- Freeradius-Users - lists.freeradius.org

Problems with DBM and MS-CHAP
by Tom Griffin 08 Aug '07

08 Aug '07

Hello, I am having a problem with Freeradius v1.1.6. We have one server (running v1.0.1) which works as we want it to, but when trying to build a new v1.1.6 server to act in the same way is proving to be difficult. All our users are stored in a local DBM database and authentication is either by MS-CHAP (when coming via a Cisco VPN 3000 concentrator) or by EAP (when coming via Cisco Aironet 1200). Using the Cisco client (and also the VPN concentrator test function) the authentication is successful, the same is true with EAP (ie. the DBM module is working). But when using MS-CHAP authentication is rejected. Here is the debug output; rad_recv: Access-Request packet from host xx.xx.xx.xx:1044, id=176, length=154 User-Name = "cs1tg" NAS-Port = 4054 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "xx.xx.xx.xx" MS-CHAP-Challenge = 0xd1076979a50becf0731656741b3a469a MS-CHAP2-Response = 0x0200ca320fdd144e34edc132ba42560c4619000000000000000064a36039b976de05bc0e340fbd2b5b0b1bff37a302ccc3f2 NAS-IP-Address = xx.xx.xx.xx NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '@' in User-Name = "cs1tg", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_dbm: try open database file: /usr/local/etc/raddb/../usradmin/users rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add cs1tg to user list sm_parse_user: start parsing: user: cs1tg parse buffer: <<Auth-Type := Local, User-Password == "BLANKED">> rlm_dbm: recod parsed process pattern rlm_dbm: Pattern matched, look for request parse buffer: <<Service-Type = Framed-User, Framed-Protocol = PPP, Class = "OU=Unishef">> rlm_dbm: recod parsed rlm_dbm: Reply found Remove cs1tg from user list modcall[authorize]: module "dbm" returns ok for request 1 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [cs1tg] (from client vpn2 port 4054) My main concern is the apparent incorrect Auth-Type of 'mschap' rather than 'MS-CHAP' that I would have expected to see (which is most likely why rad_check_password is falling back to Local). The interesting thing is that when I disable DBM and add a test user locally, the MS-CHAP module successfully authenticates the user, suggesting there is some incompatibility between newer versions of freeradius, dbm and mschap (since we are using this combination on another server with v1.0.1) Here are the main sections of the config; modules { mschap { authtype = MS-CHAP # I have tried with this line blanked also } dbm { usersfile = ${confdir}/../usradmin/users } } authorize { preprocess suffix dbm mschap eap } authenticate { Auth-Type MS-CHAP { mschap } eap } I have tried many different orderings of the authorize section as well as combinations of variables in the mschap module config, but these have all given the same result. The config shown above is the version that is working on the older server. Any help would be greatly appreciated. Regards, Tom Griffin

2 4

Additional functionality of rlm_sql
by Pshem Kowalczyk 08 Aug '07

08 Aug '07

Hi, We use freeradius mainly to proxy requests for wholesale customers of ours. For some of them we provide additional services such as session tracking and ip allocation. Currently we do it with our modified version of rlm_sql. The modification is just an extension of the module (no changes to existing procedures). We've added handling for 'preaccounting' (which is an exact copy of 'accounting') and post-proxy, which runs a single sql query for all 'Access-Accept' packets (we allocate ip here, using a stored procedure in postgresql). The patch is against the 1.1.6 version, but it shouldn't be too difficult to get it against the current one. Is anyone interested? And a question to maintainers - what are the odds of incorporating that functionality in the HEAD version? kind regards Pshem

2 4

authentication problem with mysql integration
by ram 07 Aug '07

07 Aug '07

I have installed freeradius-1.1.6 configured as mentioned http://wiki.freeradius.org/SQL_HOWTO when i do test radtest 12345 12345 x.x.x.x 1645 secret Sending Access-Request of id 2 to x.x.x.x port 1812 User-Name = "12345" User-Password = "12345" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Reject packet from host x.x.x.x:1812, id=2, length=20 rad_verify: Received Access-Reject packet from client x.x.x.x port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) rad_recv: Access-Request packet from host x.x.x.x:32772, id=2, length=57 User-Name = "12345" User-Password = "\234\312\252Q\312\261\202\354\227X\364A\271\277" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 modcall[authorize]: module "digest" returns noop for request 9 rlm_realm: No '@' in User-Name = "12345", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 radius_xlat: '12345' rlm_sql (sql): sql_set_user escaped user --> '12345' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '12345' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '12345' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '12345' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '12345' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 rlm_sql (sql): No matching entry in the database for request from user [12345] modcall[authorize]: module "sql" returns notfound for request 9 modcall: leaving group authorize (returns ok) for request 9 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 9 for 1 seconds Finished request 9 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 2 to x.x.x.x port 32772 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 9 ID 2 with timestamp 46b896e7 Nothing to do. Sleeping until we see a request. any suggestions. ram

5 5

RE: Freeradius - MySQL Update problem
by musoket＠mtn.co.ug 07 Aug '07

07 Aug '07

Hello Ivan, Mon, 06 Aug 2007 16:45:09 +0100, you wrote: >>rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, >>unique ID MAY be inconsistent >This is the source of the errors in log entries. >These are accounting start (VoIP and telephony) and stop requests. They >will use accounting_start_query and accounting_stop_query. In your >previous post you showed what you have done to >accounting_update_query_alt: > >accounting_update_query_alt = "INSERT into ${acct_table1} (AcctSessionId, >AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, >AcctSt >artTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, >AcctInputOctets, >AcctOutputOctets, CalledStationId, CallingStationId, >ServiceType,FramedProtocol, FramedIPAddress, AcctStartDelay) >values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', >'%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', >'%{Cisco-NAS-Port}', >'%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + >%{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', >'%{Acct-Authentic}','', '%{Acct-Input-Octets}', >'%{Acct-Output-Octets}', >'%{Called-Station-Id}', '%{Calling-Station-Id}', >'%{h323-remote-address}', >'%{Framed-Protocol}', '%{h323-remote-address}', '0')" >That query is not getting executed. You need to alter >accounting_start_query and expand it with those attributes. >Ivan Kalik >Kalik Informatika ISP Here are my accounting_start and accounting_stop queries. The attributes were already included: accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPor tType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{Cisco-NAS-Port}', '%{NAS-Port-T ype}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{h323-r emote-address}', '%{Framed-Protocol}', '%{h323-remote-address}', '%{Acct-Delay-Time}', '0')" accounting_start_query_alt = "UPDATE ${acct_table1} SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_s tart = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address} '" accounting_stop_query = "UPDATE ${acct_table2} SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acc t-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIP Address = '%{NAS-IP-Address}'" accounting_stop_query_alt = "INSERT into ${acct_table2} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress,NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, Calle dStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Ac ct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{Cisco-NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Caus e}', '%{h323-remote-address}', '%{Framed-Protocol}', '%{h323-remote-address}', '0', '%{Acct-Delay-Time}')"

2 1

Re: EAP-MD5client"rlm_eap_md5 : Password is required for EAP-MD5Authentication...
by rick norman 07 Aug '07

07 Aug '07

Found the problem. I drilled down and looked at the rlm_eap_md5.c code and realized my client was building the challenge response improperly. Thanks for your help. Rick Norman rnorman(a)ikaika.com Thanks for your help. > ----- Original Message ----- > From: tnt(a)kalik.co.yu > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: EAP-MD5client"rlm_eap_md5 : Password is required for EAP-MD5Authentication... > Date: Mon, 06 Aug 2007 21:20:53 +0100 > > > Send a (PAP) request with radtest. Does that work? > > Ivan Kalik > Kalik Informatika ISP > > > Dana 6/8/2007, "rick norman" <gumbo_2007(a)bsdmail.com> piše: > > > I'm using freeradius version1.1.0_2 on freebsd 6.1. > > The radius client is running locally and talks to radiusd through > > loopback. > > The users file in raddb contains the line > > > > con_d User-Password == con_d Following is radiusd -X output. I > > don't understand the failure. > > > > rad_recv: Access-Request packet from host 127.0.0.1:56788, id=190, length=63 > > User-Name = "con_d" > > NAS-Identifier = "rick" > > Message-Authenticator = 0x8427e9ce00df09446ca9130a3ade1de8 > > EAP-Message = 0x0200000a01636f6e5f64 > > Processing the authorize section of radiusd.conf > > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_realm: No '@' in User-Name = "con_d", looking up realm NULL > > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 0 > > rlm_eap: EAP packet type response id 0 length 10 > > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > > modcall[authorize]: module "eap" returns updated for request 0 > > users: Matched entry con_d at line 138 > > modcall[authorize]: module "files" returns ok for request 0 > > modcall: leaving group authorize (returns updated) for request 0 > > rad_check_password: Found Auth-Type EAP > > auth: type "EAP" > > Processing the authenticate section of radiusd.conf > > modcall: entering group authenticate for request 0 > > rlm_eap: EAP Identity > > rlm_eap: processing type md5 > > rlm_eap_md5: Issuing Challenge > > modcall[authenticate]: module "eap" returns handled for request 0 > > modcall: leaving group authenticate (returns handled) for request 0 > > Sending Access-Challenge of id 190 to 127.0.0.1 port 56788 > > EAP-Message = 0x010100160410223177b20b1d22da8c79e2c0a8562196 > > Message-Authenticator = 0x00000000000000000000000000000000 > > State = 0x93fe786c1b3d77b98c0e87dc406bbd88 > > Finished request 0 > > Going to the next request > > --- Walking the entire request list --- > > Waking up in 6 seconds... > > rad_recv: Access-Request packet from host 127.0.0.1:56788, id=191, length=93 > > User-Name = "con_d" > > NAS-Identifier = "rick" > > State = 0x93fe786c1b3d77b98c0e87dc406bbd88 > > Message-Authenticator = 0xf3b427506614646b12ec161a2be00033 > > EAP-Message = 0x02010016041037ab0f881c1fa98e477b0a5ad546b160 > > Processing the authorize section of radiusd.conf > > modcall: entering group authorize for request 1 > > modcall[authorize]: module "preprocess" returns ok for request 1 > > modcall[authorize]: module "chap" returns noop for request 1 > > modcall[authorize]: module "mschap" returns noop for request 1 > > rlm_realm: No '@' in User-Name = "con_d", looking up realm NULL > > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 1 > > rlm_eap: EAP packet type response id 1 length 22 > > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > > modcall[authorize]: module "eap" returns updated for request 1 > > users: Matched entry con_d at line 138 > > modcall[authorize]: module "files" returns ok for request 1 > > modcall: leaving group authorize (returns updated) for request 1 > > rad_check_password: Found Auth-Type EAP > > auth: type "EAP" > > Processing the authenticate section of radiusd.conf > > modcall: entering group authenticate for request 1 > > rlm_eap: Request found, released from the list > > rlm_eap: EAP/md5 > > rlm_eap: processing type md5 > > rlm_eap: Freeing handler > > modcall[authenticate]: module "eap" returns reject for request 1 > > modcall: leaving group authenticate (returns reject) for request 1 > > auth: Failed to validate the user. > > Delaying request 1 for 1 seconds > > Finished request 1 > > Going to the next request > > Waking up in 6 seconds... > > --- Walking the entire request list --- > > Cleaning up request 0 ID 190 with timestamp 46b76f06 > > Sending Access-Reject of id 191 to 127.0.0.1 port 56788 > > EAP-Message = 0x04010004 > > Message-Authenticator = 0x00000000000000000000000000000000 > > Cleaning up request 1 ID 191 with timestamp 46b76f06 > > Nothing to do. Sleeping until we see a request. > > > > > > -- _______________________________________________ > > Get your free email from http://bsdmail.com > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- _______________________________________________ Get your free email from http://bsdmail.com

2 1

Re: EAP-MD5client"rlm_eap_md5 : Password is required for EAP-MD5 Authentication...
by rick norman 06 Aug '07

06 Aug '07

I'm using freeradius version1.1.0_2 on freebsd 6.1. The radius client is running locally and talks to radiusd through loopback. The users file in raddb contains the line con_d User-Password == con_d Following is radiusd -X output. I don't understand the failure. rad_recv: Access-Request packet from host 127.0.0.1:56788, id=190, length=63 User-Name = "con_d" NAS-Identifier = "rick" Message-Authenticator = 0x8427e9ce00df09446ca9130a3ade1de8 EAP-Message = 0x0200000a01636f6e5f64 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "con_d", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry con_d at line 138 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 190 to 127.0.0.1 port 56788 EAP-Message = 0x010100160410223177b20b1d22da8c79e2c0a8562196 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x93fe786c1b3d77b98c0e87dc406bbd88 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:56788, id=191, length=93 User-Name = "con_d" NAS-Identifier = "rick" State = 0x93fe786c1b3d77b98c0e87dc406bbd88 Message-Authenticator = 0xf3b427506614646b12ec161a2be00033 EAP-Message = 0x02010016041037ab0f881c1fa98e477b0a5ad546b160 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "con_d", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry con_d at line 138 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 1 modcall: leaving group authenticate (returns reject) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 190 with timestamp 46b76f06 Sending Access-Reject of id 191 to 127.0.0.1 port 56788 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 1 ID 191 with timestamp 46b76f06 Nothing to do. Sleeping until we see a request. -- _______________________________________________ Get your free email from http://bsdmail.com

2 1

how to use LDAP for authorization and authentication while using EAP method!!!!!!
by shantanu choudhary 06 Aug '07

06 Aug '07

hello all, i have ldap server installed, i am using it to cross check user-name and password provided by the client!! now for doing this i have to configure my radius server for using LDAP for authorization and authentication. Now when i configure accordingly server cant understand any EAP method. But my client is windows which i am cant configure for methods other that eap, either i have to use ttls, peap, tls. now i configures it for PEAP while disabling verification of server certificate i cant dissable option of using MSCHAP for second phase of authetication. now here my server is not able to understand that that encrypted password. can anyone help me out with this, my server is working fine i tested it using radtest command from same local host. i just cant fix it, can u tell me what is the way out of this, what else can i do, i want to use those ldap accounts and passwords with this but not able to figure it out!! thanks and regards shantanu --------------------------------- 5, 50, 500, 5000. Store N number of mails in your inbox. Click here.

3 8

Using Calling-Station-Id or AcctSessionId as NAS-Port
by Toledo, Luis Carlos 06 Aug '07

06 Aug '07

I need to use Calling-Station-Id (or AcctSessionId) as NAS-Port and provide dynamic Ips using rlm_ippool. Using attr_rewrite it´s possible to make this change (Calling-Station-Id => NAS-Port), but the freeradius/modules C code define port as int. My calling-station-id have 15 numerics chars of size. Have anyone any idea ? Thanks Toledo

1 0

NAS's and client's? what's the difference and where are they and where defined?
by Kevin Bailey 06 Aug '07

06 Aug '07

Hi, I have Debian Etch installed with Freeradius and dialupadmin packages. Versions are ii freeradius 1.1.3-3 a high-performance and highly configurable RADIUS server ii freeradius-dialupadmin 1.1.3-3 set of PHP scripts for administering a FreeRADIUS server ii freeradius-mysql 1.1.3-3 MySQL module for FreeRADIUS server Now two months ago I set the system up and it authenticates an Epygi VOIP box and keeps accounts records for the calls made. Now I need to carry out further work - I had got things working but never fully cleared it in my head. My questions are fundemental. What are the differences between clients and NAS's? - Where should they be defined? I seem to have been able to connect the client box by adding an entry into client.com # 03/05/2007 - kbailey # Test connection to AF-IT Epygi box. client quadro.af-it.com { secret = password shortname = afit_test nastype = epygi } But this is not showing up under the NAS list in the dialupadmin interface - under Radius clients, NAS administration. Also, I see that the /etc/freeradius/naslist file is deprecated in favour of clients.conf - but there is also a /etc/freeradius-dialupadmin/naslist.conf file. This has some default servers in it. I'm almost tempted to think that the /etc/freeradius/clients.conf file is the only file which should be used - but I've heard that there are two things which are separate - clients and NAS's. Also, why are there the two references in the dialupadmin app - on web page and in naslist.conf? Thanks, Kevin -- Kevin Bailey IT Consultant Email: kbailey(a)freewayprojects.com Tel: 01752 268923 W: www.freewayprojects.com

3 3

ERROR: unable to get certificate CRL
by Cristian Novac 06 Aug '07

06 Aug '07

Hello all, I am using Freeradius-1.0.2 in some tests I have to do, and I get the following error "unable to get certificate CRL". I attached the radius log for this problem(trace_unable_CRL). If I set check_crl = no in the tls section of eap.conf file I get another error: "fatal decrypt_error"(the corresponding log file is also attached: trace_decrypt_err) If you have an idea of why do I get this error please tell me . Thanks !! rad_recv: Access-Request packet from host 172.18.0.28:32797, id=1, length=131 Calling-Station-Id = "20-10-00-00-00-01" Message-Authenticator = 0xc09296e0e297e91af27c633a5459d6ed EAP-Message = 0x02120018017370636f6173743140616c636174656c2e726f Framed-MTU = 3795 User-Name = "spcoast1(a)alcatel.ro" NAS-IP-Address = 172.18.0.28 WiMAX-Attr-46 = 0x00250000100100 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "alcatel.ro" for User-Name = "spcoast1(a)alcatel.ro" rlm_realm: Found realm "alcatel.ro" rlm_realm: Adding Stripped-User-Name = "spcoast1" rlm_realm: Proxying request from user spcoast1 to realm alcatel.ro rlm_realm: Adding Realm = "alcatel.ro" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 18 length 24 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 533 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 1 to 172.18.0.28:32797 EAP-Message = 0x011300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8c34538827939bb3bb1a0ecc2c37742f Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.18.0.28:32797, id=2, length=131 Calling-Station-Id = "20-10-00-00-00-01" Message-Authenticator = 0x899c7971f3d5894f1e1503f0bc45b10b EAP-Message = 0x02130006030d Framed-MTU = 3795 User-Name = "spcoast1(a)alcatel.ro" NAS-IP-Address = 172.18.0.28 State = 0x8c34538827939bb3bb1a0ecc2c37742f WiMAX-Attr-46 = 0x00250000100100 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "alcatel.ro" for User-Name = "spcoast1(a)alcatel.ro" rlm_realm: Found realm "alcatel.ro" rlm_realm: Adding Stripped-User-Name = "spcoast1" rlm_realm: Proxying request from user spcoast1 to realm alcatel.ro rlm_realm: Adding Realm = "alcatel.ro" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 19 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 533 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/tls rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 2 to 172.18.0.28:32797 EAP-Message = 0x011400060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c687e55b16b65767f05297e9f159b1a Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.18.0.28:32797, id=3, length=189 Calling-Station-Id = "20-10-00-00-00-01" Message-Authenticator = 0x65ec1af79679d393051f016bc287687f EAP-Message = 0x021400400d800000003616030100310100002d030146b6fe360102030405060708090a0b0c0d0e0f101112131415161718191a1b1c000006000a002f00350100 Framed-MTU = 3795 User-Name = "spcoast1(a)alcatel.ro" NAS-IP-Address = 172.18.0.28 State = 0x9c687e55b16b65767f05297e9f159b1a WiMAX-Attr-46 = 0x00250000100100 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: Looking up realm "alcatel.ro" for User-Name = "spcoast1(a)alcatel.ro" rlm_realm: Found realm "alcatel.ro" rlm_realm: Adding Stripped-User-Name = "spcoast1" rlm_realm: Proxying request from user spcoast1 to realm alcatel.ro rlm_realm: Adding Realm = "alcatel.ro" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 20 length 64 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 533 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0031], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0438], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0061], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode hit in SSL is 0 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 3 to 172.18.0.28:32797 EAP-Message = 0x0115040a0dc0000004f2160301004a02000046030146b6fed2d90c82ef83dc50f53ed42d605704a5f2af486ac1f2741ac47318e7ef20f80478ec1392969232e2e72d7df9998529326705ed0d4f0b950b69433d048742000a0016030104380b000434000431000218308202143082017d020104300d06092a864886f70d01010405003050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b3009060355040313026361301e170d3036313132303135323930365a170d3037313132303135323930365a3055310b3009060355 EAP-Message = 0x040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b13037264723110300e060355040313076173622e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100cbb5b3a2a5ace9d8cd6731122160396b47e68e4a1598ad1556f1866dac443aaa289f20337a22204eb78538fc8a3bfcd1be535298c12e55985fb50cfa3b49386d9f5383be937b31fa574daa2bae232aae4dd058c05e82f23ee0fc1ad368bbe7fd50bdc551e440f6ee82006aebc7499eec1469bfb3409028f3474f9bb2538f07990203010001300d06092a864886f70d010104 EAP-Message = 0x05000381810048faa8a1b7993087df11631d03285c12cef27cb6c4fbf340e92eae39b08d541b4890acbb2a08f1bc9b2265616aeebdb0a5599c373d1e903f598395c2ba8df82af9dde1d211ed23c92d0c215824c51974634b7a2bde7943342a3219ebc14ca4db53eae3f3957664d026ba2abb5ef86d1fc9040c940eb5b59d828f7c991c3d1ee70002133082020f30820178020100300d06092a864886f70d01010405003050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b3009060355040313026361301e170d30363131 EAP-Message = 0x32303135323734335a170d3037313132303135323734335a3050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b300906035504031302636130819f300d06092a864886f70d010101050003818d0030818902818100b87bfcb9783335c6ee9df194d18852e92e762deaba00889dcaaa1c7c631686083c11b4e39e6a1525e5d27bcc5121af7c4080cbe9cf855bbeac86b132b057be324d2d855a0d6f29f500d6cc0ccbccdb616d6f29377287bafc116e4e1b55cf1ed7478f4e41773abf267dc11766b8090c22dd56a0fd0c5c EAP-Message = 0x84269727edd58bb9e74f0203010001300d06092a8648 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x863fd5a12e04024670831e0699514147 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.18.0.28:32797, id=4, length=131 Calling-Station-Id = "20-10-00-00-00-01" Message-Authenticator = 0x90f3b75208573fa8a083d29f6e815e62 EAP-Message = 0x021500060d00 Framed-MTU = 3795 User-Name = "spcoast1(a)alcatel.ro" NAS-IP-Address = 172.18.0.28 State = 0x863fd5a12e04024670831e0699514147 WiMAX-Attr-46 = 0x00250000100100 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: Looking up realm "alcatel.ro" for User-Name = "spcoast1(a)alcatel.ro" rlm_realm: Found realm "alcatel.ro" rlm_realm: Adding Stripped-User-Name = "spcoast1" rlm_realm: Proxying request from user spcoast1 to realm alcatel.ro rlm_realm: Adding Realm = "alcatel.ro" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 21 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 533 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 4 to 172.18.0.28:32797 EAP-Message = 0x011600fc0d80000004f286f70d0101040500038181005ce646a4d51390a366e25a66fdb702e6979a90a003ebeec3a35e561d7a74ad8aa7f72b9ff1200ee8b9786cca3508a62ac21fd54a8c94f57b4a14789fe4da4b2124b5858fda873fb6123bfc640889368a4ee6b340e3ff36aec32b2c1abda267c25ef59fee9cdd62a434cd5dd0ab6e62c080e68133b0c0e306c3b1d5f00f08791616030100610d000059020102005400523050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b30090603550403130263610e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x49573c95d7a0cceceaed8b40f8bb1829 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.18.0.28:32797, id=5, length=1016 Calling-Station-Id = "20-10-00-00-00-01" Message-Authenticator = 0x98eed031051d7876bfb180dd15190b23 EAP-Message = 0x021603750d800000036b160301021d0b0002190002160002133082020f30820178020100300d06092a864886f70d01010405003050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b3009060355040313026361301e170d3036313132303135323734335a170d3037313132303135323734335a3050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b300906035504031302636130819f300d06 EAP-Message = 0x092a864886f70d010101050003818d0030818902818100b87bfcb9783335c6ee9df194d18852e92e762deaba00889dcaaa1c7c631686083c11b4e39e6a1525e5d27bcc5121af7c4080cbe9cf855bbeac86b132b057be324d2d855a0d6f29f500d6cc0ccbccdb616d6f29377287bafc116e4e1b55cf1ed7478f4e41773abf267dc11766b8090c22dd56a0fd0c5c84269727edd58bb9e74f0203010001300d06092a864886f70d0101040500038181005ce646a4d51390a366e25a66fdb702e6979a90a003ebeec3a35e561d7a74ad8aa7f72b9ff1200ee8b9786cca3508a62ac21fd54a8c94f57b4a14789fe4da4b2124b5858fda873fb6123bfc640889 EAP-Message = 0x368a4ee6b340e3ff36aec32b2c1abda267c25ef59fee9cdd62a434cd5dd0ab6e62c080e68133b0c0e306c3b1d5f00f08791616030100861000008200809f21a841ccfc4c5fc63c0a328a26e5d78fc3a637e1063e042382bb0bcc1cbae8952834803cf673c4f9c6aa67a9cdf48356b7c12b58eae434d79488126c3104d0469ffadd443f8a1402d905a457478cb6a4e487a09c7525f838ca793d9112947411992d078d05e4429cef0b28616b24fe8ca2d41739bcc29bb2c420428d31fe7516030100860f000082008044178ae2fab6ecbf60536e01be151fbb629da3d46977dbcc04ea54488832d4284f23134ba41a6fc9b1d4284fe71152e605a8b9a851 EAP-Message = 0x9dcf61c1e3aade0321c64bdca19bc2d98f8a6787ed9b5c6174370628ab5b323b96a8153601a571932c554c2b9537342128ca522d89765a446a0bd8a01cd8a8ce71c1fec8521dcff8f8c7ca1403010001011603010028ee92163f4a6b1b2538c4c35a760737f72fec382f42d0eeb1b731eedb808fefdf27d4eecc7e65d29c Framed-MTU = 3795 User-Name = "spcoast1(a)alcatel.ro" NAS-IP-Address = 172.18.0.28 State = 0x49573c95d7a0cceceaed8b40f8bb1829 WiMAX-Attr-46 = 0x00250000100100 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: Looking up realm "alcatel.ro" for User-Name = "spcoast1(a)alcatel.ro" rlm_realm: Found realm "alcatel.ro" rlm_realm: Adding Stripped-User-Name = "spcoast1" rlm_realm: Proxying request from user spcoast1 to realm alcatel.ro rlm_realm: Adding Realm = "alcatel.ro" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 22 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 533 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 021d], Certificate --> verify error:num=3:unable to get certificate CRL chain-depth=0, error=3 --> User-Name = spcoast1(a)alcatel.ro --> BUF-Name = ca --> subject = /C=ch/ST=sh/L=sh/O=asb/OU=rdr/CN=ca --> issuer = /C=ch/ST=sh/L=sh/O=asb/OU=rdr/CN=ca --> verify return:0 rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B 12318:error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned:s3_srvr.c:2004: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode hit in SSL is 0 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 5 to 172.18.0.28:32797 EAP-Message = 0x011700110d800000000715030100020230 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5ac2eb0ff6b15fa879a2d5b335114359 Finished request 4 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 1 with timestamp 46b6fed2 Cleaning up request 1 ID 2 with timestamp 46b6fed2 Cleaning up request 2 ID 3 with timestamp 46b6fed2 Cleaning up request 3 ID 4 with timestamp 46b6fed2 Cleaning up request 4 ID 5 with timestamp 46b6fed2 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.18.0.28:32796, id=1, length=131 Calling-Station-Id = "20-10-00-00-00-01" Message-Authenticator = 0x22ebf9ae55871a1c1de1a3bdf2111086 EAP-Message = 0x02640018017370636f6173743140616c636174656c2e726f Framed-MTU = 3795 User-Name = "spcoast1(a)alcatel.ro" NAS-IP-Address = 172.18.0.28 WiMAX-Attr-46 = 0x00250000100100 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "alcatel.ro" for User-Name = "spcoast1(a)alcatel.ro" rlm_realm: Found realm "alcatel.ro" rlm_realm: Adding Stripped-User-Name = "spcoast1" rlm_realm: Proxying request from user spcoast1 to realm alcatel.ro rlm_realm: Adding Realm = "alcatel.ro" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 100 length 24 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 533 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 1 to 172.18.0.28:32796 EAP-Message = 0x016500061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb2c1d890416c3898f4d6b8697368cd5c Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.18.0.28:32796, id=2, length=131 Calling-Station-Id = "20-10-00-00-00-01" Message-Authenticator = 0x9f0dc2f291146b1ceb7db575dcc10fb8 EAP-Message = 0x02650006030d Framed-MTU = 3795 User-Name = "spcoast1(a)alcatel.ro" NAS-IP-Address = 172.18.0.28 State = 0xb2c1d890416c3898f4d6b8697368cd5c WiMAX-Attr-46 = 0x00250000100100 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "alcatel.ro" for User-Name = "spcoast1(a)alcatel.ro" rlm_realm: Found realm "alcatel.ro" rlm_realm: Adding Stripped-User-Name = "spcoast1" rlm_realm: Proxying request from user spcoast1 to realm alcatel.ro rlm_realm: Adding Realm = "alcatel.ro" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 101 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 533 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/tls rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 2 to 172.18.0.28:32796 EAP-Message = 0x016600060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89b3be3d0004829d6be986eb71f3283a Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.18.0.28:32796, id=3, length=189 Calling-Station-Id = "20-10-00-00-00-01" Message-Authenticator = 0x535fafd07b98dded907fa6a22a103b85 EAP-Message = 0x026600400d800000003616030100310100002d030146b6fdcd0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c000006000a002f00350100 Framed-MTU = 3795 User-Name = "spcoast1(a)alcatel.ro" NAS-IP-Address = 172.18.0.28 State = 0x89b3be3d0004829d6be986eb71f3283a WiMAX-Attr-46 = 0x00250000100100 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: Looking up realm "alcatel.ro" for User-Name = "spcoast1(a)alcatel.ro" rlm_realm: Found realm "alcatel.ro" rlm_realm: Adding Stripped-User-Name = "spcoast1" rlm_realm: Proxying request from user spcoast1 to realm alcatel.ro rlm_realm: Adding Realm = "alcatel.ro" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 102 length 64 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 533 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0031], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0438], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0061], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode hit in SSL is 0 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 3 to 172.18.0.28:32796 EAP-Message = 0x0167040a0dc0000004f2160301004a02000046030146b6fe6a9fe83eaa33937328cff937bc165ab0541216ae2506d6a2b87dcbc98020f8aa8865e9fbcb92865dcc3881523b69445107d876f5f615aa4caf4dc118c0c9000a0016030104380b000434000431000218308202143082017d020104300d06092a864886f70d01010405003050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b3009060355040313026361301e170d3036313132303135323930365a170d3037313132303135323930365a3055310b3009060355 EAP-Message = 0x040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b13037264723110300e060355040313076173622e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100cbb5b3a2a5ace9d8cd6731122160396b47e68e4a1598ad1556f1866dac443aaa289f20337a22204eb78538fc8a3bfcd1be535298c12e55985fb50cfa3b49386d9f5383be937b31fa574daa2bae232aae4dd058c05e82f23ee0fc1ad368bbe7fd50bdc551e440f6ee82006aebc7499eec1469bfb3409028f3474f9bb2538f07990203010001300d06092a864886f70d010104 EAP-Message = 0x05000381810048faa8a1b7993087df11631d03285c12cef27cb6c4fbf340e92eae39b08d541b4890acbb2a08f1bc9b2265616aeebdb0a5599c373d1e903f598395c2ba8df82af9dde1d211ed23c92d0c215824c51974634b7a2bde7943342a3219ebc14ca4db53eae3f3957664d026ba2abb5ef86d1fc9040c940eb5b59d828f7c991c3d1ee70002133082020f30820178020100300d06092a864886f70d01010405003050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b3009060355040313026361301e170d30363131 EAP-Message = 0x32303135323734335a170d3037313132303135323734335a3050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b300906035504031302636130819f300d06092a864886f70d010101050003818d0030818902818100b87bfcb9783335c6ee9df194d18852e92e762deaba00889dcaaa1c7c631686083c11b4e39e6a1525e5d27bcc5121af7c4080cbe9cf855bbeac86b132b057be324d2d855a0d6f29f500d6cc0ccbccdb616d6f29377287bafc116e4e1b55cf1ed7478f4e41773abf267dc11766b8090c22dd56a0fd0c5c EAP-Message = 0x84269727edd58bb9e74f0203010001300d06092a8648 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaa99bd1462f410dc11a6a6761de1dfc9 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.18.0.28:32796, id=4, length=131 Calling-Station-Id = "20-10-00-00-00-01" Message-Authenticator = 0xf485eab3f9a19ea023622b1a731c590e EAP-Message = 0x026700060d00 Framed-MTU = 3795 User-Name = "spcoast1(a)alcatel.ro" NAS-IP-Address = 172.18.0.28 State = 0xaa99bd1462f410dc11a6a6761de1dfc9 WiMAX-Attr-46 = 0x00250000100100 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: Looking up realm "alcatel.ro" for User-Name = "spcoast1(a)alcatel.ro" rlm_realm: Found realm "alcatel.ro" rlm_realm: Adding Stripped-User-Name = "spcoast1" rlm_realm: Proxying request from user spcoast1 to realm alcatel.ro rlm_realm: Adding Realm = "alcatel.ro" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 103 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 533 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 4 to 172.18.0.28:32796 EAP-Message = 0x016800fc0d80000004f286f70d0101040500038181005ce646a4d51390a366e25a66fdb702e6979a90a003ebeec3a35e561d7a74ad8aa7f72b9ff1200ee8b9786cca3508a62ac21fd54a8c94f57b4a14789fe4da4b2124b5858fda873fb6123bfc640889368a4ee6b340e3ff36aec32b2c1abda267c25ef59fee9cdd62a434cd5dd0ab6e62c080e68133b0c0e306c3b1d5f00f08791616030100610d000059020102005400523050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b30090603550403130263610e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa8e5cef4dd04c58a12422974bc5e9067 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.18.0.28:32796, id=5, length=1016 Calling-Station-Id = "20-10-00-00-00-01" Message-Authenticator = 0xef503c9ddc3fa507204420bee814019e EAP-Message = 0x026803750d800000036b160301021d0b0002190002160002133082020f30820178020100300d06092a864886f70d01010405003050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b3009060355040313026361301e170d3036313132303135323734335a170d3037313132303135323734335a3050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b300906035504031302636130819f300d06 EAP-Message = 0x092a864886f70d010101050003818d0030818902818100b87bfcb9783335c6ee9df194d18852e92e762deaba00889dcaaa1c7c631686083c11b4e39e6a1525e5d27bcc5121af7c4080cbe9cf855bbeac86b132b057be324d2d855a0d6f29f500d6cc0ccbccdb616d6f29377287bafc116e4e1b55cf1ed7478f4e41773abf267dc11766b8090c22dd56a0fd0c5c84269727edd58bb9e74f0203010001300d06092a864886f70d0101040500038181005ce646a4d51390a366e25a66fdb702e6979a90a003ebeec3a35e561d7a74ad8aa7f72b9ff1200ee8b9786cca3508a62ac21fd54a8c94f57b4a14789fe4da4b2124b5858fda873fb6123bfc640889 EAP-Message = 0x368a4ee6b340e3ff36aec32b2c1abda267c25ef59fee9cdd62a434cd5dd0ab6e62c080e68133b0c0e306c3b1d5f00f08791616030100861000008200806ffcbe0dfa183678ed434bfcd5f90d2c3d2a8921ff63677a5d86b68fa2836bc27976bd848660a2ace7d5f6045090fc13f177651fa42127518f4ac99f10e58f45fc707bda6c9de95b08a2b0477e00c648b5d1965810cb5e4fb549e9f7115b854bfdcd83481d0b3134c7681e3818d792ee0ff0b313e18de447ff5cd795f7ed510716030100860f00008200805b74b9af2bced37cacc1c656c2033323c463afd46d2b75998f942a6e96cb88a2aa7b9ac9d0e0c8864054d4155bc3b1ea5837a2bb18 EAP-Message = 0x6ddbcb8c8aa2d34fc8f49c7b128e1885454313f7fd6e189a834c3f0d100cde44670ac9629d09bae908cd7a7a0fd5983d21cfe9f4afee2d7a63df6b7dcadeb052008b3ae52fce184cb889e71403010001011603010028a984f443c15e2ef560721574490852b76ca8844af9fdc310936ab58ee40c4e94153dd3db540c4680 Framed-MTU = 3795 User-Name = "spcoast1(a)alcatel.ro" NAS-IP-Address = 172.18.0.28 State = 0xa8e5cef4dd04c58a12422974bc5e9067 WiMAX-Attr-46 = 0x00250000100100 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: Looking up realm "alcatel.ro" for User-Name = "spcoast1(a)alcatel.ro" rlm_realm: Found realm "alcatel.ro" rlm_realm: Adding Stripped-User-Name = "spcoast1" rlm_realm: Proxying request from user spcoast1 to realm alcatel.ro rlm_realm: Adding Realm = "alcatel.ro" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 104 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 533 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 021d], Certificate chain-depth=0, error=0 --> User-Name = spcoast1(a)alcatel.ro --> BUF-Name = ca --> subject = /C=ch/ST=sh/L=sh/O=asb/OU=rdr/CN=ca --> issuer = /C=ch/ST=sh/L=sh/O=asb/OU=rdr/CN=ca --> verify return:1 TLS_accept: SSLv3 read client certificate A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], CertificateVerify rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept:failed in SSLv3 read certificate verify B 12314:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:rsa_pk1.c:100: 12314:error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed:rsa_eay.c:618: 12314:error:1408807A:SSL routines:SSL3_GET_CERT_VERIFY:bad rsa signature:s3_srvr.c:1850: 12314:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode hit in SSL is 0 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 5 to 172.18.0.28:32796 EAP-Message = 0x016900110d800000000715030100020233 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7034f050cb09b88bd8a1e3f22f5215b6 Finished request 4 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 1 with timestamp 46b6fe6a Cleaning up request 1 ID 2 with timestamp 46b6fe6a Cleaning up request 2 ID 3 with timestamp 46b6fe6a Cleaning up request 3 ID 4 with timestamp 46b6fe6a Cleaning up request 4 ID 5 with timestamp 46b6fe6a Nothing to do. Sleeping until we see a request. [root@Radius sbin]#

1 0