- Freeradius-Users - lists.freeradius.org

RE: Proposed Freeradius - Kerberos authentication
by Josh Howlett 23 Oct '07

23 Oct '07

David, > I've been reading the FAQs, the man pages, and going over > mailing list archives, and also the info at > deployingradius.com. I thought I should start by checking > that I'm heading in the right direction before trying > building stuff. I'm proposing that we use Freeradius to > authenticate the connections to the wireless APs using the > MIT Kerberos server. If this is possible, would it be done > using EAP-TTLS from the clients, and the Auth-Type would need > to be defaulted to Kerberos so that the > rlm_krb5 module would be used? I'm basing this on the > Protocols page in conjunction with a thread from earlier in > October about EAP-TTLS and Kerberos. You're heading in the right direction. Note that if the synced passwords all exist in the AD, you can also consider the use of EAP-PEAP; the principal advantage being the use of the Windows native supplicant; this does not support EAP-TTLS without the use of third-party tools. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG

1 0

Freeradius doesn't detect EAP when authenticating against MySQL
by Andrew Rowson 23 Oct '07

23 Oct '07

Hi, I'm trying to use my existing freeradius server and mysql database to add 802.1X PEAP functionality to my wireless network. Currently, it works great authenticating my cisco device logins. However, after setting the peap stuff up, when I try to log in with a user on the wireless, it -seems to get the wrong auth-type, and fails. Here's what happens: > rad_recv: Access-Request packet from host 192.168.1.10:2050, id=0, length=125 > User-Name = "growse" > NAS-IP-Address = 192.168.1.10 > Called-Station-Id = "0016b6edfe1b" > Calling-Station-Id = "000e35bd8c13" > NAS-Identifier = "0016b6edfe1b" > NAS-Port = 34 > Framed-MTU = 1400 > NAS-Port-Type = Wireless-802.11 > EAP-Message = <some stuff> > Message-Authenticator = <more stuff> > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "growse", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 0 length 11 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > radius_xlat: 'growse' > rlm_sql (sql): sql_set_user escaped user --> 'growse' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'growse' ORDER BY id' > rlm_sql (sql): Reserving sql socket id: 4 > radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'growse' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'growse' ORDER BY id' > radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'growse' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' > rlm_sql (sql): Released sql socket id: 4 > modcall[authorize]: module "sql" returns ok for request 0 > users: Matched entry DEFAULT at line 155 > modcall[authorize]: module "files" returns ok for request 0 > modcall: leaving group authorize (returns updated) for request 0 > rad_check_password: Found Auth-Type Local > auth: type Local > auth: No User-Password or CHAP-Password attribute in the request > auth: Failed to validate the user. > Login incorrect: [growse] (from client wlan port 34 cli 000e35bd8c13) However, if I put something like: "testuser" Auth-Type = EAP, User-Password := "test" in the users file and use the test credentials on the wireless client, it works fine. I've read a bunch of things saying that the Auth-Type aatribute shouldn't need to be set and that it should figure out that it's EAP by itself. However when using the sql db as a credentials store it can't seem to figure out that it's an EAP request. Any ideas how to fix this? Thanks, Andrew

7 29

Struggling - radgroupcheck/radgroupreply
by Bryan Martin 23 Oct '07

23 Oct '07

I need to have my NetworkGroup get passed one set of attributes and my ServerGroup get passed another. But I have some EnterpriseAdmins who need access to both sets so i need to pass the correct attribute back depending on which device they try to auth from. User Joe is a EnterpriseAdmin. He is a member of the NetworkGroup and the ServerGroup so I need him to have the correct attributes passed to him depending on which NAS-IP-Address he comes from respectivly. For instance, if joe trys to log in through 192.168.0.50 I need to pass back "Class = OU=ServerGroup". If joe trys to log in through 192.168.0.1 I need to pass him "Class = OU=NetworkGroup". The way it stands no matter which NAS-IP-Address he comes from because he is a member of both groups he gets both attributes sent back from radgroupreply. User Sally is a member of the NetworkGroup so I only want radgroupreply to send just the attributes for the NetworkGroup. User Bob is a ServerGroup so I only want bob to get the attributes from the ServerGroup. mysql> select * from radcheck; +----+----------+----------------------+----+---------------------------------------+ | id | UserName | Attribute | op | Value | +----+----------+----------------------+----+---------------------------------------+ | 8 | joe | Password-With-Header | := | {md5}928a40033e748ad825e92ec4f9870696 | | 9 | sally | Password-With-Header | := | {md5}928a40033e748ad825e92ec4f9870696 | | 10 | bob | Password-With-Header | := | {md5}928a40033e748ad825e92ec4f9870696 | +----+----------+----------------------+----+---------------------------------------+ mysql> select * from usergroup; +----------+--------------+----------+ | UserName | GroupName | priority | +----------+--------------+----------+ | joe | NetworkGroup | 1 | | joe | ServerGroup | 2 | | sally | NetworkGroup | 1 | | bob | ServerGroup | 1 | +----------+--------------+----------+ mysql> select * from radgroupcheck; +----+--------------+----------------+----+--------------+ | id | GroupName | Attribute | op | Value | +----+--------------+----------------+----+--------------+ | 9 | ServerGroup | NAS-IP-Address | = | 192.168.0.50 | | 10 | ServerGroup | Auth-Type | = | MD5 | | 11 | NetworkGroup | NAS-IP-Address | = | 192.168.0.1 | | 12 | NetworkGroup | Auth-Type | = | MD5 | +----+--------------+----------------+----+--------------+ mysql> select * from radgroupreply; +----+--------------+-----------+----+-----------------+ | id | GroupName | Attribute | op | Value | +----+--------------+-----------+----+-----------------+ | 17 | NetworkGroup | Class | := | OU=NetworkGroup | | 18 | ServerGroup | Class | := | OU=serverGroup | +----+--------------+-----------+----+-----------------+ Steps to reproduce if needed. insert into usergroup (UserName, GroupName, priority) VALUES ('joe', 'NetworkGroup', 1); insert into usergroup (UserName, GroupName, priority) VALUES ('joe', 'ServerGroup', 2); insert into usergroup (UserName, GroupName, priority) VALUES ('sally', 'NetworkGroup', 1); insert into usergroup (UserName, GroupName, priority) VALUES ('bob', 'ServerGroup', 1); insert into radgroupcheck (GroupName, Attribute, op, value) VALUES ('ServerGroup', 'NAS-IP-Address', '=', '192.168.0.50'); insert into radgroupcheck (GroupName, Attribute, op, value) VALUES ('ServerGroup', 'Auth-Type', '=', 'MD5'); insert into radgroupcheck (GroupName, Attribute, op, value) VALUES ('NetworkGroup', 'NAS-IP-Address', '=', '192.168.0.1'); insert into radgroupcheck (GroupName, Attribute, op, value) VALUES ('NetworkGroup', 'Auth-Type', '=', 'MD5'); insert into radgroupreply (GroupName, Attribute, op, Value) VALUES ('NetworkGroup', 'Class', ':=', 'OU=NetworkGroup'); insert into radgroupreply (GroupName, Attribute, op, Value) VALUES ('ServerGroup', 'Class', ':=', 'OU=serverGroup'); Thanks for your time.

2 1

FreeRADIUS and SNMP questions
by Geoffroy Arnoud 23 Oct '07

23 Oct '07

Hi all, I have 2 questions regarding FreeRADIUS and SNMP: 1/ Is it possible to run 2 FreeRADIUS servers on the same box, with SNMP support activated? I understand it's possible, using distinct values for smux_password parameter. 2/ Connecting FreeRADIUS to Net-SNMP using SMUX is quite easy. Has anyone connected FreeRADIUS with BMC PAtrol agent using SMUX? Thanks for any answer Geoff. _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 1

proxy configuration
by hussein alshatri 23 Oct '07

23 Oct '07

Hi all I have very short question I have simple configuration of one server and three clients. I am using freeradius sever to authenticate them to the server but now I am trying to make one of these clients as a proxy to the server for the others. I have changed a lot in the configuration files (e.g proxy.conf)but i don't know how to do it. Could you just tell me step by step what to do: Thank you in advance Hussein _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

3 2

EAP authentication with Cisco AP
by Peter Param 23 Oct '07

23 Oct '07

Hi All, I have been trying, unsuccessfully, to get a windows supplicant (as shipped with Vista) to authenticate via freeradius/ldap. The freeradius/ldap combo works well with the existing VPN authen/auth that we have here on campus but not with EAP. I'm not sure what or where to go from here ...any pointers? freeradius logging: Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.56.7.81:1645, id=246, length=130 User-Name = "timmy" Framed-MTU = 1400 Called-Station-Id = "0013.6067.bcb0" Calling-Station-Id = "001b.7728.a8c0" Service-Type = Login-User Message-Authenticator = 0x7d2246236182294e8085da177383f3b4 EAP-Message = 0x0202000801746e67 NAS-Port-Type = Wireless-802.11 NAS-Port = 6722 NAS-IP-Address = 10.56.7.81 NAS-Identifier = "svhwapmed0301" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "timmy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for timmy radius_xlat: '(cn=timmy)' radius_xlat: 'ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap-dev.stvincents.com.au:389, authentication 0 rlm_ldap: bind as cn=superuser,o=schs,c=au/ldapadmin to ldap-dev.stvincents.com.au:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au, with filter (cn=timmy) rlm_ldap: checking if remote access for timmy is allowed by cn rlm_ldap: Password header not found in password timmysPASSWORD for user timmy rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value timmysPASSWORD & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user timmy authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "people_search" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 246 to 10.56.7.81 port 1645 EAP-Message = 0x010300160410da433545ecf08558fb23fb9d7a1e9251 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x84dc68e3b83cac07d2bdde56656fa45b Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.56.7.81:1645, id=247, length=146 User-Name = "timmy" Framed-MTU = 1400 Called-Station-Id = "0013.6067.bcb0" Calling-Station-Id = "001b.7728.a8c0" Service-Type = Login-User Message-Authenticator = 0x80896aec4445abeab1b82e57df662896 EAP-Message = 0x020300060319 NAS-Port-Type = Wireless-802.11 NAS-Port = 6722 State = 0x84dc68e3b83cac07d2bdde56656fa45b NAS-IP-Address = 10.56.7.81 NAS-Identifier = "svhwapmed0301" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "timmy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "files" returns notfound for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for timmy radius_xlat: '(cn=timmy)' radius_xlat: 'ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au, with filter (cn=timmy) rlm_ldap: checking if remote access for timmy is allowed by cn rlm_ldap: Password header not found in password timmysPASSWORD for user timmy rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value timmysPASSWORD & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user timmy authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "people_search" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 247 to 10.56.7.81 port 1645 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa67de6a6917fb1801883447f7d07bf73 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.56.7.81:1645, id=248, length=286 User-Name = "timmy" Framed-MTU = 1400 Called-Station-Id = "0013.6067.bcb0" Calling-Station-Id = "001b.7728.a8c0" Service-Type = Login-User Message-Authenticator = 0x63c0e15a97da9e0708a94a4866dd3f63 EAP-Message = 0x0204009219800000008816030100830100007f0301471d2dfcffd525f06e56ea45e95ba59040cf607de28f6ec019a0bfc7562fb67a209ef61a1f6dfa89b1f9f 32b95eb9a60448a86c1603e922cedbdc32dfcb09a3ba40018002f00350005000ac009c00ac013c01400320038001300040100001e000000080006000003746e67 000a00080006001700180019000b00020100 NAS-Port-Type = Wireless-802.11 NAS-Port = 6722 State = 0xa67de6a6917fb1801883447f7d07bf73 NAS-IP-Address = 10.56.7.81 NAS-Identifier = "svhwapmed0301" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "timmy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 146 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall[authorize]: module "files" returns notfound for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for timmy radius_xlat: '(cn=timmy)' radius_xlat: 'ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au, with filter (cn=timmy) rlm_ldap: checking if remote access for timmy is allowed by cn rlm_ldap: Password header not found in password timmysPASSWORD for user timmy rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value timmysPASSWORD & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user timmy authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "people_search" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0083], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 248 to 10.56.7.81 port 1645 EAP-Message = 0x0105040a19c0000006f1160301004a020000460301471df0af1061ddbf5eb56761e29205a9e3e6f2c629dfedd7e48986d1d70a1bdc20c8f928a15bdc928654f 737f82c0d065558cc630a34842ed95c75e9255ffe68e0002f0016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886 f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153 013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3 035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d652043 69747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f742063657 27469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab 450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24 a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf 13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e8350365000 3ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f7669 6e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7 374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2a41bebb402ac05cba1644abf67b505d Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.56.7.81:1645, id=249, length=146 User-Name = "timmy" Framed-MTU = 1400 Called-Station-Id = "0013.6067.bcb0" Calling-Station-Id = "001b.7728.a8c0" Service-Type = Login-User Message-Authenticator = 0x92dcb7065be1aacef1d3c822189d80ac EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 6722 State = 0x2a41bebb402ac05cba1644abf67b505d NAS-IP-Address = 10.56.7.81 NAS-Identifier = "svhwapmed0301" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "timmy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 modcall[authorize]: module "files" returns notfound for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for timmy radius_xlat: '(cn=timmy)' radius_xlat: 'ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au, with filter (cn=timmy) rlm_ldap: checking if remote access for timmy is allowed by cn rlm_ldap: Password header not found in password timmysPASSWORD for user timmy rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value timmysPASSWORD & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user timmy authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "people_search" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 249 to 10.56.7.81 port 1645 EAP-Message = 0x010602f71900170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e6365311230100603550 4071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b30190603550403 1312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864 886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c64 46c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ad e33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f060 3550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636 c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798 252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6 d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1a27c6ddec22fc7e8ba7321a04a67cdf Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.56.7.81:1645, id=250, length=348 User-Name = "timmy" Framed-MTU = 1400 Called-Station-Id = "0013.6067.bcb0" Calling-Station-Id = "001b.7728.a8c0" Service-Type = Login-User Message-Authenticator = 0x28fd9e0202cf42bd44781d1936b19d5b EAP-Message = 0x020600d01980000000c61603010086100000820080c8496ebc39e0d28f133239b1bfefccb1784377f1b07bd7d12bf071b224065604e7e5e9cf15bff61442b71 af55ac6c6858f77849b77a5c2166d136211cd01d13e4310bc0c7ca31c3cd4753fc290d89f66f4d7d741efe6111767af2458fce838b9433fb7f29c861f5512c2fc 841101765ff968fd0af7618fca760a1b0f52c8c12f1403010001011603010030ffc6b4939e760c4cb04e95cd91fc9b2ad09413ca627eaf3c5c2393a7c5faf2a00 61a5537352eda0ae57c30df28076830 NAS-Port-Type = Wireless-802.11 NAS-Port = 6722 State = 0x1a27c6ddec22fc7e8ba7321a04a67cdf NAS-IP-Address = 10.56.7.81 NAS-Identifier = "svhwapmed0301" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "timmy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 208 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall[authorize]: module "files" returns notfound for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for timmy radius_xlat: '(cn=timmy)' radius_xlat: 'ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au, with filter (cn=timmy) rlm_ldap: checking if remote access for timmy is allowed by cn rlm_ldap: Password header not found in password timmysPASSWORD for user timmy rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value timmysPASSWORD & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user timmy authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "people_search" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 250 to 10.56.7.81 port 1645 EAP-Message = 0x01070041190014030100010116030100306b3fd8715c33413675406c2dba6d3c4cf5b81093805d860c763723e87d2f53c3c9c1b337b68f0ca371f395bf52371 262 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x750739061080eab3d90e47746efede12 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.56.7.81:1645, id=251, length=146 User-Name = "timmy" Framed-MTU = 1400 Called-Station-Id = "0013.6067.bcb0" Calling-Station-Id = "001b.7728.a8c0" Service-Type = Login-User Message-Authenticator = 0xac51a58b821abc23ae73f0b5faba230f EAP-Message = 0x020700061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 6722 State = 0x750739061080eab3d90e47746efede12 NAS-IP-Address = 10.56.7.81 NAS-Identifier = "svhwapmed0301" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "timmy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall[authorize]: module "files" returns notfound for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for timmy radius_xlat: '(cn=timmy)' radius_xlat: 'ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au, with filter (cn=timmy) rlm_ldap: checking if remote access for timmy is allowed by cn rlm_ldap: Password header not found in password timmysPASSWORD for user timmy rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value timmysPASSWORD & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user timmy authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "people_search" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 251 to 10.56.7.81 port 1645 EAP-Message = 0x010800501900170301002056b3fce58dfde9876381acb7eb7ec8139c58d280947a6c2cae9d9eeba78271f61703010020086e9221f752701d9d96797db6f7ae6 c3d6ff0e8afe29639e9607da3bb708140 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x144352a3976c560713ae411bf3b1f1fd Finished request 5 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 246 with timestamp 471df0af Cleaning up request 1 ID 247 with timestamp 471df0af Cleaning up request 2 ID 248 with timestamp 471df0af Cleaning up request 3 ID 249 with timestamp 471df0af Cleaning up request 4 ID 250 with timestamp 471df0af Cleaning up request 5 ID 251 with timestamp 471df0af Nothing to do. Sleeping until we see a request. ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

Wincdows Clients works, Linux don't
by Sergio Belkin 23 Oct '07

23 Oct '07

I am using freeradius with EAP/TTLS. Windows Clients work fine, but not from Linux. These are the message after trying to access from Ubuntu 7.04: --- Walking the entire request list --- Sending Access-Reject of id 252 to 10.30.1.151 port 1031 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4 seconds... rad_recv: Access-Request packet from host 10.30.1.151:1031, id=253, length=102 User-Name = "jdoe" Calling-Station-Id = "00-0e-35-bf-51-18" EAP-Message = 0x0201000b016d6261726265 Framed-MTU = 1287 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 Message-Authenticator = 0x10cf9173f0fc56e7c29c6febe5be1f90 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 48 modcall[authorize]: module "preprocess" returns ok for request 48 rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 48 modcall[authorize]: module "files" returns notfound for request 48 rlm_ldap: - authorize rlm_ldap: performing user authorization for jdoe radius_xlat: '(uid=jdoe)' radius_xlat: 'ou=people,dc=cadorna,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=cadorna,dc=edu, with filter (uid=jdoe) request done: ld 0x5555557c3e70 msgid 58 rlm_ldap: checking if remote access for jdoe is allowed by radiusAllowed rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jdoe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 48 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 48 modcall: leaving group authorize (returns updated) for request 48 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 48 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 48 modcall: leaving group authenticate (returns handled) for request 48 Sending Access-Challenge of id 253 to 10.30.1.151 port 1031 EAP-Message = 0x010f061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x93a4cdfad4b31637cd74d6d3255e4b30 Finished request 48 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 10.30.1.151:1031, id=254, length=202 User-Name = "jdoe" Calling-Station-Id = "00-0e-35-bf-51-18" EAP-Message = 0x0202005d150016030100520100004e0301471e027b594fc3bd23cd735f39013a7f93bc2b2574587abf78b635eb801f850600002600390038003500160013000a00330032002f0005000400150012000900140011000800060003020100 Framed-MTU = 1287 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 State = 0x93a4cdfad4b31637cd74d6d3255e4b30 Message-Authenticator = 0x3c9b688b198579b1ba4e97ba79c783cf Processing the authorize section of radiusd.conf modcall: entering group authorize for request 49 modcall[authorize]: module "preprocess" returns ok for request 49 rlm_eap: EAP packet type response id 2 length 93 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 49 modcall[authorize]: module "files" returns notfound for request 49 rlm_ldap: - authorize rlm_ldap: performing user authorization for jdoe radius_xlat: '(uid=jdoe)' radius_xlat: 'ou=people,dc=cadorna,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=cadorna,dc=edu, with filter (uid=jdoe) request done: ld 0x5555557c3e70 msgid 59 rlm_ldap: checking if remote access for jdoe is allowed by radiusAllowed rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jdoe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 49 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 49 modcall: leaving group authorize (returns updated) for request 49 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 49 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0052], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0852], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 49 modcall: leaving group authenticate (returns handled) for request 49 Sending Access-Challenge of id 254 to 10.30.1.151 port 1031 EAP-Message = 0x0103040a15c000000ac1160301004a020000460301471cdb5884f622bdad38ebc5862a7813cc4220fa5f1fd7a4a3a60fd18f9e2893200f5d445c4201d335a4d3376418bb45730265c2ab57c352cd5c8ddd4c2679a9b700390016030108520b00084e00084b0003b9308203b53082029da003020102020111300d06092a864886f70d010104050030818e310b3009060355040613024152311530130603550407130c4275656e6f73204169726573311f301d060355040a1316556e6976657273696461642064652050616c65726d6f31273025060355040b131e446570617274616d656e746f20646520436f6d756e69636163696f6e6573311e301c06 EAP-Message = 0x035504031315436572746966696361746520417574686f72697479301e170d3037313031313233333633305a170d3131313031303233333633305a308193310b3009060355040613024152311530130603550407130c4275656e6f73204169726573311f301d060355040a1316556e6976657273696461642064652050616c65726d6f312d302b060355040b1324446570617274616d656e746f20646520436f6d756e69636163696f6e6573202d20737032311d301b06035504031314737065637472756d2e70616c65726d6f2e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100e04585aa76fe88e53fe2e5 EAP-Message = 0xfd4e4c9732987996ca13093a1173f9760319f9bf6b1bbad6702284056432c8b9409e28789a2d91e8027baa1fadcf4951be8b3d1932d6a125dd50d18a57ea8c909eb93b83f73404193b6ebb16e7abcc49ec7b3d2546f65e41d895631ab82cbf09c6744c9d6e01064fd1548487e70baf1179f387430d7f193460f4bf55e9c6cb2100202382b2c0c10929e125f8c32bd5cd0d26c3d908688cb747475263370195f56c256bad4ee232fb9db6bf07966c6ad88f5bfa07143c5a626fde432f3582bdc50164e1b216e902efb947be80f5d64cf05e33e1ba76c3734bd4a1586895b5575ac4ea9f87384629547e75ad7c119c66abe7a07f8c7d0203010001a31730 EAP-Message = 0x1530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100c056381386ae47210e7781b5f29f6e345d3cf3170d7b56f207c5120ad7a0a3f50d8d5089b1b670e12571f30f6035435027ba8a6c0f560c4ed67436b09470a25f6c6ed5f6183671143d0119cdbd58f1564ff62d829557d30db8e3e629cde53dc086b2b6e6cbc199f38653349b1abd884554bde148d0b3c6972f3910a3d9a6004b4b85b5c2bea77f8939d3518d718d5a1290ca6c03f3ce5d98906e243f4cc698360b5d5f3015054f0dc7f0cb42475760038477a75d03c048f80b4f50b554499749833660883b818630ae143a9e0ac935e5e3d594 EAP-Message = 0xf97b881df18c0b1712e00eef6a91fa1582e7f8eb93fa Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9f0fb729292fd1fa84bf8407b903c2f1 Finished request 49 Going to the next request Cleaning up request 42 ID 247 with timestamp 471cdb53 Cleaning up request 43 ID 248 with timestamp 471cdb53 Cleaning up request 44 ID 249 with timestamp 471cdb53 Cleaning up request 45 ID 250 with timestamp 471cdb53 Cleaning up request 46 ID 251 with timestamp 471cdb53 Waking up in 1 seconds... rad_recv: Access-Request packet from host 10.30.1.151:1031, id=255, length=115 User-Name = "jdoe" Calling-Station-Id = "00-0e-35-bf-51-18" EAP-Message = 0x020300061500 Framed-MTU = 1287 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 State = 0x9f0fb729292fd1fa84bf8407b903c2f1 Message-Authenticator = 0x1bf865fa2b8ecd5298a3ba37822d1ce6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 50 modcall[authorize]: module "preprocess" returns ok for request 50 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 50 modcall[authorize]: module "files" returns notfound for request 50 rlm_ldap: - authorize rlm_ldap: performing user authorization for jdoe radius_xlat: '(uid=jdoe)' radius_xlat: 'ou=people,dc=cadorna,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=cadorna,dc=edu, with filter (uid=jdoe) request done: ld 0x5555557c3e70 msgid 60 rlm_ldap: checking if remote access for jdoe is allowed by radiusAllowed rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jdoe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 50 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 50 modcall: leaving group authorize (returns updated) for request 50 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 50 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 50 modcall: leaving group authenticate (returns handled) for request 50 Sending Access-Challenge of id 255 to 10.30.1.151 port 1031 EAP-Message = 0x0104040a15c000000ac14ee3f701692818d33744866b15afbc8774a1ed07b5b43200048c3082048830820370a003020102020101300d06092a864886f70d010104050030818e310b3009060355040613024152311530130603550407130c4275656e6f73204169726573311f301d060355040a1316556e6976657273696461642064652050616c65726d6f31273025060355040b131e446570617274616d656e746f20646520436f6d756e69636163696f6e6573311e301c06035504031315436572746966696361746520417574686f72697479301e170d3035313230313134353835305a170d3135313132393134353835305a30818e310b30090603 EAP-Message = 0x55040613024152311530130603550407130c4275656e6f73204169726573311f301d060355040a1316556e6976657273696461642064652050616c65726d6f31273025060355040b131e446570617274616d656e746f20646520436f6d756e69636163696f6e6573311e301c06035504031315436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100eb878d17120d3af300ab78838b32fde160463d4ff2693c5ebc59123788f0bfe9d90aaa34a22bab04b8e8f294176215b97f2edf6c686434ad87acccd5ecf7edec871e8449a876cbfe531c5158385aa9d30685723c EAP-Message = 0xf3273b5d2d8cde4ca62b0c07c3bdd54be96f2f68074454281c527079276d3388dcdb097e730c419f58d24eaca71fd8c5d8b6fe023154b9bdb920dc6ac013a57dc9bf94b99250b47bc32a07afbf2a2eddd37bdb8f0421f7df33eb999dce70784d065458b5e590f1c285837464709c6af7e3ae092dd38372420e780d8567699d534897f298fcde4309a2f66afee6dce842a69c31f1ca580454665eae87a04881b0bbb009928b30ef374fa534e50203010001a381ee3081eb301d0603551d0e04160414fd77533bb6a66d1e3b48bfb5d21501d829ddf4693081bb0603551d230481b33081b08014fd77533bb6a66d1e3b48bfb5d21501d829ddf469a18194 EAP-Message = 0xa4819130818e310b3009060355040613024152311530130603550407130c4275656e6f73204169726573311f301d060355040a1316556e6976657273696461642064652050616c65726d6f31273025060355040b131e446570617274616d656e746f20646520436f6d756e69636163696f6e6573311e301c06035504031315436572746966696361746520417574686f72697479820101300c0603551d13040530030101ff300d06092a864886f70d0101040500038201010066656bbb8617d0aa046d938fb367586fb47ba22a4c54ccfc21d3bdc13ae39df3cd89029a0b5bcacb39977e824d94ba8c61296ce2e38d91e22766ce9ce6d988580251e19e EAP-Message = 0xf037cea75d86cb016c26f8d51bb33fbe8f07daf1f9fc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ec906c143e12a91c2923decee5f456a Finished request 50 Going to the next request Cleaning up request 47 ID 252 with timestamp 471cdb53 Waking up in 1 seconds... rad_recv: Access-Request packet from host 10.30.1.151:1031, id=0, length=115 User-Name = "jdoe" Calling-Station-Id = "00-0e-35-bf-51-18" EAP-Message = 0x020400061500 Framed-MTU = 1287 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 State = 0x8ec906c143e12a91c2923decee5f456a Message-Authenticator = 0x6505201bc52e449d0d78f34393accd3f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 51 modcall[authorize]: module "preprocess" returns ok for request 51 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 51 modcall[authorize]: module "files" returns notfound for request 51 rlm_ldap: - authorize rlm_ldap: performing user authorization for jdoe radius_xlat: '(uid=jdoe)' radius_xlat: 'ou=people,dc=cadorna,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=cadorna,dc=edu, with filter (uid=jdoe) request done: ld 0x5555557c3e70 msgid 61 rlm_ldap: checking if remote access for jdoe is allowed by radiusAllowed rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jdoe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 51 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 51 modcall: leaving group authorize (returns updated) for request 51 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 51 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 51 modcall: leaving group authenticate (returns handled) for request 51 Sending Access-Challenge of id 0 to 10.30.1.151 port 1031 EAP-Message = 0x010502cb158000000ac178833f2254362517e85e9dcd2c4362773223204e9c66dff65f08f319c5c9a2bb6a6de09b6534fd5df1fc14ba8dc996930e5413bbb2d4cae1c5aa68abe3785bec762c0c47246c2a89066512727dfc1c8b96fb0005841d05009db8e084a3931d2046b4d8047d2c182c9b0a5b5f340ee1b4331ec0ece5185dc33e4f100ec0a0a7e6e2bad313ea717fa4d4ed2e913575014832f80d0298e5c662015b0729eabd6220c0082326acb5160301020d0c0002090080ab5cc42c337b650ab1047c54f7a4fc1a130b5596597983a2b227b2a9969953ee8238cee287777922551db722e8db74a6f760d006dac6ebfcc8a12be3a29d341f28c8 EAP-Message = 0x4c7276144e8ef17163040ab5133ee9dab782f2a030bf37bef653c2081f601c1563997b74cecc8d1d10f7bfdd6d812abd1b020076c2f9d125d24e7148765b00010200802b5df81bd6d61aef7ac659e75d873e6160d654a21ae35372e1f4c23b27eb9da51e47b885d05c5b384b6607e45a86bb5498b5909c81cfcf8079bfaf7a205b1e8ae0e4cc055ddf84fd7a3122952b744b777e35b50385e8de99a39fdce13f3806e54f399cfa985e9b938f7787f8cb091b6c9d344cc1c8cbf49a6b69642f29054f1e01008e859eb9cf1a0a028e0dac00ea41f9c36444e7e1fca9a1d1443f9facbf531a834d0ad6f4ddd46c4b724c359cccce7b96ba81baf8e3571623 EAP-Message = 0xd53ab675a4d6256fbd3485a7c422d677afcbec25fbac4b50c9d9d410bff745fe20cc8604ff15eb43fc8923b0757caac662887d1123dc38dd090c41a7f9e5352a4e2075e80b8473dcb05bf3b76bf63b6de5f7d32ce8d44933b09aa972a16d9f07da5398db6a8cd8567c1b017ec6be611af3cb5a983083297c706459982b8040cbd09c0af14f74f3130a72f89309a68eb110a947055823e5c5390c4846b3e59b63e66ddcbdcb62c6f03958908363a9185afe60cbc91aac69609409435b4b56b750383b8b251a12bac416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89c261d0437eeb9dcddbe806fe528723 Finished request 51 Going to the next request Waking up in 1 seconds... rad_recv: Access-Request packet from host 10.30.1.151:1031, id=1, length=313 User-Name = "jdoe" Calling-Station-Id = "00-0e-35-bf-51-18" EAP-Message = 0x020500cc1500160301008610000082008057043d3068860732c837deabd3478f745b102bd2059b58a6ae82b07439e2333e4d08a61e062ecc61ecc31ac7461234f8a82565867e14f62ee29eb862282a7e4a2fb1c3e9e14b3df1a4e75281a4623872c1839bf9ca2ff9d7fac21f1427e057f9178814756a0ab73dc99098322d70e12cb698a85a2a81685771b951bded038d4514030100010116030100302282d77f0730d9d730c3e02ba2ffd22eb47bcf3a5a365ff22adf85d96bd84be66928ffcf58720562175aa6725ea1cff7 Framed-MTU = 1287 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 State = 0x89c261d0437eeb9dcddbe806fe528723 Message-Authenticator = 0x7610c5f0d8723787c71194309ef953c1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 52 modcall[authorize]: module "preprocess" returns ok for request 52 rlm_eap: EAP packet type response id 5 length 204 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 52 modcall[authorize]: module "files" returns notfound for request 52 rlm_ldap: - authorize rlm_ldap: performing user authorization for jdoe radius_xlat: '(uid=jdoe)' radius_xlat: 'ou=people,dc=cadorna,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=cadorna,dc=edu, with filter (uid=jdoe) request done: ld 0x5555557c3e70 msgid 62 rlm_ldap: checking if remote access for jdoe is allowed by radiusAllowed rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jdoe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 52 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 52 modcall: leaving group authorize (returns updated) for request 52 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 52 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 52 modcall: leaving group authenticate (returns handled) for request 52 Sending Access-Challenge of id 1 to 10.30.1.151 port 1031 EAP-Message = 0x0106004515800000003b14030100010116030100305733430142da8ad230323c344f3ad0d604a9bfc411f63958f04a6d2da875d66d4b5f28db659aab44adfc8379f8b2ed9d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9d7022d071c2cef6bf33debacd0cb017 Finished request 52 Going to the next request Waking up in 1 seconds... rad_recv: Access-Request packet from host 10.30.1.151:1031, id=2, length=205 User-Name = "jdoe" Calling-Station-Id = "00-0e-35-bf-51-18" EAP-Message = 0x020600601500170301002020647f7d8d2bccc5abe810057b62591cb8d50a9c28d9e1edac7975536e78ed8717030100305f194220a912f09dead1620b1bf24c355d0134f82f36caca739a61d3211d82c6c7b337d69e644127509b25da6874c0f2 Framed-MTU = 1287 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 State = 0x9d7022d071c2cef6bf33debacd0cb017 Message-Authenticator = 0x1981ceaaca92086c0e3517f5cd3f2858 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 53 modcall[authorize]: module "preprocess" returns ok for request 53 rlm_eap: EAP packet type response id 6 length 96 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 53 modcall[authorize]: module "files" returns notfound for request 53 rlm_ldap: - authorize rlm_ldap: performing user authorization for jdoe radius_xlat: '(uid=jdoe)' radius_xlat: 'ou=people,dc=cadorna,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=cadorna,dc=edu, with filter (uid=jdoe) request done: ld 0x5555557c3e70 msgid 63 rlm_ldap: checking if remote access for jdoe is allowed by radiusAllowed rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jdoe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 53 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 53 modcall: leaving group authorize (returns updated) for request 53 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 53 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled identity of jdoe TTLS: Setting default EAP type for tunneled EAP session. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 53 modcall[authorize]: module "preprocess" returns ok for request 53 rlm_eap: EAP packet type response id 6 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 53 modcall[authorize]: module "files" returns notfound for request 53 rlm_ldap: - authorize rlm_ldap: performing user authorization for jdoe radius_xlat: '(uid=jdoe)' radius_xlat: 'ou=people,dc=cadorna,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=cadorna,dc=edu, with filter (uid=jdoe) request done: ld 0x5555557c3e70 msgid 64 rlm_ldap: checking if remote access for jdoe is allowed by radiusAllowed rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jdoe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 53 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 53 modcall: leaving group authorize (returns updated) for request 53 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 53 rlm_eap: EAP Identity rlm_eap: No such EAP type md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 53 modcall: leaving group authenticate (returns invalid) for request 53 auth: Failed to validate the user. TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls TTLS: Freeing handler for user jdoe rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 53 modcall: leaving group authenticate (returns invalid) for request 53 auth: Failed to validate the user. Delaying request 53 for 1 seconds Finished request 53 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 2 to 10.30.1.151 port 1031 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 51 ID 0 with timestamp 471cdb58 Cleaning up request 52 ID 1 with timestamp 471cdb58 Cleaning up request 53 ID 2 with timestamp 471cdb58 Cleaning up request 48 ID 253 with timestamp 471cdb58 Cleaning up request 49 ID 254 with timestamp 471cdb58 Cleaning up request 50 ID 255 with timestamp 471cdb58 Nothing to do. Sleeping until we see a request. -- -- Sergio Belkin -

3 2

Cleartext-password problem
by hadi golestani 22 Oct '07

22 Oct '07

Hi, I've installed freeradius and it was working fine with users file authentication but when I add sql module ( freeradius's wiki->SQL_HOWTO ) when I try radtest with a username that is in db, authentication failed, and it's the out put of debug mode: rad_recv: Access-Request packet from host 127.0.0.1:1026, id=168, length=147 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "n2test" MS-CHAP-Challenge = 0x409da00bcdf49bf9ac057995c300f40b MS-CHAP2-Response = 0x24003e5162483aabe749b5dd4550f8e68be60000000000000000980209d9d70a472836d24769c794daa603e726bc8f27c73e Calling-Station-Id = "192.168.1.4" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 modcall[authorize]: module "chap" returns noop for request 12 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 12 rlm_realm: No '@' in User-Name = "n2test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 12 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 12 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry DEFAULT at line 184 modcall[authorize]: module "files" returns ok for request 12 radius_xlat: 'n2test' rlm_sql (sql): sql_set_user escaped user --> 'n2test' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'n2test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql: Failed to create the pair: Unknown attribute "Cleartext-Password" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns fail for request 12 modcall: leaving group authorize (returns fail) for request 12 Finished request 12 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 12 ID 168 with timestamp 471cb73a Nothing to do. Sleeping until we see a request. Why this happens? can this was for some missing information in my db?

2 1

Load Balancing user requests to multiple LNS's
by Adrian 22 Oct '07

22 Oct '07

Hello Everyone, I am trying to configure our free-radius server to send multiple LNS L2TP parameters to a customer's radius server for establishing an L2TP tunnel prior to the user authenticating. Apparently these responses will have to exist in every request however the Customer will only establish an L2TP session if one doesn't exist already. As per their documentation, I would have to do something like below, where the :1: would be L2TP tunnel 1 and :2: would be Tunnel 2: Service-Type=framed Tunnel-Medium-Type=:1:IP Tunnel-Medium-Type=:2:IP Tunnel-Password=:1:password Tunnel-Password=:2:password Tunnel-Type=:1:L2TP Tunnel-Type=:2:L2TP Tunnel-Server-Endpoint=:1:X.X.X.X Tunnel-Server-Endpoint=:2:Y.Y.Y.Y Tunnel-Preference=:1:1 Tunnel-Preference=:2:1 The tunnel-preference would tell them to load balance between Tunnel Server Endpoint 1 and 2. I have loaded all this in a group in the radgroupreply and assigned the group to the user table however when I query the radius I only get the first tunnel info back to me. Can anyone point me in the right direction? In the radius logs there are no errors logged and it just shows the replies it sent to the customer which excludes the :2: tunnel information. I'm using Freeradius 1.0.4 with a mysql config. Thanks Adrian Boros

4 3

allowing multiple values through the attribute filter
by A.L.M.Buxey＠lboro.ac.uk 22 Oct '07

22 Oct '07

hi, i've got a remote site that we want to trust a few return attributes from.... no problem. configured. however, there are 2 different attribute values for one of the attributes and i'm not quite sure of the syntax available for use....eg realm.com Session-Timeout <= 28800, Idle-Timeout <= 600, Tunnel-Medium-Type == IEEE-802, Tunnel-Type == VLAN, Tunnel-Private-Group-Id == testvlan this works...and allows ONLY 'testvlan' attribute to be returned but I also need to accept 'othervlan' and a structure of Tunnel-Private-Group-Id =~ ( /^testvlan$/ || /^othervlan$/ ) doesnt do what i need. is this do-able in attribute filter or can I construct something in unlang (this is a 2.0.0pre2 server) thanks alan PS I've tried setting 2 values...as per the Framed-Protocol == PPP, Framed-Protocol == SLIP, part.....eg Tunnel-Private-Group-Id == testvlan, Tunnel-Private-Group-Id == othervlan, but that just stops EITHER of the return attributes from working. bug?

3 2