- Freeradius-Users - lists.freeradius.org

Cannot get EAP/TLS working
by prajakta choudhari 25 May '07

25 May '07

Hi all: My setup is a linksys router enabled with radius authentication and client connecting to it. I get the following messages and it just gets stuck on it. Can somebody help in understanding the problem. I am pasting it. Thank You Prajakta [root@localhost sbin]# ./radiusd -X -A \Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/home/praju/freeradius-1.1.3/scripts/gen/cert-srv.pem" tls: certificate_file = "/home/praju/freeradius-1.1.3/scripts/gen/cert-srv.pem" tls: CA_file = "/home/praju/freeradius-1.1.3/scripts/gen/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/radius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.6.15:2054, id=0, length=129 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000d01636572742d636c74 Message-Authenticator = 0xbc296283d7c2c9e175f632885f6daf64 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry cert-clt at line 96 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.6.15 port 2054 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6939bd070a48824264cfda1489dd8a39 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2054, id=0, length=214 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0x6939bd070a48824264cfda1489dd8a39 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100500d800000004616030100410100003d03014657213cba157c3cc8684804f2f50e4eb2a2b826c45db0e7db4af93d2ddf746200001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x1db59a11338973b8145b8cc59e4cce36 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry cert-clt at line 96 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 05f8], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 008c], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 192.168.6.15 port 2054 EAP-Message = 0x0102040a0dc0000006dd160301004a0200004603014656724e5658c1acd1dd20531f78b5edaa151a850c1659a42b7e7f7615b7cbbb206f8cc0e4ac8f19e18a7004ce143923d77c53e86b5f3e9b94f77cbd249c4f4efd00040016030105f80b0005f40005f10002923082028e308201f7a003020102020102300d06092a864886f70d0101050500307b310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340 EAP-Message = 0x636461632e696e301e170d3037303532313130323232365a170d3038303532303130323232365a308185310b300906035504061302494e311430120603550408130b6d61686172617368747261310d300b060355040713047075656e310d300b060355040a130443444143310d300b060355040b13044e4953473111300f06035504031308636572742d7372763120301e06092a864886f70d01090116117072616a616b74616340636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100ba96be1dae6471ce9089953b952d0baaa9535e3f64589ca05794e54a6989b54e5f9c414b0dc0dddcf8e4feb2adea6ddf86 EAP-Message = 0x5a98928047c0e820ce8e55723717a4e67841de9d724c3e554f8bea06cfbf66210633a0708a2c28006588c520488b3ae9319666bd8d691ac90ea7e6205024cac75f1a9db146d4cbc9e7e7585a5e76690203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100134f1f412d627f76a94946ceaaa42b36e5511ea5bb5a0b07c51c85189a61daf753aeb4c7316d0938f0c7773319344ad6c2ca2d14443d15a7e2c25849aac0b4ed1dcb2b299d0660d5bab0ecad14d656d751e536cce27050c77b1bc4302adbd100bc523313ce355a1227db12d22f26c21f71d70ea89907216a5a4a068f8a EAP-Message = 0x20983600035930820355308202bea003020102020900fd08e181edb41830300d06092a864886f70d0101050500307b310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e301e170d3037303532313130323130355a170d3039303532303130323130355a307b310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b0603 EAP-Message = 0x55040a130443444143310d300b060355040b13044e49 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x07aa3969910d4945cc7fc5dbae49ea7a Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2054, id=0, length=140 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0x07aa3969910d4945cc7fc5dbae49ea7a NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060d00 Message-Authenticator = 0x05d7c1ecdee567d780d5e08bc551fd9d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry cert-clt at line 96 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 192.168.6.15 port 2054 EAP-Message = 0x010302e70d80000006dd5347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100d4e249a959b945e0a701b23d1fcb5c72665cc9f37941b5c5e4f548db63a0f73fd7713456d14872bfaa793708153f26a8bdae729fc605d4d88bacf454e140215d6445b8e2a9f63c979dccefc27587ee04de044a465ddf6394297de61d6e4a4f01755fd2afab982e36dcc82b13fc3147b63c30de3d12309dbd8a9b180b6d390a8f0203010001a381e03081dd301d0603551d0e0416041488b0879e4157f3021edced4b EAP-Message = 0xda7beef0053f56713081ad0603551d230481a53081a2801488b0879e4157f3021edced4bda7beef0053f5671a17fa47d307b310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e820900fd08e181edb41830300c0603551d13040530030101ff300d06092a864886f70d0101050500038181007ca56158c183dd67b75efb7b5bf4de3a06886b378cd8e68345d0f4c6d4dfa08415a9cc1c EAP-Message = 0x7a6081551f38d4b1a5650cc7fbcd736ff064da2f408f6a060b688cb79551abafb6ad796d9b0ff935c69a9d7e96a3394e3c0e6cab05a17125d92c39753bd054724e827153d79b42fba5a503cf710835e99a1c4fbcd9467d902e6834fb160301008c0d000084020102007f007d307b310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf5fe1a53de2bf3ebbe4959a8f81c5198 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2054, id=0, length=1140 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0xf5fe1a53de2bf3ebbe4959a8f81c5198 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020303e80d80000003de16030103ae0b00029e00029b00029830820294308201fda003020102020101300d06092a864886f70d0101050500308181310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e301e170d3037303532333131343335375a170d3038303532323131343335375a308184310b300906035504061302494e311430120603550408130b4d6168617261 EAP-Message = 0x7368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e4953473111300f06035504031308636572742d636c743120301e06092a864886f70d01090116117072616a616b74616340636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100bca99f739541ff5508930cdac4b928611acf16bbc153a5fd10ddd735468d3f8a633566a1c059b807aacfbf5d112d1abfaa5e4834245f04cc818e20442306909c3f16b0b4ae404493281ed2509083a6465704eec6036e6566270dffea047e9207ac7681f2ca70164aa0a2a014d96a439112b3f7877cfa1297a306 EAP-Message = 0x262e3f6ced850203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010105050003818100b87aad1c3e9ccbc82a753b013bf5f4e76328950b473b8bc42f6826b19af18a4d9a2352498d613fc64155f828a3d94999c3903a305a55f46198b6ecc49b4c3f9b80c9da6af5e052da06fd47803b95d9d9c39adeed6d5a85d7d6aa2c3a284d58e99dc977eafa40a511f27938a4618262dc5f9816eefc1b9c4173f1094ec0011a1310000082008072c0fd0840915b216318c89bed05fd65aefc23ae96f4650a921fd74de49407ff214893640de85e358774d2898ece03aa8dacec05cec6c103c44fdf6967c7e713 EAP-Message = 0x96a825aa06c40d163b4e7a66b14fbd069d7ac2362b88e818298c0866bf5f572180d8c0891b5b17e238cdc9b32a0d9c9d7599ef3e8838f1c2a508919caba899e00f00008200806eb651194fae382d0d33e905d27b9fb88b3e9a2615801b101f90ddc3e6fe0d47eb739aa62baa271a65f8cefc938b09f115b14dd47862255f85072e00f8ad70d4f309c7b07962e6b73677ebae339574900be61f8dda1e04de4989d58f7f42bad3fb0e57452b2dc9fd1faf12385beafa83f4e3072aaf5e71335e6dda7131b07c6614030100010116030100209eb4b1b7820184e9b7d6d01f77ccdfb90a0b3d324aea40ab5496e430a707cc7a Message-Authenticator = 0xd088bb2c45c82c971315caa4f9a8fea7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry cert-clt at line 96 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 02a2], Certificate --> verify error:num=20:unable to get local issuer certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 0 to 192.168.6.15 port 2054 EAP-Message = 0x010400110d800000000715030100020230 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1d9ff9291ff6d9f906a5ce9b4358b893 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2054, id=0, length=140 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0x1d9ff9291ff6d9f906a5ce9b4358b893 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400060d00 Message-Authenticator = 0x7743b76f7f07ee00d9b9a3c812ad2f24 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry cert-clt at line 96 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack alert eaptls_verify returned 4 eaptls_process returned 4 rlm_eap: Handler failed in EAP/tls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 4 modcall: leaving group authenticate (returns invalid) for request 4 auth: Failed to validate the user. Delaying request 4 for 1 seconds Finished request 4 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.6.15 port 2054 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 4 ID 0 with timestamp 4656724e Nothing to do. Sleeping until we see a request. Download prohibited? No problem! To chat from any browser without download, Click Here: http://in.messenger.yahoo.com/webmessengerpromo.php

1 0

Freeradius and MS ActiveDirectory
by Ouahiba MACHANI 25 May '07

25 May '07

Hi, Is there any plug-in for Freeradius, that allow to interface with an Active Directory and authenticate users?? if not, is it possible to developpe such a plug-in ? and what are the requiremenet? could this plug-in be a PAM module ? thanks.

3 2

peap in users file?
by Matt Ashfield 24 May '07

24 May '07

Hi I'm trying to do PEAP authentication against a user listed in my users file instead of an AD or LDAP. I'm just doing this initially for some proof of concept stuff. I'm wondering how I need to set up the user in the users file? Currently my entry looks like: "testuser" User-Password == "abc.123", Tunnel-Private-Group-Id=staff But when I run in debug mode I'm getting the following, which indicates to me perhaps I'm not setting the password correctly: modcall: entering group MS-CHAP for request 7 Thu May 24 15:56:47 2007 : Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 7 Thu May 24 15:56:47 2007 : Debug: rlm_mschap: No User-Password configured. Cannot create LM-Password. Thu May 24 15:56:47 2007 : Debug: rlm_mschap: No User-Password configured. Cannot create NT-Password. Thu May 24 15:56:47 2007 : Debug: rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password Thu May 24 15:56:47 2007 : Debug: rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. Thu May 24 15:56:47 2007 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Thu May 24 15:56:47 2007 : Debug: modsingle[authenticate]: returned from mschap (rlm_mschap) for request 7 Thu May 24 15:56:47 2007 : Debug: modcall[authenticate]: module "mschap" returns reject for request 7 Thu May 24 15:56:47 2007 : Debug: modcall: leaving group MS-CHAP (returns reject) for request 7 Thu May 24 15:56:47 2007 : Debug: rlm_eap: Freeing handler Thu May 24 15:56:47 2007 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 7 Thu May 24 15:56:47 2007 : Debug: modcall[authenticate]: module "eap" returns reject for request 7 Thu May 24 15:56:47 2007 : Debug: modcall: leaving group authenticate (returns reject) for request 7 Thu May 24 15:56:47 2007 : Debug: auth: Failed to validate the user. Any advice is appreciated. Matt mda(a)unb.ca

2 1

FreeRadius +MSSQL +VoIp-h323
by Victor Akilov 24 May '07

24 May '07

Dear All! I try to combine FreeRadius and mssql-server for VoIp (With PPPoE users I don't have any problems). I red instruction to combine FreeRadius and postgresql because I suppose that it's very similar(another driver - freetds and unixodbc) but I had some misunderstanding - instruction for creating tables in database defines some tables (for example "CREATE TABLE StartTelephony","CREATE TABLE StopTelephony", "CREATE TABLE isdn_error_codes" etc) but in pgsql-voip.conf I found sql requests to another tables:radcheck, radreply,groupcheck, groupreply and etc(for dialup users), and I didn't find sql requests to tables StartTelephony and isdn_error_codes and etc. Where is my fault? Thank you in advance Victor

2 1

Integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication
by xuebin gong 24 May '07

24 May '07

Thanks Pshem for your quick answer. I expect answer like folowing "rlm_ldap: user jjeep authorized succesfully modcall[authorize]: module "ldap" returns ok" ... Request Access-Accept. But I got "rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0" ....... Request Access-Rejected. What is wrong ? need help. Thanks Robin Pshem Kowalczyk wrote:Freeradius expects exactly one answer: rlm_ldap: object not found or got ambiguous search result kind regards Pshem On 22/05/07, xuebin gong <robin_gong(a)yahoo.com> wrote: > Hi, All, > > I am user and want to integrate freeradius v1.1.6 and > openLADP v2.3.32 for authorization and > authentication. Our operating system is Fedora 5 > Linux. > > (1)Install freeRadius-1.1.6 > After following the instruction of installation in > http://wwww.freeradius.org, > install freeRadius-1.1.6 on Fedora Linux 5, run radius > server in debug mode > > radiusd -X > ...... > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > > FreeRadius was installed succeefully. > > (2)Configure freeRadius-1.1.6 > (2.1) Configure radiusd.conf > (2.1.1) LDAP module > ldap{ > server = "10.0.0.118" > identity = "cn=Manager,dc=mtcable,dc=net" > password = mtncnl1970 > basedn = "dc=mtcable,dc=net" > filter = > "uid=%{Stripped-User-Name:-%{User-Name}}" > start_tls = no > dictionary_mapping = > ${raddbdir}/ldap.attrmap > ldap_connections_number = 5 > edir_account_policy_check=no > timeout = 4 > timelimit = 3 > net_timeout = 1 > } > (2.1.2) authorize module > uncomment ldap line > > authorize{ > ...... > ldap > ...... > } > > (2.1.3) authenticate module > uncomment block ldap block: > > authenticate{ > ...... > Auth-Type LDAP { > ldap > } > ...... > } > > > (2.2) edit /usr/local/etc/raddb/users > Uncomment the following lines: > > DEFAULT Auth-Type = LDAP > Fall-Through = 1 > > (3)Install openLDAP > (4)Configure openLDAP > (5)Add one LDAP entry for testing > > dn: uid=jjeep, ou=radius, rccd=AAA3140018f, > dc=mtcable,dc=net > userPassword:: aabbccdd > cn: jeep > uid: jjeep > radiusAuthType: local > radiusSimultaneousUse: 1 > homeDirectory: // > objectClass: top > objectClass: posixAccount > objectClass: radiusprofile > uidNumber: 7012 > gidNumber: 100 > > After add this entry to LDAP, we reset the password to > "888888" > > (5)Test > After run test command line > > radtest jjeep "888888" localhost 1 testing123 > > The following is information from running Radiusd -X: > > ...... > rad_recv: Access-Request packet from host > 127.0.0.1:32771, > id=192, length=57 > User-Name = "jjeep" > User-Password = "888888" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok > for request 0 > modcall[authorize]: module "chap" returns noop for > request 0 > modcall[authorize]: module "mschap" returns noop for > request 0 > rlm_realm: No '@' in User-Name = "jjeep", looking up > realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for > request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for > request 0 > users: Matched entry DEFAULT at line 153 > modcall[authorize]: module "files" returns ok for > request 0 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for jjeep > radius_xlat: 'uid=jjeep' > radius_xlat: 'dc=mtcable,dc=net' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: (re)connect to 10.0.0.118:389, > authentication 0 > rlm_ldap: bind as cn=Manager,dc=mtcable,dc=net/mtncnl1 > > 970 to 10.0.0.118:389 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: performing search in dc=mtcable,dc=net, with > > filter uid=jjeep > rlm_ldap: object not found or got ambiguous search > result > rlm_ldap: search failed > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns notfound > for req > uest 0 > rlm_pap: WARNING! No "known good" password found for > the use > r. Authentication may fail because of this. > modcall[authorize]: module "pap" returns noop for > request0 > modcall: leaving group authorize (returns ok) for > request 0 > rad_check_password: Found Auth-Type LDAP > auth: type "LDAP" > Processing the authenticate section of radiusd.conf > modcall: entering group LDAP for request 0 > rlm_ldap: - authenticate > rlm_ldap: login attempt by "jjeep" with password > "888888" > radius_xlat: 'uid=jjeep' > radius_xlat: 'dc=mtcable,dc=net' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in dc=mtcable,dc=net, with > > filter uid=jjeep > rlm_ldap: object not found or got ambiguous search > result > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authenticate]: module "ldap" returns > notfound for > request 0 > modcall: leaving group LDAP (returns notfound) for > request 0 > auth: Failed to validate the user. > Login incorrect (rlm_ldap: User not found): [jjeep] > (from cl > ient localhost port 1) > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > > The following is logfile: > > ...... > May 17 12:09:13 dolphin slapd[2205]: conn=7 fd=17 > ACCEPT from IP=10.0.0.118:35564 (IP=0.0.0.0:389) > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND > dn="cn=Manager,dc=mtcable,dc=net" method=128 > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND > dn="cn=Manager,dc=mtcable,dc=net" mech=SIMPLE ssf=0 > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 > RESULT tag=97 err=0 text= > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH > base="dc=mtcable,dc=net" scope=2 deref=0 > filter="(uid=jjeep)" > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH > attr=radiusNASIpAddress radiusExpiration acctFlags > ntPassword lmPassword radiusCallingStationId > radiusCalledStationId radiusSimultaneousUse > radiusAuthType radiusCheckItem radiusReplyMessage > radiusLoginLATPort radiusPortLimit > radiusFramedAppleTalkZone radiusFramedAppleTalkNetwork > radiusFramedAppleTalkLink radiusLoginLATGroup > radiusLoginLATNode radiusLoginLATService > radiusTerminationAction radiusIdleTimeout > radiusSessionTimeout radiusClass > radiusFramedIPXNetwork radiusCallbackId > radiusCallbackNumber radiusLoginTCPPort > radiusLoginService radiusLoginIPHost > radiusFramedCompression radiusFramedMTU radiusFilterId > radiusFramedRouting radiusFramedRoute > radiusFramedIPNetmask radiusFramedIPAddress > radiusFramedProtocol radiusServiceType radiusReplyItem > > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 > SEARCH RESULT tag=101 err=0 nentries=3 text= > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH > base="dc=mtcable,dc=net" scope=2 deref=0 > filter="(uid=jjeep)" > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH > attr=uid > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 > SEARCH RESULT tag=101 err=0 nentries=3 text= > > It looks like LDAP search successfully and found 3 > entries, but redius server could not find any objects. > > What is wrong with my integration? > > Thanks In Advanced > > Robin ____________________________________________________________________________________Take the Internet to Go: Yahoo!Go puts the Internet in your pocket: mail, news, photos & more. http://mobile.yahoo.com/go?refer=1GNXIC

1 0

EAP-TLS: Different Certificates for different Called-Station-Id
by Wolfgang Burger 24 May '07

24 May '07

Hi, i´ve set up a freeRadius-Server (1.1.6) on OS X 10.3.9. I'm using it to authenticate my Wireless-LAN with 802.1X, EAP and self created certificates. Evertything works well so far. Is there any possibility to select different certificate_files and private_key_files, deppending on the Called-Station-ID of the request? As like: Called-Station-ID = "00112233445566:SSID1" -> Use Cert1.pem Called-Station-ID = "00112233445566:SSID2" -> Use Cert2.pem Thank you so much for any help. Kind Regards / Mit freundlichen Grüßen Wolfgang Burger <burgerw(a)immunbio.mpg.de> Max-Planck-Institut fuer Immunbiologie Scientific Data Processing Unit (+00 49) 761 / 5108 461 Stuebeweg 51 D-79108 Freiburg Germany

2 1

Grouping users and clients
by Giovanni Lovato 24 May '07

24 May '07

Hi all. We have a set of Cisco routers and a pool of users in an LDAP directory. At this time routers are configured to request authentication to FreeRadius, which binds to LDAP and grants access to user on successfully binding. We need to create groups of routers and groups of users, granting accesso to certain groups of routers only to certain groups of users. Can we do that using FreeRadius? Thank you, G.L. -- www.aldu.net/~heruan giovanni.lovato(a)aldu.net

5 7

postauth_query question
by Christoffer Dahl Petersen 24 May '07

24 May '07

Hi I'm trying to log authorization request to a postgres db. My postauth query: postauth_query = "INSERT INTO authlog (where, who, reply,authdate) VALUES ('%{NAS-IP-Address}','%{User-Name}','%{reply:Packet-Type}', NOW())" Could I use another attribute rather than NAS-IP-Address that would translate NAS-IP-Address into the shortname given i clients.conf? Some info: radiusd -X <snip> rad_recv: Access-Request packet from host 192.168.250.20:6001, id=12, length=69 User-Name = "00-15-00-15-23-3f" User-Password = "28652865" NAS-IP-Address = 192.168.250.20 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '00-15-00-15-23-3f' rlm_sql (sql): sql_set_user escaped user --> '00-15-00-15-23-3f' <snip> I have enabled "log_auth = yes" in radiusd.conf, and i get this in radiusd.log: Thu May 24 11:26:19 2007 : Auth: Login OK: [00-15-00-15-23-3f/00-15-00-15-23-3f] (from client radiustest port 0) I would like to log "radiustest" rather than 192.168.250.20 Christoffer

1 0

Reply-Item from LDAP groups
by Giovanni Lovato 24 May '07

24 May '07

Can I get a Reply-Item from LDAP groups? For example: dn: uid=testuser,ou=people,dc=domain,dc=tld uid: testuser ... dn: cn=testgroup,ou=groups,dc=domain,dc=tld cn: testgroup ... objectClass: radiusprofile radiusReplyItem: Cisco-AVPair := "shell:priv-lvl=5" so that every user of testgroup gets a priv-lvl of 5? Thank you, G.L. -- www.aldu.net/~heruan giovanni.lovato(a)aldu.net

2 1

log file for free radius 1.1.6 eap-tls authentication
by Anoop 24 May '07

24 May '07

Hi I am using free raidus 1.1.6 with eap-tls authentication.The whole set up is working fine. But i am not getting any logs .like user login ok..login filef etc Pls giude me How will i get logs and wat configurtion i need to do in the configuration files. Regards Anoop ********** DISCLAIMER ********** Information contained and transmitted by this E-MAIL is proprietary to Sify Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at admin(a)sifycorp.com

2 1