- Freeradius-Users - lists.freeradius.org

Free Radius Authentication
by S G�l�in Y�cel 15 Aug '05

15 Aug '05

Hi; I have an problem about authentication too...Please help... Here is the problemssss... rad_recv: Access-Request packet from host 10.10.8.180:1095, id=28, length=130 NAS-IP-Address = 10.10.8.180 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "testuser" Calling-Station-Id = "00028abbbee9" Called-Station-Id = "00110a2a12c9" NAS-Identifier = "Enterprise AP" EAP-Message = 0x0201000d017465737475736572 Message-Authenticator = 0x0f53c7699a63b67d4dcc91de03f4cd15 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry testuser at line 94 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 28 to 10.10.8.180:1095 --------------------------------- Start your day with Yahoo! - make it your home page

1 0

Free Radius + MySQL
by S G�l�in Y�cel 15 Aug '05

15 Aug '05

Hi; I have an problem about authentication.I work to use free radius with mysql but when I try to authenticate it becomes rlm_sql="zero lenght username not permitted"..... Have the problem in my configuration?Please help.... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

debian install and modules
by N White 14 Aug '05

14 Aug '05

I would like to get rlm_sqlcounter working, but I have FreeRADIUS installed via "apt-get install freeradius freeradius-mysql" from the Debian sources. They do not apparently include the "experimental modules" in this package, and there is not another package for these modules. I tried compiling, and then copying the 'rlm_sqlcounter.*' files to where the other libraries are, and freeradius recognized sqlcounter(it started, and saw my entries in sqlcounter.conf and experimental.conf), but it would not work correctly with them. I compiled FreeRADIUS on a test server with the experimental modules option, and copied my configs from the debian server, and it works fine. Is there any way to get rlm_sqlcounter to work with the Debian package without having to recompile/install FreeRADIUS from source? -- --------------------------- | Nick White | | nwtech(a)tele-net.net | ---------------------------

1 0

more debug?
by N White 14 Aug '05

14 Aug '05

Is there any way to get the debug to tell me more. For example: freeradius -XX Tue Jul 26 12:46:55 2005 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jul 26 12:46:55 2005 : Debug: rlm_sqlcounter: Could not find Key value pair Tue Jul 26 12:46:55 2005 : Debug: modsingle[authorize]: returned from noresetcounter (rlm_sqlcounter) for request 0 Tue Jul 26 12:46:55 2005 : Debug: modcall[authorize]: module "noresetcounter" returns noop for request 0 I'd like to see exactly what rlm_sqlcounter is doing(sql query, file checking, etc). I've been stuck on trying to get sqlcounter to work for over a week now, and more debug is never bad. Thanks. -- --------------------------- | Nick White | | nwtech(a)tele-net.net | ---------------------------

2 2

EAP-TLS
by freeradius＠zoftdev.com 12 Aug '05

12 Aug '05

Hi all conf eap-tls by http://www.alphacore.net/spipen/article.php3?id_article=1 I don't understand why I got "TLS_accept:error in SSLv3 read client certificate A " TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode and some I got "SSL negotiation finished successfully " but eaptls_process handled "modcall[authenticate]: module "eap" returns handled for request 3" why not ok? eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 02e4], Certificate chain-depth=1, error=0 --> User-Name = mobile --> BUF-Name = matilda --> subject = /C=TH/ST=SongKhla/L=Hat-Yai/O=Jameslong IT Solution/OU=Administrator/CN=matilda/emailAddress=matilda(a)zoftdev.com --> issuer = /C=TH/ST=SongKhla/L=Hat-Yai/O=Jameslong IT Solution/OU=Administrator/CN=matilda/emailAddress=matilda(a)zoftdev.com --> verify return:1 chain-depth=0, error=0 --> User-Name = mobile --> BUF-Name = mobile --> subject = /C=TH/ST=SongKhla/L=Hat-Yai/O=Jameslong IT Solution/OU=Administrator/CN=mobile/emailAddress=matilda(a)zoftdev.com --> issuer = /C=TH/ST=SongKhla/L=Hat-Yai/O=Jameslong IT Solution/OU=Administrator/CN=matilda/emailAddress=matilda(a)zoftdev.com --> verify return:1 TLS_accept: SSLv3 read client certificate A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], CertificateVerify TLS_accept: SSLv3 read certificate verify A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 23 to 192.168.101.29:1239 Ready to process requests. rad_recv: Access-Request packet from host 192.168.101.29:1239, id=20, length=143 User-Name = "mobile" NAS-IP-Address = 192.168.101.29 NAS-Port = 0 Called-Station-Id = "00-80-C8-AC-A3-80" Calling-Station-Id = "00-04-23-52-E4-10" NAS-Identifier = "jameslong5 On Center" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000b016d6f62696c65 Message-Authenticator = 0xcc20399e49cf1b257bdf7d820424d89f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "mobile", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry mobile at line 219 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 20 to 192.168.101.29:1239 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x34d599218f561dce9524e244c5cc874d Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.101.29:1239, id=21, length=230 User-Name = "mobile" NAS-IP-Address = 192.168.101.29 NAS-Port = 0 Called-Station-Id = "00-80-C8-AC-A3-80" Calling-Station-Id = "00-04-23-52-E4-10" NAS-Identifier = "jameslong5 On Center" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200500d800000004616030100410100003d030142fd2917e892c20b68f495c58695ece35b355b986b0362d67237ab6a81446fe500001600040005000a000900640062000300060013001200630100 State = 0x34d599218f561dce9524e244c5cc874d Message-Authenticator = 0x7dcff4d08c8b3ad1e6197c3b77b609c5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "mobile", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry mobile at line 219 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06bf], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00b2], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 21 to 192.168.101.29:1239 EAP-Message = 0x0103040a0dc0000007ca160301004a02000046030142fcf5cfc634fe2d81399be7642dcf7214af445a6a5ac042a14aa0c20c494810201a5ae85b62771aa723a4e765710afd512aa1f6a664c0750f5b91f167532ed74a00040016030106bf0b0006bb0006b80002e3308202df30820248a003020102020900cd64af112d8e3f1f300d06092a864886f70d01010405003081a0310b30090603550406130254483111300f06035504081308536f6e674b686c613110300e060355040713074861742d596169311e301c060355040a13154a616d65736c6f6e6720495420536f6c7574696f6e31163014060355040b130d41646d696e6973747261746f7231 EAP-Message = 0x10300e060355040313076d6174696c64613122302006092a864886f70d01090116136d6174696c6461407a6f66746465762e636f6d301e170d3035303831323137353432355a170d3036303831323137353432355a3081a8310b30090603550406130254483111300f06035504081308536f6e674b686c613110300e060355040713074861742d596169311e301c060355040a13154a616d65736c6f6e6720495420536f6c7574696f6e31163014060355040b130d41646d696e6973747261746f72311830160603550403130f74656e2e7a6f66746465762e636f6d3122302006092a864886f70d01090116136d6174696c6461407a6f66746465762e EAP-Message = 0x636f6d30819f300d06092a864886f70d010101050003818d0030818902818100a63944c8128ffdaf474ff0fb707a5e88d20f647325bfe3bf81508bb9010f3074d42e6c2d40fe889624ff567f2951cf7b1cdb8d6a549e229b4fb8a88b1c7e3cf4dc40d8fe83a6fe181807ffbb331280e78d31de9fe993c5fffe09147c0af7462b82c095e7d6a8c1bf6cd8184ec05ef6c4242285dc78396b292abc4f5dbdb7ca350203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003818100af4faff4358d3b486b3d7aebd3b24cecfbdabafa534971317dcedddc8465ec45ab0727f63f11a60d9c119125 EAP-Message = 0x83468d9f66dc5589ca5eaba64a695bc0ae573404e39dca34da6afdc32a48da03bb11a65bf1b83147fcd4a3b3ae81fa10f4afd1e9e339a8787bf4a84ba80595c8e166faf977236cb47246225bdf6e8e0334fbce9f0003cf308203cb30820334a003020102020900cd64af112d8e3f1e300d06092a864886f70d01010405003081a0310b30090603550406130254483111300f06035504081308536f6e674b686c613110300e060355040713074861742d596169311e301c060355040a13154a616d65736c6f6e6720495420536f6c7574696f6e31163014060355040b130d41646d696e6973747261746f723110300e060355040313076d6174696c6461 EAP-Message = 0x3122302006092a864886f70d01090116136d6174696c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9b6a342a9b2b46b02bfc05030ae0b2ee Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.101.29:1239, id=22, length=156 User-Name = "mobile" NAS-IP-Address = 192.168.101.29 NAS-Port = 0 Called-Station-Id = "00-80-C8-AC-A3-80" Calling-Station-Id = "00-04-23-52-E4-10" NAS-Identifier = "jameslong5 On Center" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060d00 State = 0x9b6a342a9b2b46b02bfc05030ae0b2ee Message-Authenticator = 0xec3d9e7d18a4299da1cdfb3d16e7865e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "mobile", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry mobile at line 219 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 22 to 192.168.101.29:1239 EAP-Message = 0x010403d40d80000007ca6461407a6f66746465762e636f6d301e170d3035303831323137343630375a170d3035303931313137343630375a3081a0310b30090603550406130254483111300f06035504081308536f6e674b686c613110300e060355040713074861742d596169311e301c060355040a13154a616d65736c6f6e6720495420536f6c7574696f6e31163014060355040b130d41646d696e6973747261746f723110300e060355040313076d6174696c64613122302006092a864886f70d01090116136d6174696c6461407a6f66746465762e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100cacc22cc5b EAP-Message = 0xb26e326c07f5d1b00359f54fb940765ef3d99a17a76a0d94486558dae1f9cebd0381af8589fcf18ade7c592c61d450df8742409f040f33d60c8392d5dbc139b49021ccf39d0199c06d2f9cd11e36fffc930d73ad93dbe747fb7dd6b716320cd2a2a61c622de64aba9e133078b87ab539047ee56e5a511c3e2bd8390203010001a382010930820105301d0603551d0e04160414661d0391b297482e0b26a7b7418e028e9a053f413081d50603551d230481cd3081ca8014661d0391b297482e0b26a7b7418e028e9a053f41a181a6a481a33081a0310b30090603550406130254483111300f06035504081308536f6e674b686c613110300e0603550407 EAP-Message = 0x13074861742d596169311e301c060355040a13154a616d65736c6f6e6720495420536f6c7574696f6e31163014060355040b130d41646d696e6973747261746f723110300e060355040313076d6174696c64613122302006092a864886f70d01090116136d6174696c6461407a6f66746465762e636f6d820900cd64af112d8e3f1e300c0603551d13040530030101ff300d06092a864886f70d0101040500038181002fb6e51848a1ec69684ddcf13cc77f023b965ef6c1fd880ba2bf7118dca82337a32913af86b1f470499821291a31c87cd4fde06929a064258c3485de469605aa374506632a0c73e3bcdee091983b4511a4d9623c7233c252e3df EAP-Message = 0xb16d5644a0400b266508ec52349e6c2b049bc69e2105508674a48ac502eee827ee5c67b71cb716030100b20d0000aa02010200a500a33081a0310b30090603550406130254483111300f06035504081308536f6e674b686c613110300e060355040713074861742d596169311e301c060355040a13154a616d65736c6f6e6720495420536f6c7574696f6e31163014060355040b130d41646d696e6973747261746f723110300e060355040313076d6174696c64613122302006092a864886f70d01090116136d6174696c6461407a6f66746465762e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21cd9c86d8ccd5eeb592c3946879a337 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.101.29:1239, id=23, length=1224 User-Name = "mobile" NAS-IP-Address = 192.168.101.29 NAS-Port = 0 Called-Station-Id = "00-80-C8-AC-A3-80" Calling-Station-Id = "00-04-23-52-E4-10" NAS-Identifier = "jameslong5 On Center" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204042a0d800000042016030103f00b0002e00002dd0002da308202d63082023fa003020102020900cd64af112d8e3f20300d06092a864886f70d01010405003081a0310b30090603550406130254483111300f06035504081308536f6e674b686c613110300e060355040713074861742d596169311e301c060355040a13154a616d65736c6f6e6720495420536f6c7574696f6e31163014060355040b130d41646d696e6973747261746f723110300e060355040313076d6174696c64613122302006092a864886f70d01090116136d6174696c6461407a6f66746465762e636f6d301e170d3035303831323137353530305a170d30363038313231 EAP-Message = 0x37353530305a30819f310b30090603550406130254483111300f06035504081308536f6e674b686c613110300e060355040713074861742d596169311e301c060355040a13154a616d65736c6f6e6720495420536f6c7574696f6e31163014060355040b130d41646d696e6973747261746f72310f300d060355040313066d6f62696c653122302006092a864886f70d01090116136d6174696c6461407a6f66746465762e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d73522fe3322d18f1f7f0d6864b5a2dc662d02d3b0c7c91038872e4279521fd2ed1eeab519f6ef16c54aad5ca5077165f598734f6ca7705b EAP-Message = 0xa492a60faefb84e50f2fb163c1d88c2d0f1c21754e47161b897e9e3f4b7d34fcd253ddc6b4c2b0a6b0bcb9e82c72c62e20d24c848d346e069fc7f7ebdd4d05a4e6f50fd5ed8fb3610203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010104050003818100a23cfac78c49c6bf4d7ee61bfd75fd59f48a1e038cd58245aa45342b7362f4677981833e979e1f1ce1f44e5caef7cb37ce46eaa6106a1b40aab92617f3ad23efda5f0f41700fcf0f91c49f5b3ea5a436f132fa1cb0d8d431379de9f5e854428149775a29c081228425fe2772f04b27911167959553729f003004e4e2c66dde0e10000082 EAP-Message = 0x00805bf6c6167f32b9af7c7722417a12d629e02761731b74bc49cf48c5592f12991478c7e57296eef758fdc96758abe9a12c6db656ff4f45d7cad505e3032ba4e0ee410148cc4bbdd1207e7a5be9fc62515d16aee1622879b67fa6a7aabc9d239cad6de544d6a11f0245fc0c90cd751d085d3cef029dd4ab05b2c0f2c83a8c44af3b0f0000820080aa2f7a1990af568dff5280930f2ec6acacc49abe1bc367401db835579068ef0aa4a76406820ffcb36a55124c1a1b59282ea4452ff033a88f3828c35e8c0fa74fb102fe03184819a25977d06ee5506e6a40e6fad9eba33793e9284419ed48dd53d900a04b1963438395e7df4b75b28a504716330a50 EAP-Message = 0xdb8eff69472bfc6fb927761403010001011603010020ad6706b7670f0b4de4e9c1cab4403e17fd15ec16aa437c6f181859051c330557 State = 0x21cd9c86d8ccd5eeb592c3946879a337 Message-Authenticator = 0x754db892f17e8d5624eb42e38996702c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "mobile", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 users: Matched entry mobile at line 219 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 02e4], Certificate chain-depth=1, error=0 --> User-Name = mobile --> BUF-Name = matilda --> subject = /C=TH/ST=SongKhla/L=Hat-Yai/O=Jameslong IT Solution/OU=Administrator/CN=matilda/emailAddress=matilda(a)zoftdev.com --> issuer = /C=TH/ST=SongKhla/L=Hat-Yai/O=Jameslong IT Solution/OU=Administrator/CN=matilda/emailAddress=matilda(a)zoftdev.com --> verify return:1 chain-depth=0, error=0 --> User-Name = mobile --> BUF-Name = mobile --> subject = /C=TH/ST=SongKhla/L=Hat-Yai/O=Jameslong IT Solution/OU=Administrator/CN=mobile/emailAddress=matilda(a)zoftdev.com --> issuer = /C=TH/ST=SongKhla/L=Hat-Yai/O=Jameslong IT Solution/OU=Administrator/CN=matilda/emailAddress=matilda(a)zoftdev.com --> verify return:1 TLS_accept: SSLv3 read client certificate A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], CertificateVerify TLS_accept: SSLv3 read certificate verify A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 thnaks you.

1 0

GOT error read client CA in eap-tls
by freeradius＠zoftdev.com 12 Aug '05

12 Aug '05

Hi all I config freeradius follow this document http://www.alphacore.net/spipen/article.php3?id_article=1 but I got error below rad_recv: Access-Request packet from host 192.168.101.29:1239, id=62, length=230 User-Name = "mobile" NAS-IP-Address = 192.168.101.29 NAS-Port = 0 Called-Station-Id = "00-80-C8-AC-A3-80" Calling-Station-Id = "00-04-23-52-E4-10" NAS-Identifier = "jameslong5 On Center" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400500d800000004616030100410100003d030142fd1e5eebf3eb7698937e226b8350843678f15002dc309a1934beb1c6f56e1d00001600040005000a000900640062000300060013001200630100 State = 0x9b6a342a9b2b46b0fd473df927bba128 Message-Authenticator = 0xc68c53d418a3f44053680ba65b37dfbf Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "mobile", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry mobile at line 219 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06bf], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00b2], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode Thanks you.

1 0

Accounting VSAs
by Wesley Spadola 12 Aug '05

12 Aug '05

I was wondering if it is possible to modify the accounting queries to accept our own Vendor Specific Attributes. I would like to insert the Ascend-Data-Rate attribute we receive from our Ascent (Lucent) MAX TNT machine running TAOS 11. Upon browsing the sql.conf file, my thinking was that if most of the attributes get %{} "escaped" and turned into "variables" that are inserted and modified, that VSAs would too. Upon some testing, at least in my case, I have found that this isn't true. I find that the NAS sends many Vendor-Specific lines that dictionary.ascend contains and FreeRADIUS therefore decodes, but I am stumped as to how to include these in our queries. Is here any documentation or workarounds? Thanks, Wes

2 3

16bit attributes...
by Wesley Spadola 12 Aug '05

12 Aug '05

BTW, Does FreeRADIUS support 16bit attributes yet? I see a message at http://lists.cistron.nl/pipermail/cistron-radius/2004-January/005824.html says that FR is close to doing it, but I haven't been able to find any information more recently to support this. Thanks, Wes

2 1

Re: LEAP and PEAP protocols
by David Mitton 12 Aug '05

12 Aug '05

LEAP is a proprietary protocol of Cisco's. They have never published a spec, but it has been reverse engineered. (use Google) It is severely flawed. PEAP is in an Internet Draft (v2), but what Microsoft has implemented (v0) and what Cisco supports(v1) are two different derivations of previous versions. You will have to do some archival spelunking to get specs that may agree with the implementations. Good luck! Dave. ----- Original Message ----- From: "Alan DeKok" <aland(a)ox.org> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: LEAP and PEAP protocols Date: Fri, 12 Aug 2005 11:10:52 -0400 > > Juan Daniel Moreno <juanitomoreno(a)gmail.com> wrote: > > I would like to know if any of you has somme information about LEAP and PEAP > > protocols. Does any RFC about them exist? I find nothing in the net. Thanks > > you!!! > > doc/rfc/* > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

conecpt question
by Markus Krause 12 Aug '05

12 Aug '05

hi all! what i am dreaming of (at least regarding radius ;-) ): - wlan with wpa/802.1x using freeradius - clients mostly windows xp, several mac os x, few linux (unimportant right now) - the normal users (known to the local unix network the accesspoint/switch is connected to via nis or (some day) ldap) can access easily just with their username and password, if possible without client certificates (to keep things simple for the user) - some special 'accounts' (for guests etc.) in the freeradius users files can this be realized with freeradius? as far as i understand the conecpts behind this all this means a have to use peap, eap/ttls or eap/mschap-v2, am i right? has anyone set up something like this and can help me with some ideas, hints about trap-doors and other trouble ahead? or even some example configuration files? any help is appreciated! thanks in advance for your help! ;-) markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

3 2