- Freeradius-Users - lists.freeradius.org

1.1.4 slow to respond
by Andrew Long 12 Jun '07

12 Jun '07

I am getting slow response time from the server for authentication requests (chap/mschap) that eventually fail (users submitting wrong password). The problem is that the NAS is sending about 3 requests before getting a response. By the time the deny arrives, it is out of order and the NAS logs an unexpected packet (though it correctly denies the user). I am wondering if disabling all authentication/authorization methods except chap/mschap would solve this by speeding the response time. The server is not the speediest machine... 1 GHZ processor/1GB ram, but is dedicated for freeradius except for serving some static web pages. I have never seen system usage stats above nominal levels. Regards, Andrew

3 2

Behaviour of freeradius when receiving a response from a proxy server
by Nicolas Castel 12 Jun '07

12 Jun '07

Hi all, I wonder about the freeradius server behaviour after receiving a response from a proxy. Is it normal that the request passes through the post-auth section once the request has been received ? Below, the behaviour i observed Note: this is only a test in order to undersand the freeradius server behaviour in that case. rad_recv: Access-Request packet from host 127.0.0.1:16395, id=235, length=109 User-Name = "D00000" User-Password = "password" NAS-IP-Address = 172.26.233.2 NAS-Port-Type = Wireless-802.11 WISPr-Location-Name = "Testing:FR,localhost" NAS-Identifier = "FRAF1" Event-Timestamp = "Jun 12 2007 09:26:34 GMT" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall: entering group request_processing for request 0 radius_xlat: 'test.fr' rlm_attr_rewrite: Added attribute Proxy-To-Realm with value 'test.fr' modcall[authorize]: module "add_proxy_to_realm" returns ok for request 0 modcall: leaving group request_processing (returns ok) for request 0 modcall: leaving group authorize (returns ok) for request 0 Processing the pre-proxy section of radiusd.conf modcall: entering group pre-proxy for request 0 modcall: entering group request_processing for request 0 radius_xlat: '/var/log/freeradius/radacct//RADIUS-Trace-20070612' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/RADIUS-Trace-%Y%m%d expands to /var/log/freeradius/radacct//RADIUS-Trace-20070612 modcall[pre-proxy]: module "radius_trace" returns ok for request 0 modcall: leaving group request_processing (returns ok) for request 0 modcall: leaving group pre-proxy (returns ok) for request 0 Sending Access-Request of id 0 to 172.26.233.2 port 1812 User-Name = "D000001" User-Password = "password" NAS-IP-Address = 172.26.233.2 NAS-Port-Type = Wireless-802.11 WISPr-Location-Name = "Testing:FR,localhost" NAS-Identifier = "FRAF1" Event-Timestamp = "Jun 12 2007 09:26:34 GMT" Proxy-State = 0x323335 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 172.26.233.2:1812, id=0, length=67 Reply-Message = "User authenticated on remote platform." Proxy-State = 0x323335 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 0 radius_xlat: '/var/log/freeradius/radacct//RADIUS-Trace-20070612' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/RADIUS-Trace-%Y%m%d expands to /var/log/freeradius/radacct//RADIUS-Trace-20070612 modcall[post-proxy]: module "radius_trace" returns ok for request 0 modcall: leaving group post-proxy (returns ok) for request 0 authorize: Skipping authorize in post-proxy stage rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'User authenticated on remote platform.' Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 modcall: entering group request_processing for request 0 modcall[post-auth]: module "local_voucher_account_info" returns ok for request 0 radius_xlat: '/var/log/freeradius/radacct//RADIUS-Trace-20070612' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/RADIUS-Trace-%Y%m%d expands to /var/log/freeradius/radacct//RADIUS-Trace-20070612 modcall[post-auth]: module "radius_trace" returns ok for request 0 modcall: leaving group request_processing (returns ok) for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 91 to 127.0.0.1 port 16395 Reply-Message = "User authenticated on remote platform." Finished request 0 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 91 with timestamp 466e71d8 Nothing to do. Sleeping until we see a request. The example above shows that the request passes through authorize, pre-proxy, post-proxy and then though post-auth. Is there any way that the request does not pass through the post-auth section ? Thanks in advance.

3 2

freeRADIUS with PEAP doesn't authenticate WinXp supplicant
by Apangshu Saha 12 Jun '07

12 Jun '07

Dear All, I am using winxp as supplicant and configured every possible configuration files of freeRADIUS to support PEAP. But still the log file in server shows like following: and the client doesnot authenticated. whatshould i do in Winxp supplicant....at the time of connection it shows to enter Username/Password/Logon Domain......what is that Logon Domain? What should i enter here?what configuration setting i should make in xpsupplicant? plz see the following log file and help me what should i do? / /************log file**************************8 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=214 User-Name = "testuser" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0xd316349afcfe1dc084768fa39e502497 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005019800000004616030100410100003d0301466ef55151e34499d4e0e15c72bb20474e547f6ca8156439c527ad5ac76c0a0700001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xf71f7a4777cdd86d08877ab3de3ec762 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 05f6], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x0102040a19c000000653160301004a020000460301466e470fa9c7109a172aed739dfa7cc7f5a64a8e4281076ebcc58c4a7676bee920a8c128e283cab0f2a26570674f1984771c0818971f23474e5db5a2bf5c77392100040016030105f60b0005f20005ef00028930820285308201eea003020102020102300d06092a864886f70d0101050500307d310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e4953473111300f060355040313087072616a616b7461311f301d06092a864886f70d01090116107072616a616b74 EAP-Message = 0x6140636461632e696e301e170d3037303532393035303635315a170d3038303532383035303635315a307b310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450554e45310d300b060355040a130443444143310d300b060355040b13044e495347310f300d060355040313065052414a414b311f301d06092a864886f70d01090116105072616a616b746140636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100c4682bbf78964108c4b94d5976695394751375febb82827ad98069865b6e8e8d5d151e4c22cb8b1b96d300972bc5b2905316b1b485d54c060eb3 EAP-Message = 0x19fe4f7248c37e493aa7a0459f6e8f6c50400f4e22e3bdd804ed998e9f9bfeab26e7d2c2ae2f99c7453670daf7cea13f891febc690c9be4ada506eba501d31fa49daf7fa8b130203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100159024193168e51423e2d73826a6e2bb07937a3de03bd4fe61eef65a0c00b6e0da6d08e51ae89f8bc12b312e29306466e53caae1f4ef4cb1cb0174c250621b520a265296de3c53df587a3a3c3f922b6949a95fbda7d149503d53361270cbb4043fcdb99a44011b1042efe168c70fd493123fb3a6f997671ef304f287cbc842ab000360308203 EAP-Message = 0x5c308202c5a0030201020209009271838f2a65231f300d06092a864886f70d0101050500307d310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e4953473111300f060355040313087072616a616b7461311f301d06092a864886f70d01090116107072616a616b746140636461632e696e301e170d3037303532393035303530385a170d3039303532383035303530385a307d310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a13044344 EAP-Message = 0x4143310d300b060355040b13044e4953473111300f06 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x66261f68c0a988471b7dbd1406aa25a9 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=140 User-Name = "testuser" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0x66261f68c0a988471b7dbd1406aa25a9 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200061900 Message-Authenticator = 0x715b22052c0a834c8ab26540be3c7ee1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 2 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x0103025919000355040313087072616a616b7461311f301d06092a864886f70d01090116107072616a616b746140636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100b4695f7f4ac6d738e8f1ba01d9ba31b7a55ec069aa18e5323fafd646b55a2c5fcf8777d20a34ebe6e6b3c7210f75cd3c0b9a1298565c6f4408fcb71fd95906402256723fe9c98d4d5ce6d6d47e2e705f2acf120d40ec9df1f05f376e9e61702409c1ab1df14225f2592720037abb529527f0140f266dda722bc85ee638e0927d0203010001a381e33081e0301d0603551d0e041604146e8a698195a518d1efe841869bc3b87746e660e430 EAP-Message = 0x81b00603551d230481a83081a580146e8a698195a518d1efe841869bc3b87746e660e4a18181a47f307d310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e4953473111300f060355040313087072616a616b7461311f301d06092a864886f70d01090116107072616a616b746140636461632e696e8209009271838f2a65231f300c0603551d13040530030101ff300d06092a864886f70d010105050003818100876aaf9ca0aebb3f6331d22edc4d8a8fb3828e6db868fc65f40f2ab80dfba2a06bdedb167a348a1bdc59 EAP-Message = 0xb14cb59fb92bce6dac1822379ecb469faba3a4dd0efd449f7dd3ae13dd0cce3ed2a59f2c83f88a75585a94e269b51ce27008bc2dbd4e3493e7657b09f1f07eaed60ab55c9ef636d587e3aa7c530c0b3ef8c01b875a4316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xeeffea22eecd70571b93074167e1f9d9 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=326 User-Name = "testuser" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0xeeffea22eecd70571b93074167e1f9d9 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300c01980000000b6160301008610000082008057a095505e914a7b5abe8025749ed79d441c0253ffc67fca83b899e2f086449bb015e9389edc1e440c81e28aa97382183f45cc7ce253fb95218c43cafde60441baa54bb5fb50a7b44e9ae8ab6b4c83028e015e96fe32f4f66aa315cf6d61bb1f73767316d4a238ea9a5601ab94c31fc149d571858362ca64d87222891897bcbe1403010001011603010020e6f71473f403b2d477ad3db5019876b535c1f3d63622c01e65ce12f09f82f056 Message-Authenticator = 0x1adf37f766e60a62b2a64ea969e12a2e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 3 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x0104003119001403010001011603010020ac7b7eae7df6a094a06aac986552e097a71e014578dcdac2d0aa555ac0e82762 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe09ac59efcfd79cdce50681ada73421e Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=140 User-Name = "testuser" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0xe09ac59efcfd79cdce50681ada73421e NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0xc678535af140a79e91368303e815f863 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 4 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x0105002019001703010015ebc8d24acae130428ed6d6893d7ce9eabb27a803bb Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcffd82ce7722fb003680179d65ba88e3 Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=170 User-Name = "testuser" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0xcffd82ce7722fb003680179d65ba88e3 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0205002419001703010019c215488e5af95d08053d8add389cf76bec07c3b8a752467f63 Message-Authenticator = 0xf659306a361f36453617aadc3172c0c5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 36 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - testuser rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of testuser PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to testuser Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: No such EAP type mschapv2 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x010600261900170301001b070ae9621b3a0172525b8ec994d48f8ba1eaa1993e5bad037fbc82 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xced664250055f6ce7932cae33490350b Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=172 User-Name = "testuser" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0xced664250055f6ce7932cae33490350b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600261900170301001bbdd92f192251db8ca1d0badadf2540be9d4e58ac52a5b914f2a17d Message-Authenticator = 0xb04c98dd979b625880b0b41a63bd758d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 6 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 6 modcall: leaving group authenticate (returns invalid) for request 6 auth: Failed to validate the user. Delaying request 6 for 1 seconds Finished request 6 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 6 ID 0 with timestamp 466e4711 Nothing to do. Sleeping until we see a request. /*************end of log file*******/ with thanks... apangshu

3 2

Multiple shared secrets?
by Mark J Elkins 12 Jun '07

12 Jun '07

Can one have multiple shared secrets for the same client(NAS) ? ie - in clients.conf - something like... client 192.168.10.20{ secret = secret1 secret = secret2 shortname = mynas nastype = other } ... so that if the first secret does not work - the second secret is tried? (or how else could I solve the problem) I'm merging two Radius Servers - and authenticating packets from my Incumberant Telcom Provider - who is using proxies (a handful) from (hundreds of) multiple NAS's... from different services (Dialup - is one system, aDSL is another system). I currently have two different shared secrets - and these seem to be bleeding together... I'm looking for a stop-gap until I can get the right people to do the right thing. -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

3 2

Server dies
by Hugh Messenger 12 Jun '07

12 Jun '07

Having been running freeradius in debug mode (with no problems at all) for a month or so while testing and provisioning, it's time to put it in production. Unfortunately, when I run it as a service, it dies after a few hours. No clues, no errors, no nothing . it just silently dies off. Load is not a factor - we're migrating our wireless networks to PPPOE, and right now just have a handful of test users. So freeradius isn't handling more than a handful of requests per hour. I'm running RHEL4, fully up2date. Freeradius 1.1.6, using sqlippool and sql accounting. MySql 5.1 is on another machine. If it makes any difference, the init.d integration seems to be working fine, it correctly starts on boot, and I can control it with 'service'. Are there any logs or stats I could post to help give a clue? I'm basically looking at a blank wall, I have no idea how to even start trying to track this one down. As usual, TIA for any suggestions. -- hugh

2 1

FreeRADIUS 1.1.6 & max_servers
by Dow, Corey 11 Jun '07

11 Jun '07

Hi there, I'm using freeRADIUS 1.1.6 and am authenticating users via NTLM to AD. From time to time, radiusd stops authenticating connections and I see in radius.log that the maximum number of threads has been reached: Fri Jun 8 13:55:54 2007 : Info: The maximum number of threads (32) are active, cannot spawn new thread to handle request Fri Jun 8 13:55:59 2007 : Error: Discarding duplicate request from client nm5406-10:1025 - ID: 229 due to unfinished request 214 Fri Jun 8 13:56:04 2007 : Error: Discarding duplicate request from client nm5406-10:1025 - ID: 229 due to unfinished request 214 Fri Jun 8 13:56:04 2007 : Error: WARNING: Unresponsive child (id 2786053008) for request 213 Fri Jun 8 13:56:09 2007 : Error: Discarding duplicate request from client nm5406-10:1025 - ID: 229 due to unfinished request 214 Fri Jun 8 13:56:16 2007 : Info: The maximum number of threads (32) are active, cannot spawn new thread to handle request Fri Jun 8 13:56:21 2007 : Error: Discarding duplicate request from client nm5406-10:1025 - ID: 230 due to unfinished request 215 Fri Jun 8 13:56:26 2007 : Error: Discarding duplicate request from client nm5406-10:1025 - ID: 230 due to unfinished request 215 Most of what I have been able to gather seems to indicate that this is because of a 'slow' server. I seem to be hitting this even with a very quiet test environment, and only a handful of supplicants. I can't reproduce this at will, and would appreciate any suggestions to correct. Thanks in advance, Corey Corey Dow Solution Test Center Engineer ProCurve Networking Hewlett-Packard Company 8000 Foothills Blvd. (MS 5549) Roseville, CA 95747 Tel : 1-916-785-8003

1 0

Help with Multiple AD/LDAP
by Ryan Kramer 11 Jun '07

11 Jun '07

Hello, I'm working on a new config to allow multiple AD servers to be hit, and am running into a problem. Just a quick background, I have one server that has multiple root level OU's with users under it. It may not be the recommended design, but for our needs it is suitable. I've set up freeradius with three unique ldap entries, all connecting to the same AD server but under different OU's. Anyway, in users.conf I've got this: DEFAULT Ldap-Group == "WIFIUSER" Filter-ID = "WIFIUSER", Fall-Through=1 radiusd.conf authorize { ... LDAP1 LDAP2 LDAP3 } which will return group=WIFIUSER in the accept-accept if the user is in the WIFIUSER AD group. The problem is it only works if the user exists in the last LDAP entry that is listed. it will still return an accept-accept, but no group, if they aren't in the last OU. (In the example above, a user in the LDAP1 OU would not get the WIFUSER group accept-accept, even though they are in it. Moving LDAP1 to the bottom would make it work. Any suggestions? Ryan Kramer

1 1

Re: Freeradius-Users Digest, Vol 26, Issue 34
by Apangshu Saha 11 Jun '07

11 Jun '07

Hi martin, i have enabled all the following things in eap.conf....but still the supplicant shows attempting to authenticate.....i am using winXp as supplicant.....what will be the configuration setting in winxp....it asks log in name..password..and domain name...what is that domain name.....i am giving the user name and password as same as i have written in "users" file in RADIUS server....but what should i put in domain name....you plz help me how should i set the supplicant...... with thanks... apangshu eap { > default_eap_type = peap > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > > md5 { > } > > tls { > ... > } > > ttls { > ... > } > peap { > ... > } > >>> mschapv2 { > >>> } > } > On 6/11/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. help in setting up PEAP in freeRADIUS with winXp (Apangshu Saha) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 11 Jun 2007 20:38:36 +0530 > From: "Apangshu Saha" <apangshu(a)gmail.com> > Subject: help in setting up PEAP in freeRADIUS with winXp > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <c52421460706110808x6fe85e32w7e88da881b7938a5(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Martin, > Thanks for your reply.Everything you mentioned is configured in eap.conf > file.Still i am facing the problem. > Plz let me know how to proceed to fix it. > > With thanks... > Apangshu > > On 6/11/07, freeradius-users-request(a)lists.freeradius.org < > freeradius-users-request(a)lists.freeradius.org> wrote: > > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. Re: help in setting up PEAP in freeRADIUS with winXp > > supplicant (Martin Gadbois) > > 2. Re: Freeradius as a secondary (Jeff) > > 3. Re: Big "VSA + Proxy" problem (Guilherme Franco) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Mon, 11 Jun 2007 09:28:27 -0400 > > From: Martin Gadbois <martin.gadbois(a)colubris.com> > > Subject: Re: help in setting up PEAP in freeRADIUS with winXp > > supplicant > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <466D4DFB.1020704(a)colubris.com> > > Content-Type: text/plain; charset=UTF-8 > > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > Apangshu Saha wrote: > > > > > rad_check_password: Found Auth-Type EAP > > > auth: type "EAP" > > > Processing the authenticate section of radiusd.conf > > > modcall: entering group authenticate for request 5 > > > rlm_eap: EAP Identity > > > rlm_eap: No such EAP type mschapv2 > > > rlm_eap: Failed in EAP select > > > modcall[authenticate]: module "eap" returns invalid for request 5 > > > modcall: leaving group authenticate (returns invalid) for request 5 > > > auth: Failed to validate the user. > > > PEAP: Tunneled authentication was rejected. > > > rlm_eap_peap: FAILURE > > > > Do you have mschap enabled in your eap.conf? > > > > eap { > > default_eap_type = peap > > timer_expire = 60 > > ignore_unknown_eap_types = no > > cisco_accounting_username_bug = no > > > > md5 { > > } > > > > tls { > > ... > > } > > > > ttls { > > ... > > } > > peap { > > ... > > } > > >>> mschapv2 { > > >>> } > > } > > > > > > - -- > > ============== +---------------------------------------------+ > > Martin Gadbois | "Please answer by yes or no. | > > Sr. SW Designer | Uncooperative user waste precious CPU time" | > > Colubris Networks Inc. | -- The Andromeda Strain, M. Crichton, 1969 | > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v1.4.5 (GNU/Linux) > > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > > > iD8DBQFGbU379Y3/iTTCEDkRAhz+AJkBQD2iH/pJHGSFwVdBnNcFAMdILACgomOf > > vZhC4ftJ7IjYZXP+1oTcjQI= > > =YvGQ > > -----END PGP SIGNATURE----- > > > > > > ------------------------------ > > > > Message: 2 > > Date: Mon, 11 Jun 2007 10:28:37 -0400 > > From: Jeff <jeffa(a)jahelpdesk.com> > > Subject: Re: Freeradius as a secondary > > To: "FreeRadius users mailing list" > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <20070611142837.c0c38dfd(a)ns1.jahelpdesk.com> > > Content-Type: text/plain; charset="us-ascii" > > > > Ok new issue thats eluding me > > I uninstalled version 1. then installed version 2 > > > > anyway. i resetup the configs and made sure my services file is 1645 > > radius and 1646 for acct as before > > anyway > > when i do a auth with ntradping all connects aok > > when i do anykind of an accouting request, stop start update i get error > > 10054 > > which i read may mean check the port which it apperas i am set aok > unless > > i am missing something > > > > NEXT > > Nothing is going into the radacct dir for detail file either or is it > > being created > > > > Also when i do a /etc/init.d/freeradius start or restart everything is > aok > > when i do a /etc/init.d/freeradius reload I see in the radius log that > its > > saying there is errors in the radius config > > > > Anyway anyone have any ideas? > > _____ > > > > From: Peter Nixon [mailto:listuser@peternixon.net] > > To: FreeRadius users mailing list [mailto: > > freeradius-users(a)lists.freeradius.org] > > Sent: Sun, 10 Jun 2007 19:43:58 -0400 > > Subject: Re: Freeradius as a secondary > > > > On Sun 10 Jun 2007, Jeff wrote: > > > I am using the version installed through software update on opensuse > > > > You may wish to use my updated packages at: > > http://software.opensuse.org/download/network:/aaa/ > > > > Just add is as a software repository in YaST. (ie. > > http://software.opensuse.org/download/network:/aaa/openSUSE_10.2/) > > > > Cheers > > > > -- > > > > Peter Nixon > > http://www.peternixon.net/ > > PGP Key: http://www.peternixon.net/public.asc > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > >

1 0

help in setting up PEAP in freeRADIUS with winXp
by Apangshu Saha 11 Jun '07

11 Jun '07

Hi Martin, Thanks for your reply.Everything you mentioned is configured in eap.conf file.Still i am facing the problem. Plz let me know how to proceed to fix it. With thanks... Apangshu On 6/11/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: help in setting up PEAP in freeRADIUS with winXp > supplicant (Martin Gadbois) > 2. Re: Freeradius as a secondary (Jeff) > 3. Re: Big "VSA + Proxy" problem (Guilherme Franco) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 11 Jun 2007 09:28:27 -0400 > From: Martin Gadbois <martin.gadbois(a)colubris.com> > Subject: Re: help in setting up PEAP in freeRADIUS with winXp > supplicant > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <466D4DFB.1020704(a)colubris.com> > Content-Type: text/plain; charset=UTF-8 > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Apangshu Saha wrote: > > > rad_check_password: Found Auth-Type EAP > > auth: type "EAP" > > Processing the authenticate section of radiusd.conf > > modcall: entering group authenticate for request 5 > > rlm_eap: EAP Identity > > rlm_eap: No such EAP type mschapv2 > > rlm_eap: Failed in EAP select > > modcall[authenticate]: module "eap" returns invalid for request 5 > > modcall: leaving group authenticate (returns invalid) for request 5 > > auth: Failed to validate the user. > > PEAP: Tunneled authentication was rejected. > > rlm_eap_peap: FAILURE > > Do you have mschap enabled in your eap.conf? > > eap { > default_eap_type = peap > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > > md5 { > } > > tls { > ... > } > > ttls { > ... > } > peap { > ... > } > >>> mschapv2 { > >>> } > } > > > - -- > ============== +---------------------------------------------+ > Martin Gadbois | "Please answer by yes or no. | > Sr. SW Designer | Uncooperative user waste precious CPU time" | > Colubris Networks Inc. | -- The Andromeda Strain, M. Crichton, 1969 | > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.5 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > iD8DBQFGbU379Y3/iTTCEDkRAhz+AJkBQD2iH/pJHGSFwVdBnNcFAMdILACgomOf > vZhC4ftJ7IjYZXP+1oTcjQI= > =YvGQ > -----END PGP SIGNATURE----- > > > ------------------------------ > > Message: 2 > Date: Mon, 11 Jun 2007 10:28:37 -0400 > From: Jeff <jeffa(a)jahelpdesk.com> > Subject: Re: Freeradius as a secondary > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20070611142837.c0c38dfd(a)ns1.jahelpdesk.com> > Content-Type: text/plain; charset="us-ascii" > > Ok new issue thats eluding me > I uninstalled version 1. then installed version 2 > > anyway. i resetup the configs and made sure my services file is 1645 > radius and 1646 for acct as before > anyway > when i do a auth with ntradping all connects aok > when i do anykind of an accouting request, stop start update i get error > 10054 > which i read may mean check the port which it apperas i am set aok unless > i am missing something > > NEXT > Nothing is going into the radacct dir for detail file either or is it > being created > > Also when i do a /etc/init.d/freeradius start or restart everything is aok > when i do a /etc/init.d/freeradius reload I see in the radius log that its > saying there is errors in the radius config > > Anyway anyone have any ideas? > _____ > > From: Peter Nixon [mailto:listuser@peternixon.net] > To: FreeRadius users mailing list [mailto: > freeradius-users(a)lists.freeradius.org] > Sent: Sun, 10 Jun 2007 19:43:58 -0400 > Subject: Re: Freeradius as a secondary > > On Sun 10 Jun 2007, Jeff wrote: > > I am using the version installed through software update on opensuse > > You may wish to use my updated packages at: > http://software.opensuse.org/download/network:/aaa/ > > Just add is as a software repository in YaST. (ie. > http://software.opensuse.org/download/network:/aaa/openSUSE_10.2/) > > Cheers > > -- > > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > >

2 1

Freeradius as a secondary
by Jeff 11 Jun '07

11 Jun '07

I am using Freeradius as a Secondary Radius. The issue is sometimes not always but 98% of the time A user when they connect to the secondary (freeradius) and connect accounting packet start and then when they disconnect no accounting packet stop gets to the secondary Reason its going to the primary radius (VOPRAdius) Thus the problem being the secondary thinks they are still connected. The nas's are not onn site these are from level3 networks Does anyone know what to do for this? Since freeradius is not being used as a primary too I am at a stump on this one.

3 11