- Freeradius-Users - lists.freeradius.org

PEAP/MS-CHAPv2 authentication to active directory
by Mitchell, Mark 12 Apr '08

12 Apr '08

Hello, I'm trying to get 802.1x authentication going using PEAP/MS-CHAPv2 but cant quite get it going (I think I'm pretty cloise though) so I'm hoping someone here can take a look at my debug output below and perhaps offer some helpful advice. Here's the specifics: Ubuntu 7.10, freeRADIUS 1.1.7, Samba 3.0. Note that there are calls to a freeNAC perl module called check_mac that performs mac-auth-bypass vlan assignment for non-802.1x compliant devices. I've followed the freeNAC instructions and tried some slight variations that I've found posted elsewhere but still not gettting it. I've gotten to the point where I can issue the ntlm_auth command "manually" and authenticate to AD so Samba, Winbind, and Kerberos seem to be OK. When I attempt to get freeRADIUS to do the ntlm_auth for me as described in the freeNAC docs and other web resources like deployingradius.com and the freeradius wiki, I keep getting logon failures. See attached radius debug output below. I'm just attaching the last part of the debug because for one it's quite large and two, it seems to be going well up to a certain point. My EAP-TLS tunnel appears to be getting setup fine but it just act as if my password is wrong. I'm using a Windows XP SP2 client with a recent PEAP patch added and have tried entering username/password/domain both manually and automatically. I am not validating the server cert at this point. Following is the end of the radius debug: . . . rad_recv: Access-Request packet from host 111.111.28.101:1645, id=245, length=264 User-Name = "SANDIA\\mgmitch" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-05-74-43-BD-3F" Calling-Station-Id = "00-0A-E4-23-CD-16" EAP-Message = 0x020800601900170301005590558ffa6f1d6b8a4bad64a0b8958aa4c140f2c145163dc92ee5b73ae341713f0466627a1454f0ad3f787b9ab756c8e07050b693f28f17f721c200525f544119a36d2d30e31ae5db2f44f8636bdc03c4f71a422436 Message-Authenticator = 0xb7b52cd2660e4b2695c96dc035368275 Cisco-NAS-Port = "GigabitEthernet1/4" NAS-Port = 50104 NAS-Port-Type = Ethernet State = 0x5a5253d83424d1e321022fa6ebfd1ece NAS-IP-Address = 111.111.28.101 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 perl_pool: item 0x8062e8a0 asigned new request. Handled so far: 3 found interpetator at address 0x8062e8a0 perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x8062e8a0 modcall[authorize]: module "check_mac" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "SANDIA\mgmitch", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 96 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020800491a020800443191a4d2d65459406cb3e67baa8f903a120000000000000000fde26c946d2f343603ffe6e34f2ad40987f990c82eeecf550053414e4449415c6d676d69746368 PEAP: Setting User-Name to SANDIA\mgmitch PEAP: Adding old state with 56 ed PEAP: Sending tunneled request EAP-Message = 0x020800491a020800443191a4d2d65459406cb3e67baa8f903a120000000000000000fde26c946d2f343603ffe6e34f2ad40987f990c82eeecf550053414e4449415c6d676d69746368 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "SANDIA\\mgmitch" State = 0x56ed3aacd660b70c9a6a4fde3b0858f9 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 perl_pool: item 0x809a4090 asigned new request. Handled so far: 3 found interpetator at address 0x809a4090 perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x809a4090 modcall[authorize]: module "check_mac" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "SANDIA\mgmitch", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 73 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for mgmitch with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=mgmitch' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: '--domain=SANDIA' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 8c radius_xlat: '--challenge=3f6d14e36675d931' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=fde26c946d2f343603ffe6e34f2ad40987f990c82eeecf55' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x80674b80 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 245 to 111.111.28.101 port 1645 EAP-Message = 0x010900261900170301001b05fb2b4d0b7732c23c08f5b0c933d75f9c6e7c894c6f5eb0b85242 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x975785863b043e267c2ca1d79c291dde Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 111.111.28.101:1645, id=246, length=206 User-Name = "SANDIA\\mgmitch" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-05-74-43-BD-3F" Calling-Station-Id = "00-0A-E4-23-CD-16" EAP-Message = 0x020900261900170301001be11c8a187a3a255b0ded0e8a021d224bce90335e6c02dac30ab5e8 Message-Authenticator = 0xa2889de2b2358293a5d30fd95541b61b Cisco-NAS-Port = "GigabitEthernet1/4" NAS-Port = 50104 NAS-Port-Type = Ethernet State = 0x975785863b043e267c2ca1d79c291dde NAS-IP-Address = 111.111.28.101 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 perl_pool: item 0x8012eae0 asigned new request. Handled so far: 4 found interpetator at address 0x8012eae0 perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x8012eae0 modcall[authorize]: module "check_mac" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "SANDIA\mgmitch", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 246 to 111.111.28.101 port 1645 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3 seconds... If anyone can help shed light on this, I would sure appreciate it. Thanks, Mark

2 1

NAS sql
by A.L.M.Buxey＠lboro.ac.uk 11 Apr '08

11 Apr '08

hi, any reason why the NAS schema is not part of the database schema? nas.sql and schema.sql rather than just schema.sql? alan

2 3

postgres accounting schema
by A.L.M.Buxey＠lboro.ac.uk 11 Apr '08

11 Apr '08

hi, I wonder how many of you have needed to change the postgres schema for radacct table - the default value of VARCHAR(32) for the AcctSessionId seems to be very low - our user-names are often that long by themselves! (domain and full path when using machine auth for example) I've submitted a patch via the bugs system to put this up to something safer. perhaps time that we all peer through the current supplied values and what we are each using after we've fixed things? If others can start with sane values (no matter if its MySQL, PostgresQL, Orcale etc) then that can only be a good thing for our community. There was also talk about certain indexes and procedures recently. alan

1 0

Re: Problem with proxy-radius function
by Ivan Popov 11 Apr '08

11 Apr '08

Hello Debug is difficult because of Segmentation Fault. I will try to rebuild radius (in the night) with last patch , that you already provide. Is It something wrong whth my configuration? I decide to disable all nonused modules. Maybe I disable something major? root@aaa# radiusd -X FreeRADIUS Version 2.0.4, for host i686-pc-linux-gnu, built on Apr 7 2008 at 10:36:05 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/postgresql/dialup.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 8192 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = no } } client MAIN_NAS { ipaddr = 192.168.101.1 netmask = 32 require_message_authenticator = no secret = "key" shortname = "nas1" nastype = "other" } client jds { ipaddr = 192.168.0.1 require_message_authenticator = no secret = "superkey" shortname = "jds" nastype = "other" } client jds2 { ipaddr = 192.168.0.2 require_message_authenticator = no secret = "superkey" shortname = "jds2" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server jds1 { ipaddr = 192.168.0.1 port = 1646 type = "acct" secret = "superkey" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server jds2 { ipaddr = 192.168.0.2 port = 1646 type = "acct" secret = "superkey" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server_pool jds { type = fail-over home_server = jds1 home_server = jds2 } realm domain.com { acct_pool = jds nostrip } radiusd: #### Instantiating modules #### instantiate { } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "Calling-Station-Id, Acct-Session-Id, 3GPP2-Correlation-Id" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_postgresql" server = "localhost" port = "" login = "rad" password = "......" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 48 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_reply_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, superkeyActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, superkeyBadPPPFrameCount, superkeyCorrelationId, AcctSessionTime, NASIPAddress) values('%{Acct-Session-Id}', '%{Acct- Unique-Session-Id}', '%{Calling-Station-Id}', '%S', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP- Address}')" accounting_start_query_alt = "" accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', OutputPacket = '% {Acct-Output-Packets}', InputPacket = '%{Acct-Input-Packets}', AcctOutputOctets = '%{Acct-Output-Octets}', ReleaseIndicator = '%{Acct-Terminate-Cause}', superkeyBadPPPFrameCount = '%{3GPP2-Bad-PPP-Frame-Count}', superkeyCorrelationId = '%{3GPP2-Correlation-Id}', superkeyActiveTime = '%{3GPP2-Active-Time}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql): Attempting to connect to radacc@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 rlm_sql (sql): Connected new DB handle, #0 ......... rlm_sql (sql): starting 47 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #47 rlm_sql (sql): Connected new DB handle, #47 Module: Checking pre-proxy {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating pre_proxy_log detail pre_proxy_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking post-proxy {...} for more modules to load Module: Instantiating post_proxy_log detail post_proxy_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "acct" ipaddr = * port = 0 } Listening on accounting address * port 1813 Listening on proxy address * port 1222 Ready to process requests. Acct-Status-Type = Start User-Name = "test1(a)domain.com" Calling-Station-Id = "77734565" Framed-IP-Address = 192.168.50.19 NAS-IP-Address = X.X.X.X Event-Timestamp = "Apr 10 2008 17:08:14 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "09446618" 3GPP2-Service-Reference-Id = 0x00000000 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "domain.com" for User-Name = "test1(a)domain.com" rlm_realm: Found realm "domain.com" rlm_realm: Proxying request from user test1 to realm domain.com rlm_realm: Adding Realm = "domain.com" rlm_realm: Preparing to proxy accounting request to realm "domain.com" ++[suffix] returns updated +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "09446618",Acct-Session-Id = "0000000\000",Calling-Station-Id = "77734565"' rlm_acct_unique: Acct-Unique-Session-ID = "e05fa4c07c65ca2b". ++[acct_unique] returns ok expand: %{User-Name} -> test1(a)domain.com rlm_sql (sql): sql_set_user escaped user --> 'test1(a)domain.com' expand: INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, superkeyActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, superkeyBadPPPFrameCount, superkeyCorrelationId, AcctSessionTime, NASIPAddress) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%S', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}') -> INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, superkeyActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, superkeyBadPPPFrameCount, superkeyCorrelationId, AcctSessionTime, NASIPAddress) values('0000000', 'e05fa4c07c65ca2b', '77734565', '2008-04-10 17:08:13', NULL,'0', '0', '0', '192.168.50.19', trim('test1(a)domain.com'), '0', '0', '09446618', '0', '192.168.101.1') rlm_sql (sql): Reserving sql socket id: 24 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 24 ++[sql] returns ok +- entering group pre-proxy expand: /var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d -> /var/log/radius/radacct/192.168.101.1/pre-proxy-detail-20080410 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.101.1/pre-proxy-detail-20080410 expand: %t -> Thu Apr 10 17:08:13 2008 ++[pre_proxy_log] returns ok Acct-Status-Type = Start User-Name = "test1(a)domain.com" Calling-Station-Id = "77734565" Framed-IP-Address = 192.168.50.19 NAS-IP-Address = 192.168.101.1 Event-Timestamp = "Apr 10 2008 17:08:14 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "09446618" 3GPP2-Service-Reference-Id = 0x00000000 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 Proxy-State = 0x3937 Proxying request 551 to home server 192.168.0.1 port 1646 Acct-Status-Type = Start User-Name = "test1(a)domain.com" Calling-Station-Id = "77734565" Framed-IP-Address = 192.168.50.19 NAS-IP-Address = 192.168.101.1 Event-Timestamp = "Apr 10 2008 17:08:14 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "09446618" 3GPP2-Service-Reference-Id = 0x00000000 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 Proxy-State = 0x3937 Going to the next request Waking up in 0.9 seconds. Ignoring request from unknown home server 192.168.0.1 port 1646 ................. Rejecting request 593 due to lack of any response from home server 192.168.0.1 port 1646 Finished request 593. Cleaning up request 593 ID 139 with timestamp +90 Cleaning up request 593 ID 362747136 with timestamp +90 Segmentation fault root@aaa# exit ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Friday, April 11, 2008 12:59:26 PM Subject: Re: Problem with proxy-radius function Ivan Popov wrote: > What I can say .. > root@aaa:/var/log/radius <mailto:root@aaa:/var/log/radius># tcpdump -i > eth0 host X.X.X.X <sigh> While this is interesting, you were asked for debugging output. > Is It correct? I thing it should be between port 1813 and 1646 ... The traffic looks OK. There may be something else going wrong, and the debug output may show it. Is it possible to run the server in debug mode? If not, why? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

FR 2.0.3 gives duplicate NULL realm error
by John Horne 11 Apr '08

11 Apr '08

Hello, I have been running FR 2.0.2 (built from source) for a short while with no problems. I have now upgraded to 2.0.3 (built from Fedora 9 source RPM). When I try and start radiusd (using 'radiusd -X' I get the following error: realm NULL { /etc/raddb/proxy.conf[107]: Duplicate realm "NULL" } # realm NULL I have thoroughly checked the files, and there is no duplicate of the NULL realm. The end part of proxy.conf contains the NULL realm, and it is configured as: home_server_pool local_proxies { type = fail-over home_server = IAS-1 home_server = IAS-2 home_server = ILS009 } [other home server pools and realms defined] realm NULL { auth_pool = local_proxies } I'm not sure why the 'radiusd -X' output gives as the very last line '} # realm NULL'. As can be seen in proxy.conf, the very last line has no comment attached to it. Anyone any ideas about why radiusd is complaining about a duplicate NULL realm? Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

2 5

Problem with LDAP module in 2.0.3 -- Ldap-UserDn unavailable
by Jason Alderfer 11 Apr '08

11 Apr '08

I'm testing upgrading from 1.1.7 to 2.0.3 and have run into a problem with the LDAP module. The problem appears in 2 places. First, I'm using the --with-edir option so I have password_attribute = nspmPassword and edir_account_policy_check = yes set. However, in 2.0.3, when I set "edir_account_policy_check = yes", I get this error: +- entering group post-auth rlm_ldap: User's FQDN not in config items list. ++[ldap] returns fail PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE If I don't set edir_account_policy_check, then authentication is successful, but the second problem shows up. A little background: In 1.1.7 I'm setting VLANs via the 'users' file like this: DEFAULT Ldap-UserDn =~ "ou=is,ou=n,o=emu" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = 3 and I've tried this in 2.0.3, but I've also tried unlang if (Ldap-UserDn =~ /ou=is,ou=n,o=emu/i) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 3 } } Neither of these work in 2.0.3. The VLAN does not get set. Files returns noop, and unlang shows in debug output ++? if (Ldap-UserDn =~ /ou=is,ou=n,o=emu/i) (Attribute Ldap-UserDn was not found) I did some digging and I think I know why this is. In rlm_ldap.c beginning at line 1306 is /* * Adding new attribute containing DN for LDAP object associated with * given username */ pairadd(check_pairs, pairmake("Ldap-UserDn", user_dn, T_OP_EQ)); However, in 1.1.7 the code is pairadd(&request->packet->vps, pairmake("Ldap-UserDn", user_dn, T_OP_EQ)); If I add this line to 2.0.3 just after the existing pairadd line and recompile, then everything just works -- edir policy check works and I can set VLANs using files module or unlang. Is this a bug in 2.0.3 or am I missing something in my new config file that would make the Ldap-UserDn available? Jason

1 1

rlm_ldap error
by Jean Frontin 11 Apr '08

11 Apr '08

rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap Hello, I want to receive as Reply-Message carLicense value. When I debug a radiusd session I can see the erro mentionned below (line marked by a star). Have you an idea to eliminate this ? rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP carLicense mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type ... rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... * rlm_ldap: parsing carLicense failed: big brother is watching you Regards -- Jean Frontin System team I R I T Université Paul-Sabatier 118, rte de Narbonne 31062 Toulouse cedex 9 France tel (33)(0)5 61 55 63 03 mail frontin(a)irit.fr

2 1

Re: Problem with proxy-radius function
by Ivan Popov 11 Apr '08

11 Apr '08

What I can say .. root@aaa:/var/log/radius# tcpdump -i eth0 host X.X.X.X 12:38:19.725549 IP aaa.copy.net.1094 > X.X.X.X.1646: RADIUS, Accounting Request (4), id: 0xca length: 387 12:38:19.725660 IP aaa.copy.net.1094 > X.X.X.X.1646: RADIUS, Accounting Request (4), id: 0xa8 length: 589 12:38:19.726122 IP aaa.copy.net.1094 > X.X.X.X.1646: RADIUS, Accounting Request (4), id: 0x26 length: 571 12:38:19.726298 IP aaa.copy.net.1094 > X.X.X.X.1646: RADIUS, Accounting Request (4), id: 0x82 length: 589 12:38:19.755292 IP X.X.X.X.1646 > aaa.copy.net.1094: RADIUS, Accounting Response (5), id: 0xca length: 24 12:38:19.755297 IP X.X.X.X.1646 > aaa.copy.net.1094: RADIUS, Accounting Response (5), id: 0xa8 length: 24 12:38:19.758275 IP X.X.X.X.1646 > aaa.copy.net.1094: RADIUS, Accounting Response (5), id: 0x82 length: 24 12:38:19.761917 X.X.X.X.1646 > aaa.copy.net.1094: RADIUS, Accounting Response (5), id: 0x26 length: 24 Looks like traffic goes between port 1094(my side - different time different) and 1646 Is It correct? I thing it should be between port 1813 and 1646 ... Is It because listen { ipaddr = my.ip.addres port = 0 type = acct } ? P.S On website http://www.freeradius.org/getting.html Link to daily snapshot not work. ftp://ftp.freeradius.org/pub/radius/CVS-snapshots/ ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Friday, April 11, 2008 12:23:10 PM Subject: Re: Problem with proxy-radius function banga wrote: > AnyOne? > > Error: Rejecting request 20696 due to lack of any response from home server > X.X.X.X port 1646 > Error: Ignoring request from unknown home server X.X.X.X port 1646 > How I can fix that ? I think what's happening is that the home server is sending the response from the wrong port. You would have to show *more* of the debug log to be sure. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

libpam-radius-auth password problem
by Fabio Pedretti 11 Apr '08

11 Apr '08

I am trying to configure a linux machine (Ubuntu 8.04 alpha, 32 bit) with radius authentication using libpam-radius-auth. I installed freeradius-2.0.3 (from selfbuilded deb package) on the same machine and added this line at the top of users file: testuser Cleartext-Password := "testing" Then I installed libpam-radius-auth 1.3.17-0ubuntu1 from the ubuntu repositories. I added the radius entry in /etc/pam.d/sshd: [...] auth required pam_env.so envfile=/etc/default/locale auth sufficient pam_radius_auth.so debug # Standard Un*x authentication. @include common-auth [...] and this on pam_radius_auth.conf: # server[:port] shared_secret timeout (s) 127.0.0.1 testing123 1 When I try to authenticate with ssh into the machine I noticed that freeradius receive this password "\010\n\r\177INCORRECT", that it's not the one I typed. This is the output of auth.log: Mar 18 18:05:59 test sshd[2533]: pam_radius_auth: Got user name testuser Mar 18 18:05:59 test sshd[2533]: pam_radius_auth: Sending RADIUS request code 1 Mar 18 18:05:59 test sshd[2533]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -1211761632. Mar 18 18:06:00 test sshd[2533]: pam_radius_auth: RADIUS server 127.0.0.1 failed to respond Mar 18 18:06:00 test sshd[2533]: pam_radius_auth: All RADIUS servers failed to respond. Mar 18 18:06:00 test sshd[2533]: pam_radius_auth: authentication failed Mar 18 18:06:00 test sshd[2533]: pam_unix(sshd:auth): check pass; user unknown Mar 18 18:06:00 test sshd[2533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=fabio-mac.local Mar 18 18:06:02 test sshd[2533]: Failed password for invalid user testuser from 10.33.4.8 port 57680 ssh2 This is the output of freeradius -X rad_recv: Access-Request packet from host 127.0.0.1 port 3558, id=65, length=93 User-Name = "testuser" User-Password = "\010\n\r\177INCORRECT" NAS-IP-Address = 127.0.1.1 NAS-Identifier = "sshd" NAS-Port = 2533 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "fabio-mac.local" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry testuser at line 50 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "? INCORRECT" rlm_pap: Using clear text password "testing" rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [testuser/\010\n\r\177INCORRECT] (from client localhost port 2533 cli fabio-mac.local) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 65 to 127.0.0.1 port 3558 Waking up in 4.9 seconds. Cleaning up request 2 ID 65 with timestamp +135 Ready to process requests. Testig with radtest works fine. I noticed a similar problem some time ago, that seemed to be related to 64 bit machines: http://lists.cistron.nl/pipermail/freeradius-users/2006-August/055877.html However I am using a 32 bit machine on an updated system. Where could be the problem? Thanks, Fabio

2 3

Freeradius 2.0.3 crashing when in proxy mode Segmentation fault.
by Vikash Badal 11 Apr '08

11 Apr '08

Greetings, Can you please assist me with this issue. I set up this server to be the authorative radius server for a realm and no issues were encountered Once I set up the server to proxy, the following issue occured. -------------------------------------------------------- Thu Apr 10 06:49:01 2008 : Debug: Finished request 33. Thu Apr 10 06:49:01 2008 : Debug: Cleaning up request 33 ID 170 with timestamp +451 Thu Apr 10 06:49:01 2008 : Debug: Going to the next request Thu Apr 10 06:49:01 2008 : Debug: Waking up in 4.6 seconds. Thu Apr 10 06:49:06 2008 : Error: Rejecting request 31 due to lack of any response from home server 196.26.56.8 port 1646 Thu Apr 10 06:49:06 2008 : Debug: Finished request 31. Thu Apr 10 06:49:06 2008 : Debug: Cleaning up request 31 ID 169 with timestamp +442 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x28401100 (LWP 100207)] 0x0806417d in cleanup_delay (ctx=0x287fe110) at event.c:477 477 DEBUG2("Cleaning up request %d ID %d with timestamp +%d", (gdb) bt #0 0x0806417d in cleanup_delay (ctx=0x287fe110) at event.c:477 #1 0x080651ae in wait_a_bit (ctx=0x287fe110) at event.c:947 #2 0x08064dec in post_proxy_fail_handler (request=0x287fe110) at event.c:794 #3 0x08064ea5 in no_response_to_proxied_request (ctx=0x287fe110) at event.c:819 #4 0x280c8a9d in fr_event_run (el=0x287fb000, when=0xbfbfe828) at event.c:214 #5 0x280c9078 in fr_event_loop (el=0x287fb000) at event.c:381 #6 0x080681bd in radius_event_process () at event.c:2675 #7 0x0805d376 in main (argc=2, argv=0xbfbfe928) at radiusd.c:394 (gdb) up #1 0x080651ae in wait_a_bit (ctx=0x287fe110) at event.c:947 947 cleanup_delay(request); (gdb) p/x *request $1 = {packet = 0x0, proxy = 0x0, reply = 0x0, proxy_reply = 0x0, config_items = 0x0, username = 0x0, password = 0x0, root = 0x0, data = 0x0, client = 0x0, child_pid = 0x0, timestamp = 0x47fd9c34, number = 0x1f, listener = 0x28495ac0, proxy_listener = 0x28495af0, simul_max = 0x2, simul_count = 0x0, simul_mpp = 0x0, options = 0x0, module = 0x80734f5, component = 0x80734f5, received = {tv_sec = 0x47fd9c34, tv_usec = 0x45fa}, when = {tv_sec = 0x47fd9c42, tv_usec = 0x6f03}, delay = 0x186a0, master_state = 0x1, child_state = 0x6, priority = 0x3, ev = 0x0, next_when = {tv_sec = 0x47fd9c42, tv_usec = 0x6f03}, next_callback = 0x0, in_request_hash = 0x0, in_proxy_hash = 0x0, home_server = 0x0, home_pool = 0x2848a240, proxy_when = {tv_sec = 0x47fd9c34, tv_usec = 0x6f03}, num_proxied_requests = 0x1, num_proxied_responses = 0x0, server = 0x0, parent = 0x0} (gdb) Vikash Please note: This email and its content are subject to the disclaimer as displayed at the following link http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm. Should you not have Web access, send a mail to disclaimers(a)is.co.za and a copy will be emailed to you.

2 1