- Freeradius-Users - lists.freeradius.org

MySQL Attirbute Order
by Frosty 12 May '07

12 May '07

I am creating a custom web interface for my work and just wanted to put forward a simple question. When inserting data into the radreply or radgroupreply tables, does the order of the attributes matter? All the attributes are present and correct, but would it matter if say, Frame type attributes came before or after the Tunnel attributes? -- View this message in context: http://www.nabble.com/MySQL-Attirbute-Order-tf3731417.html#a10444812 Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

SQL acconting
by Umar Draz 12 May '07

12 May '07

Dear Members! I have installed Freeradius with mysql running fine for web administration i have installed ARA but when I click on (online user) the page is always blank the same problem i also faced on (Dailup Admin). I manually checked mysql table (radacct) the table always empty. So please help me what should i do to check my online users. Regards, Umar Draz _________________________________________________________________ Catch suspicious messages before you open themwith Windows Live Hotmail. http://imagine-windowslive.com/hotmail/?locale=en-us&ocid=TXT_TAGHM_migrati…

2 1

Re : User-Name and Clear Text Password configurations
by Eshun Benjamin 12 May '07

12 May '07

I want to send out Authentication Request message with only the "User-Name" and "Password". Moreover i want the password to be clear text. Is it possible to configure the free-radius server for just these requirements? YES I did configure the username and password in the "users" file but server seems to be looking for a encrypted password and is thus sending back a reject. Any way to configure a username and a clear text password? You can use CHAP to authenticate and ensure you send clear text from your access point but not EAP. You can see what you are receiving if you do radiusd -X ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Diameter K <diametera(a)gmail.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Samedi, 12 Mai 2007, 11h05mn 47s Objet : User-Name and Clear Text Password configurations Hi All, I want to send out Authentication Request message with only the "User-Name" and "Password". Moreover i want the password to be clear text. Is it possible to configure the free-radius server for just these requirements? I did configure the username and password in the "users" file but server seems to be looking for a encrypted password and is thus sending back a reject. Any way to configure a username and a clear text password? Thanks in advance, Shiv - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

Markus Wintruff istaußer Haus.
by markus.wintruff＠linde.com 12 May '07

12 May '07

Ich werde ab 12.05.2007 nicht im Büro sein. Ich kehre zurück am 21.05.2007. Bitte wenden sie sich an Michael Cochu michael.cochu(a)linde.com +49-40-7339-1432. I am not in the office. Please contact Michael Cochu michael.cochu(a)linde.com +49-40-7339-1432.

1 0

3Com Total Control not logging
by Roberto Greiner 11 May '07

11 May '07

Hi, I just migrated my old GNU-Radius to freeradius 1.1.6 in a Debian Etch box. So far, everything is working, but one odd thing is happening. I'm authenticating users from tree differente types of NAS: One Monowall Box, one pptp box (running PopTop), and one dialup box based on 3Com's Total Control. All three are working fine and authenticating properly, but with one catch. The users from the Total Control box do authenticate properly, but they are not registered in the logs. No entry in the radacct table in MySQL, nothing in radwho nor in radlast. The users are connecting (I've confirmed that), and no error message is generated for the the Total Control users, but no log is generated. Sample entries from the radius.log file: Wed May 9 14:33:27 2007 : Auth: Login OK: [TCuser] (from client totalcontrol port 3604 cli ) Wed May 9 14:33:27 2007 : Auth: Login OK: [Monowalluser] (from client monowall port 112 cli 00:19:7d:4f:ea:52) The only diference I've noticed is that the Total Control entries do not have an address (MAC or IP) at the, which both the Monowall and the pptp users get. Could it be related? All NAS are configured exactly the same way, and their config is stored in the nas table in MySQL. Any ideas of what could be wrong? In GNU-Radius the Total Control box was logging properly. Thank you in advance, Marcos Roberto Greiner -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------

2 1

Must set auth-type - but why?
by John Horne 11 May '07

11 May '07

Hi, I am in the process of upgrading a couple of servers from using FreeRadius 1.0.1 (on FC3), to FreeRadius 1.1.6 (on CentOS 5). In our 'users' file we have a few entries such as: bob Auth-Type = Local,User-Password := "abc",Proxy-To-Realm := LOCAL This works fine with FR 1.0.1. By default we proxy all requests with the NULL realm, so the 'Proxy-To-Realm' had to be included. These users (listed in the 'users' file) connect from Windows XP clients using MS-CHAPv2. However, with FR 1.1.6, this type of user entry failed. After some investigating of the list archives, I saw that the use of Auth-Type generally seemed not to be required. FreeRadius would work out what to do. It didn't. I removed the Auth-Type and still got login failures. The following however, setting the Auth-Type, did work: bob Auth-Type = MSCHAP,User-Password := "abc",Proxy-To-Realm := LOCAL Whilst trying to sort this out, I noted Alan DeKok's comments (in the list archives) that generally Auth-Type does not need to be set (or indeed should *not* be set), and that FR will do the right thing. I am, therefore, a bit concerned that in this instance it seems that Auth-Type must be set for FR to work. I am wondering if this is because I have perhaps made some other error in the radiusd.conf file. Using FR 1.1.6, and running 'radiusd -X', I see failures when not using Auth-Type, and this is in fact exactly the same as if I used 'Auth-Type = Local': ================================================================== rad_recv: Access-Request packet from host 127.0.0.1:33137, id=20, length=149 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "bob" MS-CHAP-Challenge = 0xb3b1f660b5ea874b1c876ca0c058e629 MS-CHAP2-Response = 0xe0008a5ba595d775a04d4169716641ae087e0000000000000000da72659a62c6a221bd42a1079c1114f714f46bc286ab4047 Calling-Station-Id = "141.163.60.7" NAS-IP-Address = 141.163.199.250 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry bob at line 8 modcall[authorize]: module "files" returns ok for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "bob", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "bob" rlm_realm: Proxying request from user bob to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 WARNING: You set Proxy-To-Realm = LOCAL, but it is a LOCAL realm! Cancelling invalid proxy request. rad_check_password: Found Auth-Type auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [bob] (from client localhost port 0 cli 141.163.60.7) Cancelling proxy as request was already rejected Request 0 rejected in proxy_send. Server rejecting request 0. Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 127.0.0.1:33137, id=20, length=149 Sending Access-Reject of id 20 to 127.0.0.1 port 33137 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 20 with timestamp 464449e2 Nothing to do. Sleeping until we see a request. ================================================================== As can be seen it says that rlm_mschap sees it is an MS-CHAP request and sets the Auth-Type. But it then later says: rad_check_password: Found Auth-Type auth: type Local and then fails because of no User-Password or CHAP-Password attribute. If I set the Auth-Type in the 'users' file, then I get: ===================================================================== rad_recv: Access-Request packet from host 127.0.0.1:33137, id=21, length=149 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "bob" MS-CHAP-Challenge = 0xdc450c11091700477a0d759da792a0a7 MS-CHAP2-Response = 0x8f007bdfb77f958d304d40526eabbcb6cfdf0000000000000000d16a13d382097bbc5cfb8d41468f6422ee9eff3f038f9eab Calling-Station-Id = "141.163.60.7" NAS-IP-Address = 141.163.199.250 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry bob at line 8 modcall[authorize]: module "files" returns ok for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "bob", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "bob" rlm_realm: Proxying request from user bob to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 WARNING: You set Proxy-To-Realm = LOCAL, but it is a LOCAL realm! Cancelling invalid proxy request. rad_check_password: Found Auth-Type MSCHAP auth: type "mschap" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_mschap: Told to do MS-CHAPv2 for bob with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 0 modcall: leaving group authenticate (returns ok) for request 0 Login OK: [bob] (from client localhost port 0 cli 141.163.60.7) WARNING: Cancelling proxy to Realm LOCAL, as the realm is local. Sending Access-Accept of id 21 to 127.0.0.1 port 33137 MS-CHAP2-Success = 0x8f533d31334430304342353844313130454643343131313043333241424237434145394236454443454531 MS-MPPE-Recv-Key = 0x273434105c0ed9fc6e57a499d5abffee MS-MPPE-Send-Key = 0x98eed82e84689dc22315e6d3d83733f8 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 Finished request 0 ===================================================================== As can be seen the Auth-Type in the users file is seen and rlm_mschap now does the right thing: rlm_mschap: Told to do MS-CHAPv2 for bob with NT-Password In the radiusd.conf file, which is basically the same from FR 1.0.1 to 1.1.6, the relevant (I hope) sections are: ===================================================================== modules { pap { auto_header = yes } $INCLUDE ${confdir}/eap.conf mschap { # - this line used in FR 1.0.1 authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } [ rest of modules section snipped ] authorize { preprocess eap files mschap suffix } authenticate { Auth-Type PAP { pap } mschap eap } ===================================================================== So my question is, does anyone have an explanation for this behaviour? Obviously it is great that our 'users' files entries work under FreeRadius 1.1.6 with only a minor change. However, since generally Auth-Type should not be required, it is a worry that we *have* to set it to get FR to work. Since the radiusd output shows that FR sees this is an MS-CHAP request, I would have thought it would handle it correctly. It doesn't, but instead treats it as a 'Local' type request. Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

4 8

ttls problem
by tevfik 11 May '07

11 May '07

Hi. I have problems with performing authentication with freeradius. When I use the command: radtest tkiziloren password ldap.anaadolu.edu 10 testing123 i get the message below: rad_recv: Access-accepted... However when i try to perform same task by using securew2 on XP client, it always shows "attempting to authenticate", I pasted the debug results or radiusd below: I am new to freeradius. Could anybody help me where the problem is?. Is there a problem with certificate? (I use cisco aironet 1200 AP) Thanks in advance. Tevfik Kızılören. rad_recv: Access-Request packet from host 10.10.7.203:1645, id=0, length=148 User-Name = "tkiziloren" Framed-MTU = 1400 Called-Station-Id = "0017.0e85.f190" Calling-Station-Id = "0011.2fb9.d08b" Service-Type = Login-User Message-Authenticator = 0xfcbf4e4b477d844b3826ae784cd6977e EAP-Message = 0x020400061500 NAS-Port-Type = Wireless-802.11 NAS-Port = 675 State = 0x74d2bac8b603cafd625c55c0992b70ba NAS-IP-Address = 10.10.7.203 NAS-Identifier = "testbum" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 0 to 10.10.7.203 port 1645 EAP-Message = 0x0105024e1580000006445504061302545231123010060355040813095452416e61646f6c75311b3019060355040a1312416e61646f6c7520556e6976657273697479310d300b060355040b13044241554d311c301a060355040313136c6461702e616e61646f6c752e6564752e74723122302006092a864886f70d01090116136c64617040616e61646f6c752e6564752e747230819f300d06092a864886f70d010101050003818d0030818902818100f87fe052d754f4586d4e311ea15bb54cd7bbe1e505e648171bfa44c6a1523906cc31d776e4a8113dd3f002e7ddd43868af03076e0f4c57c6791845adc2f7732d909e58267dc127244ebe656f95 EAP-Message = 0xf53a09222a4a3451369f97a04391610dc4b77848268d41b7f9bc37f04654d00abdc0ee376c8aad064e5ac5a5a1595bffeea9b30203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041450fd81eacea4e2d3d18547e154bc515d08630096301f0603551d2304183016801450fd81eacea4e2d3d18547e154bc515d08630096300d06092a864886f70d01010505000381810092f44ed2dade447e098f90432e2a2b58d93139471c0b41d3bbdebf1c2d09e321b43bbe2faad7d8c60e6642f5b6c2746fbb4be07033 EAP-Message = 0x4b77db5093871b2203bf2271cb97b98cc169c03f4f67d7a01261d971dfddc176cce3a42e1dd1e37037060a528db7e8481722e222549b882a93cfa582a29df0f1b401a28e197772410a1f1016030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9d3c9b53656089b1510d55b3a1f50a33 Finished request 6 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 6 ID 0 with timestamp 46421b1a Cleaning up request 4 ID 254 with timestamp 46421b1a Cleaning up request 5 ID 255 with timestamp 46421b1a Nothing to do. Sleeping until we see a request. -- View this message in context: http://www.nabble.com/ttls-problem-tf3717596.html#a10400374 Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 21

LDAP/RACF authentication error
by Marc Giuliani 11 May '07

11 May '07

Hello, I am try to set up authentication for Oracle 10g (on Solaris) --> Radius (on Solaris)--> LDAP (on Z/os) --> Racf (on z/os)... i was able to get past my last error however now I am getting a "no authentication method found" type of error. Can anyone assist me? I have checked that the secret password matches on the LDAP server, radius server and Oracle... rad_recv: Access-Request packet from host 10.71.175.19:37544, id=178, length=47 User-Name = "NBCTST1" User-Password = "/\265P\251R\344>%P\2022\0144\0165p" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/opt/local/var/log/radius/radacct/10.71.175.19/auth-detail-20070511' rlm_detail: /opt/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /opt/local/var/log/radius/radacct/10.71.175.19/auth-detail-20070511 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "NBCTST1", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [NBCTST1//\265P\251R\344>%P\2022\0144\0165p] (from client test1 port 0) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 1 for 1 seconds

1 0

TTLS working. Is it secure?
by tevfik 11 May '07

11 May '07

Hi, I was able to configure radius server, users can connect after entering user credentials. However I am not sure whether the configuration fully correct or not. In below, I pasted my radius daemon logs for only one authentication process. Entered username was true and password was false. Why there are 4 request for only one authentication process? What is wrong with it? What does "rlm_ldap: user tkiziloren authorized to use remote access" mean? The password is not true how can a user authorized although his/her password is false. Thanks in advance. Tevfik. rad_recv: Access-Request packet from host 10.10.7.203:1645, id=11, length=139 User-Name = "tkiziloren" Framed-MTU = 1400 Called-Station-Id = "0017.0e85.f190" Calling-Station-Id = "0011.2fb9.d08b" Service-Type = Login-User Message-Authenticator = 0x46e9a61e176eb2fad26f1f689c9edc79 EAP-Message = 0x0202000f01746b697a696c6f72656e NAS-Port-Type = Wireless-802.11 NAS-Port = 260 NAS-IP-Address = 10.10.7.203 NAS-Identifier = "testbaum" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.anadolu.edu.tr:389, authentication 0 rlm_ldap: bind as / to ldap.anadolu.edu.tr:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 11 to 10.10.7.203 port 1645 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbe88ae73ff01db2d490c7144a376c659 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.7.203:1645, id=12, length=202 User-Name = "tkiziloren" Framed-MTU = 1400 Called-Station-Id = "0017.0e85.f190" Calling-Station-Id = "0011.2fb9.d08b" Service-Type = Login-User Message-Authenticator = 0x1c053c94b8fa5bc90c998ed9517b8a7c EAP-Message = 0x0203003c158000000032160301002d0100002903014a5bc504f836fec860348fb73185a7cc772a9bdf5f440445d0eaedbc8e8ffa77000002000a0100 NAS-Port-Type = Wireless-802.11 NAS-Port = 260 State = 0xbe88ae73ff01db2d490c7144a376c659 NAS-IP-Address = 10.10.7.203 NAS-Identifier = "testbaum" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 60 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 002d], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 05e7], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 12 to 10.10.7.203 port 1645 EAP-Message = 0x0104040a15c000000644160301004a02000046030146446335adedcee21b0f7d388612e4511b161a05d7f60d50d05c530f0fbb556120d89b7e2fff61268e1088096ae7e5496aa5a0fc9da67f65c7f65e1d792a44f208000a0016030105e70b0005e30005e00002c5308202c13082022aa003020102020101300d06092a864886f70d010105050030818f310b300906035504061302545231123010060355040813095452416e61646f6c75311b3019060355040a1312416e61646f6c7520556e6976657273697479310d300b060355040b13044241554d311c301a060355040313136c6461702e616e61646f6c752e6564752e74723122302006092a86 EAP-Message = 0x4886f70d01090116136c64617040616e61646f6c752e6564752e7472301e170d3037303530383130333833325a170d3038303530373130333833325a3081a3310b300906035504061302545231123010060355040813095452416e61646f6c75311230100603550407130945736b697365686972311b3019060355040a1312416e61646f6c7520556e6976657273697479310d300b060355040b13044241554d311c301a060355040313136c6461702e616e61646f6c752e6564752e74723122302006092a864886f70d01090116136c64617040616e61646f6c752e6564752e747230819f300d06092a864886f70d010101050003818d003081890281 EAP-Message = 0x8100aa7e832714838afb5c85df7c60afaf107142a9e077659f216e0b0cee26180413d2ce23bd4551cb0e7243dbae482db8757502159b52b08f8776b1fef8110ea8798dc7bd0db591296d73e37cad9a07ad8b1c1db6360104861ae0405cab03544b1ae33633df6a5403c79bdde9ab57ed2dcfe191f5f34418b555c953351acc461ce70203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181003c0a0c3e188348ce41725b4c062f8a8570a1bf407bb6ee3504b9df6a18e935fe2f8792c914c2eabadd85e6ea701ec99443a06e436152b7b9fd413cf44fbd09db68cdf3879c76ea673153 EAP-Message = 0xb8adc112064df7b8369c796d37251577569523b465b686408649adbb9f9006148c9e8df035dec411681b9365b9d317f44efd89b9b42b000315308203113082027aa003020102020100300d06092a864886f70d010105050030818f310b300906035504061302545231123010060355040813095452416e61646f6c75311b3019060355040a1312416e61646f6c7520556e6976657273697479310d300b060355040b13044241554d311c301a060355040313136c6461702e616e61646f6c752e6564752e74723122302006092a864886f70d01090116136c64617040616e61646f6c752e6564752e7472301e170d3037303530383130333734345a170d EAP-Message = 0x3130303530373130333734345a30818f310b30090603 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdc75d5eda4e0cae9d79bba28bc969a70 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.7.203:1645, id=13, length=148 User-Name = "tkiziloren" Framed-MTU = 1400 Called-Station-Id = "0017.0e85.f190" Calling-Station-Id = "0011.2fb9.d08b" Service-Type = Login-User Message-Authenticator = 0x94a629eda2e1b020387e4292f0195afb EAP-Message = 0x020400061500 NAS-Port-Type = Wireless-802.11 NAS-Port = 260 State = 0xdc75d5eda4e0cae9d79bba28bc969a70 NAS-IP-Address = 10.10.7.203 NAS-Identifier = "testbaum" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 13 to 10.10.7.203 port 1645 EAP-Message = 0x0105024e1580000006445504061302545231123010060355040813095452416e61646f6c75311b3019060355040a1312416e61646f6c7520556e6976657273697479310d300b060355040b13044241554d311c301a060355040313136c6461702e616e61646f6c752e6564752e74723122302006092a864886f70d01090116136c64617040616e61646f6c752e6564752e747230819f300d06092a864886f70d010101050003818d0030818902818100f87fe052d754f4586d4e311ea15bb54cd7bbe1e505e648171bfa44c6a1523906cc31d776e4a8113dd3f002e7ddd43868af03076e0f4c57c6791845adc2f7732d909e58267dc127244ebe656f95 EAP-Message = 0xf53a09222a4a3451369f97a04391610dc4b77848268d41b7f9bc37f04654d00abdc0ee376c8aad064e5ac5a5a1595bffeea9b30203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041450fd81eacea4e2d3d18547e154bc515d08630096301f0603551d2304183016801450fd81eacea4e2d3d18547e154bc515d08630096300d06092a864886f70d01010505000381810092f44ed2dade447e098f90432e2a2b58d93139471c0b41d3bbdebf1c2d09e321b43bbe2faad7d8c60e6642f5b6c2746fbb4be07033 EAP-Message = 0x4b77db5093871b2203bf2271cb97b98cc169c03f4f67d7a01261d971dfddc176cce3a42e1dd1e37037060a528db7e8481722e222549b882a93cfa582a29df0f1b401a28e197772410a1f1016030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x601d05b1669ab2bed2334dbb4dbe4d93 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.7.203:1645, id=14, length=342 User-Name = "tkiziloren" Framed-MTU = 1400 Called-Station-Id = "0017.0e85.f190" Calling-Station-Id = "0011.2fb9.d08b" Service-Type = Login-User Message-Authenticator = 0xd740350b53fca08d4001aed5cb55bdd5 EAP-Message = 0x020500c81580000000be1603010086100000820080989a4f4fef1e07bdc30e36fef2b9fa53649b34891e3af4981558eff851af2c16e31edfadd788ed4caa1d9dd75fec547af24d81a30e3322652f9b3c6cf57c9e5638979da52036cc0d84e3671e2cd0e60c20c322c485f9d4893ed9a3202c3af09dae9c0f79d2a2a4a28838920c2a20dcfe9080af2e72ae3e3d4bab2353ca2dd2321403010001011603010028e030b00731ce0c04645a08c8b19879ac634ccc7264530fe9242eefa8c94c712d7f2b1f6194a2b777 NAS-Port-Type = Wireless-802.11 NAS-Port = 260 State = 0x601d05b1669ab2bed2334dbb4dbe4d93 NAS-IP-Address = 10.10.7.203 NAS-Identifier = "testbaum" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 200 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 14 to 10.10.7.203 port 1645 EAP-Message = 0x0106003d15800000003314030100010116030100281527d07e80080ef64fd3fc412609c08d94edb977645467e3ffb76ef7f04fc2cca1a0f8d6834de619 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x596d167bc9c74853ae5bd540423f3b81 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.7.203:1645, id=15, length=221 User-Name = "tkiziloren" Framed-MTU = 1400 Called-Station-Id = "0017.0e85.f190" Calling-Station-Id = "0011.2fb9.d08b" Service-Type = Login-User Message-Authenticator = 0x853240c191a67fa8675d6ccc5cd4abc3 EAP-Message = 0x0206004f1580000000451703010040cf6a442a8eef8f67c64a243cfc035a468d8b995f900af8238341332e934fc5adf057972e7723fdb6baa8a96d50184bc4ac3397ddd2963033bd8dd2ef5d184328 NAS-Port-Type = Wireless-802.11 NAS-Port = 260 State = 0x596d167bc9c74853ae5bd540423f3b81 NAS-IP-Address = 10.10.7.203 NAS-Identifier = "testbaum" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 79 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "tkiziloren", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 29 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for tkiziloren radius_xlat: '(uid=tkiziloren)' radius_xlat: 'ou=people,dc=anadolu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=anadolu,dc=edu,dc=tr, with filter (uid=tkiziloren) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tkiziloren authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 4 modcall: leaving group authorize (returns ok) for request 4 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 4 rlm_ldap: - authenticate rlm_ldap: login attempt by "tkiziloren" with password "egermen" rlm_ldap: user DN: uid=tkiziloren,ou=people,dc=anadolu,dc=edu,dc=tr rlm_ldap: (re)connect to ldap.anadolu.edu.tr:389, authentication 1 rlm_ldap: bind as uid=tkiziloren,ou=people,dc=anadolu,dc=edu,dc=tr/egermen to ldap.anadolu.edu.tr:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials rlm_ldap: modcall[authenticate]: module "ldap_1x" returns reject for request 4 modcall: leaving group LDAP (returns reject) for request 4 auth: Failed to validate the user. TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 4 modcall: leaving group authenticate (returns invalid) for request 4 auth: Failed to validate the user. Delaying request 4 for 1 seconds Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 15 to 10.10.7.203 port 1645 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 11 with timestamp 46446335 Cleaning up request 1 ID 12 with timestamp 46446335 Cleaning up request 2 ID 13 with timestamp 46446335 Cleaning up request 3 ID 14 with timestamp 46446335 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 15 with timestamp 46446336 Nothing to do. Sleeping until we see a request. -- View this message in context: http://www.nabble.com/TTLS-working.-Is-it-secure--tf3727367.html#a10431721 Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 4

Re: free radius 1.1.6 -eap-tls authentication
by anoop_c＠sifycorp.com 11 May '07

11 May '07

Dear all Thank you for the responses I am using openssl tool for certificate generation.I have inclided the file xpextensions while generating certificates.The same certificates worked well with Navis radius server and windows xp as client.So this may not be the problem here Anoop hi, how did you generate your certificates? alan They also say this: \"The most common problem with PEAP is that the client sends a series of Access-Request messages, the server sends an series of Access-Challenge responses, and then... nothing happens. After a little wait, it all starts again. If you see this happening STOP! The RAIDUS server certificate has to have special OID\'s in it, or else the Microsoft clients will silently fail. etc.\" There we messages yesterday on this list describing this exact problem, and how to fix it. The file \"eap.conf\" describes this problem and how to fix it. The FAQ says what to do when PEAP or EAP-TLS doesn\'t work with a Windows client. Regards Anoop

2 1