- Freeradius-Users - lists.freeradius.org

Re: virtual server configuration
by usawebbox＠fastmail.fm 24 Mar '08

24 Mar '08

> It also says: > # If CA_file (below) is not used, then the > # certificate_file below MUST include not > # only the server certificate, but ALSO all > # of the CA certificates used to sign the > # server certificate. > > Please read ALL of the comments in a module you are configuring. > Selectively reading them means that you miss vital information. > > Alan DeKok. Except that my server cert does contain a CA cert. I'm not 100% sure it's sufficient, because it was issued from an intermediate CA (it needs to be the signer(s) not the issuer, right?), so I went to another CA got a webserver cert in pem format directly from the root. Downloaded the root CA cert in pem format and appended them.... same error: Error reading Trusted root CA list (null) Do we know this mode is working (No CA_File, but certificate file with server cert + ca cert)? In any case, I'd be willing to experiment more. -- usawebbox(a)fastmail.fm -- http://www.fastmail.fm - Access your email from home and the web

2 5

permissions in /etc/raddb
by Andrew Long 24 Mar '08

24 Mar '08

After a clean rpmbuild of 2.0.3, radiusd -X yielded some errors processing files in /etc/raddb. I ran strace and found permission denied on relevant files. The rpm installed files in this dir with ownership root.root, so naturally radiusd cannot read them. Is it preferable to allow read access to the files (I have no passwords in these files, using SQL) or to change the ownership? Andrew

3 2

rpmbuild freeradius-server-2.0.3.tar.gz
by Andrew Long 24 Mar '08

24 Mar '08

CentOS 4.6 (final) per instructions I received when rpmbuilding 2.0.1, I added "%_incdir /usr/include" to my .rpmmacros file. I was unsure whether or not the dir in the tgz still needed renaming to freeradius-2.0.3 so I left it as is. Now, I get the following error returned after running rpmbuild -bb freeradius.spec: RPM build errors: File not found: /var/tmp/freeradius-server-root/usr/share/freeradius-server Any clues? - Andrew

4 10

Terminate EAP-PEAP client connection at FreeRadius and proxy(forward) request as MS-CHAP
by Ryan 24 Mar '08

24 Mar '08

Hi All, Need some help on the configuration to have an EAP-PEAP request proxied as MS-CHAP to another radius. Main Radius server: version 2.0.2 Radius to be proxied to: version 1.1.3 Key configuration entries on main radius server as follows: ------------------ radiusd.conf ------------------ modules { pap { auto_header = no # encryption_scheme = clear } chap { authtype = CHAP } mschap { use_mppe = yes authtype = MS-CHAP require_encryption = yes require_strong = yes } } -------- users -------- DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := SECURACCESS ---------------- proxy.conf ---------------- home_server goebbels { type = auth+acct ipaddr = xxx.xxx.xxx.151 port = 1812 secret = xxxxxx response_window = 20 zombie_period = 40 revive_interval = 120 status_check = request check_interval = 30 num_answers_to_alive = 3 } home_server_pool my_auth_failover { type = fail-over home_server = goebbels } realm gmail.com { } realm SECURACCESS { pool = my_auth_failover nostrip hints } ------------- eap.conf ------------- eap { peap { default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no } } ---------------------------- site-enabled/default ---------------------------- authorize { preprocess chap mschap IPASS suffix eap files pap } authenticate { Auth-Type MS-CHAP { mschap } eap } The request is proxied successfully to the inner radius using MS-CHAP and the authentication is correct however when the reply is returned, I'm getting errors. Here is the output for reference. rad_recv: Access-Request packet from host xxx.xxx.xxx.219 port 62987, id=22, length=158 User-Name = "majereryan(a)gmail.com" Framed-MTU = 1400 Called-Station-Id = "001e.7a3c.7a10" Calling-Station-Id = "001e.3a8b.f065" Service-Type = Login-User Message-Authenticator = 0x749ecae7e4f112c2dc2c4edad03ab8f3 EAP-Message = 0x02020017016d616a65726540716d61782e636f6d2e7367 NAS-Port-Type = Wireless-802.11 NAS-Port = 288 NAS-IP-Address = 192.168.0.88 NAS-Identifier = "Test_802_1x" +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 23 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry DEFAULT at line 41 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 22 to xxx.xxx.xxx.219 port 62987 Service-Type = Framed-User Session-Timeout = 36000 Idle-Timeout = 10800 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d9c5d6c3d9f44de59e52e5a67a9cf7f Finished request 0. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host xxx.xxx.xxx.219 port 62987, id=23, length=219 User-Name = "majereryan(a)gmail.com" Framed-MTU = 1400 Called-Station-Id = "001e.7a3c.7a10" Calling-Station-Id = "001e.3a8b.f065" Service-Type = Login-User Message-Authenticator = 0xcbcc4b5fac3cad3cedb45f85d411f1a1 EAP-Message = 0x0203004219800000003816030100330100002f030147e775d6e6585e5c5af14cae88358db237b2036cb19a1b44dd865f48b4bd86ad000008000a002f001600330100 NAS-Port-Type = Wireless-802.11 NAS-Port = 288 State = 0x3d9c5d6c3d9f44de59e52e5a67a9cf7f NAS-IP-Address = 192.168.0.88 NAS-Identifier = "Test_802_1x" +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 66 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 56 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0033], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0c2d], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 23 to xxx.xxx.xxx.219 port 62987 EAP-Message = 0x0104040019c000000c8a160301004a02000046030147e775d7acdfb705710141663b058234d2bb9ce24dd0a972c026aa2b5d2700de208e1a18df3ecb9ce8c1015331eaa444cc93baebc8423d07c038860ef666174f90000a001603010c2d0b000c29000c260004df308204db308202c3a003020102020304d931300d06092a864886f70d010105050030793110300e060355040a1307526f6f74204341311e301c060355040b1315687474703a2f2f7777772e6361636572742e6f7267312230200603550403131943412043657274205369676e696e6720417574686f726974793121301f06092a864886f70d0109011612737570706f727440636163 EAP-Message = 0x6572742e6f7267301e170d3038303331393037343035335a170d3038303931353037343035335a301c311a30180603550403131173616272652e716d61782e6e65742e736730820122300d06092a864886f70d01010105000382010f003082010a0282010100e654a1a0247e825410f8c197fa6b89a46e915bfc58209652f2692b97e158d9ac38bccf95947af8c1b45b142fe4fbfcbd5ad50bb8cc4b9f326313ce41e76051fd29ec19c8ae28cae1c3c6d669ce5868a32d6f2540b664b14b27adcfd380c4c595db5cfe90f93ba9ee81c61f0b437b6266953e918ae103e0d2e82ff55cbb67ef4fe2b7717cdaf7a35d92aa98af912c0ab440e73343c04f82 EAP-Message = 0x85119bd665b28168c05f72732ee013da440eecea5771d4908f9a3bfed423a8095949933d24eedeafcb333aaaf93e6e072ec543f6bf6f1378fd7d5dc3b0a064e116739c46523a7f84cae13d4a3bac4404eda0c9ea4cae63e36ac24bba8648991a4ef55edb6cf4ad3b7b0203010001a381c83081c5300c0603551d130101ff0402300030340603551d25042d302b06082b0601050507030206082b0601050507030106096086480186f8420401060a2b0601040182370a0303300b0603551d0f0404030205a0303306082b0601050507010104273025302306082b060105050730018617687474703a2f2f6f6373702e6361636572742e6f72672f303d06 EAP-Message = 0x03551d1104363034821173616272652e716d61782e6e65742e7367a01f06082b06010505070805a0130c1173616272652e716d61782e6e65742e7367300d06092a864886f70d0101050500038202010093811ff53747ff2b6208d5b3d54abad96cb795ee1692bb8a6a98aa18feb32550bd0570724afcc0b746430ee1002a5ec2228e7bf40e26dcc49bed5b20777160efb837a4f70eb8e642770fe673c0ca53bd39db7e72b9694d1f00fea2c30190b3b0585a4d44f244b0ebb91cb44afec59b944e8ae60652d7716a2ff44e17871aa0f6f0907bb127725ae69632d1979d6b619ccc54f6b15bbb0af8ce28a3e9d9de137700b8fb9b5bf8fe7deffdbdb32a EAP-Message = 0xa9d10b5c95fbffbeb9296b02 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d9c5d6c3c9844de59e52e5a67a9cf7f Finished request 1. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host xxx.xxx.xxx.219 port 62987, id=24, length=159 User-Name = "majereryan(a)gmail.com" Framed-MTU = 1400 Called-Station-Id = "001e.7a3c.7a10" Calling-Station-Id = "001e.3a8b.f065" Service-Type = Login-User Message-Authenticator = 0xe210919a74fb784b321b8817189a9d31 EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 288 State = 0x3d9c5d6c3c9844de59e52e5a67a9cf7f NAS-IP-Address = 192.168.0.88 NAS-Identifier = "Test_802_1x" +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 24 to xxx.xxx.xxx.219 port 62987 EAP-Message = 0x010503fc1940edf48f0c0243a84e5ff7e2d5196f4d1387936c0a43a90cdce1f51b105920981c6db8b3ae274b199721ea3f7e3d4f9dd19f26ce13c4d161cd32957f72c5e8dccee4ccd7b3f6fb8706abdf7765a7d442dfcb6c3a4920787a64e16eac578543e5012da0a003fa12c889af11ed0f8d39f34dedda9fc24716668a46610e6e6797c3577ef21ff255769799f87d20b1dd4f28447cbe6f09ffa7f7c91cb84cdb0e9d846e7581fdd496cde9acddcc96be02677282a68b21a6b70e131b6f15eb833a8c48c8a1f5796d9c28217a4adc70511d8711ea02baa39b2b7f26dd5d467b29a6b3e46d2b7a3c4c7bcbbcf9872dfc8e785589b27fb1ba751041d4 EAP-Message = 0x11899ef7202320f56b61855c82f0acf298e639da1cbabd95fb366ca263ece17b8dda92eb789647e404f619c7040662e0a1900dbcb27382bddda608636e4d71bf72e1fec47657731ec9993995a595258a0007413082073d30820525a003020102020100300d06092a864886f70d010104050030793110300e060355040a1307526f6f74204341311e301c060355040b1315687474703a2f2f7777772e6361636572742e6f7267312230200603550403131943412043657274205369676e696e6720417574686f726974793121301f06092a864886f70d0109011612737570706f7274406361636572742e6f7267301e170d303330333330313232393439 EAP-Message = 0x5a170d3333303332393132323934395a30793110300e060355040a1307526f6f74204341311e301c060355040b1315687474703a2f2f7777772e6361636572742e6f7267312230200603550403131943412043657274205369676e696e6720417574686f726974793121301f06092a864886f70d0109011612737570706f7274406361636572742e6f726730820222300d06092a864886f70d01010105000382020f003082020a0282020100ce22c0e2467dec3628075096f2a033408c4bf13b663f31e56b0236dbd67cf6f1888f4e7736054195f909f012cf46867360b76e7ee8c05864aecdb0ad45170c63fa670ae8d6d2bf3ee798c4f04cfae003bb EAP-Message = 0x355d6c21de9e20d9bacd66323772faf708f5c7cd58c98ee70e5eea3efe1ca1140a156c86845b64662a7aa94b5379f588a27bee2f0a612b8db27e4d56a513eceada929eac44411e5860650566f8c044bdcb94f7427e0bf76568985105f0f30591041d1b1782ecc857bbc36b7a88f1b072cc255b2091ec1602128f32e9171848d0c7052e023042b8259c056b3faa3aa7eb5348f7e8d2b60798dc1bc6347f7fc91c827a05582b085bf338a2ab175d66c998d79e108ba2d2dd749af7710c7260dfcd6f98339d9634763e247a92b00e951e6fe6a0453847aad741ed4ab712f6d71b838a0f2ed809b659d7aa04ffd2937d682edd8b4bab58ba2f8dea95a7a0c3 EAP-Message = 0x5489a5fbdb8b5122 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d9c5d6c3f9944de59e52e5a67a9cf7f Finished request 2. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host xxx.xxx.xxx.219 port 62987, id=25, length=159 User-Name = "majereryan(a)gmail.com" Framed-MTU = 1400 Called-Station-Id = "001e.7a3c.7a10" Calling-Station-Id = "001e.3a8b.f065" Service-Type = Login-User Message-Authenticator = 0x1831b9c6ed39e206304a0bae85d5a8a1 EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 288 State = 0x3d9c5d6c3f9944de59e52e5a67a9cf7f NAS-IP-Address = 192.168.0.88 NAS-Identifier = "Test_802_1x" +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 25 to xxx.xxx.xxx.219 port 62987 EAP-Message = 0x010603fc19409db2c3be11be2c91868b9678ad20d38a2f1a3fc6d051658721b11901657f451c87f57cd0414c4f299821fd331f750c0451fa1977dbd4141cee81c31df598b769069122dd0050cc8131ac12077b38da685be62bd47ec95fade8eb724cf301e54b20bf9aa657ca9100018ba1752137b5630d673e464f702067cec5d659db02e0f0d2cbcdba62b79041e8dd20e429bc642942c822dc789aff43ec981b09514b5a5ac271f1c4cb73a9e5a10b0203010001a38201ce308201ca301d0603551d0e0416041416b5321bd4c7f3e0e68ef3bdd2b03aeeb23918d13081a30603551d2304819b308198801416b5321bd4c7f3e0e68ef3bdd2b03aeeb2 EAP-Message = 0x3918d1a17da47b30793110300e060355040a1307526f6f74204341311e301c060355040b1315687474703a2f2f7777772e6361636572742e6f7267312230200603550403131943412043657274205369676e696e6720417574686f726974793121301f06092a864886f70d0109011612737570706f7274406361636572742e6f7267820100300f0603551d130101ff040530030101ff30320603551d1f042b30293027a025a023862168747470733a2f2f7777772e6361636572742e6f72672f7265766f6b652e63726c303006096086480186f84201040423162168747470733a2f2f7777772e6361636572742e6f72672f7265766f6b652e63726c30 EAP-Message = 0x3406096086480186f842010804271625687474703a2f2f7777772e6361636572742e6f72672f696e6465782e7068703f69643d3130305606096086480186f842010d04491647546f2067657420796f7572206f776e20636572746966696361746520666f7220465245452068656164206f76657220746f20687474703a2f2f7777772e6361636572742e6f7267300d06092a864886f70d0101040500038202010028c7ee9c8202ba5c8012ca350a1d816f896a99ccf2680f7fa7e18d58953ebdf206c3905aacb560f6994301a388709c9d629da487af67580d30363be6ad48d3cb740286713ee22b0368f1346240463b53ea28f4acfb6695538a4d5dfd EAP-Message = 0x3bd960d7ca79693bb16592a6c681825c9ccdeb4d018aa5df1155aa15ca1f37c082987061db6a7c96a38e2e543e4f21a990efdc82bfdce845ad4d9073083c9465b00499767fe2bcc26a15aa97043724d81e944e6d0e51bed6c48fca966df743dfe83065273b7bbb434363c443f7b2ec68cce1198e22fb98e17b5a3e01373b8b08b0a2f3954e1acb9bcd9ab1dbb270f02d4adbd8b0e36f45483312fffe3c322a54f7c4f78af08823c247fe647a71c0d11ea663b0077ea42fd3018fdc9f2bb6c608a90f934825fc12fd9f42dcf3c43ef657b0d7dd69d10677340a4bd2caa0ff1cc68cc916bec4cc323768735f08fb51f7495336050a95024cf2791a10f6d8 EAP-Message = 0x3a759cf31df1a20d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d9c5d6c3e9a44de59e52e5a67a9cf7f Finished request 3. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host xxx.xxx.xxx.219 port 62987, id=26, length=159 User-Name = "majereryan(a)gmail.com" Framed-MTU = 1400 Called-Station-Id = "001e.7a3c.7a10" Calling-Station-Id = "001e.3a8b.f065" Service-Type = Login-User Message-Authenticator = 0x0a71bcc21970eb9c06a717f1577e3124 EAP-Message = 0x020600061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 288 State = 0x3d9c5d6c3e9a44de59e52e5a67a9cf7f NAS-IP-Address = 192.168.0.88 NAS-Identifier = "Test_802_1x" +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 26 to xxx.xxx.xxx.219 port 62987 EAP-Message = 0x010700ae19007067861bb316f52fe5a4eb7986f93d0bc2730ba599ac6ffc67b8e52f0ba618248d7bd14835291840ac9360e1968650b47a59d88f210b9fcf8291c63bbf6bdc0791b9975623aab66c94c648063ce4ce4eaae4f62f09dc536f2efc74eb3a6399c2a6ac89bca7b244a00d8a10e36cf224cbfa9b9f70472ede148bd4b2200996a264f1241cdca1359c15b2d4bc552e7d06f59c0e55f45ad693da76ad25734cc54316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d9c5d6c399b44de59e52e5a67a9cf7f Finished request 4. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host xxx.xxx.xxx.219 port 62987, id=27, length=483 User-Name = "majereryan(a)gmail.com" Framed-MTU = 1400 Called-Station-Id = "001e.7a3c.7a10" Calling-Station-Id = "001e.3a8b.f065" Service-Type = Login-User Message-Authenticator = 0x822399b94b0bc1594b5b849189d31868 EAP-Message = 0x0207014819800000013e1603010106100001020100170ad80d5a2cd2fcb9d0a4a40eea398e52008afac68b2470ea250f7440dab21e43294467175ee5a24d366ea5e84a1fe2964aea5c55c01375fc3e5666d553bf3b83674694c7b713105e167810033f88222eeead7868843e2e6ab8165d9d7ce3b820cabf4cbe0926ec2b6f18ef48603576e3df1ba92b3dace41b17a97f690057e9f16689b072ed11b78e1a361409d699385dc1338942718e07de64efe811c1cb160f829d8481d74de028c2c83b240796455ef721d75092fe02f5eaee4d8c305f8d5b4e376b13aa1becf11474ea3dc7a62439d88da215bfefc41cd75073c1399085d1e8bd8c55f9e287 EAP-Message = 0xcb469d3cd49d56c02c19b6717b6a647892830384a3a0cc2b14030100010116030100287747b2da88c656a202dd69c5c460b346189416e6ff86cb124f2bff6b9443c04fa7f9c324d5644021 NAS-Port-Type = Wireless-802.11 NAS-Port = 288 State = 0x3d9c5d6c399b44de59e52e5a67a9cf7f NAS-IP-Address = 192.168.0.88 NAS-Identifier = "Test_802_1x" +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 7 length 253 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 318 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 27 to xxx.xxx.xxx.219 port 62987 EAP-Message = 0x0108003919001403010001011603010028f7057de02b9d0e5184efd841fab6a4b44d3877cd7b25a3e786145bf58a866c76e6bda53e876b473d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d9c5d6c389444de59e52e5a67a9cf7f Finished request 5. Going to the next request Waking up in 0.5 seconds. rad_recv: Access-Request packet from host xxx.xxx.xxx.219 port 62987, id=28, length=159 User-Name = "majereryan(a)gmail.com" Framed-MTU = 1400 Called-Station-Id = "001e.7a3c.7a10" Calling-Station-Id = "001e.3a8b.f065" Service-Type = Login-User Message-Authenticator = 0x9aa9d97e0e231cea6b19cb67a7427212 EAP-Message = 0x020800061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 288 State = 0x3d9c5d6c389444de59e52e5a67a9cf7f NAS-IP-Address = 192.168.0.88 NAS-Identifier = "Test_802_1x" +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 28 to xxx.xxx.xxx.219 port 62987 EAP-Message = 0x0109002b19001703010020eedbab1e5637b6f9a112f580254e552325658744d6663cd65b9a405cc43ffe6e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d9c5d6c3b9544de59e52e5a67a9cf7f Finished request 6. Going to the next request Waking up in 0.5 seconds. rad_recv: Access-Request packet from host xxx.xxx.xxx.219 port 62987, id=29, length=204 User-Name = "majereryan(a)gmail.com" Framed-MTU = 1400 Called-Station-Id = "001e.7a3c.7a10" Calling-Station-Id = "001e.3a8b.f065" Service-Type = Login-User Message-Authenticator = 0x96b9aec4b089096c9bc1d6d2598c65a4 EAP-Message = 0x0209003319001703010028b6876e498464cf83b2c91427000ebfa013931247315f451d4cfe1c43fb21d97e7a74d1138289b578 NAS-Port-Type = Wireless-802.11 NAS-Port = 288 State = 0x3d9c5d6c3b9544de59e52e5a67a9cf7f NAS-IP-Address = 192.168.0.88 NAS-Identifier = "Test_802_1x" +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 9 length 51 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - majereryan(a)gmail.com PEAP: Got tunneled identity of majereryan(a)gmail.com PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to majereryan(a)gmail.com +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 9 length 23 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry DEFAULT at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop PEAP: Calling authenticate in order to initiate tunneled EAP session. +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled PEAP: Cancelling proxy to realm SECURACCESS until the tunneled EAP session has been established PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 29 to xxx.xxx.xxx.219 port 62987 EAP-Message = 0x010a004b19001703010040650e624cd28f313fcdaa01569602f1b5c46136cbe5807506d27344870727fcaefd991233d94b0b695e9888a3f104d8f9611b03212fc6762840ca318a5ab8dfe7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d9c5d6c3a9644de59e52e5a67a9cf7f Finished request 7. Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Request packet from host xxx.xxx.xxx.219 port 62987, id=30, length=260 User-Name = "majereryan(a)gmail.com" Framed-MTU = 1400 Called-Station-Id = "001e.7a3c.7a10" Calling-Station-Id = "001e.3a8b.f065" Service-Type = Login-User Message-Authenticator = 0x97de9e8789eb63dd4e16c3acf1663d79 EAP-Message = 0x020a006b19001703010060b2c9dbe814f29a10ef2fd8f8e39a7f63976d9ef95692d2062c4d148432e7e0ddcfe869c72ff3e3e55496d2a432990bd1b2526e4e95621c082d40089bedc6376916d2d615d323b5ea3ab2a7078b0fb89d90401eff5baa808b9cfaf1364a4ead75 NAS-Port-Type = Wireless-802.11 NAS-Port = 288 State = 0x3d9c5d6c3a9644de59e52e5a67a9cf7f NAS-IP-Address = 192.168.0.88 NAS-Identifier = "Test_802_1x" +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 10 length 107 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to majereryan(a)gmail.com +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 10 length 77 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry DEFAULT at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop PEAP: Calling authenticate in order to initiate tunneled EAP session. +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Not-EAP proxy set. Not composing EAP ++[eap] returns handled PEAP: Tunneled authentication will be proxied to SECURACCESS PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. Tunneled session will be proxied. Not doing EAP. ++[eap] returns handled Sending Access-Request of id 212 to xxx.xxx.xxx.151 port 1812 User-Name = "majereryan(a)gmail.com" NAS-IP-Address = xxx.xxx.xxx.219 MS-CHAP-Challenge = 0x5d6e0e7c347dfb2e0d636bb267dbbb25 MS-CHAP2-Response = 0x0a613cd2bf39eed5861aabb762c1c824164f0000000000000000034b01fe706028ca1c4aac06d12203ba01fb335cc5849983 Proxy-State = 0x3330 Proxying request 8 to home server xxx.xxx.xxx.151 port 1812 Sending Access-Request of id 212 to xxx.xxx.xxx.151 port 1812 User-Name = "majereryan(a)gmail.com" NAS-IP-Address = xxx.xxx.xxx.219 MS-CHAP-Challenge = 0x5d6e0e7c347dfb2e0d636bb267dbbb25 MS-CHAP2-Response = 0x0a613cd2bf39eed5861aabb762c1c824164f0000000000000000034b01fe706028ca1c4aac06d12203ba01fb335cc5849983 Proxy-State = 0x3330 Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Accept packet from host xxx.xxx.xxx.151 port 1812, id=212, length=210 Class = 0x7773675f353132 Service-Type = Framed-User Session-Timeout = 36000 Idle-Timeout = 10800 MS-CHAP2-Success = 0x0a533d34414246383744434131334641313736423838364530413830334530464244303739454539433042 MS-MPPE-Recv-Key = 0xd05b8c013b092f1d163f93190e1f9049 MS-MPPE-Send-Key = 0x03ffeba42e61c4fe7f41d9c2d6ab2725 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Proxy-State = 0x3330 +- entering group post-proxy expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/xxx.xxx.xxx.219/post-proxy-detail-20080324 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/xxx.xxx.xxx.219/post-proxy-detail-20080324 expand: %t -> Mon Mar 24 17:35:20 2008 ++[post_proxy_log] returns ok PEAP: Passing reply from proxy back into the tunnel. PEAP: Passing reply back for EAP-MS-CHAP-V2 0x8177078 2 +- entering group post-proxy expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/0.0.0.0/post-proxy-detail-20080324 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/0.0.0.0/post-proxy-detail-20080324 expand: %t -> Mon Mar 24 17:35:20 2008 ++[post_proxy_log] returns ok rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x8177078 2. rlm_eap_mschapv2: Authentication succeeded. MSCHAP Success ++[eap] returns ok POST-PROXY 2 +- entering group post-auth expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/0.0.0.0/reply-detail-20080324 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/0.0.0.0/reply-detail-20080324 expand: %t -> Mon Mar 24 17:35:20 2008 ++[reply_log] returns ok POST-AUTH 2 PEAP: Got reply 11 PEAP: Got tunneled Access-Challenge PEAP: Reply was handled ++[eap] returns ok Sending Access-Challenge of id 30 to xxx.xxx.xxx.219 port 62987 EAP-Message = 0x010b005319001703010048123d1f08e9391db9d1fdaaffd38640765bc5bf7468f612ba7fcc5865888b259a8fb79f1a745c0390e6f4be1e216bbe72b48e8f6478adf27f6a7e1fc824c97ff0ad244185501e6f93 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d9c5d6c359744de59e52e5a67a9cf7f Finished request 8. Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Request packet from host xxx.xxx.xxx.219 port 62987, id=31, length=188 User-Name = "majereryan(a)gmail.com" Framed-MTU = 1400 Called-Station-Id = "001e.7a3c.7a10" Calling-Station-Id = "001e.3a8b.f065" Service-Type = Login-User Message-Authenticator = 0xc9fe0bbade3ca7d7279e162081682679 EAP-Message = 0x020b002319001703010018f832b95c14b1b34d82496c06d938a70470f470e31e44e795 NAS-Port-Type = Wireless-802.11 NAS-Port = 288 State = 0x3d9c5d6c359744de59e52e5a67a9cf7f NAS-IP-Address = 192.168.0.88 NAS-Identifier = "Test_802_1x" +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 11 length 35 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to majereryan(a)gmail.com +- entering group authorize expand: %{Client-IP-Address} -> xxx.xxx.xxx.219 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '/' in User-Name = "majereryan(a)gmail.com", skipping NULL due to config. ++[IPASS] returns noop rlm_realm: Looking up realm "gmail.com" for User-Name = "majereryan(a)gmail.com" rlm_realm: Found realm "gmail.com" rlm_realm: Adding Stripped-User-Name = "majere" rlm_realm: Proxying request from user majere to realm gmail.com rlm_realm: Adding Realm = "gmail.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 11 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry DEFAULT at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop PEAP: Calling authenticate in order to initiate tunneled EAP session. +- entering group authenticate rlm_eap: No EAP session matching the State variable. rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler ++[eap] returns invalid PEAP: Can't handle the return code 4 rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [majereryan(a)gmail.com/<via Auth-Type = EAP>] (from client gecko port 288 cli 001e.3a8b.f065) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> majereryan(a)gmail.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.4 seconds. Waking up in 0.3 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 31 to xxx.xxx.xxx.219 port 62987 EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.4 seconds. It seems to be that it can't match the EAP session based on the output as shown ------------------------------------------------------------------------------------------------------ PEAP: Calling authenticate in order to initiate tunneled EAP session. +- entering group authenticate rlm_eap: No EAP session matching the State variable. rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler ++[eap] returns invalid PEAP: Can't handle the return code 4 rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid ------------------------------------------------------------------------------------------------------ Thanks/Regards, Ryan

1 0

Re: Terminate EAP-PEAP client connection at FreeRadius Proxy and proxy(forward) request as PAP
by Ryan 24 Mar '08

24 Mar '08

Ok, thanks for pointing this out. I suppose I will have to either enable EAP on the radius for the EAP request to be proxied or have MSCHAP configured on it. Though using EAP will means I need to recompile the radius as I'm using the source packages. The radius that I need to proxy to runs 1.1.7 with LDAP. Do you have any advise on which will be a better approach? Thanks/Regards, Ryan > You can't do that. Inner tunnel for PEAP is EAP-MSCHAPv2 and you can > proxy that. You can't transform that into PAP. If you have a look at > the thread you have quoted you will see that his users were using > EAP-TTLS PAP not PEAP. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 22/3/2008, "Ryan" <majereryan(a)gmail.com> pi?e: > > >Sorry for being not specific enough. Was thinking of understanding how > >it works and then figure out the configuration myself. > > > >Basically I need to terminate a request that uses EAP/PEAP on the main > >radius and proxy the request to an inner radius server for > >authentication using PAP. What will I need to configure in order to > >get it forwarded correctly? > > > >Thanks/Regards, > >Ryan > > > >Ryan wrote: > >> Just read through some of the messages available on proxy tunneling. > >> I'm currently using 2.0.2 and read through the examples on inner > >> tunnel which seems to be able to do what I need. Can someone help by > >> providing more details on how it actually works? > > > > PEAP authentication is really SSL + authentication inside of the SSL > >tunnel. So... the server handles authentication "outside" of the > >tunnel, and authentication "inside" of the tunnel as independent > >authentications. > > > > Do you have *specific* questions? Asking "how does it work" is rather > >open-ended. > > > > Alan DeKok. > >- > >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > >

1 1

A good Open Source Billing Program For Freeradius?
by Lance Buttars 23 Mar '08

23 Mar '08

I need to setup a hotspot with billing capabilities and was wondering if anyone had some recommendations.

6 6

Re: Terminate EAP-PEAP client connection at FreeRadius Proxy and proxy(forward) request as PAP
by Ryan 22 Mar '08

22 Mar '08

Sorry for being not specific enough. Was thinking of understanding how it works and then figure out the configuration myself. Basically I need to terminate a request that uses EAP/PEAP on the main radius and proxy the request to an inner radius server for authentication using PAP. What will I need to configure in order to get it forwarded correctly? Thanks/Regards, Ryan Ryan wrote: > Just read through some of the messages available on proxy tunneling. > I'm currently using 2.0.2 and read through the examples on inner > tunnel which seems to be able to do what I need. Can someone help by > providing more details on how it actually works? PEAP authentication is really SSL + authentication inside of the SSL tunnel. So... the server handles authentication "outside" of the tunnel, and authentication "inside" of the tunnel as independent authentications. Do you have *specific* questions? Asking "how does it work" is rather open-ended. Alan DeKok.

2 1

Re: Problem Freeradius+Ipcop ProxyAdv with mysql
by vabbè 21 Mar '08

21 Mar '08

1 - The secret key is correct, it's same in server and NAS (radius123). 2 - The entry Auth-Type System is comment out already. Ivan Kalik wrote: > > 1. There is quite a clear warning in the debug. > > 2. Comment out the entry in users file setting Auth-Type System if you > are not using it. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 18/3/2008, "vabbè" <emailpersonal(a)email.it> piše: > -- View this message in context: http://www.nabble.com/Problem-Freeradius%2BIpcop-ProxyAdv-with-mysql-tp1612… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Hostapdradiusclient->-freeradiusproxy-X-freeradiusserver
by romain.raynaud＠orange-ftgroup.com 21 Mar '08

21 Mar '08

Hi! I have a problem to configure the freeradius 2.0.2 proxy to communicate with the freeradius 2.0.2 server. And I found nothing to help me neither on the web nor on the wiki. My architecture is this one : Hostapd radius client 10.193.11.212 -> 10.193.11.232 -> 10.193.11.166 freeradius server freeradius proxy I have no connection message between the proxy and the server and no proxied messages send from the radius proxy. ok all my requests are receive by the proxy Could you help me in my configuration or give me all the configuration files for example. thanks My configuration is this one: Server : Radiusd.conf Listen { type = auth ipaddr = 10.193.11.166 port = 1812 } Listen { type = acct ipaddr = 10.193.11.166 port = 1813 } proxy_requests = no Client.conf client 10.193.11.232/32 { secret = testing123 shortname = proxy } Proxy : Radiusd.conf Listen { type = auth ipaddr = 10.193.11.232 port = 1812 } Listen { type = acct ipaddr = 10.193.11.232 port = 1813 } Listen { type = proxy ipaddr = 10.193.11.232 port = 1814 } proxy_requests = yes Proxy.conf Home_server{ type = auth+acc ipaddr = 10.193.11.166 shortname = proxy secret = testing123 } Client.conf client 10.193.11.212/32 { secret = secret shortname = oaporg } Client : ok all my requests are receive by the proxy secret = secret shortname = oaporg nas ip addr = 10.193.11.212 proxy server = 10.193.11.232 Romain RAYNAUD

3 2

WPA_Supplicant re-authentication
by Arran Cudbard-Bell 21 Mar '08

21 Mar '08

Hi All, I know this isn't strictly a FreeRADIUS issue but many of the users of the list are involved in academia and so may have come across this with their linux users. wpa_Supplicant appears to work fine on wireless networks, but on wired networks it attempts to re-authenticate every 30 seconds.. I can't find the root cause for this; packet traces show no EAPOL activity prior to re-authentication and the supplicant itself reveals nothing in it's output or logs. The only possible explanation I can think of, is the out-of-order EAP-Notification packet the ProCurve NAS sends after the EAP-Success packet. Could this confuse the supplicant into thinking the session was ongoing, and then time out after 30 seconds and restart the authentication process ? It certainly breaks the EAP Spec.. It anyone else experiencing this with different NAS? Thanks, Arran

4 3