- Freeradius-Users - lists.freeradius.org

freeBSD and freeRADIUS with mySQL
by eric＠gozippy.com 28 Feb '06

28 Feb '06

We've been trying to get freeradius, freebsd and mysql to all work together now for a week... If anyone has figured out how to do this - please let me know. There are literally hundreds of posts on various forums I found by googleing the errors and all are having the same issues... the ports for freeradius don't seem to install correctly, and when we build from lates binaries there is errors when trying to load mysql... In the mandrake 10.2 system I had - all I did was install mysqlxx-dev development extensions, and all was good... I can't find any support for freebsd. -grateful for any links or how-to's...

5 4

Help with log file format
by Walter Reynolds 28 Feb '06

28 Feb '06

For some reason my replies are not getting to the list. > Walter Reynolds <waltr(a)umich.edu> wrote: > > We have some tools that currently run some statistics on the radius > > accounting file. Well, we currently use a different radius server. With > > that in mind the log format is different. Is there a way to modify the > > format of the accounting log format? > > Which accounting log? The detail file? That's pretty much > unchanged since the original Livingston format 13 years ago. > > Could you be more specific, and say what should be changed, and to > what it should be changed? > > Alan DeKok. I apologize for not giving all the info, I am new to radius and am still learning. Yes I am refering to the detail file. Currently we have implemented a version of MERIT Radius. I know less about that than Freeradius, so forgive me if I do not give you what you need. Currently we have two files that appear to be accounting data to me. Following are what we get (I have removed IP info for safty sake) These two lines are from logfile.20060220 Mon Feb 20 13:07:12 2006: Received-Authentication: 63/62890 'waltr' from XXX.XXX.XXX.XXX port 9126 PPP Mon Feb 20 13:07:12 2006: Authentication: 63/62890 'waltr' from XXX.XXX.XXX.XXX port 9126 PPP - OK -- total 0, holding 0 No, what is more important to me os from the session.20060220.las file (mainly the first line) This is strange though as because Pre-Auth the accounting data is sent to the merit radius then forwarded to a freeradius and back. Either way this is the format of the merit radius and our scripts. NA NA 1140458855 20 20 waltr@ NA 'PROFILE' NA NA XXX.XXX.XXX.XXX/9126 NA NA Framed/PPP/XXX.XXX.XXX.XXX ## User-Name:0='waltr' Calling-Station-Id:0='XXX.XXX.XXX.XXX' Acct-Status-Type:1=Stop ## Acct-Input-Octets:1=1208 Acct-Output-Octets:1=1648 Acct-Session-Id:0='0B901E52' ## Acct-Input-Packets:1=11 Acct-Output-Packets:1=9 Acct-Terminate-Cause:1=User-Request ## Tunnel-Client-Endpoint:10=:49:'XXX.XXX.XXX.XXX' Acct-Authentic:1=RADIUS Acct-Delay-Time:1=0 ## NAS-IP-Address:2=XXX.XXX.XXX.XXX NAS-Port-Type:1=Virtual I hope this helps clear up my question. -- Walter Reynolds University of Michigan

2 1

rlm_eap: Handler failed in EAP/peap
by Agus Supriyadi 28 Feb '06

28 Feb '06

Dear All, I've got a problem with my freeradius. I've installed freeradius 1.1.0. I'm gonna using EAP/PEAP and MSCHAPv2. The radius returned Access-Reject message when I try to authenicate user. This is the debug message from freeradius: ------------------- BEGIN DEBUG ----------------------- rad_recv: Access-Request packet from host 128.16.100.2:21645, id=112, length=219 User-Name = "agus" Framed-MTU = 1400 Called-Station-Id = "0012.43f9.07f0" Calling-Station-Id = "0040.96a6.0915" Service-Type = Login-User Message-Authenticator = 0x035385584153738e930ae5647bba4e77 EAP-Message = 0x020900561900170301004bbeba44dea711ccc50b11d2b66d81c5ee2f2254128135c4bfbc0c8f56c11d93419377cb9061b873416e21389346112ea96d1078b7ad8db16c64b70d812a071923b02819bd681a5902ead889 NAS-Port-Type = Wireless-802.11 NAS-Port = 208 State = 0xbe8af775ecd2998b486819e32c8c5eb3 NAS-IP-Address = 128.16.100.2 NAS-Identifier = "iSpot" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "agus", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 86 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 rlm_passwd: Added LM-Password: 'B736D7A84FBDE543AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: 'AA4348E74FCFE5BB2061F2FF5C085304' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" modcall[authorize]: module "etc_smbpasswd" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to agus PEAP: Adding old state with e5 7c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "agus", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 rlm_passwd: Added LM-Password: 'B736D7A84FBDE543AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: 'AA4348E74FCFE5BB2061F2FF5C085304' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" modcall[authorize]: module "etc_smbpasswd" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 7 rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: Told to do MS-CHAPv2 for agus with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 60 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=agus --challenge=b7bc51d8fa48dfc5 --nt-response=09d697e7c477017b27c969c52b93deb49200295bda22bf6b' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=agus --challenge=b7bc51d8fa48dfc5 --nt-response=09d697e7c477017b27c969c52b93deb49200295bda22bf6b [2006/02/28 05:41:41, 0] utils/ntlm_auth.c:get_winbind_domain(140) could not obtain winbind domain name! Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: leaving group MS-CHAP (returns reject) for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: leaving group authenticate (returns reject) for request 7 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 112 to 128.16.100.2 port 21645 EAP-Message = 0x010a00261900170301001bce70eaa23461d24fc4ce2a1d288dd015b9c4c3640a8a4edb8bae92 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x475bad5b4f387d108835cc1a2cf108f0 Finished request 7 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Access-Request packet from host 128.16.100.2:21645, id=113, length=171 User-Name = "agus" Framed-MTU = 1400 Called-Station-Id = "0012.43f9.07f0" Calling-Station-Id = "0040.96a6.0915" Service-Type = Login-User Message-Authenticator = 0xc2617d78095ef05b9cac0310eb5d1793 EAP-Message = 0x020a00261900170301001bd67b9a87e9d765a68d39d4c7315696e06a111f82effe74aca9e9c0 NAS-Port-Type = Wireless-802.11 NAS-Port = 208 State = 0x475bad5b4f387d108835cc1a2cf108f0 NAS-IP-Address = 128.16.100.2 NAS-Identifier = "iSpot" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "agus", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 10 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 8 rlm_passwd: Added LM-Password: 'B736D7A84FBDE543AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: 'AA4348E74FCFE5BB2061F2FF5C085304' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" modcall[authorize]: module "etc_smbpasswd" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: leaving group authenticate (returns invalid) for request 8 auth: Failed to validate the user. ------------------- END DEBUG ----------------------- Can anybody tell me what happen with my freeradius? -- -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS d(-) s:- a--- C++(+++)$>++++$ UL$>++++$ P+? L++$>$ !E--- W++ !N !o !K-- w !O M !V PS PE !Y PGP t 5 X R tv b DI D G e h r y ------END GEEK CODE BLOCK------

2 3

authentication failure
by pelusa vali 28 Feb '06

28 Feb '06

hi everybody, i'm using debian sarge kernel 2.6.13, openssl 0.9.8a, hostapd 0.5.1, freeradius 1.0.5, madwifi-ng-r1406, i want to use eap-tls in my wlan and over my own ap over linux. so i can install and configure all programs (except hostapd, so instead compile myself i installed it from .deb format), now i have my certificates and programs running but when try to connect a windows client it always stops in this state: "Trying to authenticate", and any more happen. i generate certificates using winxp extensions and try to export and install them in winxp but always same behavior. clients cann't get ip direction, but before implementing this they could. here you have an extract from freeradius messages: --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.50.1:32771, id=14, length=250 User-Name = "Administrador" NAS-IP-Address = 192.168.50.1 NAS-Port = 0 Called-Station-Id = "00-0F-66-11-C1-97:WLAN1" Calling-Station-Id = "00-12-F0-BC-C1-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x021400500d800000004616030100410100003d03014403d116c1beab0d54a 903ac411f6de1bd9eaf339bf5ac89f9e0ff0a7410c68800001600040005000a0009006400620003000600 13001200630100 State = 0x6780e9b9e7fd2c531421b8437d11c9db Message-Authenticator = 0x11d975fb9373293a13b5a0b3ad2f6f1f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 19 modcall[authorize]: module "preprocess" returns ok for request 19 modcall[authorize]: module "chap" returns noop for request 19 modcall[authorize]: module "mschap" returns noop for request 19 rlm_realm: No '@' in User-Name = "Administrador", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 19 rlm_eap: EAP packet type response id 20 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 19 users: Matched entry Administrador at line 97 modcall[authorize]: module "files" returns ok for request 19 modcall: group authorize returns updated for request 19 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 19 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 025c], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0070], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 19 modcall: group authenticate returns handled for request 19 Sending Access-Challenge of id 14 to 192.168.50.1:32771 EAP-Message = 0x0115032f0d8000000325160301004a02000046030144038ac7e0a94b5017e c7050d18c3b7c7de8ae1b639249257f1753c48bc3ddee2014ad227cbde60e2c63a6cf9f2a85ae8ff8ba6a d0b3bca15b0ad6cc8e5e90703d000400160301025c0b0002580002550002523082024e308201b7a003020 102020428022006300d06092a864886f70d0101050500305f310b30090603550406130245433113301106 03550408130a4368696d626f72617a6f3111300f0603550407130852696f62616d6261310f300d0603550 40a13064553504f4348311730150603550403130e7777772e61706d6167612e636f6d301e170d30363032 32373135303735335a17 EAP-Message = 0x0d3037303232373135303735335a305f310b3009060355040613024543311 330110603550408130a4368696d626f72617a6f3111300f0603550407130852696f62616d6261310f300d 060355040a13064553504f4348311730150603550403130e7777772e61706d6167612e636f6d30819f300 d06092a864886f70d010101050003818d0030818902818100b94ddf014e77cbcc5b23133a98b77090353f 7b9fba6db33b2cd1510e8f8c8f533bcec923900dad61e3a0c02e04700c9c95856bdf7d559147a4afc8cb5 c38d410178d9552d322aedcce46483f7dd761e7583b1e6d075cd10727c0941416b9accb097baaec90b46c 04aef567ffd08c4acff6 EAP-Message = 0x88252d81a766ce4e63d9a21c774d970203010001a317301530130603551d2 5040c300a06082b06010505070301300d06092a864886f70d0101050500038181007f41e4ef50c1c77d45 0dee7b0b4372c3cb68163fec851512100ac72fc77d70a83fe87d93d1447842eb919bac6a0ad112b687550 ad520f50e4651cfde1246343e6f458a1501de2e4018dbfbb5658b9da522e6283e3d0ab083e8e344befc06 28d3ec0245dc672333ace70c8d44d0f1cfce9571c74a4ead43597c4567322e09954e16030100700d00006 802010200630061305f310b3009060355040613024543311330110603550408130a4368696d626f72617a 6f3111300f0603550407 EAP-Message = 0x130852696f62616d6261310f300d060355040a13064553504f43483117301 50603550403130e7777772e61706d6167612e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa544f4d0d0e97f26a36b397073d84dfc Finished request 19 and here is hostapd output: IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE ath0: RADIUS Received 68 bytes from RADIUS server ath0: RADIUS Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=12 length=68 Attribute 79 (EAP-Message) length=12 Value: 01 12 00 0a 0d 80 00 00 00 00 Attribute 80 (Message-Authenticator) length=18 Value: 27 c2 5d 33 9e 5a 62 db bc 26 d5 c6 5c 7f 62 4c Attribute 24 (State) length=18 Value: 39 24 c3 3e ed 0b 61 bd c2 95 36 bc 86 1e 47 bc ath0: STA 00:12:f0:bc:c1:68 RADIUS: Received RADIUS packet matched with a pendin g request, round trip time 0.00 sec RADIUS packet matching with station 00:12:f0:bc:c1:68 ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: using EAP timeout of 30 seconds ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: decapsulated EAP packet (code=1 id=18 l en=10) from RADIUS server: EAP-Request-TLS (13) IEEE 802.1X: 00:12:f0:bc:c1:68 BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:12:f0:bc:c1:68 (identifier 18) TX EAPOL - hexdump(len=28): 00 12 f0 bc c1 68 00 0f 66 11 c1 97 88 8e 02 00 00 0 a 01 12 00 0a 0d 80 00 00 00 00 IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE ath0: RADIUS Next RADIUS client retransmit in 75 seconds IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 - aWhile --> 0 IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: EAP timeout IEEE 802.1X: 5 bytes from 00:12:f0:bc:c1:68 IEEE 802.1X: version=1 type=1 length=0 ignoring 1 extra octets after IEEE 802.1X packet ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: received EAPOL-Start from STA ath0: STA 00:12:f0:bc:c1:68 WPA: event 5 notification WPA: 00:12:f0:bc:c1:68 WPA_PTK entering state AUTHENTICATION2 IEEE 802.1X: 00:12:f0:bc:c1:68 AUTH_PAE entering state ABORTING IEEE 802.1X: 00:12:f0:bc:c1:68 BE_AUTH entering state INITIALIZE ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: aborting authentication IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 AUTH_PAE entering state RESTART IEEE 802.1X: station 00:12:f0:bc:c1:68 - new auth session, clearing State IEEE 802.1X: Generated EAP Request-Identity for 00:12:f0:bc:c1:68 (identifier 19 , timeout 30) IEEE 802.1X: 00:12:f0:bc:c1:68 BE_AUTH entering state IDLE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 AUTH_PAE entering state CONNECTING IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 AUTH_PAE entering state AUTHENTICATING IEEE 802.1X: 00:12:f0:bc:c1:68 BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:12:f0:bc:c1:68 (identifier 19) TX EAPOL - hexdump(len=36): 00 12 f0 bc c1 68 00 0f 66 11 c1 97 88 8e 02 00 00 1 2 01 13 00 12 01 68 65 6c 6c 6f 5f 63 6c 69 65 6e 74 73 IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:12:f0:bc:c1:68 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 22 bytes from 00:12:f0:bc:c1:68 IEEE 802.1X: version=1 type=0 length=18 EAP: code=2 identifier=19 length=18 (response) ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: received EAP packet (code=2 id=19 len=1 8) from STA: EAP Response-Identity (1) ath0: STA 00:12:f0:bc:c1:68 IEEE 802.1X: STA identity 'Administrador' IEEE 802.1X: 00:12:f0:bc:c1:68 BE_AUTH entering state RESPONSE Encapsulating EAP message into a RADIUS packet ath0: RADIUS Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=13 length=170 Attribute 1 (User-Name) length=15 Value: 'Administrador' Attribute 4 (NAS-IP-Address) length=6 Value: 192.168.50.1 Attribute 5 (NAS-Port) length=6 Value: 0 Attribute 30 (Called-Station-Id) length=30 Value: '00-0F-66-11-C1-97:WLANESPOCH' Attribute 31 (Calling-Station-Id) length=19 Value: '00-12-F0-BC-C1-68' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=20 Value: 02 13 00 12 01 41 64 6d 69 6e 69 73 74 72 61 64 6f 72 Attribute 80 (Message-Authenticator) length=18 Value: 41 7b 75 d3 c0 21 4b 3e 18 3e 40 10 62 37 3c 9a ath0: RADIUS Next RADIUS client retransmit in 3 seconds so my questions are: 1) why client cann't authenticate to freeradius? maybe i'm missing any configuration or freeradius and hostapd aren't working well together? 2) as you can see in freeradius and hostapd output, they say: "CONNECT 11Mbps 802.11b", but my ap and clients are configured to work with 802.11g, why freeradius and hostapd detects 11b? 3) what does this mean: "TLS_accept:error in SSLv3 read client certificate A"? 4) is there any way i can test my certificates from freeradius?? any command? or may be install wpa-supplicant over my debian and test from there (authenticator and supplicant in same machine??). could any body try to help? i know these are many questions but i'm lost and don't know what to do. thanks in advance for your help and time. _________________________________________________________________ Charla con tus amigos en línea mediante MSN Messenger: http://messenger.latam.msn.com/

1 0

cutting User-Passwords after 8 chars
by Stefan Winter 28 Feb '06

28 Feb '06

Hello, while migrating some legacy auth to RADIUS, a problem has shown up with users that enter more than 8 chars as their password. The old system truncated the stored passwords after 8 chars, and if a user input more, his input as well got truncated. So, logging in with stored pass = "12345678" but entering "1234567890" worked. Now, with a RADIUS mySQL backend, we copied the stored passwords from the legacy system. Unfortuntely, users now get a failed login if they try to input the longer version, since stored pw and input don't match (which is prerfectly okay from the RADIUS pov). I solved (well, hacked) this by putting something in the hints file (yes, I really start to love hints - and blatantly plug: please incorporate bug #335): DEFAULT Client-IP-Address == X.Y.Z.A, User-Password =~ "(........)(.+)" User-Password := `%{1}` and it works (phew!). Now my question is, is there some more elegant way which I have just overlooked, or is that it? I am aware that the most elegant way is to tell the users that things changed, but no. Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0

authorization, when mysql is down.
by ???????, ?? ???????? 28 Feb '06

28 Feb '06

I have one more question about authorization with mysql. Can I give access to everyone, if suddenly my database will go down or will be corrupted? How to do it, if it is possible? ------------------------------------------------------------------------------- http://www.one.lv - Tavs mobilais e-pasts! Tagad lasi savu e-pastu ar mobilo telefonu - wap.one.lv!

1 0

Linksys and Dlink access Point does not authenticate to FreeRadius 1.1.0 server
by Michael Calizo 28 Feb '06

28 Feb '06

Hi, I have a Dlink DI-824VUP+ wireless VPN router, Freeradius 1.1.0 server. My free radius is working, I can authenticate using radtest on both localhost and remote host. But when i try to use my Dlink access point to authenticate on freeradius nothing happened. My Dlink config looks like this: Network ID: myWIFI Chanel: 6 Security: WAP *802.1X Settings * Radius Server: 192.168.1.12 Radius Port: 1812 Shared Key: test123 When I issue radiusd -x nothing is happening using Dlink. But when I use radtest it authenticates. Thnx alot.. -- Mike Calizo Registered Linux User # 365113 _________________________________________________ Even the longest journey has to start with a small first-step

1 0

Is it possible to make PAP module understand both CRYPT (MD5) and plaintext passwords?
by Alex Savguira 27 Feb '06

27 Feb '06

Having pap pap{ encryption_scheme = crypt } pap papplain{ encryption_scheme = clear } .... Auth-Type PAP { pap } Auth-Type PAPPLAIN { papplain } in radiusd.conf having user1 Crypt-Password := blablaencrypted user2 User-Password := blablacleartext in radcheck table. having pptp Auth-Type := PAPPLAIN dialup Auth-Type := pap in radgroupcheck having user1 ppttp user2 dialup in user groups... In fact I have added extra logic to the custom dialup-admin clone I am running to make it select the right attribute and ecnryption scheme or none for user depending on his/her membership in a certain group. Regards Alex.

2 1

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 27 Feb '06

27 Feb '06

Alan, I've solved my problems already... I've even finished the custom modification to dialup-admin which takes care of changing the Crypt-Passwords to User-Passwords for users accessing the new services. Thanks for clearing things up... >> btest | NT-Password | == | NT-hashbla-bla-bla^&&@0-3443 >> btest | Crypt-Password | == | $$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1 > Which is exactly what I keep saying is not needed, and is causing > problems for you. OK, I understood your point, but would you be so kind to explain WHY do you think it is such a bad idea (besides the fact that it doesn't work with the current version of rlm_sql)... The solution seems to be perfectly logical: - none of the network technitians on-site can abuse user's passwords since they are encrypted and supposedly beyound their cracking abilities, and both PAP and MS-CHAP should work... OK, again, it doesn't work NOW, but why shouldn't it? What's so evil about this configuration? Btw, in freeradius FAQ you, guys, claim, that PAP is better than CHAP because it allows storing passwords in encrypted form. I kinda agree with that... Why do you now claim that storing in clear text is better? Ok, it is less headache for me, but what about privacy rights of my users? Thanks Alex

3 2

RE: type of lvalue in VALUE_PAIR
by Jonathan De Graeve 27 Feb '06

27 Feb '06

> -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens Alan > DeKok > Verzonden: maandag 27 februari 2006 23:17 > Aan: edvin.seferovic(a)kolp.at; FreeRadius users mailing list > Onderwerp: Re: type of lvalue in VALUE_PAIR > > "Seferovic Edvin" <edvin.seferovic(a)kolp.at> wrote: > > Okay - but I suppose I will have to patch my NAS ( Poptop server ) to > use > > Acct-Input-GigaWords and Output- instead of Octets. Still if I patch my > NAS > > to send GigaWords.. when I use sqlcounter to count the MBs I will still > not > > be able to compare the check-name which is written into uint32 variable. > > Shouldn't this be patched too ( I am not a professional programmer - so > > excuse my "silly" question ). > > Yes, but that doesn't have much to do with RADIUS attributes. > > If your NAS doesn't send the Gigawords attributes, then why are you > worried about people using more than 4G of traffic? Your NAS will > never tell the server that the user had more than 4G of traffic. > The nice thingy about this is that most nasses just wrap around 2GB (2^31, signed int instead of 2^32,unsigned int) > > Poptop server accepts Session-Octets-Limit for the traffic limit ( > actually > > it is ppp that is doing the limiting ). So Ive added this attribute to > my > > dictionary. PPP also needs Octets-Direction so it can know which traffic > > flow to count. Ive added both attributes and it is working ( for 2^32 ). > > Ah, Ok. > > > Can you give me some directives how to implement this. Maybe to extend > the > > config of sqlcounter and value_pair struct? > > I don't see how that will help if your NAS doesn't send the Gigaword > attributes. > > If it does send them, then yes, you'll have to update the sqlcounter > module to handle 64-bit numbers. But you don't need to update any of > the valuepair structures. You could do it by using a multiplicator, say using kbytes/mbytes instead of bits/bytes. That will save you the 64-bit numbering within sqlcounter. SQL can handle this with the builtin calculation functions J.

1 0