- Freeradius-Users - lists.freeradius.org

Authenticating user with FDS
by Hariharan R 11 Jul '06

11 Jul '06

Hi all, I am using FreeRADIUS1.1.1 with Fedora Directory server as a backend data store. Let us consider the scenario.. I have two servers, one is a mail server and another one is a proxy server. Both servers are configured to use RADIUS+FDS for user authentication. In FDS i have two organizational unit under root domain. For Ex; ou=mailusers,dc=example,dc=com ou=proxyusers,dc=example,dc=com In the 'raddb/radiusd.conf' file i specified the base domain as (In LDAP module) basedn = "dc=example,dc=com" So whenever a client request comes to the RADIUS server it will look for the username in FDS. The problem is, how the RADIUS will identify that whether the request is comes from the 'mail server' or from the 'proxy server'. Because for mailserver users i have to look in the "ou=mailusers,dc=example,dc=com" and for proxy users i have to look in the "ou=proxyusers,dc=example,dc=com". How i can change the LDAP basedn according to the request. Any one pls help me to solve this problem. If u have some other method to achieve my objective pls let me know. --- Regards, Hariharan.R

2 1

show logged in users
by Fretz Marco 10 Jul '06

10 Jul '06

hello anohter question: whats the best way to see which users are logged in? - reading out the pppoe router with snmp for active sessions - search for session ids with start but no stop event i want do the first one. becuase our routers are in isolated management network and i want access the router from our webinterface or some admin hosts.... can i be 100% sure that a user is logged in if there is no stop event? thanks and kind regards marco fretz

2 1

Windows XP keeps "verifying identity"
by Klaas De Craemer 10 Jul '06

10 Jul '06

Hello, I have been trying to set up an Access Point on a soekris-board for some days now, but I keep getting stuck. The certificates are all in place, Freeradius starts up nicely, hostapd seems to work... But the trouble starts in Windows XP SP2: When I try to associate with the AP, it keeps sitting in a "Attempting Verification"-loop. In my freeradius-window, the authentication messages keep scrolling by, but it seems like the Windows-client doesn't "listen" to them.... I am using freeradius 1.0.2 built from source on kernel 2.6.15 Below is some of the Radius-output ("radiusd -X -A") and some of that from hostapd: =================Freeradius====================== rad_recv: Access-Request packet from host 127.0.0.1:1026, id=74, length=245 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x026800500d800000004616030100410100003d030144afac86153ed083623ea17e4a82459787262b54cdb6eb6b33603567da79e78600001600040005000a000900640062000300060013001200630100 State = 0xe1ca3273104420e8f3fa797348da4fbf Message-Authenticator = 0xb662295a5ab68423baa41ed3e1976b0f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 74 modcall[authorize]: module "preprocess" returns ok for request 74 modcall[authorize]: module "chap" returns noop for request 74 modcall[authorize]: module "mschap" returns noop for request 74 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 74 rlm_eap: EAP packet type response id 104 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 74 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 74 modcall: group authorize returns updated for request 74 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 74 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 057b], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 006d], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 74 modcall: group authenticate returns handled for request 74 Sending Access-Challenge of id 74 to 127.0.0.1:1026 EAP-Message = 0x0169040a0dc000000641160301004a02000046030144afaba4db9800c241c6097bfa7eb313e6b163c2c1db2a249c781b6c7e2648f3206bb401df913de39db66c828301156e1d7429bfd2b70632a98e371577d7a57871000400160301057b0b00057700057400025930820255308201bea003020102020101300d06092a864886f70d0101040500305c310b3009060355040613024245310c300a0603550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d301e170d3036303730383039313133395a170d3037303730 EAP-Message = 0x383039313133395a306c310b3009060355040613024245310c300a0603550408130357564c310e300c060355040713055469656c74310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100af6bd5feb703ca2b30d6cecb02524a0fcb8bc364a2c2bc39400561629844d18a24c448656f1cf6964c9a064c82cc3616264e2419e073093ab7289e8688c656f652f8e4e63a9a54dd1492a5757df04bc0ecd4441868f158da2fdadcb4bd31a07243fe8bce413f7fbf85f0 EAP-Message = 0xd006ecbcd62019e26e8c58290e1fe1ccd2189e2c53450203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000381810052b4fd21f12d8d14ffd712d100fb12a3daa5e681a44b0e2dda3762829611171cfd8d5828a6f1db3216cce98190a1f6a110a66848e8b2846a2da6254a5a42ad21731004b858723fbf9651bdae4915d167ce8b8be8c9167ee7c78b1de730334035d321ceb8196873e73d8ae15c5e6d974d2cca62bff234a117561c16408e25bde9000315308203113082027aa003020102020100300d06092a864886f70d0101040500305c310b3009060355040613024245310c300a06 EAP-Message = 0x03550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d301e170d3036303730383039303733345a170d3039303730373039303733345a305c310b3009060355040613024245310c300a0603550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d0a45b7a7abbdc0330bec488c4e5e2fd56eb84f7066d6ce7 EAP-Message = 0xe6ef10a6f757b59a15da4694dc47dde72da145998c53 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7d981da6b6526a9fc3fe589ab7276e7a Finished request 74 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1026, id=75, length=171 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x026900060d00 State = 0x7d981da6b6526a9fc3fe589ab7276e7a Message-Authenticator = 0x212c160c65f716be783b7b5466fc4725 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 75 modcall[authorize]: module "preprocess" returns ok for request 75 modcall[authorize]: module "chap" returns noop for request 75 modcall[authorize]: module "mschap" returns noop for request 75 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 75 rlm_eap: EAP packet type response id 105 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 75 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 75 modcall: group authorize returns updated for request 75 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 75 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 75 modcall: group authenticate returns handled for request 75 Sending Access-Challenge of id 75 to 127.0.0.1:1026 EAP-Message = 0x016a024b0d8000000641a423ee3382420f826dd1bfb6cdba0e19a54627841829135284486abb171f2ead064a2b1d3f4261451d82ae9a04dd1b60d6339ec876e7347e33ed82ec712846ccc30bad864cfc8f6784de9ba4f08749a65f290203010001a381e23081df30090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041435ac18d86277eb69414cd999bf1b325fa98ea02d3081840603551d23047d307b801435ac18d86277eb69414cd999bf1b325fa98ea02da160a45e305c310b3009060355040613024245310c300a0603550408 EAP-Message = 0x130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d820100300d06092a864886f70d0101040500038181007127f79df3611d53c650b0ed7ee16008f75dc296a0e95db3d97cd80fc7328e1193408c582a40e9dd7b0bafad2dbc335f0be62f1c6e0cb604a686fe7114a8204986a4f93e91213c798add773cb9e2d2265991bef7d13b9c3f614e28a6c94b2f8ac412f1b3fbf5d29a1c771352cb430813a7c084797a1e98fbfb3c127794f38092160301006d0d0000650201020060005e305c310b3009060355040613024245310c EAP-Message = 0x300a0603550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6e48de8b1b13d264c089c9916447801f Finished request 75 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1026, id=76, length=171 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x026a00060d00 State = 0x6e48de8b1b13d264c089c9916447801f Message-Authenticator = 0xf29176423b6e75d12aacdfa951f33faf Processing the authorize section of radiusd.conf modcall: entering group authorize for request 76 modcall[authorize]: module "preprocess" returns ok for request 76 modcall[authorize]: module "chap" returns noop for request 76 modcall[authorize]: module "mschap" returns noop for request 76 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 76 rlm_eap: EAP packet type response id 106 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 76 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 76 modcall: group authorize returns updated for request 76 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 76 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 76 modcall: group authenticate returns handled for request 76 Sending Access-Challenge of id 76 to 127.0.0.1:1026 EAP-Message = 0x016b000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe62d35d365edc5eece99a281849cfdc8 Finished request 76 ===================hostapd======================= IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE DATA (TX callback) ACK IEEE 802.1X: 00:02:6f:3c:37:d8 TX status - version=1 type=0 length=587 - ack=1 DATA IEEE 802.1X: 10 bytes from 00:02:6f:3c:37:d8 IEEE 802.1X: version=1 type=0 length=6 EAP: code=2 identifier=131 length=6 (response) wlan0: STA 00:02:6f:3c:37:d8 IEEE 802.1X: received EAP packet (code=2 id=131 len=6) from STA: EAP Response-TLS (13) IEEE 802.1X: 00:02:6f:3c:37:d8 BE_AUTH entering state RESPONSE Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute wlan0: RADIUS Sending RADIUS message to authentication server wlan0: RADIUS Next RADIUS client retransmit in 3 seconds IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE wlan0: RADIUS Received 68 bytes from RADIUS server wlan0: RADIUS Received RADIUS message wlan0: STA 00:02:6f:3c:37:d8 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.03 sec RADIUS packet matching with station 00:02:6f:3c:37:d8 wlan0: STA 00:02:6f:3c:37:d8 IEEE 802.1X: using EAP timeout of 30 seconds wlan0: STA 00:02:6f:3c:37:d8 IEEE 802.1X: decapsulated EAP packet (code=1 id=132 len=10) from RADIUS server: EAP-Request-TLS (13) IEEE 802.1X: 00:02:6f:3c:37:d8 BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:02:6f:3c:37:d8 (identifier 132) IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE DATA (TX callback) ACK IEEE 802.1X: 00:02:6f:3c:37:d8 TX status - version=1 type=0 length=10 - ack=1 IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE ===============================================

3 4

RE: Windows XP keeps "verifying identity"
by Garber, Neal 10 Jul '06

10 Jul '06

> Sending Access-Challenge of id 15 to 127.0.0.1:1027 <snip> > rad_recv: Access-Request packet from host 127.0.0.1:1027, id=0, length=159 <snip> It's receiving the request from a loopback address. Is the client the same machine as the FreeRadius server? Are you really connecting to an Access Point? If so, what is its IP address?

2 1

RE: Windows XP keeps "verifying identity"
by Klaas De Craemer 10 Jul '06

10 Jul '06

With all due respect, but I'm not that stupid that I would not even look into a configuration file. Take a look at the log I attached in a previous email and you'll see that EAP is enabled and also processes the user "KlaasDC". It only seems that the client does not respond to the access chalenge: Sending Access-Challenge of id 15 to 127.0.0.1:1027 EAP-Message = 0x0116000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1d1065c2554dce6ca1d156d938f7049a This is what happens when WInXP tries to associate (and begins to loop): (At the bottom is "radiusd -X -A" starting up) ========================= rad_recv: Access-Request packet from host 127.0.0.1:1027, id=0, length=159 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201000c014b6c6161734443 Message-Authenticator = 0xf26a1b4afcdfaf58003784904286014e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 0 to 127.0.0.1:1027 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xecd47882c04772432949c86821e23447 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1027, id=1, length=245 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200500d800000004616030100410100003d030144b249ff398dc35bbc9f32d603876f313d1cb0ff5bbcdd3c79b38f84c78a08d700001600040005000a000900640062000300060013001200630100 State = 0xecd47882c04772432949c86821e23447 Message-Authenticator = 0x72675c13c503b9f653fbaf49f92a1c7e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 057b], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 006d], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 1 to 127.0.0.1:1027 EAP-Message = 0x0103040a0dc000000641160301004a02000046030144b248eda44415e2b853c9772a1130637ea6b6a80733c192f1a2b71cff3c143f20fd26745d9e97554fa1bf0dba61e8d11ceb72fadc393ac548c297bc6be166248a000400160301057b0b00057700057400025930820255308201bea003020102020101300d06092a864886f70d0101040500305c310b3009060355040613024245310c300a0603550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d301e170d3036303730383039313133395a170d3037303730 EAP-Message = 0x383039313133395a306c310b3009060355040613024245310c300a0603550408130357564c310e300c060355040713055469656c74310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100af6bd5feb703ca2b30d6cecb02524a0fcb8bc364a2c2bc39400561629844d18a24c448656f1cf6964c9a064c82cc3616264e2419e073093ab7289e8688c656f652f8e4e63a9a54dd1492a5757df04bc0ecd4441868f158da2fdadcb4bd31a07243fe8bce413f7fbf85f0 EAP-Message = 0xd006ecbcd62019e26e8c58290e1fe1ccd2189e2c53450203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000381810052b4fd21f12d8d14ffd712d100fb12a3daa5e681a44b0e2dda3762829611171cfd8d5828a6f1db3216cce98190a1f6a110a66848e8b2846a2da6254a5a42ad21731004b858723fbf9651bdae4915d167ce8b8be8c9167ee7c78b1de730334035d321ceb8196873e73d8ae15c5e6d974d2cca62bff234a117561c16408e25bde9000315308203113082027aa003020102020100300d06092a864886f70d0101040500305c310b3009060355040613024245310c300a06 EAP-Message = 0x03550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d301e170d3036303730383039303733345a170d3039303730373039303733345a305c310b3009060355040613024245310c300a0603550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d0a45b7a7abbdc0330bec488c4e5e2fd56eb84f7066d6ce7 EAP-Message = 0xe6ef10a6f757b59a15da4694dc47dde72da145998c53 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6a5cabb694011c03b8fc460c9d76fb83 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1027, id=2, length=171 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300060d00 State = 0x6a5cabb694011c03b8fc460c9d76fb83 Message-Authenticator = 0xc614706a41c325fb9d8cf69c9000c0b7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 2 to 127.0.0.1:1027 EAP-Message = 0x0104024b0d8000000641a423ee3382420f826dd1bfb6cdba0e19a54627841829135284486abb171f2ead064a2b1d3f4261451d82ae9a04dd1b60d6339ec876e7347e33ed82ec712846ccc30bad864cfc8f6784de9ba4f08749a65f290203010001a381e23081df30090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041435ac18d86277eb69414cd999bf1b325fa98ea02d3081840603551d23047d307b801435ac18d86277eb69414cd999bf1b325fa98ea02da160a45e305c310b3009060355040613024245310c300a0603550408 EAP-Message = 0x130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d820100300d06092a864886f70d0101040500038181007127f79df3611d53c650b0ed7ee16008f75dc296a0e95db3d97cd80fc7328e1193408c582a40e9dd7b0bafad2dbc335f0be62f1c6e0cb604a686fe7114a8204986a4f93e91213c798add773cb9e2d2265991bef7d13b9c3f614e28a6c94b2f8ac412f1b3fbf5d29a1c771352cb430813a7c084797a1e98fbfb3c127794f38092160301006d0d0000650201020060005e305c310b3009060355040613024245310c EAP-Message = 0x300a0603550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe9ed44552d38720950c7fe3055463168 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1027, id=3, length=171 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400060d00 State = 0xe9ed44552d38720950c7fe3055463168 Message-Authenticator = 0xc276ffa3767a7f670e8d5bcd77b97f3e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 3 to 127.0.0.1:1027 EAP-Message = 0x0105000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xea1e68322139e30bccee339205586d29 Finished request 3 Going to the next request Waking up in 6 seconds... ============================= ============================= Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/server_key.pem" tls: certificate_file = "/etc/freeradius/certs/server_cert.pem" tls: CA_file = "/etc/freeradius/certs/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/etc/freeradius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. ========================== >make appropriate changes in radiusd.conf & eap.conf for the authentication >method you want to use > > >Pradeep > > >------------------------------ > >Message: 3 >Date: Sat, 8 Jul 2006 15:27:31 +0200 >From: "Klaas De Craemer" <klaasdc at gmail.com> >Subject: Re: Windows XP keeps "verifying identity" >To: freeradius-users at lists.freeradius.org >Message-ID: > <f59e60020607080627r344aad2bia7fc636a141fba6c at mail.gmail.com> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >Ow, I forgot to say that I'm trying to use EAP-TLS... > >2006/7/8, Klaas De Craemer <klaasdc at gmail.com> >...

1 0

accouting over more than one servers
by Fretz Marco 10 Jul '06

10 Jul '06

hello there ive got a problem. we are using 2 radius servers to auth our xDSL users quering from a CISCO PPPoE Router. how can i protect a user to dial in from a secound xdsl line if first radius is down and CISCO AAA useses the 2nd radius server? and btw: does anybody know how to setup up AAA on a CISCO IOS to send periodically accounting infos to the radius server? thanks and kind regards marco fretz

1 0

Re: Windows XP keeps "verifying identity"
by Pradeep Sengar 10 Jul '06

10 Jul '06

make appropriate changes in radiusd.conf & eap.conf for the authentication method you want to use Pradeep ------------------------------ Message: 3 Date: Sat, 8 Jul 2006 15:27:31 +0200 From: "Klaas De Craemer" <klaasdc(a)gmail.com> Subject: Re: Windows XP keeps "verifying identity" To: freeradius-users(a)lists.freeradius.org Message-ID: <f59e60020607080627r344aad2bia7fc636a141fba6c(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Ow, I forgot to say that I'm trying to use EAP-TLS... 2006/7/8, Klaas De Craemer <klaasdc(a)gmail.com> ... ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 15, Issue 23 ************************************************

1 0

Error: WARNING: Unresponsive child
by Farhan Karim 10 Jul '06

10 Jul '06

fellows, we are facing a continuous problems in free-radius server. It had been working fine but lately now an error that it generates as we enable forwarding packets from INFRANET Radius Server to FreeRadius server. freeradius ver 1.1.0 the error that it generates in radius.log file is: Wed Jul 5 17:45:20 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Jul 5 17:45:20 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Jul 5 17:45:20 2006 : Info: rlm_jradius: configuring jradius server 200.100.96.20:1825 Wed Jul 5 17:45:20 2006 : Info: Ready to process requests. Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 6) for request 16 Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 7) for request 17 Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 4) for request 19 Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 5) for request 20 Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 8) for request 21 Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 10) for request 22 Wed Jul 5 17:50:52 2006 : Error: WARNING: Unresponsive child (id 9) for request 24 Wed Jul 5 17:51:04 2006 : Error: WARNING: Unresponsive child (id 4) for request 25 Wed Jul 5 17:51:04 2006 : Error: WARNING: Unresponsive child (id 7) for request 26 Wed Jul 5 17:51:04 2006 : Error: WARNING: Unresponsive child (id 6) for request 28 Wed Jul 5 17:51:06 2006 : Error: WARNING: Unresponsive child (id 5) for request 35 Wed Jul 5 17:51:07 2006 : Error: WARNING: Unresponsive child (id 10) for request 39 Wed Jul 5 17:51:07 2006 : Error: WARNING: Unresponsive child (id 8) for request 38 Wed Jul 5 17:51:07 2006 : Error: WARNING: Unresponsive child (id 9) for request 42 Wed Jul 5 17:51:19 2006 : Error: WARNING: Unresponsive child (id 7) for request 44 Wed Jul 5 17:51:19 2006 : Error: WARNING: Unresponsive child (id 8) for request 46 Wed Jul 5 17:51:19 2006 : Error: WARNING: Unresponsive child (id 4) for request 48 Wed Jul 5 17:51:20 2006 : Error: WARNING: Unresponsive child (id 10) for request 50 Wed Jul 5 17:51:21 2006 : Error: WARNING: Unresponsive child (id 5) for request 52 Wed Jul 5 17:51:21 2006 : Error: WARNING: Unresponsive child (id 6) for request 56 Wed Jul 5 17:51:22 2006 : Error: WARNING: Unresponsive child (id 9) for request 57 Wed Jul 5 17:51:34 2006 : Error: WARNING: Unresponsive child (id 7) for request 58 Wed Jul 5 17:51:34 2006 : Error: WARNING: Unresponsive child (id 10) for request 59 Wed Jul 5 17:51:34 2006 : Error: WARNING: Unresponsive child (id 6) for request 63 Wed Jul 5 17:51:34 2006 : Error: WARNING: Unresponsive child (id 4) for request 66 Wed Jul 5 17:51:34 2006 : Error: WARNING: Unresponsive child (id 8) for request 68 Wed Jul 5 17:51:36 2006 : Error: WARNING: Unresponsive child (id 5) for request 75 Wed Jul 5 17:51:37 2006 : Error: WARNING: Unresponsive child (id 9) for request 79 Wed Jul 5 17:51:51 2006 : Error: WARNING: Unresponsive child (id 8) for request 81 Wed Jul 5 17:51:51 2006 : Error: WARNING: Unresponsive child (id 7) for request 83 Wed Jul 5 17:51:51 2006 : Error: WARNING: Unresponsive child (id 10) for request 86 Wed Jul 5 17:51:51 2006 : Error: WARNING: Unresponsive child (id 6) for request 88 Wed Jul 5 17:51:51 2006 : Error: WARNING: Unresponsive child (id 5) for request 89 Wed Jul 5 17:51:52 2006 : Error: WARNING: Unresponsive child (id 4) for request 92 Wed Jul 5 17:51:52 2006 : Error: WARNING: Unresponsive child (id 5) for request 90 Wed Jul 5 17:52:04 2006 : Error: WARNING: Unresponsive child (id 9) for request 95 Wed Jul 5 17:52:08 2006 : Error: WARNING: Unresponsive child (id 10) for request 96 Wed Jul 5 17:52:08 2006 : Error: WARNING: Unresponsive child (id 6) for request 98 Wed Jul 5 17:52:09 2006 : Error: WARNING: Unresponsive child (id 7) for request 105 Wed Jul 5 17:52:09 2006 : Error: WARNING: Unresponsive child (id 5) for request 106 Wed Jul 5 17:52:09 2006 : Error: WARNING: Unresponsive child (id 4) for request 111 Wed Jul 5 17:52:09 2006 : Error: WARNING: Unresponsive child (id 6) for request 101 Wed Jul 5 17:52:09 2006 : Error: WARNING: Unresponsive child (id 8) for request 102 Wed Jul 5 17:52:19 2006 : Error: WARNING: Unresponsive child (id 4) for request 113 Wed Jul 5 17:52:19 2006 : Error: WARNING: Unresponsive child (id 9) for request 114 Wed Jul 5 17:52:22 2006 : Error: Dropping conflicting packet from client 202.100.96.21:39779 - ID: 38 due to unfinished request 124 Wed Jul 5 17:52:35 2006 : Error: WARNING: Unresponsive child (id 7) for request 118 ................ we have no clue as what the problem has occured. the other question that i have to ask is that is there a way that the freeradius server acknowledge the main INFRANET radius server (which is forwarding the packets to freeradius server) with OK so that main radius server dont get stuck due to waiting of packets acknowldement from freeradius server? our freeradius server is acting as proxy server for the jradius server that process the interim-update packets. If i have left out any required thing, please do tell me. we request for the earliest response. Regards,

3 3

Can I run a shell scipt automatically after authorizing?
by Kun Niu 10 Jul '06

10 Jul '06

Dear all, Now I have a shell script to run after a authentication session. How can I implement this? >From the config file? Thanks for your attention and look forward to your reply. Sincerely, Kun

2 1

Get my SSHA ldap passwds?
by John Gray 09 Jul '06

09 Jul '06

Hi, I have plain-text passwords coming from a pix firewall for vpn authentication. I have SSHA hashed passwds stored in ldap. Can't I hash the passwds from the pix and compare 'em the SSHA passwds from ldap somehow? It works fine if I put plain text passwords in ldap. But I don't relish the thought of storing them plain text. Thanks, John

1 1