- Freeradius-Users - lists.freeradius.org

MS CHAP V2 authentication failure...
by Jon 01 Mar '06

01 Mar '06

here is [most] of the -X -A output rlm_eap: EAP packet type response id 4 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 0 to 127.0.0.1:1025 EAP-Message = 0x0105003119001403010001011603010020f640f17cc4d9b95c689f37535f0c167e7ef85920fa1a584ae45ca46e4e27be88 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89c31ab5692851c1b54665f205acfdb1 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=138 User-Name = "jboast" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "0014bf1c0216" Calling-Station-Id = "0090967ee1f9" NAS-Identifier = "0014bf1c0216" NAS-Port = 38 Framed-MTU = 1400 State = 0x89c31ab5692851c1b54665f205acfdb1 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0x86ad4528b700aed9bb049bed435eeb10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 0 to 127.0.0.1:1025 EAP-Message = 0x0106002019001703010015c0b9557e082a58271186f1038ce6579a67a52b2c30 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4641f1c68dfd842fbecaa2555be47878 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=166 User-Name = "jboast" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "0014bf1c0216" Calling-Station-Id = "0090967ee1f9" NAS-Identifier = "0014bf1c0216" NAS-Port = 38 Framed-MTU = 1400 State = 0x4641f1c68dfd842fbecaa2555be47878 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0206002219001703010017c6caefa5edac16bea7db9a9ee8f16dec3d5db28d1111ef Message-Authenticator = 0xceffd3aede7f9a429813aa64fde5fc65 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 rlm_eap: EAP packet type response id 6 length 34 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - jboast rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of jboast PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to jboast Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 rlm_eap: EAP packet type response id 6 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 0 to 127.0.0.1:1025 EAP-Message = 0x010700371900170301002c822385e6e9fb2b3f8f6155f76311e50bfbdb2a4d27557ae1de8893be311197d14003ff17cb0259d2b452ce2f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb931efb43a135bd61a8d7beedcd95701 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=220 User-Name = "jboast" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "0014bf1c0216" Calling-Station-Id = "0090967ee1f9" NAS-Identifier = "0014bf1c0216" NAS-Port = 38 Framed-MTU = 1400 State = 0xb931efb43a135bd61a8d7beedcd95701 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700581900170301004dcd9e19e4f8d3efb85c7af02264394c0effdc9df18751700ce7a51ddb927afa8d37e5e0a96c4dc4e54c62183f32aa2a9af1da58a06434e307bde2540bf10bc20fafbeefd8fbdc591c3a111133f1 Message-Authenticator = 0x72c9d318441ce6bedfb78bff20d6ef6a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 rlm_eap: EAP packet type response id 7 length 88 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to jboast PEAP: Adding old state with 07 73 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 rlm_eap: EAP packet type response id 7 length 65 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 0 to 127.0.0.1:1025 EAP-Message = 0x010800261900170301001bef481fb0682ffedaef80653a2b14e3ce38c357d2ac27693b8b5b7e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc1d1f811200e081feb3c7e131c64e96b Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=170 User-Name = "jboast" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "0014bf1c0216" Calling-Station-Id = "0090967ee1f9" NAS-Identifier = "0014bf1c0216" NAS-Port = 38 Framed-MTU = 1400 State = 0xc1d1f811200e081feb3c7e131c64e96b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800261900170301001b2e1b4f233395cb709a8d40be375a07c87f3d040c139b8989f41d4e Message-Authenticator = 0x8e4f17e45575d244747d1f0d76b2f772 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: group authenticate returns invalid for request 8 auth: Failed to validate the user. Delaying request 8 for 1 seconds Finished request 8 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 127.0.0.1:1025 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 8 ID 0 with timestamp 4404fa1e Nothing to do. Sleeping until we see a request. im sure it's something simple, i've been working at it all day, i need a break, hopefully someone can help. Thanks Jon

2 1

another sql database
by debik 28 Feb '06

28 Feb '06

I have got onother database on my serwer. I it used by ISP accounting. In this database is the table called users where are logins and passwords. I have tried to put in radiusd.conf another module called sql1 and create file sql1.conf When i start radius it says me that the parameters are in attribute = format. I know what im doing wrong, but is there anyway to correct this. I know the RFC about freeradius and supouse there is not anyway to do this.

2 2

Re:Database connection failure and retry
by Marko Dinic 28 Feb '06

28 Feb '06

>>"Ming-Ching Tiew" <mingching.tiew at redtone.com> wrote: >> >> A little while ago I posted about in my configuration, using unixodbc/freetds, >> we noticed that database/network failure causes permanent disability in >> radius server to stop logging and I was given the reply that it is in the >> feature of radius server to retry upon failure. >> >> So there is a discrepancy between what I noticed verses the "supposed to be" >> behaviour. >> >> Upon further investigation I explored into the code, I found this in sql_mysql.c :- >> >> static int sql_fetch_row(SQLSOCK * sqlsocket, SQL_CONFIG *config) >> { >> rlm_sql_mysql_sock *mysql_sock = sqlsocket->conn; >> >> /* >> * Check pointer before de-referencing it. >> */ >> if (!mysql_sock->result) { >> return SQL_DOWN; >> } >> >> sqlsocket->row = mysql_fetch_row(mysql_sock->result); >> >> if (sqlsocket->row == NULL) { >> return sql_check_error(mysql_errno(mysql_sock->sock)); >> } >> return 0; >> } >> >> >> However the code in sql_unixodbc.c is like this :- >> >> >> static int sql_fetch_row(SQLSOCK *sqlsocket, SQL_CONFIG *config) { >> rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; >> >> sqlsocket->row = NULL; >> >> if(SQLFetch(unixodbc_sock->stmt_handle) == SQL_NO_DATA_FOUND) >> return 0; >> >> /* XXX Check if return suggests we should return error or SQL_DOWN */ >> >> sqlsocket->row = unixodbc_sock->row; >> return 0; >> } >> >> >> There is no checking whatsoever, so unixodbc driver is unable to reconnect >> upon failure. > > Ok... are you willing to supply a patch? > > Alan DeKok. > A while ago Alan suggested I should use odbc instead of native sybase driver, so I set up unixODBC 2.2.11 with freetds 0.63 ODBC driver, but I encountered the same problem as described above. However, I couldn't afford waiting for a patch, so I patched it myself. I've never used ODBC API before, so I cannot be sure if this is a complete solution to the problem, or whether it will work for everyone - the only thing i do know is that it works well for me. Here it is: -------------------------------------PATCH STARTS HERE------------------------------------------ --- freeradius-1.1.0/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c 2005-08-29 19:01:58.000000000 +0200 +++ freeradius-1.1.0-unixodbcfix/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c 2006-02-28 17:25:27.000000000 +0100 @@ -40,6 +40,7 @@ /* Forward declarations */ static char *sql_error(SQLSOCK *sqlsocket, SQL_CONFIG *config); +static int sql_state(long err_handle, SQLSOCK *sqlsocket, SQL_CONFIG *config); static int sql_free_result(SQLSOCK *sqlsocket, SQL_CONFIG *config); static int sql_affected_rows(SQLSOCK *sqlsocket, SQL_CONFIG *config); static int sql_num_fields(SQLSOCK *sqlsocket, SQL_CONFIG *config); @@ -67,23 +68,23 @@ /* 1. Allocate environment handle and register version */ err_handle = SQLAllocHandle(SQL_HANDLE_ENV,SQL_NULL_HANDLE,&unixodbc_sock->env_handle); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate environment handle %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate environment handle\n"); return -1; } err_handle = SQLSetEnvAttr(unixodbc_sock->env_handle, SQL_ATTR_ODBC_VERSION, (void*)SQL_OV_ODBC3, 0); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Can't register ODBC version %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Can't register ODBC version\n"); SQLFreeHandle(SQL_HANDLE_ENV, unixodbc_sock->env_handle); return -1; } /* 2. Allocate connection handle */ err_handle = SQLAllocHandle(SQL_HANDLE_DBC, unixodbc_sock->env_handle, &unixodbc_sock->dbc_handle); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate connection handle %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate connection handle\n"); SQLFreeHandle(SQL_HANDLE_ENV, unixodbc_sock->env_handle); return -1; } @@ -93,9 +94,9 @@ (SQLCHAR*) config->sql_server, strlen(config->sql_server), (SQLCHAR*) config->sql_login, strlen(config->sql_login), (SQLCHAR*) config->sql_password, strlen(config->sql_password)); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Connection failed %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Connection failed\n"); SQLFreeHandle(SQL_HANDLE_DBC, unixodbc_sock->dbc_handle); SQLFreeHandle(SQL_HANDLE_ENV, unixodbc_sock->env_handle); return -1; @@ -103,9 +104,9 @@ /* 4. Allocate the statement */ err_handle = SQLAllocStmt(unixodbc_sock->dbc_handle, &unixodbc_sock->stmt_handle); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate the statement %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate the statement\n"); return -1; } @@ -139,16 +140,17 @@ static int sql_query(SQLSOCK *sqlsocket, SQL_CONFIG *config, char *querystr) { rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; long err_handle; + int state; if (config->sqltrace) radlog(L_DBG, "query: %s", querystr); /* Executing query */ err_handle = SQLExecDirect(unixodbc_sock->stmt_handle, (SQLCHAR *)querystr, strlen(querystr)); - if (!SQL_SUCCEEDED(err_handle)) - { - radlog(L_ERR, "rlm_sql_unixodbc: '%s'\n", sql_error(sqlsocket, config)); - return -1; + if ((state = sql_state(err_handle, sqlsocket, config))) { + if(state == SQL_DOWN) + radlog(L_ERR, "rlm_sql_unixodbc: rlm_sql should attempt to reconnect\n"); + return state; } return 0; } @@ -165,9 +167,11 @@ rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; SQLINTEGER column, len; int numfields; + int state; - if(sql_query(sqlsocket, config, querystr) < 0) - return -1; + /* Only state = 0 means success */ + if((state = sql_query(sqlsocket, config, querystr))) + return state; numfields=sql_num_fields(sqlsocket, config); if(numfields < 0) @@ -214,11 +218,9 @@ int num_fields = 0; err_handle = SQLNumResultCols(unixodbc_sock->stmt_handle,(SQLSMALLINT *)&num_fields); - if (!SQL_SUCCEEDED(err_handle)) - { - radlog(L_ERR, "rlm_sql_unixodbc: '%s'\n", sql_error(sqlsocket, config)); + if (sql_state(err_handle, sqlsocket, config)) return -1; - } + return num_fields; } @@ -247,14 +249,19 @@ *************************************************************************/ static int sql_fetch_row(SQLSOCK *sqlsocket, SQL_CONFIG *config) { rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; + long err_handle; + int state; sqlsocket->row = NULL; - if(SQLFetch(unixodbc_sock->stmt_handle) == SQL_NO_DATA_FOUND) - return 0; - - /* XXX Check if return suggests we should return error or SQL_DOWN */ - + err_handle = SQLFetch(unixodbc_sock->stmt_handle); + if(err_handle == SQL_NO_DATA_FOUND) + return 0; + if ((state = sql_state(err_handle, sqlsocket, config))) { + if(state == SQL_DOWN) + radlog(L_ERR, "rlm_sql_unixodbc: rlm_sql should attempt to reconnect\n"); + return state; + } sqlsocket->row = unixodbc_sock->row; return 0; } @@ -346,6 +353,41 @@ SQLINTEGER errornum = 0; SQLSMALLINT length = 255; static char result[1024]; /* NOT thread-safe! */ + + rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; + + SQLError( + unixodbc_sock->env_handle, + unixodbc_sock->dbc_handle, + unixodbc_sock->stmt_handle, + state, + &errornum, + error, + 256, + &length); + + sprintf(result, "%s %s", state, error); + result[sizeof(result) - 1] = '\0'; /* catch idiot thread issues */ + return result; +} + +/************************************************************************* + * + * Function: sql_state + * + * Purpose: Returns 0 for success, SQL_DOWN if the error was + * connection related or -1 for other errors + * + *************************************************************************/ +static int sql_state(long err_handle, SQLSOCK *sqlsocket, SQL_CONFIG *config) { + SQLCHAR state[256] = ""; + SQLCHAR error[256] = ""; + SQLINTEGER errornum = 0; + SQLSMALLINT length = 255; + int res = -1; + + if(SQL_SUCCEEDED(err_handle)) + return 0; /* on success, just return 0 */ rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; @@ -359,9 +401,25 @@ 256, &length); - sprintf(result, "%s %s", state, error); - result[sizeof(result) - 1] = '\0'; /* catch idiot thread issues */ - return result; + if(state[0] == '0') { + switch(state[1]) { + case '1': /* SQLSTATE 01 class contains info and warning messages */ + radlog(L_ERR, "rlm_sql_unixodbc: Warning %s %s\n", state, error); + case '0': /* SQLSTATE 00 class means success */ + res = 0; + break; + case '8': /* SQLSTATE 08 class describes various connection errors */ + radlog(L_ERR, "rlm_sql_unixodbc: SQL down %s %s\n", state, error); + res = SQL_DOWN; + break; + default: /* any other SQLSTATE means error */ + radlog(L_ERR, "rlm_sql_unixodbc: Error %s %s\n", state, error); + res = -1; + break; + } + } + + return res; } /************************************************************************* @@ -378,11 +436,9 @@ int affected_rows; err_handle = SQLRowCount(unixodbc_sock->stmt_handle, (SQLINTEGER *)&affected_rows); - if (!SQL_SUCCEEDED(err_handle)) - { - radlog(L_ERR, "rlm_sql_unixodbc: '%s'\n", sql_error(sqlsocket, config)); + if (sql_state(err_handle, sqlsocket, config)) return -1; - } + return affected_rows; } -------------------------------------PATCH ENDS HERE------------------------------------------ -- Best regards, Marko Dinic, System Engineer ----- YUnet International http://www.eunet.yu Dubrovacka 35/III, 11000 Belgrade Tel: +381 11 311 9901; Fax: + 381 11 311 9901 ----- This e-mail is confidential and intended only for the recipient. Unauthorized distribution, modification or disclosure of its contents is prohibited. If you have received this e-mail in error, please notify the sender by telephone +381 11 311 9901. -----

2 1

Fw: Help needed with MS-CHAP
by Charles Blake 28 Feb '06

28 Feb '06

I am sorry. I just want to know what happens when Radius receives a request with a MS-CHAP password, how it authenticates the user? Thank you, Charles ----- Original Message ----- From: "Alan DeKok" <aland(a)ox.org> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Friday, February 24, 2006 10:52 AM Subject: Re: Help needed with MS-CHAP > "Charles Blake" <charles(a)neutel.com> wrote: >> I just want to authenticate MS-CHAPv2 passwords. My question is: >> >> Where do I have those passwords in my Linux server? > > I've been trying to say you don't. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 3

freeBSD and freeRADIUS with mySQL
by eric＠gozippy.com 28 Feb '06

28 Feb '06

We've been trying to get freeradius, freebsd and mysql to all work together now for a week... If anyone has figured out how to do this - please let me know. There are literally hundreds of posts on various forums I found by googleing the errors and all are having the same issues... the ports for freeradius don't seem to install correctly, and when we build from lates binaries there is errors when trying to load mysql... In the mandrake 10.2 system I had - all I did was install mysqlxx-dev development extensions, and all was good... I can't find any support for freebsd. -grateful for any links or how-to's...

5 4

Help with log file format
by Walter Reynolds 28 Feb '06

28 Feb '06

For some reason my replies are not getting to the list. > Walter Reynolds <waltr(a)umich.edu> wrote: > > We have some tools that currently run some statistics on the radius > > accounting file. Well, we currently use a different radius server. With > > that in mind the log format is different. Is there a way to modify the > > format of the accounting log format? > > Which accounting log? The detail file? That's pretty much > unchanged since the original Livingston format 13 years ago. > > Could you be more specific, and say what should be changed, and to > what it should be changed? > > Alan DeKok. I apologize for not giving all the info, I am new to radius and am still learning. Yes I am refering to the detail file. Currently we have implemented a version of MERIT Radius. I know less about that than Freeradius, so forgive me if I do not give you what you need. Currently we have two files that appear to be accounting data to me. Following are what we get (I have removed IP info for safty sake) These two lines are from logfile.20060220 Mon Feb 20 13:07:12 2006: Received-Authentication: 63/62890 'waltr' from XXX.XXX.XXX.XXX port 9126 PPP Mon Feb 20 13:07:12 2006: Authentication: 63/62890 'waltr' from XXX.XXX.XXX.XXX port 9126 PPP - OK -- total 0, holding 0 No, what is more important to me os from the session.20060220.las file (mainly the first line) This is strange though as because Pre-Auth the accounting data is sent to the merit radius then forwarded to a freeradius and back. Either way this is the format of the merit radius and our scripts. NA NA 1140458855 20 20 waltr@ NA 'PROFILE' NA NA XXX.XXX.XXX.XXX/9126 NA NA Framed/PPP/XXX.XXX.XXX.XXX ## User-Name:0='waltr' Calling-Station-Id:0='XXX.XXX.XXX.XXX' Acct-Status-Type:1=Stop ## Acct-Input-Octets:1=1208 Acct-Output-Octets:1=1648 Acct-Session-Id:0='0B901E52' ## Acct-Input-Packets:1=11 Acct-Output-Packets:1=9 Acct-Terminate-Cause:1=User-Request ## Tunnel-Client-Endpoint:10=:49:'XXX.XXX.XXX.XXX' Acct-Authentic:1=RADIUS Acct-Delay-Time:1=0 ## NAS-IP-Address:2=XXX.XXX.XXX.XXX NAS-Port-Type:1=Virtual I hope this helps clear up my question. -- Walter Reynolds University of Michigan

2 1

rlm_eap: Handler failed in EAP/peap
by Agus Supriyadi 28 Feb '06

28 Feb '06

Dear All, I've got a problem with my freeradius. I've installed freeradius 1.1.0. I'm gonna using EAP/PEAP and MSCHAPv2. The radius returned Access-Reject message when I try to authenicate user. This is the debug message from freeradius: ------------------- BEGIN DEBUG ----------------------- rad_recv: Access-Request packet from host 128.16.100.2:21645, id=112, length=219 User-Name = "agus" Framed-MTU = 1400 Called-Station-Id = "0012.43f9.07f0" Calling-Station-Id = "0040.96a6.0915" Service-Type = Login-User Message-Authenticator = 0x035385584153738e930ae5647bba4e77 EAP-Message = 0x020900561900170301004bbeba44dea711ccc50b11d2b66d81c5ee2f2254128135c4bfbc0c8f56c11d93419377cb9061b873416e21389346112ea96d1078b7ad8db16c64b70d812a071923b02819bd681a5902ead889 NAS-Port-Type = Wireless-802.11 NAS-Port = 208 State = 0xbe8af775ecd2998b486819e32c8c5eb3 NAS-IP-Address = 128.16.100.2 NAS-Identifier = "iSpot" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "agus", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 86 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 rlm_passwd: Added LM-Password: 'B736D7A84FBDE543AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: 'AA4348E74FCFE5BB2061F2FF5C085304' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" modcall[authorize]: module "etc_smbpasswd" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to agus PEAP: Adding old state with e5 7c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "agus", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 rlm_passwd: Added LM-Password: 'B736D7A84FBDE543AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: 'AA4348E74FCFE5BB2061F2FF5C085304' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" modcall[authorize]: module "etc_smbpasswd" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 7 rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: Told to do MS-CHAPv2 for agus with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 60 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=agus --challenge=b7bc51d8fa48dfc5 --nt-response=09d697e7c477017b27c969c52b93deb49200295bda22bf6b' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=agus --challenge=b7bc51d8fa48dfc5 --nt-response=09d697e7c477017b27c969c52b93deb49200295bda22bf6b [2006/02/28 05:41:41, 0] utils/ntlm_auth.c:get_winbind_domain(140) could not obtain winbind domain name! Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: leaving group MS-CHAP (returns reject) for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: leaving group authenticate (returns reject) for request 7 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 112 to 128.16.100.2 port 21645 EAP-Message = 0x010a00261900170301001bce70eaa23461d24fc4ce2a1d288dd015b9c4c3640a8a4edb8bae92 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x475bad5b4f387d108835cc1a2cf108f0 Finished request 7 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Access-Request packet from host 128.16.100.2:21645, id=113, length=171 User-Name = "agus" Framed-MTU = 1400 Called-Station-Id = "0012.43f9.07f0" Calling-Station-Id = "0040.96a6.0915" Service-Type = Login-User Message-Authenticator = 0xc2617d78095ef05b9cac0310eb5d1793 EAP-Message = 0x020a00261900170301001bd67b9a87e9d765a68d39d4c7315696e06a111f82effe74aca9e9c0 NAS-Port-Type = Wireless-802.11 NAS-Port = 208 State = 0x475bad5b4f387d108835cc1a2cf108f0 NAS-IP-Address = 128.16.100.2 NAS-Identifier = "iSpot" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "agus", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 10 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 8 rlm_passwd: Added LM-Password: 'B736D7A84FBDE543AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: 'AA4348E74FCFE5BB2061F2FF5C085304' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" modcall[authorize]: module "etc_smbpasswd" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: leaving group authenticate (returns invalid) for request 8 auth: Failed to validate the user. ------------------- END DEBUG ----------------------- Can anybody tell me what happen with my freeradius? -- -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS d(-) s:- a--- C++(+++)$>++++$ UL$>++++$ P+? L++$>$ !E--- W++ !N !o !K-- w !O M !V PS PE !Y PGP t 5 X R tv b DI D G e h r y ------END GEEK CODE BLOCK------

2 3

authentication failure
by pelusa vali 28 Feb '06

28 Feb '06

hi everybody, i'm using debian sarge kernel 2.6.13, openssl 0.9.8a, hostapd 0.5.1, freeradius 1.0.5, madwifi-ng-r1406, i want to use eap-tls in my wlan and over my own ap over linux. so i can install and configure all programs (except hostapd, so instead compile myself i installed it from .deb format), now i have my certificates and programs running but when try to connect a windows client it always stops in this state: "Trying to authenticate", and any more happen. i generate certificates using winxp extensions and try to export and install them in winxp but always same behavior. clients cann't get ip direction, but before implementing this they could. here you have an extract from freeradius messages: --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.50.1:32771, id=14, length=250 User-Name = "Administrador" NAS-IP-Address = 192.168.50.1 NAS-Port = 0 Called-Station-Id = "00-0F-66-11-C1-97:WLAN1" Calling-Station-Id = "00-12-F0-BC-C1-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x021400500d800000004616030100410100003d03014403d116c1beab0d54a 903ac411f6de1bd9eaf339bf5ac89f9e0ff0a7410c68800001600040005000a0009006400620003000600 13001200630100 State = 0x6780e9b9e7fd2c531421b8437d11c9db Message-Authenticator = 0x11d975fb9373293a13b5a0b3ad2f6f1f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 19 modcall[authorize]: module "preprocess" returns ok for request 19 modcall[authorize]: module "chap" returns noop for request 19 modcall[authorize]: module "mschap" returns noop for request 19 rlm_realm: No '@' in User-Name = "Administrador", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 19 rlm_eap: EAP packet type response id 20 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 19 users: Matched entry Administrador at line 97 modcall[authorize]: module "files" returns ok for request 19 modcall: group authorize returns updated for request 19 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 19 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 025c], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0070], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 19 modcall: group authenticate returns handled for request 19 Sending Access-Challenge of id 14 to 192.168.50.1:32771 EAP-Message = 0x0115032f0d8000000325160301004a02000046030144038ac7e0a94b5017e c7050d18c3b7c7de8ae1b639249257f1753c48bc3ddee2014ad227cbde60e2c63a6cf9f2a85ae8ff8ba6a d0b3bca15b0ad6cc8e5e90703d000400160301025c0b0002580002550002523082024e308201b7a003020 102020428022006300d06092a864886f70d0101050500305f310b30090603550406130245433113301106 03550408130a4368696d626f72617a6f3111300f0603550407130852696f62616d6261310f300d0603550 40a13064553504f4348311730150603550403130e7777772e61706d6167612e636f6d301e170d30363032 32373135303735335a17 EAP-Message = 0x0d3037303232373135303735335a305f310b3009060355040613024543311 330110603550408130a4368696d626f72617a6f3111300f0603550407130852696f62616d6261310f300d 060355040a13064553504f4348311730150603550403130e7777772e61706d6167612e636f6d30819f300 d06092a864886f70d010101050003818d0030818902818100b94ddf014e77cbcc5b23133a98b77090353f 7b9fba6db33b2cd1510e8f8c8f533bcec923900dad61e3a0c02e04700c9c95856bdf7d559147a4afc8cb5 c38d410178d9552d322aedcce46483f7dd761e7583b1e6d075cd10727c0941416b9accb097baaec90b46c 04aef567ffd08c4acff6 EAP-Message = 0x88252d81a766ce4e63d9a21c774d970203010001a317301530130603551d2 5040c300a06082b06010505070301300d06092a864886f70d0101050500038181007f41e4ef50c1c77d45 0dee7b0b4372c3cb68163fec851512100ac72fc77d70a83fe87d93d1447842eb919bac6a0ad112b687550 ad520f50e4651cfde1246343e6f458a1501de2e4018dbfbb5658b9da522e6283e3d0ab083e8e344befc06 28d3ec0245dc672333ace70c8d44d0f1cfce9571c74a4ead43597c4567322e09954e16030100700d00006 802010200630061305f310b3009060355040613024543311330110603550408130a4368696d626f72617a 6f3111300f0603550407 EAP-Message = 0x130852696f62616d6261310f300d060355040a13064553504f43483117301 50603550403130e7777772e61706d6167612e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa544f4d0d0e97f26a36b397073d84dfc Finished request 19 and here is hostapd output: IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE ath0: RADIUS Received 68 bytes from RADIUS server ath0: RADIUS Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=12 length=68 Attribute 79 (EAP-Message) length=12 Value: 01 12 00 0a 0d 80 00 00 00 00 Attribute 80 (Message-Authenticator) length=18 Value: 27 c2 5d 33 9e 5a 62 db bc 26 d5 c6 5c 7f 62 4c Attribute 24 (State) length=18 Value: 39 24 c3 3e ed 0b 61 bd c2 95 36 bc 86 1e 47 bc ath0: STA 00:12:f0:bc:c1:68 RADIUS: Received RADIUS packet matched with a pendin g request, round trip time 0.00 sec RADIUS packet matching with station 00:12:f0:bc:c1:68 ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: using EAP timeout of 30 seconds ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: decapsulated EAP packet (code=1 id=18 l en=10) from RADIUS server: EAP-Request-TLS (13) IEEE 802.1X: 00:12:f0:bc:c1:68 BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:12:f0:bc:c1:68 (identifier 18) TX EAPOL - hexdump(len=28): 00 12 f0 bc c1 68 00 0f 66 11 c1 97 88 8e 02 00 00 0 a 01 12 00 0a 0d 80 00 00 00 00 IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE ath0: RADIUS Next RADIUS client retransmit in 75 seconds IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 - aWhile --> 0 IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: EAP timeout IEEE 802.1X: 5 bytes from 00:12:f0:bc:c1:68 IEEE 802.1X: version=1 type=1 length=0 ignoring 1 extra octets after IEEE 802.1X packet ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: received EAPOL-Start from STA ath0: STA 00:12:f0:bc:c1:68 WPA: event 5 notification WPA: 00:12:f0:bc:c1:68 WPA_PTK entering state AUTHENTICATION2 IEEE 802.1X: 00:12:f0:bc:c1:68 AUTH_PAE entering state ABORTING IEEE 802.1X: 00:12:f0:bc:c1:68 BE_AUTH entering state INITIALIZE ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: aborting authentication IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 AUTH_PAE entering state RESTART IEEE 802.1X: station 00:12:f0:bc:c1:68 - new auth session, clearing State IEEE 802.1X: Generated EAP Request-Identity for 00:12:f0:bc:c1:68 (identifier 19 , timeout 30) IEEE 802.1X: 00:12:f0:bc:c1:68 BE_AUTH entering state IDLE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 AUTH_PAE entering state CONNECTING IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 AUTH_PAE entering state AUTHENTICATING IEEE 802.1X: 00:12:f0:bc:c1:68 BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:12:f0:bc:c1:68 (identifier 19) TX EAPOL - hexdump(len=36): 00 12 f0 bc c1 68 00 0f 66 11 c1 97 88 8e 02 00 00 1 2 01 13 00 12 01 68 65 6c 6c 6f 5f 63 6c 69 65 6e 74 73 IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 22 bytes from 00:12:f0:bc:c1:68 IEEE 802.1X: version=1 type=0 length=18 EAP: code=2 identifier=19 length=18 (response) ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: received EAP packet (code=2 id=19 len=1 8) from STA: EAP Response-Identity (1) ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: STA identity 'Administrador' IEEE 802.1X: 00:12:f0:bc:c1:68 BE_AUTH entering state RESPONSE Encapsulating EAP message into a RADIUS packet ath0: RADIUS Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=13 length=170 Attribute 1 (User-Name) length=15 Value: 'Administrador' Attribute 4 (NAS-IP-Address) length=6 Value: 192.168.50.1 Attribute 5 (NAS-Port) length=6 Value: 0 Attribute 30 (Called-Station-Id) length=30 Value: '00-0F-66-11-C1-97:WLANESPOCH' Attribute 31 (Calling-Station-Id) length=19 Value: '00-12-F0-BC-C1-68' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=20 Value: 02 13 00 12 01 41 64 6d 69 6e 69 73 74 72 61 64 6f 72 Attribute 80 (Message-Authenticator) length=18 Value: 41 7b 75 d3 c0 21 4b 3e 18 3e 40 10 62 37 3c 9a ath0: RADIUS Next RADIUS client retransmit in 3 seconds so my questions are: 1) why client cann't authenticate to freeradius? maybe i'm missing any configuration or freeradius and hostapd aren't working well together? 2) as you can see in freeradius and hostapd output, they say: "CONNECT 11Mbps 802.11b", but my ap and clients are configured to work with 802.11g, why freeradius and hostapd detects 11b? 3) what does this mean: "TLS_accept:error in SSLv3 read client certificate A"? 4) is there any way i can test my certificates from freeradius?? any command? or may be install wpa-supplicant over my debian and test from there (authenticator and supplicant in same machine??). could any body try to help? i know these are many questions but i'm lost and don't know what to do. thanks in advance for your help and time. _________________________________________________________________ Charla con tus amigos en línea mediante MSN Messenger: http://messenger.latam.msn.com/

1 0

cutting User-Passwords after 8 chars
by Stefan Winter 28 Feb '06

28 Feb '06

Hello, while migrating some legacy auth to RADIUS, a problem has shown up with users that enter more than 8 chars as their password. The old system truncated the stored passwords after 8 chars, and if a user input more, his input as well got truncated. So, logging in with stored pass = "12345678" but entering "1234567890" worked. Now, with a RADIUS mySQL backend, we copied the stored passwords from the legacy system. Unfortuntely, users now get a failed login if they try to input the longer version, since stored pw and input don't match (which is prerfectly okay from the RADIUS pov). I solved (well, hacked) this by putting something in the hints file (yes, I really start to love hints - and blatantly plug: please incorporate bug #335): DEFAULT Client-IP-Address == X.Y.Z.A, User-Password =~ "(........)(.+)" User-Password := `%{1}` and it works (phew!). Now my question is, is there some more elegant way which I have just overlooked, or is that it? I am aware that the most elegant way is to tell the users that things changed, but no. Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0

authorization, when mysql is down.
by ???????, ?? ???????? 28 Feb '06

28 Feb '06

I have one more question about authorization with mysql. Can I give access to everyone, if suddenly my database will go down or will be corrupted? How to do it, if it is possible? ------------------------------------------------------------------------------- http://www.one.lv - Tavs mobilais e-pasts! Tagad lasi savu e-pastu ar mobilo telefonu - wap.one.lv!

1 0