- Freeradius-Users - lists.freeradius.org

Re: Re: The server will carry local authentication first, despite ofproxying or not, is this correct?
by LinHai 16 Apr '07

16 Apr '07

Hi, >The server will not perform authentication before proxying. Read the >debug log you posted to the list. But in debug log, rlm_sql (sql) , I found 4 sql query has been carried. These sql query should not be performed for optimizing reason, I think. >The server *will* process the request through some modules before >proxying. If that is not "supposed" to happen, please explain how the >server can proxy the request without doing *some* processing of it. Maybe we can perform a judgement first,if the server should proxy the request,then send it to home server directly. = = = = = = = = = = = = = = = = = = = = 　　　　　　　　致礼！　　　　　　　　LinHai 　　　　　　　　lh(a)mail.tzptt.zj.cn 　　　　　　　　　　2007-04-16

1 0

Re: The server will carry local authentication first, despite of proxying or not, is this correct?
by Alan DeKok 16 Apr '07

16 Apr '07

LinHai wrote: > In radiusd.c, function "int rad_respond(REQUEST *request, RAD_REQUEST_FUNP fun)", I found such problem: > If a AUTHENTICATION_REQUEST or ACCOUNTING_REQUEST packet is received, the server will first carry the operation > (ex. authentication) itself, then send proxy request to home server, despite of proxying or not. The server will not perform authentication before proxying. Read the debug log you posted to the list. The server *will* process the request through some modules before proxying. If that is not "supposed" to happen, please explain how the server can proxy the request without doing *some* processing of it. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

The server will carry local authentication first, despite of proxying or not, is this correct?
by LinHai 16 Apr '07

16 Apr '07

Hi all: In radiusd.c, function "int rad_respond(REQUEST *request, RAD_REQUEST_FUNP fun)", I found such problem: If a AUTHENTICATION_REQUEST or ACCOUNTING_REQUEST packet is received, the server will first carry the operation (ex. authentication) itself, then send proxy request to home server, despite of proxying or not. For example, home server is 61.191.145.206,port 1645, with realm "serv.com", I test in local server: "./radtest test(a)serv.com test localhost 12 testing123", we can find that in local server, an authentication operation is carried before proxying to home sever 61.191.145.206, which is not needed at all. Is the behaviour correct? Thanks for reply! rad_recv: Access-Request packet from host 127.0.0.1:39969, id=17, length=65 User-Name = "test(a)serv.com" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 12 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "serv.com" for User-Name = "test(a)serv.com" rlm_realm: Found realm "serv.com" rlm_realm: Adding Stripped-User-Name = "test" rlm_realm: Proxying request from user test to realm serv.com rlm_realm: Adding Realm = "serv.com" rlm_realm: Preparing to proxy authentication request to realm "serv.com" modcall[authorize]: module "suffix" returns updated for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'test(a)serv.com' rlm_sql (sql): sql_set_user escaped user --> 'test(a)serv.com' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test(a)serv.com' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Att ribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test(a)serv.com' AND usergroup.GroupName = radgroupcheck.Gro upName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test(a)serv.com' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Att ribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test(a)serv.com' AND usergroup.GroupName = radgroupreply.Gro upName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 Sending Access-Request of id 0 to 61.191.145.206 port 1645 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 12 Proxy-State = 0x3137 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:39969, id=17, length=65 Ignoring duplicate packet from client localhost:39969 - ID: 17, due to outstandi ng proxied request 0. --- Walking the entire request list --- Waking up in 3 seconds... 　　　　　　　　LinHai 　　　　　　　　lh(a)mail.tzptt.zj.cn 　　　　　　　　　　2007-04-16

1 0

unsubscribe
by Bin Chen 16 Apr '07

16 Apr '07

unsubscribe

1 0

access-accept with exception
by Wael ELLOUZE 15 Apr '07

15 Apr '07

Hello, My freeradius verify the login, password and all other attributes. My question is : Is it possible to access-accept all authentication that come with the attribute called-station-id=1111 and how to do this exception Thanks in advance for your reply.

2 1

WEP only client
by Ian Truelsen 15 Apr '07

15 Apr '07

I have a client whose wifi adaptor (Linksys WUSB11) can only do wep key encryption and I was wondering whether it would be possible to use eap-tls or something similar given the restrictions. What is the most secure system that can be used with this type of adaptor? -- Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com AIM: ihtruelsen MSN: ihtruelsen(a)hotmail.com Google Talk: ian.truelsen(a)gmail.com

4 4

glibc double free or corruption still happening
by Roberto Greiner 14 Apr '07

14 Apr '07

Hi, I've installed FreeRadius 1.1.6 to my Debian Etch box, trying to solve the 'glibc double free or corruption', but the error is still happening. To make sure that no old library was causing the problem, I searched for any file and folder which could be from the old freeradius (using locate *radiu* and updatedb, it until no file was to be found). Then I recompiled everything and reinstalled. The problem persisted. Could I have missed some library with the locate I used? Is there a better way to uninstall everything for the upgrade? Any other Ideas? Thank you, Roberto Greiner PS: The Radius -X output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 0 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib *** glibc detected *** double free or corruption (fasttop): 0x800fbcc8 *** Aborted -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------

5 9

Problem when executing radiusd
by BOQUET Stephanie 14 Apr '07

14 Apr '07

Hi, when I execute radiusd, it ends with "Abandon" : a "**** glibc detected ***** radiusd : double free or corruption" error occured. Thanks for helping me ! Stephanie

4 3

online users
by Mordor Networks 14 Apr '07

14 Apr '07

i want to know how many user logged in mysql database/radius but it only show the number of user in my databse for example is says 61 logged out and 0 login so here is the problem //login users from// $login_users = ; < what i have to write here ? which table i have to query? how i can fix that ? if i change the number from 0 to 1 it show me one user online so their must be a way to fix it? heres the code : <?php include ("include/Artichow/class/jpgraph.php"); include ("include/Artichow/class/jpgraph_pie.php"); include ("include/Artichow/class/jpgraph_pie3d.php"); include_once ("class/Oreon.class.php"); include_once ("phpradmin.conf.php"); $oreon_db = new OreonDatabase($conf_pra["host"], $conf_pra["user"], $conf_pra["password"], $conf_pra["db"]); $table = "userinfo"; //este si es valido $total_users_in_db = $oreon_db ->getTotalRowsInTable($table); //$total_users_in_db = 500; //login users from DB (SELECT COUNT(*) FROM radacct??;) $login_users = ; //logoff users total_users_in_db - login_users $logoff_users = ($total_users_in_db - $login_users); //percent $percent_login = ($login_users * 100 / $total_users_in_db); $percent_logoff = ( 100 - $percent_login ); $data = array($percent_login,$percent_logoff); //$data = array(12,88); $graph = new PieGraph(350,170,"auto"); $graph->SetShadow(); //$graph->title->Set( $lang['pra_total_users_in_db']":" $total_users_in_db); $graph->title->Set("Total users in Data Base: $total_users_in_db"); $graph->title->SetFont(FF_FONT1,FS_BOLD); $p1 = new PiePlot3D($data); $p1->ExplodeSlice( 1); $p1->SetLabelType( "PIE_VALUE_ABS"); $p1->SetSize(0.40); $p1->SetCenter(0.33); $p1->SetSliceColors(array('green','blue')); $p1->setLegends(array( "LogIN Users: $login_users", "LogOUT Users: $logoff_users", )); $graph->Add($p1); $graph->Stroke(); ?>

5 7

Re: Re : EAP/TTLS PEAP MSCHAP
by Arran Cudbard-Bell 13 Apr '07

13 Apr '07

Eshun Benjamin wrote: > Hello Arran, Which specific OID? I also think it has to do with the > certificate. Could you please be specific if possible with example. I > trried to use another certificate and I am getting 2 issues; > 1. is before access challenge ; > > Wed Apr 4 21:33:09 2007 : Debug: modsingle[authorize]: returned > from suffix (rlm_realm) for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modcall[authorize]: module > "suffix" returns noop for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modsingle[authorize]: calling eap > (rlm_eap) for request 2 > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap: EAP packet type response > id 2 length 192 > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap: No EAP Start, assuming > it's an on-going EAP conversation > Wed Apr 4 21:33:09 2007 : Debug: modsingle[authorize]: returned > from eap (rlm_eap) for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modcall[authorize]: module "eap" > returns updated for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modsingle[authorize]: calling > files (rlm_files) for request 2 > Wed Apr 4 21:33:09 2007 : Debug: users: Matched entry DEFAULT at > line 225 > Wed Apr 4 21:33:09 2007 : Debug: modsingle[authorize]: returned > from files (rlm_files) for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modcall[authorize]: module "files" > returns ok for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modsingle[authorize]: calling > etc_smbpasswd (rlm_passwd) for request 2 > Wed Apr 4 21:33:09 2007 : Debug: rlm_passwd: Added LM-Password: > '739EA6CD54DF1680AAD3B435B51404EE' to config_items > Wed Apr 4 21:33:09 2007 : Debug: rlm_passwd: Added NT-Password: > 'F138C6624B18D0E17EA9630C746A8202' to config_items > Wed Apr 4 21:33:09 2007 : Debug: rlm_passwd: Added > SMB-Account-CTRL-TEXT: '[UX ]' to config_items > Wed Apr 4 21:33:09 2007 : Info: rlm_passwd: Adding "Auth-Type = MS-CHAP" > Wed Apr 4 21:33:09 2007 : Debug: modsingle[authorize]: returned > from etc_smbpasswd (rlm_passwd) for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modcall[authorize]: module > "etc_smbpasswd" returns ok for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modsingle[authorize]: calling pap > (rlm_pap) for request 2 > Wed Apr 4 21:33:09 2007 : Debug: rlm_pap: Normalizing LM-Password > from hex encoding > Wed Apr 4 21:33:09 2007 : Debug: rlm_pap: Normalizing NT-Password > from hex encoding > Wed Apr 4 21:33:09 2007 : Debug: rlm_pap: Found existing Auth-Type, > not changing it. > Wed Apr 4 21:33:09 2007 : Debug: modsingle[authorize]: returned > from pap (rlm_pap) for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modcall[authorize]: module "pap" > returns noop for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modcall: leaving group authorize > (returns updated) for request 2 > Wed Apr 4 21:33:09 2007 : Debug: rad_check_password: Found > Auth-Type EAP > Wed Apr 4 21:33:09 2007 : Debug: auth: type "EAP" > Wed Apr 4 21:33:09 2007 : Debug: Processing the authenticate > section of radiusd.conf > Wed Apr 4 21:33:09 2007 : Debug: modcall: entering group authenticate > for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modsingle[authenticate]: calling > eap (rlm_eap) for request 2 > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap: Request found, released > from the list > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap: EAP/peap > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap: processing type peap > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap_peap: Authenticate > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap_tls: processing TLS > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap_tls: Length Included > Wed Apr 4 21:33:09 2007 : Debug: eaptls_verify returned 11 > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake > [length 0086], ClientKeyExchange > Wed Apr 4 21:33:09 2007 : Debug: TLS_accept: SSLv3 read client > key exchange A > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap_tls: <<< TLS 1.0 > ChangeCipherSpec [length 0001] > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake > [length 0010], Finished > Wed Apr 4 21:33:09 2007 : Debug: TLS_accept: SSLv3 read finished A > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap_tls: >>> TLS 1.0 > ChangeCipherSpec [length 0001] > Wed Apr 4 21:33:09 2007 : Debug: TLS_accept: SSLv3 write change > cipher spec A > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake > [length 0010], Finished > Wed Apr 4 21:33:09 2007 : Debug: TLS_accept: SSLv3 write finished A > Wed Apr 4 21:33:09 2007 : Debug: TLS_accept: SSLv3 flush data > Wed Apr 4 21:33:09 2007 : Debug: (other): SSL negotiation > finished successfully > Wed Apr 4 21:33:09 2007 : Error: rlm_eap: SSL error > error:00000000:lib(0):func(0):reason(0) > Wed Apr 4 21:33:09 2007 : Debug: SSL Connection Established > Wed Apr 4 21:33:09 2007 : Debug: eaptls_process returned 13 > Wed Apr 4 21:33:09 2007 : Debug: rlm_eap_peap: EAPTLS_HANDLED > Wed Apr 4 21:33:09 2007 : Debug: modsingle[authenticate]: returned > from eap (rlm_eap) for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modcall[authenticate]: module > "eap" returns handled for request 2 > Wed Apr 4 21:33:09 2007 : Debug: modcall: leaving group authenticate > (returns handled) for request 2 > > 2. Then during access challenge; some access denied errors. > > Wed Apr 4 21:21:48 2007 : Debug: eaptls_verify returned 11 > Wed Apr 4 21:21:48 2007 : Debug: eaptls_process returned 7 > Wed Apr 4 21:21:48 2007 : Debug: rlm_eap_peap: EAPTLS_OK > Wed Apr 4 21:21:48 2007 : Debug: rlm_eap_peap: Session > established. Decoding tunneled attributes. > Wed Apr 4 21:21:48 2007 : Debug: rlm_eap_tls: <<< TLS 1.0 Alert > [length 0002], fatal access_denied > Wed Apr 4 21:21:48 2007 : Error: TLS Alert read:fatal:access denied > Wed Apr 4 21:21:48 2007 : Info: rlm_eap_peap: No data inside of the > tunnel. > Wed Apr 4 21:21:48 2007 : Debug: rlm_eap: Handler failed in EAP/peap > Wed Apr 4 21:21:48 2007 : Debug: rlm_eap: Failed in EAP select > Wed Apr 4 21:21:48 2007 : Debug: modsingle[authenticate]: returned > from eap (rlm_eap) for request 11 > Wed Apr 4 21:21:48 2007 : Debug: modcall[authenticate]: module > "eap" returns invalid for request 11 > Wed Apr 4 21:21:48 2007 : Debug: modcall: leaving group authenticate > (returns invalid) for request 11 > Wed Apr 4 21:21:48 2007 : Debug: auth: Failed to validate the user. > Wed Apr 4 21:21:48 2007 : Debug: Delaying request 11 for 1 seconds > Wed Apr 4 21:21:48 2007 : Debug: Finished request 11 > Wed Apr 4 21:21:48 2007 : Debug: Going to the next request > Wed Apr 4 21:21:48 2007 : Debug: rl_next: returning NULL > Wed Apr 4 21:21:48 2007 : Debug: Waking up in 6 seconds... > Wed Apr 4 21:21:54 2007 : Debug: --- Walking the entire request list --- > Sending Access-Reject of id 0 to 10.1.5.26 port 2048 > > > ================================================== > > Benjamin K. Eshun > > > ----- Message d'origine ---- > De : Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> > À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Envoyé le : Mercredi, 4 Avril 2007, 19h51mn 45s > Objet : Re: EAP/TTLS PEAP MSCHAP > > Eshun Benjamin wrote: > > Mac connects but ms windows does not. I am doing server side cert. > > Error from ms windows. > > > > > > User-Name = "testgeneral" > > NAS-IP-Address = 10.1.5.26 > > Called-Station-Id = "0016014d9158" > > Calling-Station-Id = "0019e3034ceb" > > NAS-Identifier = "0016014d9158" > > NAS-Port = 36 > > Framed-MTU = 1400 > > State = 0x3d946123f5f422f576bed1eb52863e55 > > NAS-Port-Type = Wireless-802.11 > > EAP-Message = > > > 0x0202005019800000004616030100410100003d030146139aedbfdec7d57168bf7fdbe984cfd19f5d1e7c13ee839e4b0a55d34aa86600001600040005000a000900640062000300060013001200630100 > > Message-Authenticator = 0x3efce19c566f372e8744589f65d58401 > > Wed Apr 4 14:32:48 2007 : Debug: Processing the authorize section > > of radiusd.conf > > Wed Apr 4 14:32:48 2007 : Debug: modcall: entering group authorize > > for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling > > preprocess (rlm_preprocess) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from preprocess (rlm_preprocess) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module > > "preprocess" returns ok for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling > > mschap (rlm_mschap) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from mschap (rlm_mschap) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module > > "mschap" returns noop for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling > > suffix (rlm_realm) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: rlm_realm: No '@' in User-Name = > > "testgeneral", looking up realm NULL > > Wed Apr 4 14:32:48 2007 : Debug: rlm_realm: No such realm "NULL" > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from suffix (rlm_realm) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module > > "suffix" returns noop for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling eap > > (rlm_eap) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap: EAP packet type response > > id 2 length 80 > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap: No EAP Start, assuming > > it's an on-going EAP conversation > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from eap (rlm_eap) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module "eap" > > returns updated for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling > > files (rlm_files) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: users: Matched entry testgeneral > > at line 216 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from files (rlm_files) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module "files" > > returns ok for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling > > etc_smbpasswd (rlm_passwd) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from etc_smbpasswd (rlm_passwd) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module > > "etc_smbpasswd" returns notfound for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling pap > > (rlm_pap) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: rlm_pap: Found existing Auth-Type, > > not changing it. > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from pap (rlm_pap) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module "pap" > > returns noop for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modcall: leaving group authorize > > (returns updated) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: rad_check_password: Found > > Auth-Type EAP > > Wed Apr 4 14:32:48 2007 : Debug: auth: type "EAP" > > Wed Apr 4 14:32:48 2007 : Debug: Processing the authenticate > > section of radiusd.conf > > Wed Apr 4 14:32:48 2007 : Debug: modcall: entering group authenticate > > for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authenticate]: calling > > eap (rlm_eap) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap: Request found, released > > from the list > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap: EAP/peap > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap: processing type peap > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_peap: Authenticate > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_tls: processing TLS > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_tls: Length Included > > Wed Apr 4 14:32:48 2007 : Debug: eaptls_verify returned 11 > > Wed Apr 4 14:32:48 2007 : Debug: (other): before/accept > > initialization > > Wed Apr 4 14:32:48 2007 : Debug: TLS_accept: before/accept > > initialization > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake > > [length 0041], ClientHello > > Wed Apr 4 14:32:48 2007 : Debug: TLS_accept: SSLv3 read client > > hello A > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake > > [length 004a], ServerHello > > Wed Apr 4 14:32:48 2007 : Debug: TLS_accept: SSLv3 write server > > hello A > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake > > [length 038f], Certificate > > Wed Apr 4 14:32:48 2007 : Debug: TLS_accept: SSLv3 write > > certificate A > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake > > [length 0004], ServerHelloDone > > Wed Apr 4 14:32:48 2007 : Debug: TLS_accept: SSLv3 write server > > done A > > Wed Apr 4 14:32:48 2007 : Debug: TLS_accept: SSLv3 flush data > > Wed Apr 4 14:32:48 2007 : Error: TLS_accept:error in SSLv3 read > > client certificate A > > Wed Apr 4 14:32:48 2007 : Error: rlm_eap: SSL error > > error:00000000:lib(0):func(0):reason(0) > > Wed Apr 4 14:32:48 2007 : Debug: In SSL Handshake Phase > > Wed Apr 4 14:32:48 2007 : Debug: In SSL Accept mode > > Wed Apr 4 14:32:48 2007 : Debug: eaptls_process returned 13 > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_peap: EAPTLS_HANDLED > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authenticate]: returned > > from eap (rlm_eap) for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authenticate]: module > > "eap" returns handled for request 74 > > Wed Apr 4 14:32:48 2007 : Debug: modcall: leaving group authenticate > > (returns handled) for request 74 > > Sending Access-Challenge of id 0 to 10.1.5.26 port 2048 > > EAP-Message = > > > 0x010303f21900160301004a02000046030146139af0c3e704b47f4b6b436a8b07d916c60b21a951af6c2918a39cadca6aa22013971c62e79c9f9f6e232f6d035b7705438843f46c8e38f788750500db6621bf000400160301038f0b00038b00038800038530820381308202eaa003020102020900e8e427c494215d09300d06092a864886f70d0101050500308188310b30090603550406130244453110300e060355040813075361636873656e3110300e060355040713074472657364656e3110300e060355040a13074d50492d4342473111300f060355040b1308436f6d7075746572310f300d06035504031306736572766572311f301d06092a86 > > EAP-Message = > > > 0x4886f70d010901161061646d696e406d70692d6362672e6465301e170d3037303332343131313731395a170d3130303332333131313731395a308188310b30090603550406130244453110300e060355040813075361636873656e3110300e060355040713074472657364656e3110300e060355040a13074d50492d4342473111300f060355040b1308436f6d7075746572310f300d06035504031306736572766572311f301d06092a864886f70d010901161061646d696e406d70692d6362672e646530819f300d06092a864886f70d010101050003818d0030818902818100ac1158639bcdf711751f54bdf25c666d6f3a532967a7cba624a5167b > > EAP-Message = > > > 0xfb5c89d5a3f9d86fe9a7a2b0899925a4373725bed9eb20d41f05019541ee096201bb57b8f01646ac62884f36d54ea32620a11c760e769ace49d8d7dc42b3ba35c6d410b2fddbc2d689536f66646e94f594b516cb5b312f96f562529bcd7015540fd2be7d0203010001a381f03081ed301d0603551d0e041604141acd4d6d72dc026df7d0a5e77ea636e2c9bcfd4f3081bd0603551d230481b53081b280141acd4d6d72dc026df7d0a5e77ea636e2c9bcfd4fa1818ea4818b308188310b30090603550406130244453110300e060355040813075361636873656e3110300e060355040713074472657364656e3110300e060355040a13074d50492d4342 > > EAP-Message = > > > 0x473111300f060355040b1308436f6d7075746572310f300d06035504031306736572766572311f301d06092a864886f70d010901161061646d696e406d70692d6362672e6465820900e8e427c494215d09300c0603551d13040530030101ff300d06092a864886f70d0101050500038181009e5e89fa8a5e26ce9710bfde499a2b36d412f5acff40b544eec4839a67b768e6a778a5b8d54c8ad8b3ec8f438e96e0740103cbdb3e64c751e722e2c3538dccac3a993b94824ba4e48ba40ebc5c7b37c5c6048616f3b10d7f3d4b23cd84cd1e3e4b318e75d4fcd637ee1b5f263cd4adb006a80f62639825f6fb1a284e254a89be16030100040e000000 > > Message-Authenticator = 0x00000000000000000000000000000000 > > State = 0x4e138cc588a831123b8c899c1e03c4fc > > Wed Apr 4 14:32:48 2007 : Debug: Finished request 74 > > Wed Apr 4 14:32:48 2007 : Debug: Going to the next request > > Wed Apr 4 14:32:48 2007 : Debug: rl_next: returning NULL > > Wed Apr 4 14:32:48 2007 : Debug: Waking up in 6 seconds... > > rad_recv: Access-Request packet from host 10.1.5.26:2048, id=0, > length=143 > > User-Name = "testgeneral" > > NAS-IP-Address = 10.1.5.26 > > Called-Station-Id = "0016014d9158" > > Calling-Station-Id = "0019e3034ceb" > > NAS-Identifier = "0016014d9158" > > NAS-Port = 36 > > Framed-MTU = 1400 > > State = 0x4e138cc588a831123b8c899c1e03c4fc > > NAS-Port-Type = Wireless-802.11 > > EAP-Message = 0x020300061900 > > Message-Authenticator = 0xf89ebcfef5ea8e2a15b9fc63884890df > > Wed Apr 4 14:32:48 2007 : Debug: Processing the authorize section > > of radiusd.conf > > Wed Apr 4 14:32:48 2007 : Debug: modcall: entering group authorize > > for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling > > preprocess (rlm_preprocess) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from preprocess (rlm_preprocess) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module > > "preprocess" returns ok for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling > > mschap (rlm_mschap) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from mschap (rlm_mschap) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module > > "mschap" returns noop for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling > > suffix (rlm_realm) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: rlm_realm: No '@' in User-Name = > > "testgeneral", looking up realm NULL > > Wed Apr 4 14:32:48 2007 : Debug: rlm_realm: No such realm "NULL" > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from suffix (rlm_realm) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module > > "suffix" returns noop for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling eap > > (rlm_eap) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap: EAP packet type response > > id 3 length 6 > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap: No EAP Start, assuming > > it's an on-going EAP conversation > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from eap (rlm_eap) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module "eap" > > returns updated for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling > > files (rlm_files) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: users: Matched entry testgeneral > > at line 216 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from files (rlm_files) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module "files" > > returns ok for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling > > etc_smbpasswd (rlm_passwd) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from etc_smbpasswd (rlm_passwd) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module > > "etc_smbpasswd" returns notfound for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: calling pap > > (rlm_pap) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: rlm_pap: Found existing Auth-Type, > > not changing it. > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authorize]: returned > > from pap (rlm_pap) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authorize]: module "pap" > > returns noop for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modcall: leaving group authorize > > (returns updated) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: rad_check_password: Found > > Auth-Type EAP > > Wed Apr 4 14:32:48 2007 : Debug: auth: type "EAP" > > Wed Apr 4 14:32:48 2007 : Debug: Processing the authenticate > > section of radiusd.conf > > Wed Apr 4 14:32:48 2007 : Debug: modcall: entering group authenticate > > for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authenticate]: calling > > eap (rlm_eap) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap: Request found, released > > from the list > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap: EAP/peap > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap: processing type peap > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_peap: Authenticate > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_tls: processing TLS > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_tls: Received EAP-TLS ACK > > message > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_tls: ack handshake > > fragment handler > > Wed Apr 4 14:32:48 2007 : Debug: eaptls_verify returned 1 > > Wed Apr 4 14:32:48 2007 : Debug: eaptls_process returned 13 > > Wed Apr 4 14:32:48 2007 : Debug: rlm_eap_peap: EAPTLS_HANDLED > > Wed Apr 4 14:32:48 2007 : Debug: modsingle[authenticate]: returned > > from eap (rlm_eap) for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modcall[authenticate]: module > > "eap" returns handled for request 75 > > Wed Apr 4 14:32:48 2007 : Debug: modcall: leaving group authenticate > > (returns handled) for request 75 > > > > > > ================================================== > > > > Benjamin K. Eshun > > > > > > Découvrez une nouvelle façon d'obtenir des réponses à toutes vos > > questions ! Profitez des connaissances, des opinions et des > > expériences des internautes sur Yahoo! Questions/Réponses > > <http://fr.rd.yahoo.com/evt=42054/*http://fr.answers.yahoo.com>. > > ------------------------------------------------------------------------ > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > Your sever side certificate needs to have special OIDS, which the peap > section of the eap.conf file warns you about. Windows will check that > these OIDS are present in the certificate sent from the server, if they > are not it will fail silently. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------------------------------------------------ > Découvrez une nouvelle façon d'obtenir des réponses à toutes vos > questions ! Profitez des connaissances, des opinions et des > expériences des internautes sur Yahoo! Questions/Réponses > <http://fr.rd.yahoo.com/evt=42054/*http://fr.answers.yahoo.com>. Ok, your trying to do EAP-TLS ? Looks like the client side is ok. Wed Apr 4 21:33:09 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Apr 4 21:33:09 2007 : Debug: SSL Connection Established I don't think that error is actually an error, note the lack of an error location ... But could someone please confirm this ... Wed Apr 4 21:21:48 2007 : Debug: rlm_eap_peap: Session established. Decoding tunneled attributes. Wed Apr 4 21:21:48 2007 : Debug: rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied Wed Apr 4 21:21:48 2007 : Error: TLS Alert read:fatal:access denied Wed Apr 4 21:21:48 2007 : Info: rlm_eap_peap: No data inside of the tunnel. This however is an error. This would be where windows is rejecting the server side certificate and so TLS negotiation is failing. I'm currently in the same situation, trying to generate a certificate with openssl containing the correct OID (object identifier) . According to the microsoft support article (http://support.microsoft.com/kb/814394/en-us) "The IAS or the VPN server computer certificate is configured with the Server Authentication purpose. The object identifier for Server Authentication is 1.3.6.1.5.5.7.3.1." But I have no idea how to add it to the certificate, if you find out please let me know :) Thanks, Arran

5 8