- Freeradius-Users - lists.freeradius.org

RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]
by Bohannan, Chad W 01 Dec '05

01 Dec '05

Hello, I am attempting to have FR authenticate administrative access for my Cisco gear against AD. The problem I am having is this. When I attempt to join the realm <<net ads join -U UID>> the command appears successful and from the AD side, the system has joined (visable in AD), however the proccess hangs on the FR side. If I stop the process and reissue the command, I get the following output and the process again hangs: [2005/12/01 11:08:36, 0] libads/ldap.c:ads_add_machine_acct(1405) ads_add_machine_acct: Host account for rws-radius01 already exists - modifying old account <<ntlm_auth --request-nt-key --domain=mydomain --username= \myuid>> NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) <<wbinfo -a UID%PASSWD>> plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user UID%PASSWD with plaintext password challenge/response password authentication failed error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO Could not authenticate user UID with challenge/response I am sure there is something simple I have overlooked, but I am unable to find it at this point. Any suggestions would be much appreciated. Chad -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of charles schwartz Sent: Tuesday, November 22, 2005 11:28 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial] Hi list, A lot of people on this list would like to integrate Active Directory with FreeRADIUS in order to provide a transparent user authentication login process. There are at least 2 ways to integrate AD: LDAP and NTLM. I've written a tutorial about how to do this with NTLM (winbind, ntlm_auth). The Windows supplicants are configured to work with PEAP and MSCHAPv2. You can download it from here: http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tutorial.pdf Good luck! Regards, Charles Schwartz - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

IP address allocation based on Calling-station-id
by Matias E. Fabiano 01 Dec '05

01 Dec '05

Hi all, I have an application running on a server which stores data sent from GPRS phones. In order to do it without traversing the internet, the telco created me an APN which my GPRS phones will use to connect to my server. But my server's application also needs to connect back to the phones, for example, to reprogramm some parameters, and I can't do it because the phone's IPs are changing all the time. One way to solve it is assign IP address statically. So, they told me that what I can do is set up a table on my Radius server with all my phone numbers on one column and the desired IP address on the other, so everytime the user logs in and requests an IP address, i'll assign the same. I've runned some tests and the phone's number comes on the calling-station-id attribute, inside the authentication request. Is possible on freeradius to assign IP address based on the calling-station-id attribute? How can I accomplish this? Best regards and thanks!!!

1 0

802.1x ldap tls
by Paolo Barbato 01 Dec '05

01 Dec '05

Hi list, yes I know that this question has been discussed so many times but, still I'm in trouble. I've set up freeradius in order to authenticate+authorize Cisco NAS of Aironet. I've successfully connected PC/MAC wireless clients using TTLS+PAP with in backend and LDAP DB. Problem arise when I try to make the same with TLS, I mean PEAP+MSCHAP and LDAP DB. THis doesn't works. If I set a local user in users file, that is good, but if I try a LDAP user nothing come. LDAP store plain password. Some hints ? Here, some extracts from log: rlm_ldap: - authorize rlm_ldap: performing user authorization for myRfx radius_xlat: '(uid=myRfx)' radius_xlat: 'o=Consorzio RFX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=Consorzio RFX, with filter (uid=myRfx) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user myRfx authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 9 modcall: group authorize returns updated for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 9 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for myRfx with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 9 modcall: group Auth-Type returns reject for request 9 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 9 modcall: group authenticate returns reject for request 9 auth: Failed to validate the user. Login incorrect: [myRfx/<no User-Password attribute>] (from client localhost port 0) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\tE=691 R=1" EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x9db3b30 3 MS-CHAP-Error = "\tE=691 R=1" EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 9 modcall: group authenticate returns handled for request 9 Sending Access-Challenge of id 239 to 150.178.33.150:1645 EAP-Message = 0x010a002a1900170301001f1daf025ff66ee7cba51f42762f540bf78052e745788d4144c9705681d67359 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2846493df32aa5a3d90a7d4d8c3b4867 Finished request 9 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 150.178.33.150:1645, id=240, length=176 User-Name = "myRfx" Framed-MTU = 1400 Called-Station-Id = "0011.2075.ab11" Calling-Station-Id = "0030.6519.c496" Service-Type = Login-User Message-Authenticator = 0x33f13f5d35c399dbc0f3422dc2c798d9 EAP-Message = 0x020a002a1900170301001fa1cae4d87f9f3e55c42ec8b99729dadddf42ba9a8f4eba029615a9ece90eff NAS-Port-Type = Wireless-802.11 NAS-Port = 12652 State = 0x2846493df32aa5a3d90a7d4d8c3b4867 NAS-IP-Address = 150.178.33.150 NAS-Identifier = "NET26" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 10 modcall[authorize]: module "preprocess" returns ok for request 10 modcall[authorize]: module "chap" returns noop for request 10 modcall[authorize]: module "mschap" returns noop for request 10 rlm_realm: No '@' in User-Name = "myRfx", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 10 rlm_eap: EAP packet type response id 10 length 42 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 10 modcall[authorize]: module "files" returns notfound for request 10 rlm_ldap: - authorize rlm_ldap: performing user authorization for myRfx radius_xlat: '(uid=myRfx)' radius_xlat: 'o=Consorzio RFX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=Consorzio RFX, with filter (uid=myRfx) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user myRfx authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 10 modcall: group authorize returns updated for request 10 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 10 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 10 modcall: group authenticate returns invalid for request 10 auth: Failed to validate the user. Login incorrect: [myRfx/<no User-Password attribute>] (from client rfxnet1 port 12652 cli 0030.6519.c496) Delaying request 10 for 1 seconds Finished request 10 Going to the next request Regards, Paolo. -- ------------------------------------------------------------------------------------------------ Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it Network Administrator phone: (39-049)-829-5097 (39-049)-829-5000 Corso Stati Uniti,4 www: http://www.igi.cnr.it 35127 Camin-Padova PGP: http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org ------------------------------------------------------------------------------------------------

2 3

WLAN 802.1x FreeRadius with LDAP
by Christian Poessinger 01 Dec '05

01 Dec '05

Hello folks, I want to do a setup with a HP Procurve 520wl Access Point, OpenLDAP and FreeRadius with 802.1x and users in my LDAP backend. LDAP and Radius works fine, when i do a radtest user pass radius.domain.tld 0 secret i get an access accept package back. Now i configured my AP to use the Radius server for 802.1x auth, when i want to logon into the WLAN I enter my user and pass that just worked with radtest but I recieve an acces reject package. This is really strange cause the Radius debug mode tells me LDAP connection successfull. I use clear passwords in the backend, so there should be no problem. Anyone has an idea for my problem? Here is the Radius debug message with the access reject packet: rlm_ldap: - authorize rlm_ldap: performing user authorization for user radius_xlat: '(uid=user)' radius_xlat: 'ou=people,dc=domain,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=de, with filter (uid=user) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 11 to xxx.xxx.164.26:6001 EAP-Message = 0x0105040619407c917840ad1cf254e5ca549ca9b1053de4de1e704dc6eb9cec86a35eafabe5 2f60e8ee1a9697a755a713be14acd2db7f3402acb70864e3139ef470c900d024f2fd0f455b94 028c87d7a170ce86f302e35c4e658d09f17016227f0003cf308203cb30820334a00302010202 0900927540ab5d693004300d06092a864886f70d01010405003081a0310b3009060355040613 0244453110300e06035504081307426176617269613112301006035504071309577565727a62 75726731163014060355040a130d4765466f656b6f4d20652e562e31193017060355040b1310 4765466f656b6f4d20652e562e20434131193017060355040313 EAP-Message = 0x104765466f656b6f4d20652e562e204341311d301b06092a864886f70d010901160e636140 6765666f656b6f6d2e6465301e170d3035303531363137313832335a170d3036303531363137 313832335a3081a0310b30090603550406130244453110300e06035504081307426176617269 613112301006035504071309577565727a6275726731163014060355040a130d4765466f656b 6f4d20652e562e31193017060355040b13104765466f656b6f4d20652e562e20434131193017 060355040313104765466f656b6f4d20652e562e204341311d301b06092a864886f70d010901 160e6361406765666f656b6f6d2e646530819f300d06092a8648 EAP-Message = 0x86f70d010101050003818d0030818902818100c8124b32b761710b8c576a5b8f566a1dd8cc 97c423dfd8901cd58b9e90960328233879b3a09ebda855dbaa4376c00318ebc1767173051ae1 5995a1d41c9a6289707d5f7dd1e608ca5071e2aeb99092204f9386789c9ec8d5f754a26e9940 297ffbe547b5d0cf5ee16566abcc7578e25ac6a3b5e57befee43f2828174d27db19f02030100 01a382010930820105301d0603551d0e04160414ac6e4891d5a749d6548d7eda627ca2d64d12 d2693081d50603551d230481cd3081ca8014ac6e4891d5a749d6548d7eda627ca2d64d12d269 a181a6a481a33081a0310b30090603550406130244453110300e EAP-Message = 0x06035504081307426176617269613112301006035504071309577565727a62757267311630 14060355040a130d4765466f656b6f4d20652e562e31193017060355040b13104765466f656b 6f4d20652e562e20434131193017060355040313104765466f656b6f4d20652e562e20434131 1d301b06092a864886f70d010901160e6361406765666f656b6f6d2e6465820900927540ab5d 693004300c0603551d13040530030101ff300d06092a864886f70d0101040500038181004a36 34f23e46d180ec87122ee39ba0c6757d22a23ec39a38e3f282e82efb7428b83d04f665e28b00 e99a88217803c1abb4a0bc90fe6a51a37eec1c1868853a5436d5 EAP-Message = 0x9035f217c35ab4d53d6f1e3d11cdeabc9f77 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc479631c6d6d413371d8af0ebf14ac4f Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host xxx.xxx.164.26:6001, id=12, length=155 User-Name = "user" NAS-IP-Address = xxx.xxx.1.66 Called-Station-Id = "00-08-88-12-2e-3f" Calling-Station-Id = "00-0d-37-ab-2f-c7" NAS-Identifier = "ORiNOCO-AP-2000-00-02-00" State = 0xc479631c6d6d413371d8af0ebf14ac4f Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0xb07e446b64197c49b0ebaca6e799dc53 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for user radius_xlat: '(uid=user)' radius_xlat: 'ou=people,dc=domain,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=de, with filter (uid=user) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 12 to xxx.xxx.164.26:6001 EAP-Message = 0x0106003b1900715e896f163c5ccb279cd28b82295a1bd493ac86f6ffe4733d43f380f4871b 567d14ecb8d5171f15de61995e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xccbffd45885465294711dc5bf8395320 Finished request 3 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host xxx.xxx.164.26:6001, id=13, length=341 User-Name = "user" NAS-IP-Address = xxx.xxx.1.66 Called-Station-Id = "00-08-88-12-2e-3f" Calling-Station-Id = "00-0d-37-ab-2f-c7" NAS-Identifier = "ORiNOCO-AP-2000-00-02-00" State = 0xccbffd45885465294711dc5bf8395320 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600c01980000000b616030100861000008200801942772db96a99e5e538cb1d5d208967 b1353ea1158512bb1bd050ab7e2aca218fe43e45fbb41a076a2a0dad179b456de8d7afce55b7 c72e125ebe3bb4c42ff4804ded92a10e29c9f021a9dcfe7cac9c60fc41d1be343c7cb74b2889 5a5855e476b79b5db1fea73e1d0615baa9bfcca6004b37f7ebc2ef0f54e6d38ba0c57a631403 010001011603010020340f13326352d4d4b739b0a1d5350db6b211be3d1b16345f3429ce4875 18e879 Message-Authenticator = 0x1379379ef003130e6e5d8bc4ea849160 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for user radius_xlat: '(uid=user)' radius_xlat: 'ou=people,dc=domain,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=de, with filter (uid=user) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 13 to xxx.xxx.164.26:6001 EAP-Message = 0x0107003119001403010001011603010020eb7dbacfe1675927e1f3fcf8e5f61914d375ca69 10fcded8e503adb2dbfccbff Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbe4b1111c47a456a9bbe659aa28a4911 Finished request 4 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host xxx.xxx.164.26:6001, id=14, length=182 User-Name = "user" NAS-IP-Address = xxx.xxx.1.66 Called-Station-Id = "00-08-88-12-2e-3f" Calling-Station-Id = "00-0d-37-ab-2f-c7" NAS-Identifier = "ORiNOCO-AP-2000-00-02-00" State = 0xbe4b1111c47a456a9bbe659aa28a4911 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700211980000000171503010012a389dbe218dce122f0104ff21769ccb64b2b Message-Authenticator = 0xca07ce402c4e46c7342a2abc05383cab Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 7 length 33 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for user radius_xlat: '(uid=user)' radius_xlat: 'ou=people,dc=domain,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=de, with filter (uid=user) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: group authenticate returns invalid for request 5 auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host xxx.xxx.164.26:6001, id=14, length=182 Sending Access-Reject of id 14 to xxx.xxx.164.26:6001 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 9 with timestamp 43886940 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 10 with timestamp 43886941 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 11 with timestamp 43886942 Cleaning up request 3 ID 12 with timestamp 43886942 Cleaning up request 4 ID 13 with timestamp 43886942 Cleaning up request 5 ID 14 with timestamp 43886942 Nothing to do. Sleeping until we see a request.

8 26

CPU - FR1.0.5
by Breuer Nicolas 01 Dec '05

01 Dec '05

Hello all, I've a problem with FR 1.0.5. I've installed it on an old server Pentium Intel 3 (no multi-threading) i've installed FR1.0.5 and radiusd take all CPU !! after a while, requests aren't more served.. kernel : Linux 2.6.9-1.667 #1 When i launch radiusd with -s option there is no problem.. Do you have an explication ? kernel is compiled with no multi-threading. I've an other radiusd on a pentium 4 with multi-threading and i have no problems on this server.. Thanks

3 3

Re: Fall-through and different NAS IP Settings
by Curt LeCaptain 30 Nov '05

30 Nov '05

As always, run it in debugging mode. You would see the answer. In this case, NAS-IP-Address is an attribute in the RADIUS packet. So if the NAS doesn't send it, it doesn't match that entry. Okay, so I'm looking at my radiusd -X output and here's what I get on a access-request: rad_recv: Access-Request packet from host ip.add.re.ss:21737, id=82, length=84 Framed-Protocol = PPP User-Name = "user(a)domain.com" User-Password = "drb2859" NAS-Port-Type = Virtual NAS-Port = 81185 Service-Type = Framed-User NAS-IP-Address = ip.add.re.ss I'm just asking this for my understanding, am I still going to want to use Client-IP-Address even though from what I can see here, the NAS-IP-Address attribute is appearing within the output of debugging? Thanks, Curt LeCaptain

2 1

error in configurable failover?
by Norbert Wegener 30 Nov '05

30 Nov '05

I am trying to get configurable failover working.(ok, this example is not yet that far) With authenticate { #ldap1 group { ldap1 { notfound = return } } } in radiusd.conf I get: rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x8117ff8 Module: Instantiated ldap (ldap1) radiusd.conf[1862] Unknown Auth-Type "_UnNamedGroup" in authenticate section. Errors setting up modules changing this to authenticate { ldap1 #group { #ldap1 { #notfound = return #} #} # } freeradius starts without problems. radiusd -v radiusd: FreeRADIUS Version 1.1.0-pre0, for host i686-pc-linux-gnu, built on Nov 22 2005 at 22:02:26 Norbert Wegener

3 3

Decyhpering error message
by King, Michael 30 Nov '05

30 Nov '05

I have a single user that cannot associate to a AP. By chance, it's actually me. I'm failing 802.1x authentication . (We're using PEAP, with the XP client) with FreeRadius talking to AD Other users get on the AP fine. Watching the radius.log I see this error message. (I have not had a chance to put the server into Debug mode, that would affect a few hundred users, and right now it's just me, ) Wed Nov 30 09:49:40 2005 : Error: rlm_eap: UserIdentity Unknown Wed Nov 30 09:49:40 2005 : Error: rlm_eap: Identity Unknown, authentication failed Wed Nov 30 09:49:40 2005 : Auth: Login incorrect: [<no User-Name attribute>] (from client Wireless-network-2 port 2 cli 00-14-a5-45-e9-22) Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Length Included Wed Nov 30 09:49:41 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Length Included Wed Nov 30 09:49:41 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Length Included Wed Nov 30 09:49:41 2005 : Info: (other): SSL negotiation finished successfully Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Length Included Wed Nov 30 09:49:41 2005 : Info: (other): SSL negotiation finished successfully Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:42 2005 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Nov 30 09:49:42 2005 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Nov 30 09:49:51 2005 : Error: Discarding duplicate request from client Wireless-network-2:1025 - ID: 227 due to unfinished request 4837665 Wed Nov 30 09:49:51 2005 : Error: rlm_radutmp: Logout entry for NAS Wireless-network-2 port 1 has wrong ID Wed Nov 30 09:49:53 2005 : Error: Discarding duplicate request from client Wireless-network-2:1025 - ID: 227 due to unfinished request 4837665 Wed Nov 30 09:49:53 2005 : Info: rlm_eap_tls: Length Included Wed Nov 30 09:49:53 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Nov 30 09:49:53 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:53 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:53 2005 : Info: rlm_eap_tls: Length Included Wed Nov 30 09:49:53 2005 : Info: (other): SSL negotiation finished successfully Wed Nov 30 09:49:55 2005 : Error: rlm_radutmp: Logout entry for NAS Wireless-network-2 port 2 has wrong ID Now, the first line is not my MAC, so I don't think it's me. I get timed out at 9:49:51 So my question: That last entry Logout entry for NAS Wireless-network-2 port 2 has wrong ID, I think that's an Accounting message. Correct? I know that without the debug logs, it's hard to actually diagnose my acutal problem.

2 1

RADIUS EAP-TLS and Samba-LDAP
by james widanta 30 Nov '05

30 Nov '05

HI list I am using free radius with EAP-TLS for wireless authentication then I add Samba-LDAP for primary domain controller. Both radius and Samba LDAP are working . Now when I login from my windows xp to the domain I have to connect via wired first then install the certificate to make my radius authentication works. Every time I change the password I have toreinstall the certificate to get connected. Is anyone can tell me how to configure Samba-Ldap or Radius to make the authentication works for both radius and Samba-ldap? Thank you

2 1

Re: Freeradius-Users Digest, Vol 7, Issue 119
by Marcos Gonzalez 30 Nov '05

30 Nov '05

freeradius-users-request(a)lists.freeradius.org escribió: >> I think the problem is the NAS configuration. I don't know if some kind >> of misconfiguration made only time being tracked, not bytes sent and >> received. >> > > The NAS may not track that information. If it doesn't track it, it > can't send that data in a RADIUS packet. > > I'd check the Cisco documentation. Thank you Alan, for answering. In the Cisco documentation about the 1200, they show the list of attributes the Aironet 1200 can include in an accounting package: http://www.cisco.com/en/US/products/hw/wireless/ps430/products_configuratio… Here is an extract: * Attributes Sent in Accounting-Request (update) Packets 1 User-Name 4 NAS-IP-Address [...] 42 Acct-Input-Octets 43 Acct-Output-Octets [...] 47 Acct-Input-Packets 48 Acct-Output-Packets * Attributes Sent in Accounting-Request (stop) Packets 1 User-Name 4 NAS-IP-Address [...] 42 Acct-Input-Octets 43 Acct-Output-Octets [...] 47 Acct-Input-Packets 48 Acct-Output-Packets So yes, this NAS is supposed to report those pieces of information. At least, thats what Cisco says. But the fact is it isn't doing so. > I expect the NAS will not send > those attributes, ever. > > Alan DeKok. > > You think the NAS won't send those attributes. I have no experience with NASs, so I'd appreciate a lot if you could explain me why you think so. I don't want to spend time trying to do something that isn't possible. Thank you in advance, again.

2 1