- Freeradius-Users - lists.freeradius.org

ARUBA NAS simultaneous-Use Problem ... Enterasys and colubris work very well
by alfonso celestino 27 Sep '05

27 Sep '05

Hi, Everybody Please I need your help!! Why, When I work with enterasys or colubris NAS the simultaneous-Use work perfectly, but with ARUBA NAS not work. I need add or configure another things?, or the problem is from Aruba Manufacturer?, I need some Specific characteristics (Which) from Aruba Manufacturer?. Please someone help me!! Thank in advance Alfonso Celestino DGSCA, UNAM ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Cisco Privilege Level
by Ryan Sharpe 27 Sep '05

27 Sep '05

Hello all, I'm having a problem getting users to default to the right privilege level. aaa authentication login default group radius local aaa authorization exec default group radius local radius-server host xx.20.xx.xx auth-port 1645 acct-port 1646 radius-server key 7 xxxxxxxxxxxx privilege exec level 2 enable DEFAULT Group == "radiusfull", Auth-Type = System CiscoAVPair = "shell:priv-lvl=2", Fall-Through = No DEFAULT Group == "radiusview", Auth-Type = System CiscoAVPair = "shell:priv-lvl=1", Fall-Through = No rad_recv: Access-Request packet from host xx.xx.xx.xx:1645, id=30, length=93 User-Name = "rsharpe" User-Password = "*****" Cisco-NAS-Port = "tty226" NAS-Port = 226 NAS-Port-Type = Virtual Calling-Station-Id = "xx.xx.xx.xx" NAS-IP-Address = xx.xx.xx.xx Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "rsharpe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 users: Matched entry DEFAULT at line 54 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 modcall[authenticate]: module "unix" returns ok for request 2 modcall: group authenticate returns ok for request 2 Sending Access-Accept of id 30 to xx.xx.xx.xx:1645 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 30 with timestamp 43304ea1 Nothing to do. Sleeping until we see a request. What I am trying to accomplish is to have to two different unix groups authorized to two different levels. As I'm sure you can see from the configuration I want to have "radiusfull" have access to exec level 2 and "radiusview" have access to exec level 1. I know that the service is working I can login with my unix account to the router. I have seen numerous examples about how to do this, and from what I understand it should work. I also did a packet capture of the communication between the two devices and I did no see any of the AVPairs in the packet data. If someone could help and enlighten me that would be great. THANKS! -- Ryan Sharpe Junior Technical Analyst LARG*net (519) 661-2111 x86356 rsharpe(a)largnet.on.ca http://www.largnet.on.ca

2 1

users file for ser
by Santiago L. Aggio 27 Sep '05

27 Sep '05

Hi, I am using ser-0.9.3 and freeradius-1.0.5. Is possible to use a DEFAULT tag with Auth-Type Digest? I don't want to define in the users file all my users. I would use something similar to Auth-Type PAM or LDAP? Thank you in advance Santiago. ----------------------------------------------------------------- | Santiago L. Aggio | TE: 54-291-4861666 | | SECECOM - CRIBABB | FAX: 54-291-4861527 | | Camino la Carrindanga km 7 | | | 8000 - Bahia Blanca | E-MAIL: slaggio(a)criba.edu.ar | | Buenos Aires - Argentina | HTTP: www.criba.edu.ar | -----------------------------------------------------------------

2 1

Problem with PEAP and MS-CHAPv2 and AD
by Graham, Robert 27 Sep '05

27 Sep '05

I am having a strange problem, and was hoping for some expertise in this matter and I need to get this working very quickly since I am running out of time. I have freeradius configured to authenticate our users for a wired 802.1x environment. Authentication works succesfully if the supplicant (odyssey client) sends only the username and not domain\username. The problem is when I install the odyssey gina module to configure the supplicant to authenticate prior to windows login it passes the credentials as domain\username, whichs fails authentication. I did some searches and made the following changes: proxy.conf added: realm domain { type = radius authhost = LOCAL accthost = LOCAL } and uncommented the ntdomain section in radiusd.conf This did not work, so I tried another suggestion and changed the ntlm_auth string from: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=MEM --username=%{User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" to: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Now when I login I get the following error: This also occurs at the desktop level rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack? radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=RGraham --domain=MEM --challenge=71c3373eb458a75e --nt-response=c410b4f18e8527df26495cad16d20a09679b03969efa3d3e' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=RGraham --domain=MEM --challenge=71c3373eb458a75e --nt-response=c410b4f18e8527df26495cad16d20a09679b03969efa3d3e Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: group Auth-Type returns reject for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0xf8716a50 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE If I change the ntlm_auth back to the original string and authenticate at the desktop (not gina) it authenticates. So my question is: What do I need to do to configure Freeradius to strip the domain portion where EAP-PEAP is successful at both gina (login) and desktop? Any help would be greatly appreciated. Thanks Robert Graham

1 0

LDAP Freeradius
by Cris Boisvert 27 Sep '05

27 Sep '05

I can authenticate off correctly when I run radiuss -X But when I start radius normally it can't connect to the ldap server? Running Freeradius on fedora core 4 Ideas? Why would it working in debug but not normally? Here's the log info --------------------------------Radius log----------------------------------- Mon Sep 26 15:55:27 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Mon Sep 26 15:55:27 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon Sep 26 15:55:27 2005 : Info: Ready to process requests. Mon Sep 26 15:55:30 2005 : Error: rlm_ldap: bind to 192.168.77.6:389 failed: Can't contact LDAP server Mon Sep 26 15:55:30 2005 : Error: rlm_ldap: (re)connection attempt failed ------------------radius x output ----------------------------------------- modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "wow(a)pork.com" with password "test1234" radius_xlat: '(mail=wow(a)pork.com)' radius_xlat: 'o=pork.com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.77.6:389, authentication 0 rlm_ldap: bind as / to 192.168.77.6:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=pork.com, with filter (mail=wow(a)pork.com) rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: user DN: uid=wow,ou=People,o=pork.com rlm_ldap: (re)connect to 192.168.77.6:389, authentication 1 rlm_ldap: bind as uid=wow,ou=People,o=pork.com/test1234 to 192.168.77.6:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user wow(a)pork.com authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 26 to 192.168.77.6:3665 Finished request 0

1 0

Problem with radzap
by Andoni Ayala - KNET 27 Sep '05

27 Sep '05

hello!. I have experienced with freeradius, but i updated to 1.0.1 on Fedora Core 3 and when i use radzap i get this error: Error: There appears to be another RADIUS server running on the authentication port 1812 i launch this command: radzap '' 34 user456 even, replacing '' with NAS ip. can anyone help me? (i'm searching on google and freeradius-list archive but nothing help me) Thanks --

2 2

rml_perl
by Abdul Lateef 27 Sep '05

27 Sep '05

Hi all, I linked rml_perl module successfully to call only in authenticate event to return h323-credit-amount based on example.pl. and others event i want to do them from sql.conf. Here is the configuration what i did. ==========users file========= DEFAULT Auth-Type := Perl ===========radiusd file======== In module section perl { module = /usr/local/etc/example.pl func_accounting = accounting func_authenticate = authenticate func_authorize = authorize func_preacct = preacct func_checksimul = checksimul func_xlat = xlat } authenticate { Auth-Type Perl { perl } } But it is not working, and i cannot see any log in radius.log file while the logs writing is enabled. Anyone can help me is these configurations are correct? Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

2 1

separate accounting to two modules based on NAS-IP-Address
by Ilia Chipitsine 27 Sep '05

27 Sep '05

Dear Sirs, how can I organize radiusd.conf in order to put accounting coming from nas1 to one module and from nas2 to another module ? Cheers, Ilia Chipitsine

2 1

problem with MD5 EAP Radius
by dongyining 27 Sep '05

27 Sep '05

hi all, I wanted to make an AP with MD5 eap auths on the linux kernel 2.4.20,hostapd 0.4.2,madwifi 20050629,chip 5212.I have execessed in the wpa-psk mode.But when I tried the MD5 and Radius,the user can't pass the authorization.I didn't know where is the mistake.I hoped to find the same cases in the internet,but nothing found. I hope some one can help me,any suggestion will be greatly appreicated here is the DEBUG message: IEEE 802.1X: 5 bytes from 00:0c:41:c2:2f:7a IEEE 802.1X: version=1 type=1 length=0 ignoring 1 extra octets after IEEE 802.1X packet ath0: STA 00:0c:41:c2:2f:7a IEEE 802.1X: received EAPOL-Start from STA ath0: STA 00:0c:41:c2:2f:7a WPA: event 5 notification WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state AUTHENTICATION2 IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state ABORTING IEEE 802.1X: 00:0c:41:c2:2f:7a BE_AUTH entering state INITIALIZE ath0: STA 00:0c:41:c2:2f:7a IEEE 802.1X: aborting authentication IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state RESTART IEEE 802.1X: Integrated EAP server in use - do not generate EAP- Request/IdentityIEEE 802.1X: 00:0c:41:c2:2f:7a BE_AUTH entering state IDLE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE EAP: EAP entering state INITIALIZE EAP: EAP entering state SELECT_ACTION EAP: getDecision: no identity known yet -> CONTINUE EAP: EAP entering state PROPOSE_METHOD EAP: getNextMethod: type 1 EAP: EAP entering state METHOD_REQUEST EAP: building EAP-Request: Identifier 41 EAP: EAP entering state SEND_REQUEST EAP: eapReqData -> EAPOL - hexdump(len=10): 01 29 00 0a 01 68 65 6c 6c 6f EAP: EAP entering state IDLE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state CONNECTING IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state DISCONNECTED ath0: STA 00:0c:41:c2:2f:7a IEEE 802.1X: unauthorizing port madwifi_set_sta_authorized: addr=00:0c:41:c2:2f:7a authorized=0 IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state RESTART IEEE 802.1X: Integrated EAP server in use - do not generate EAP- Request/IdentityIEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE EAP: EAP entering state INITIALIZE EAP: EAP entering state SELECT_ACTION EAP: getDecision: no identity known yet -> CONTINUE EAP: EAP entering state PROPOSE_METHOD EAP: getNextMethod: type 1 EAP: EAP entering state METHOD_REQUEST EAP: building EAP-Request: Identifier 205 EAP: EAP entering state SEND_REQUEST EAP: eapReqData -> EAPOL - hexdump(len=10): 01 cd 00 0a 01 68 65 6c 6c 6f EAP: EAP entering state IDLE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state CONNECTING IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state AUTHENTICATING IEEE 802.1X: 00:0c:41:c2:2f:7a BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:0c:41:c2:2f:7a (identifier 205) TX EAPOL - hexdump(len=28): 00 0c 41 c2 2f 7a 00 02 c7 23 6d 3e 88 8e 02 00 00 fIEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE Wireless event: cmd=0x8c04 len=20 ath0: STA 00:0c:41:c2:2f:7a IEEE 802.11: deassociated ath0: STA 00:0c:41:c2:2f:7a WPA: event 2 notification madwifi_del_key: addr=00:0c:41:c2:2f:7a key_idx=0 ioctl[IEEE80211_IOCTL_DELKEY]: Invalid argument WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state DISCONNECTED WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state INITIALIZE madwifi_del_key: addr=00:0c:41:c2:2f:7a key_idx=0 ioctl[IEEE80211_IOCTL_DELKEY]: Invalid argument IEEE 802.1X: station 00:0c:41:c2:2f:7a port disabled IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a KEY_RX entering state NO_KEY_RECEIVE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a KEY_RX entering state NO_KEY_RECEIVE EAP: EAP entering state DISABLED IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a KEY_RX entering state NO_KEY_RECEIVE EAP: State machine removed Wireless event: cmd=0x8c03 len=20 ath0: STA 00:0c:41:c2:2f:7a IEEE 802.11: associated New STA ath0: STA 00:0c:41:c2:2f:7a WPA: event 1 notification ath0: STA 00:0c:41:c2:2f:7a IEEE 802.1X: start authentication EAP: State machine created IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a BE_AUTH entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_KEY_TX entering state NO_KEY_TRANSMIT IEEE 802.1X: 00:0c:41:c2:2f:7a KEY_RX entering state NO_KEY_RECEIVE IEEE 802.1X: 00:0c:41:c2:2f:7a CTRL_DIR entering state IN_OR_BOTH IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a BE_AUTH entering state IDLE IEEE 802.1X: 00:0c:41:c2:2f:7a KEY_RX entering state NO_KEY_RECEIVE IEEE 802.1X: 00:0c:41:c2:2f:7a CTRL_DIR entering state FORCE_BOTH IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a KEY_RX entering state NO_KEY_RECEIVE ath0: STA 00:0c:41:c2:2f:7a WPA: start authentication WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state INITIALIZE madwifi_del_key: addr=00:0c:41:c2:2f:7a key_idx=0 WPA: 00:0c:41:c2:2f:7a WPA_PTK_GROUP entering state IDLE WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state AUTHENTICATION WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state AUTHENTICATION2 IEEE 802.1X: 5 bytes from 00:0c:41:c2:2f:7a IEEE 802.1X: version=1 type=1 length=0 ignoring 1 extra octets after IEEE 802.1X packet ath0: STA 00:0c:41:c2:2f:7a IEEE 802.1X: received EAPOL-Start from STA ath0: STA 00:0c:41:c2:2f:7a WPA: event 5 notification WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state AUTHENTICATION2 IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state DISCONNECTED ath0: STA 00:0c:41:c2:2f:7a IEEE 802.1X: unauthorizing port madwifi_set_sta_authorized: addr=00:0c:41:c2:2f:7a authorized=0 IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state RESTART IEEE 802.1X: Integrated EAP server in use - do not generate EAP- Request/IdentityIEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE EAP: EAP entering state INITIALIZE EAP: EAP entering state SELECT_ACTION EAP: getDecision: no identity known yet -> CONTINUE EAP: EAP entering state PROPOSE_METHOD EAP: getNextMethod: type 1 EAP: EAP entering state METHOD_REQUEST EAP: building EAP-Request: Identifier 186 EAP: EAP entering state SEND_REQUEST EAP: eapReqData -> EAPOL - hexdump(len=10): 01 ba 00 0a 01 68 65 6c 6c 6f EAP: EAP entering state IDLE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state CONNECTING IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state AUTHENTICATING IEEE 802.1X: 00:0c:41:c2:2f:7a BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:0c:41:c2:2f:7a (identifier 186) TX EAPOL - hexdump(len=28): 00 0c 41 c2 2f 7a 00 02 c7 23 6d 3e 88 8e 02 00 00 fIEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE ....... here is the hostapd.conf interface=ath0 driver=madwifi logger_syslog=-1 logger_syslog_level=2 logger_stdout=-1 logger_stdout_level=2 debug=4 dump_file=/tmp/hostapd.dump ssid=dongyining macaddr_acl=2 accept_mac_file=/etc/hostapd.accept deny_mac_file=/etc/hostapd.deny auth_algs=1 ieee8021x=1 eapol_key_index_workaround=1 eap_reauth_period=3600 eap_server=1 eap_user_file=/etc/hostapd.eap_user own_ip_addr=192.168.1.1 auth_server_addr=192.168.1.1 auth_server_port=1812 auth_server_shared_secret=secret radius_retry_primary_interval=600 radius_acct_interim_interval=600 radius_server_clients=/etc/hostapd.radius_clients radius_server_auth_port=1812 wpa=3 wpa_passphrase=dongyining wpa_key_mgmt=WPA-PSK WPA-EAP wpa_pairwise=TKIP CCMP wpa_group_rekey=600 wpa_strict_rekey=1 wpa_gmk_rekey=86400 rsn_preauth=1 here is the hostapd.eap_user # Phase 1 users "FORD" MD5 "secret"

2 1

How to run CA.all script to generate EAP-TLS certifiate
by ann lee 27 Sep '05

27 Sep '05

Hi,all: I am new to freeradius world. I am trying to setup EAP-TLS using freeradius server. Would you pls tell me which cisco access point is preferred for the EAP-TLS setup? I have installed openssl-0.9.8 and freeradius-1.0.5 on Redhat 9.0. I tried several times to generate certificate by runing CA.all script which was downloaded from www.missl.cs.umd.edu/wireless/eaptls. But each time I met same issue and failed to generate the certificates. I just typed "./CA.all" to run the script, is there any optional parameters need I input ? (I did not update the file /usr/local/openssl/ssl/openssl.cnf and CA.all) the following is part of the error log: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:whatever An optional company name []:radius Using configuration from /usr/local/openssl/ssl/openssl.cnf Enter pass phrase for ./demoCA/private/cakey.pem: (I entered "whatever" for pass phrase, right? I don't know what is the pass phrase?) ./demoCA/serial: No such file or directory (I think this file ./demoCA/serial will be created automatically when running the CA.all, right?) error while loading serial number 4427:error:02001002:system library:fopen:No such file or directory:bss_file.c:349:fopen('./demoCA/serial','r') 4427:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:351: No certificate matches private key 4429:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:150: unable to load certificate 4430:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting: TRUSTED CERTIFICATE Enclosed is the complete log of runing the script CA.all. I am not clear the root cause. Your help is very appreciated. had better provide me a successful log of running the CA.all. I don't know which information I should input when runing the CA.all. Thanks a lot ann --------------------------------- 雅虎免费G邮箱－中国第一绝无垃圾邮件骚扰超大邮箱雅虎助手－搜索、杀毒、防骚扰 run ./CA.all ################## create private key name : name-root CA.pl -newcert ################## Generating a 1024 bit RSA private key ...........++++++ ..................++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Beijing Locality Name (eg, city) []:Beijing Organization Name (eg, company) [Internet Widgits Pty Ltd]:OpenTide Organizational Unit Name (eg, section) []:IT Solution Common Name (eg, YOUR name) []:wanghao Email Address []:wanghao@opentide.com.cn ################## create CA use just created 'newreq.pem' private key as filename CA.pl -newca ################## CA certificate filename (or enter to create) ################## exporting ROOT CA CA.pl -newreq CA.pl -signreq openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem -out root.pem openssl pkcs12 -in root.cer -out root.pem ################## MAC verified OK ################## creating client certificate name : name-clt client certificate stored as cert-clt.pem CA.pl -newreq CA.pl -signreq ################## Generating a 1024 bit RSA private key ..................++++++ ..........................++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Beijing Locality Name (eg, city) []:Beijing Organization Name (eg, company) [Internet Widgits Pty Ltd]:OpenTide Organizational Unit Name (eg, section) []:IT Solution Common Name (eg, YOUR name) []:wanghao Email Address []:wanghao@opentide.com.cn Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:whatever An optional company name []:radius Using configuration from /usr/local/openssl/ssl/openssl.cnf Enter pass phrase for ./demoCA/private/cakey.pem: ./demoCA/serial: No such file or directory error while loading serial number 4427:error:02001002:system library:fopen:No such file or directory:bss_file.c:349:fopen('./demoCA/serial','r') 4427:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:351: No certificate matches private key 4429:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:150: unable to load certificate 4430:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting: TRUSTED CERTIFICATE ################## creating server certificate name : name-srv server certificate stored as cert-srv.pem CA.pl -newreq CA.pl -signreq ################## Generating a 1024 bit RSA private key ..............................++++++ ..........++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:

1 0