- Freeradius-Users - lists.freeradius.org

freeradius+WinXP-PEAP+PAM
by Muthu 09 Jul '06

09 Jul '06

Hi, I am trying to use PAM authentication with freeradius for Win XP client (PEAP). I am getting error in the tls section. Ver : FreeRADIUS 1.1.1 in Linux AP : Linksys Client : Windows XP I enabled the options in raidusd.conf and I have placed with prober entries in /etc/pam.d I ran the below command *radtest username "password" localhost 1 testing123 * Output: ======= sysnet-gateway25 ~ # radtest muthu "password" localhost 2 testing123 Sending Access-Request of id 130 to 127.0.0.1 port 1812 User-Name = "muthu" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=130, length=20 Client: ======== When I try to use from Windows XP client machine, it prompting for username and password. After I typed the username and password, it is not getting connected. It is keep saying "Trying to Authenticate". Client settings in XP : PEAP, validate certificate option is not enabled" If I look at the serverside logs, it is saying multiple error like, *rlm_eap_tls: Start returned 1, eaptls_verify returned 11, rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session.** * So I attached the full debug log in this mail. Pls help me on this. Server side debug log: ====================== rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=123 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a016d75746875 Message-Authenticator = 0xbca303874074727b4b65a69509bb731c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa866ca10b5f371e8e53fbfebe5307ce0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=211 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 State = 0xa866ca10b5f371e8e53fbfebe5307ce0 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005019800000004616030100410100003d030144b0dffdd8f693786422edf97c49f4343ecc13aad75093912d990b6bda25d40c00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xa99a675d8eba749010439b512eac06b8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 02d7], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x0102033a1900160301004a02000046030144b0d849e10e331db1eab13dfd51c3659279c6cea9cb802871cbb32c3dd270e5200421d74bc64b451bf65a807251eece64a76048cabe160e52af94cb7cebb74a8d00040016030102d70b0002d30002d00002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e7420636572746966 EAP-Message = 0x69636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030 EAP-Message = 0x818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09779afa3d EAP-Message = 0xd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e835036516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7dae0a8612eeb132ce408f8df394f3a0 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=323 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 State = 0x7dae0a8612eeb132ce408f8df394f3a0 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200c01980000000b61603010086100000820080542d7bb3645e47fc6feda7709e7145f048e741c81e299fe0f6373344aca4a7be3b64c745d9a47aec1e55e28411b74061185ffd6a5fee2fcc9d298f9a733ffa4fd0d2eed8577830ba403e8dc4afdb4ae473dec2cbe190028b5967be8483c617196db0fad02f9909b78b1df7d7063719207fcdf8d4b59ceb088b3daaeb47167e4614030100010116030100202112e387bb6cebe749727be7cdd0da3629ba181306e2c221b1fcce60089167d1 Message-Authenticator = 0x7ca279ee6b43a242fd409d6e475cad2c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x01030031190014030100010116030100207dcf757a63f78f532eedcb0253324c106b6b3803bc2afada89d2f058b67105d7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x98a8efaf81fde7503edad7e110b20404 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=137 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 State = 0x98a8efaf81fde7503edad7e110b20404 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0x9b90602709d935a5da18d0ed60e3bc6a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x01040020190017030100158dda0df9cdef5e3687b7d519fc47822fbbcc9813a0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x779974e1770813a7e8a6097539d59abf Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=164 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 State = 0x779974e1770813a7e8a6097539d59abf NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400211900170301001672ccf21456545dc224b4b4c1b6fbfc0071017a82faad Message-Authenticator = 0x7f0540a46bd8ccb3c5b13c7d5a13f88d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 33 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - muthu rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of muthu PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to muthu Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x010500361900170301002b2c22860183854f6a55c100c85d2c78be83f1afab3a40e49373bd7990d0d06d091922907022b7e48d597c29 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1d64eb1932f6e356c6890d53d9c3c4dd Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=218 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 State = 0x1d64eb1932f6e356c6890d53d9c3c4dd NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500571900170301004cf131dc1876143f35e3f376892adb80c72d7ae37d8fceef5573317cb4cc345c0eb7727a61b7beabdf5da381d5667f16ffbe72b23cb9e24ba9810c93fec8be45ec40ecb6ac4da2bcf409cedaba Message-Authenticator = 0x950bd18efdce7c7bc50baf9437f8d42a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 87 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to muthu PEAP: Adding old state with 3d 60 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 64 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 5 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for muthu with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 5 modcall: leaving group MS-CHAP (returns reject) for request 5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 5 modcall: leaving group authenticate (returns reject) for request 5 auth: Failed to validate the user. Login incorrect: [muthu/<no User-Password attribute>] (from client localhost port 0) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x010600261900170301001b88cd580851e3522b1a4516b384de6ea0f9c4e36944e068bd9b1fc0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c90bcf7478ad30a644a3f50c12b4611 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.142:2048, id=0, length=169 User-Name = "muthu" NAS-IP-Address = 192.168.0.142 Called-Station-Id = "001217102e2e" Calling-Station-Id = "0012f0444aa3" NAS-Identifier = "001217102e2e" NAS-Port = 45 Framed-MTU = 1400 State = 0x7c90bcf7478ad30a644a3f50c12b4611 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600261900170301001b59d1cd3753054b8b1797fd0beb904a25105f437a11e7ac8b21b8f4 Message-Authenticator = 0xc48fa3cd3df1609ff1ebbc19b3907780 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "muthu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 6 modcall: leaving group authenticate (returns invalid) for request 6 auth: Failed to validate the user. Login incorrect: [muthu/<no User-Password attribute>] (from client private-network-1 port 45 cli 0012f0444aa3) Delaying request 6 for 1 seconds Finished request 6 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.0.142 port 2048 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 6 ID 0 with timestamp 44b0d849 Nothing to do. Sleeping until we see a request. Thanks & Regards, Muthu.

3 2

Cisco, RADIUS , LDAP Authentication Problem
by Thato Molise 09 Jul '06

09 Jul '06

GlacierHi all, I'm currently running redhat linux 3 ES with kernel-2.4.21-27.EL openldap-2.0.27-17, and freeradius-1.0.1-1.RHEL3. I dont have a problem authenticating RADIUS against LDAP but the major problem is RADIUS is ignoring LDAP Expiration date for unix Accounts; what causes this?

1 0

Authentication by validating RADIUS attribute value
by HariHaran 08 Jul '06

08 Jul '06

Hi all, I am using FreeRADIUS1.1.1 and Fedora directory server7.2 as the LDAP backend to store all the user information. I configured RADIUS to contact LDAP server for authenticate the user request. I have to implement the following requirement, For each user in the LDAP server i will set some value to the RADIUS attribute , say for eg Filter-ID = 100 If an authentication request comes to the RADIUS server it will contact the LDAP server, if the user is present in the LDAP server the RADIUS will authenticate the user. What i want is, i want to authenticate the user by validating the value of the RADIUS attribute in LDAP server. For example if the Filter-ID is 100 for user 'jack' i have to authenticate. If 'jack' has Filter-ID as 123 i should not authenticate. Is i have to call a script before authenticating an user? If it is so how i can call and from which file i have to define the entries? What are the various methods by which i can achieve the above? Anyone pls help me to get rid of the problem. Thanks in advance. Pls give me the complete details. --- Regards, _______________________________________________ No banners. No pop-ups. No kidding. Make My Way your home on the Web - http://www.myway.com

2 1

RE: 802.1x authentication
by Pradeep Sengar 08 Jul '06

08 Jul '06

just do google everything is there Pradeep Date: Fri, 7 Jul 2006 09:32:17 -0500 > From: "Jin Fan" <jfan(a)cwlab.com> > Subject: RE: 802.1x authentication > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <F26421BAB0F1D146BABD4977D6159084012CA1B0(a)ctiexch.ctinet.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, all: > > To further describe my challenge, here is debugging output from > freeradius. One line says, "rlm_eap: Failed in EAP select". I must have > set up eap wrong. Could anyone help me out here? Btw, in the following > example, user "TRPZEDU\\jfan" tries to authenticate through 802.1x > . Thanks. > > Jin > > rad_recv: Access-Request packet from host 192.168.3.26:20000, id=89, > length=157 > NAS-Port-Id = "1/1" > Calling-Station-Id = "00-0B-BE-D4-50-46" > Called-Station-Id = "00-0B-0E-13-74-C0:hotspot" > Service-Type = Framed-User > User-Name = "TRPZEDU\\jfan" > State = 0xdcfe3f22dc8680c7b0e05b3d498b6090 > EAP-Message = 0x020200060319 > NAS-Identifier = "Trapeze" > NAS-Port-Type = Wireless-802.11 > NAS-IP-Address = 192.168.3.26 > Message-Authenticator = 0xc846da111c9f48b4a5570fff318767a2 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 6 > modcall[authorize]: module "preprocess" returns ok for request 6 > modcall[authorize]: module "chap" returns noop for request 6 > modcall[authorize]: module "mschap" returns noop for request 6 > rlm_realm: No '@' in User-Name = "TRPZEDU\jfan", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 6 > rlm_eap: EAP packet type response id 2 length 6 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 6 > users: Matched entry DEFAULT at line 152 > users: Matched entry DEFAULT at line 171 > users: Matched entry TRPZEDU\jfan at line 228 > modcall[authorize]: module "files" returns ok for request 6 > radius_xlat: 'TRPZEDU\\jfan' > rlm_sql (sql): sql_set_user escaped user --> 'TRPZEDU\\jfan' > radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE > Username = 'TRPZEDU=5C=5C=5C=5Cjfan' ORDER BY id' > rlm_sql (sql): Reserving sql socket id: 3 > rlm_sql (sql): User TRPZEDU\\jfan not found in radcheck > radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, > radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM > radgroupcheck,usergroup WHERE usergroup.Username = > 'TRPZEDU=5C=5C=5C=5Cjfan' AND usergroup.GroupName = > radgroupcheck.GroupName ORDER BY radgroupcheck.id' > radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, > radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM > radgroupreply,usergroup WHERE usergroup.Username = > 'TRPZEDU=5C=5C=5C=5Cjfan' AND usergroup.GroupName = > radgroupreply.GroupName ORDER BY radgroupreply.id' > rlm_sql (sql): User TRPZEDU\\jfan not found in radgroupcheck > rlm_sql (sql): User not found > rlm_sql (sql): Released sql socket id: 3 > modcall[authorize]: module "sql" returns notfound for request 6 > modcall: group authorize returns updated for request 6 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 6 > rlm_eap: Request found, released from the list > rlm_eap: EAP NAK > rlm_eap: EAP-NAK asked for EAP-Type/peap > rlm_eap: No such EAP type peap > rlm_eap: Failed in EAP select > modcall[authenticate]: module "eap" returns invalid for request 6 > modcall: group authenticate returns invalid for request 6 > auth: Failed to validate the user. > Delaying request 6 for 1 seconds > Finished request 6 > Going to the next request > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 89 to 192.168.3.26:20000 > EAP-Message = 0x04020004 > Message-Authenticator = 0x00000000000000000000000000000000 > Trapeze-VLAN-Name = "vlan10" > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 5 ID 88 with timestamp 44ae6d5d > Cleaning up request 6 ID 89 with timestamp 44ae6d5d > Nothing to do. Sleeping until we see a request. > > > ________________________________ > > From: freeradius-users-bounces+jfan=cwlab.com(a)lists.freeradius.org on > behalf of Jin Fan > Sent: Thu 7/6/2006 5:22 PM > To: FreeRadius users mailing list > Subject: 802.1x authentication > > > > Hi, All: > > I need some pointers on how to set up 802.1x (PEAP/MSCHAP v.2) > authentication in freeradius. Generating certificates? Modifying > configurations? > > Jin > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > >

1 0

Questions about debug output
by Paul Long 08 Jul '06

08 Jul '06

I have a few questions about the debug output from an ultimately successful EAP-TTLS-CHAP authentication. Consider this snippet: ... rad_recv: Access-Request packet from host 192.168.1.228:1045, id=210, length=166 User-Name = "anonymous" NAS-IP-Address = 192.168.1.228 Connect-Info = "CONNECT 802.11" Called-Station-Id = "000b6b8c03f9" Calling-Station-Id = "00146c6f2e75" NAS-Identifier = "00-14-6c-6f-2e-75" NAS-Port-Type = Wireless-802.11 NAS-Port = 15 NAS-Port-Id = "15" Framed-MTU = 1400 State = 0x656cef9c49bb7e305b809bc113ece6c4 EAP-Message = 0x020700061500 Message-Authenticator = 0xfd14176dee74fed4980d51bbf880b8a6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 173 ... 1. First, what does this mean: 'module "chap" returns noop for request 3?' My client uses CHAP, so why doesn't "chap," here, return ok? What does "noop" mean? 2. I read in a comment in the out-of-the-box eap.conf file that it is customary to specify "anonymous" for the "name of the user 'outside' of the tunnel" with ttls { use_tunneled_reply = yes }. Is the User-Name field in the above Access-Request this outside user name? 3. Is the User-Name in the Access-Request the same as what I've seen called the "outer identity?" 4. Is just using "anonymous" okay? Should I include a realm, e.g., anonymous(a)example.net? Is there something I lose by not specifying a realm in User-Name (everything seems to work okay so far)? 5. What does "No EAP Start" mean? 6. Why does modcall[authorize] say "Matched entry DEFAULT at line 173" here and in the subsequent challenge response (not shown), whereas later in the challenge response it says "Matched entry plong at line 76" ("plong" is the name part of the inner identity, if I'm using the terminology correctly)? Paul

2 1

Authentication by validating RADIUS attribute value
by Hariharan R 08 Jul '06

08 Jul '06

1 0

Radius + 802.1X
by Emerson 07 Jul '06

07 Jul '06

Hi, i posted 2 messages with Radius + Dhcp and Radius with ip pool, but for this answers, i learn that radius don't have anithing with dhcp, and ip pool work with connections PPP. But I need to deliver ip's to my clients, they use wifi hardware 802.1X. Why i deliver ip's for them ? My freeradius work ok, and i put dhcp to work together, but not work, anyone can answer this for me ? Anyone have any experience with it ? Thank's..... Emerson

2 1

rlm_sql variable substitution clarification
by Guy Fraser 07 Jul '06

07 Jul '06

I have run into an issue where we now have different types of NAS servers. I would like to use %{Connect-Info} if available or a string formatted from two attributes like : D%{Ascend-Data-Rate}_X%{Ascend-Xmit-Rate} This is how I tried to do it : ConnectInfo_stop = \ '%{Connect-Info:-D%{Ascend-Data-Rate}_X%{Ascend-Xmit-Rate}}' This is what I get when %{Connect-Info} is not available : "D_X" I haven't seen any examples where two attributes are combined to make one attribute. Thanks

2 4

802.1x authentication
by Jin Fan 07 Jul '06

07 Jul '06

Hi, All: I need some pointers on how to set up 802.1x (PEAP/MSCHAP v.2) authentication in freeradius. Generating certificates? Modifying configurations? Jin

2 2

Session Log
by fvt3 07 Jul '06

07 Jul '06

Is there a session log in freeradius? I want to find out who logged on and how much time they have until there session is timeout. Is there such a thing? __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1