-MTU = 1400 NAS-Port-Type = Ethernet Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000c016a73646965747a Message-Authenticator = 0x4f6d8dd3b1012bc9f500b915421a8fe3 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "joe", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 1.2.3.126 port 1024, id=29, length=253 User-Name = "joe" NAS-IP-Address = 1.2.3.126 NAS-Identifier = "00:08:da:57:3f:63" NAS-Port = 0 Called-Station-Id = "00-08-DA-57-3F-61:" Calling-Station-Id = "00-1A-4B-61-9C-C8" Framed-MTU = 1400 NAS-Port-Type = Ethernet Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100500d800000004616030100410100003d03014829bb9f9cfe85aa6ac13f1df8fff02e7c2ce116dcee5d0847a173bddd4fab7d00001600040005000a000900640062000300060013001200630100 State = 0xbbdf20d6bbde2d9285f320de1e094fc7 Message-Authenticator = 0xcfd61b81787d9db0dbc4487e94abba8d +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "joe", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06f6], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 008b], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 29 to 1.2.3.126 port 1024 EAP-Message = 0x010204000dc0000007... EAP-Message = 0x83300d06092a864886f70d01 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbbdf20d6badd2d9285f320de1e094fc7 Finished request 5. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 1.2.3.126 port 1024, id=30, length=179 User-Name = "joe" NAS-IP-Address = 1.2.3.126 NAS-Identifier = "00:08:da:57:3f:63" NAS-Port = 0 Called-Station-Id = "00-08-DA-57-3F-61:" Calling-Station-Id = "00-1A-4B-61-9C-C8" Framed-MTU = 1400 NAS-Port-Type = Ethernet Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200060d00 State = 0xbbdf20d6badd2d9285f320de1e094fc7 Message-Authenticator = 0x199602f63d262136de69a50907a837a2 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "joe", looking up r rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP c ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 30 to 1.2.3.126 port 1024 EAP-Message = 0x010303ee0d80000007... Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbbdf20d6b9dc2d9285f320de1e094fc7 Finished request 6. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 1.2.3.126 port 1024, id=31, length=179 User-Name = "joe" NAS-IP-Address = 1.2.3.126 NAS-Identifier = "00:08:da:57:3f:63" NAS-Port = 0 Called-Station-Id = "00-08-DA-57-3F-61:" Calling-Station-Id = "00-1A-4B-61-9C-C8" Framed-MTU = 1400 NAS-Port-Type = Ethernet Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300060d00 State = 0xbbdf20d6b9dc2d9285f320de1e094fc7 Message-Authenticator = 0xd5780baba7af2999a85f8234b3c06fc5 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "joe", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type etc...

1 0

radcheck question
by Pete Kay 28 May '08

28 May '08

Hi, My freeradius works if I use a test client to send in the username and password, but when I switch to sip server, it does not work anymore. I have searched the internet and some people suggested that this may be due to Attribute setting, so I tried 'Cleartext-Password','User-Password', and 'Digest-HA1', but none of those work. What is wrong with my radius setting? Your help will be greately appreciated. Thanks, Pete Here is the radiusd -X log: Waking up in 4.9 seconds. User-Name = "1006(a)192.168.1.104" Digest-Attributes = 0x0a0631303036 Digest-Attributes = 0x010f3139322e3136382e312e313034 Digest-Attributes = 0x022a3438336465356263616637653 5646335323862373335643661393364363634636237376533396636 Digest-Attributes = 0x04137369703a3139322e3136382e312e313034 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "9b614ed006554a3a7ea094b14237dae9" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 825241654 NAS-Port = 5060 NAS-IP-Address = 127.0.0.1 +- entering group authorize ++[preprocess] returns ok expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080529 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080529 expand: %t -> Thu May 29 07:02:41 2008 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_digest: Adding Auth-Type = DIGEST ++[digest] returns ok rlm_realm: Looking up realm "192.168.1.104" for User-Name = " 1006(a)192.168.1.104" rlm_realm: Found realm "192.168.1.104" rlm_realm: Adding Stripped-User-Name = "1006" rlm_realm: Adding Realm = "192.168.1.104" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop expand: %{Stripped-User-Name} -> 1006 expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> 1006 rlm_sql (sql): sql_set_user escaped user --> '1006' rlm_sql (sql): Reserving sql socket id: 1 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1006' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1006' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '1006' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '1006' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '1006' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = '1006' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'openser' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'openser' ORDER BY id rlm_sql (sql): User found in group openser expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'openser' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'openser' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Local !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [1006(a)192.168.1.104/<via Auth-Type = Local>] (from client localhost port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 1006(a)192.168.1.104 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 227 for 1 seconds

2 1

Regarding the installation of Radius
by Anant Mule 28 May '08

28 May '08

I have complied freeradius with ./configure, make & make install. but when i give the command as radiusd -X it gives me the error as radiusd: error while loading shared libraries: libfreeradius-radius-2.0.4.so: cannot open shared object file: No such file or directory I installed freeradius-server-libs-2.0.4-8.1.i586.rpm also. but same errors occure. Please help Thanks in Advance Anant Mule

3 2

2.0.4 occasionally loses User-Password attribute?
by Stefan Winter 28 May '08

28 May '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello list, something weird occcured today. We have one "special" user which is not in a database, but gets a Crypt-Password set hardcoded in the virtual server config. For some reason, the incoming request has a correct User-Password, but later the pap module claims there is none. Here's the -X: Going to the next request Waking up in 4.3 seconds. ~ User-Name = "cyrus" ~ User-Password = "obfuscated" ~ NAS-IP-Address = A.B.C.D ~ NAS-Identifier = "IMAP" ~ NAS-Port = 18585 ~ NAS-Port-Type = Virtual ~ Service-Type = Authenticate-Only server IMAP { +- entering group authorize ++[request] returns notfound ++? if (( User-Name == cyrus ) && ( RESTENA-Service-Type == IMAP ) ) ?? Evaluating (User-Name == cyrus ) -> TRUE ?? Evaluating (RESTENA-Service-Type == IMAP ) -> TRUE ++? if (( User-Name == cyrus ) && ( RESTENA-Service-Type == IMAP ) ) -> TRUE ++- entering if (( User-Name == cyrus ) && ( RESTENA-Service-Type == IMAP ) ) +++[control] returns notfound ++- if (( User-Name == cyrus ) && ( RESTENA-Service-Type == IMAP ) ) returns notfound ~ expand: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/auth-detail - -> /var/log/radius/radacct/20080528/IMAP-service/auth-detail rlm_detail: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/auth-detail expands to /var/log/radius/radacct/20080528/IMAP-service/auth-detail ~ expand: %t -> Wed May 28 13:18:12 2008 ++[auth_log] returns ok ~ expand: %{User-Name} -> cyrus rlm_sql (sql-imap): sql_set_user escaped user --> 'cyrus' rlm_sql (sql-imap): Reserving sql socket id: 1 ~ expand: (SELECT id, username, attribute, value, op FROM check_imap WHERE username='%{SQL-User-Name}') ~ UNION (SELECT id, username, attribute, value, op FROM check_imap_mailgui WHERE username='%{SQL-User-Name}') -> (SELECT id, username, attribute, value, op FROM check_imap WH ERE username='cyrus') UNION ~ (SELECT id, username, attribute, value, op FROM check_imap_mailgui WHERE username='cyrus') rlm_sql_mysql: query: (SELECT id, username, attribute, value, op FROM check_imap WHERE username='cyrus') ~ UNION (SELECT id, username, attribute, value, op FROM check_imap_mailgui WHERE username='cyrus') rlm_sql (sql-imap): Released sql socket id: 1 rlm_sql (sql-imap): User cyrus not found ++[sql-imap] returns notfound ++? if (RESTENA-Service-Type == UserGUI ) ? Evaluating (RESTENA-Service-Type == UserGUI ) -> FALSE ++? if (RESTENA-Service-Type == UserGUI ) -> FALSE rlm_pap: No clear-text password in the request. Not performing PAP. ++[pap] returns noop auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. That is rather strange. The virtual server config is nothing spectacular, though non-standard, so here it is below: server IMAP { authorize { ~ # remember: UserGUI sends its own RESTENA-Service-Type, honour # it (IMAP comes without) ~ update request { ~ RESTENA-Service-Type = "IMAP" ~ } ~ if ( ( User-Name == cyrus ) && ( RESTENA-Service-Type == IMAP ) ) { ~ update control { ~ Crypt-Password := somecryptstring ~ } ~ } ~ auth_log ~ sql-imap ~ if ( RESTENA-Service-Type == UserGUI ) { ~ sql-dialup ~ } ~ pap } authenticate { ~ Auth-Type PAP{ ~ pap ~ } } The thousands of users in the sql-* databases are authenticated fine, the problem only occurs with this one static user. I'm sort of lost here. Greetings, Stefan Winter -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFIPUL5+jm90f8eFWYRAoCNAJ43yoK3MUsTaBGyVjPkgwF0WYJyBgCdFvnO BYXomOsHoqdlKRTnyGoaQyM= =ZctO -----END PGP SIGNATURE-----

3 3