- Freeradius-Users - lists.freeradius.org

Tunneled authentication rejected on PEAP
by Mario Alberto Cruz Gartner 12 Jul '05

12 Jul '05

Hi! I'm receiving a "rlm_eap_peap: Had sent TLV failure, rejecting." on the end of the debug when trying to auth EAP/PEAP XP-SP2 client. Looking earlier, on the debug, i'd see: ----- rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: group authenticate returns reject for request 6 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ----- But... now i don't know if the mschapv2 is the value that is "Unknow" or what value is unknow for the auth? Please, help me telling me what i doing wrong? Thanks in advice for your help. radiusd.conf: ----- prefix = /programas/freeradius2 exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } with_cisco_vsa_hack = no files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { eap } authenticate { eap } preacct { acct_unique } accounting { detail radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { } ----- eap.conf: ----- eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/tls/cert-srv.pem certificate_file = ${raddbdir}/certs/tls/cert-srv.pem CA_file = ${raddbdir}/certs/tls/CA/cacert.pem dh_file = ${raddbdir}/certs/tls/dh random_file = ${raddbdir}/certs/tls/random fragment_size = 1024 include_length = yes } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no } mschapv2 { } } ----- debug log: ----- + LD_LIBRARY_PATH=/usr/local/openssl/lib + LD_PRELOAD=/usr/local/openssl/lib/libcrypto.so + export LD_LIBRARY_PATH LD_PRELOAD + /programas/freeradius2/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /programas/freeradius2/etc/raddb/clients.conf Config: including file: /programas/freeradius2/etc/raddb/eap.conf Config: including file: /programas/freeradius2/etc/raddb/sql.conf main: prefix = "/programas/freeradius2" main: localstatedir = "/programas/freeradius2/var" main: logdir = "/programas/freeradius2/var/log/radius" main: libdir = "/programas/freeradius2/lib" main: radacctdir = "/programas/freeradius2/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/programas/freeradius2/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/programas/freeradius2/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/programas/freeradius2/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /programas/freeradius2/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/programas/freeradius2/etc/raddb/certs/tls/cert-srv.pem" tls: certificate_file = "/programas/freeradius2/etc/raddb/certs/tls/cert-srv.pem" tls: CA_file = "/programas/freeradius2/etc/raddb/certs/tls/CA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/programas/freeradius2/etc/raddb/certs/tls/dh" tls: random_file = "/programas/freeradius2/etc/raddb/certs/tls/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/programas/freeradius2/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/programas/freeradius2/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.20.7:55049, id=141, length=134 User-Name = "pepe" NAS-IP-Address = 192.168.20.7 Called-Station-Id = "00-0c-41-b1-37-07" Calling-Station-Id = "00-0b-7d-0f-f7-35" NAS-Identifier = "Linksys BEFW11S4-V4.X" Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x023200090170657065 Message-Authenticator = 0x3fe87643717488557b8e86a44a4929c6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_eap: EAP packet type response id 50 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 141 to 192.168.20.7:55049 EAP-Message = 0x013300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x15018a8667aa6f2bf399348682539a27 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.20.7:55048, id=142, length=255 User-Name = "pepe" NAS-IP-Address = 192.168.20.7 Called-Station-Id = "00-0c-41-b1-37-07" Calling-Station-Id = "00-0b-7d-0f-f7-35" NAS-Identifier = "Linksys BEFW11S4-V4.X" State = 0x15018a8667aa6f2bf399348682539a27 Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0233007019800000006616030100610100005d030142d40537ab2cf5b1ffa5776b3b8f68665e174ed49548c109ad68f86f7a0cd1d120e0cbf6c19dcd9b3581e28dbd6a1c2353a68b22d555b27765d568d1f260b5ac04001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x1b8c51e62702793dfd50c8837d3c4b0f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 rlm_eap: EAP packet type response id 51 length 112 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0662], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 142 to 192.168.20.7:55048 EAP-Message = 0x0134040a19c0000006bf160301004a02000046030142d40500bd0530d47bb9f0bf7d0466dff46308e08dc3535d98837308a00fad2920b108b434da5eb62bf266f75260a4fe1061477acffb72dc08e8f4bd96a54f60f800040016030106620b00065e00065b0002c4308202c030820229a003020102020900f12ab1347a5cd9e1300d06092a864886f70d010104050030818c310b300906035504061302434f311830160603550408130f56616c6c652064656c204361756361310d300b0603550407130443616c69311e301c060355040a1315556e6976657273696461642064656c2056616c6c6531343032060355040b132b4f666963696e61206465 EAP-Message = 0x20496e666f726d617469636120792054656c65636f6d756e69636163696f6e6573301e170d3035303632323138333932335a170d3036303632323138333932335a30819d310b300906035504061302434f311830160603550408130f56616c6c652064656c204361756361310d300b0603550407130443616c69311e301c060355040a1315556e6976657273696461642064656c2056616c6c6531343032060355040b132b4f666963696e6120646520496e666f726d617469636120792054656c65636f6d756e69636163696f6e6573310f300d060355040313066f6e65626f7830819f300d06092a864886f70d010101050003818d00308189028181 EAP-Message = 0x00d30db19c37a7284f5f673101f2773ac3924fc774d15b7f55bc563b955b73aff9ac4f61d88aadaab244f47e944cdba13890f54008bd9ef1c553229e671ac5f4ffe6bb9bea797ac67188e37b9db3fb60006b68a8b3d01f73e9600612ae2d6bd4f0ce313e761bbdd177d9344579bd17565cc7b12a944820f52ab29365d22e4a24d30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181000795bf4630d57fde5f57eb8b0d4f0ceab17fd13b31437e09d666c1a5f7e3c6bc095b29442d889460764b7108194e06cc690a8b4e5ce1bc45744d57ffff07a9326ff1ac7e0d066e2cc86f83 EAP-Message = 0x8db90cbfa1ecd56e767573304003569d1693f6cf224e9a651d9d2e78a208ce2aed4ac4f0da6187ca561c946c98d24aa0161d9bf2080003913082038d308202f6a003020102020900f12ab1347a5cd9df300d06092a864886f70d010104050030818c310b300906035504061302434f311830160603550408130f56616c6c652064656c204361756361310d300b0603550407130443616c69311e301c060355040a1315556e6976657273696461642064656c2056616c6c6531343032060355040b132b4f666963696e6120646520496e666f726d617469636120792054656c65636f6d756e69636163696f6e6573301e170d3035303632323138333631 EAP-Message = 0x395a170d3037303632323138333631395a30818c310b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4f23eb8f5f09f1a8c84ebb931550b4bd Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.20.7:55050, id=143, length=149 User-Name = "pepe" NAS-IP-Address = 192.168.20.7 Called-Station-Id = "00-0c-41-b1-37-07" Calling-Station-Id = "00-0b-7d-0f-f7-35" NAS-Identifier = "Linksys BEFW11S4-V4.X" State = 0x4f23eb8f5f09f1a8c84ebb931550b4bd Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x023400061900 Message-Authenticator = 0x830d6a0c2dcc38bb22d7a1400948e4fe Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_eap: EAP packet type response id 52 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 143 to 192.168.20.7:55050 EAP-Message = 0x013502c51900300906035504061302434f311830160603550408130f56616c6c652064656c204361756361310d300b0603550407130443616c69311e301c060355040a1315556e6976657273696461642064656c2056616c6c6531343032060355040b132b4f666963696e6120646520496e666f726d617469636120792054656c65636f6d756e69636163696f6e657330819f300d06092a864886f70d010101050003818d0030818902818100a4d3a6bb7f0b08a448a8b84fe5236a0ef724951374d6320389f264f2c5007aee8cfc1cfd319e16e1cb910c5cfd07821ac809e1ac9baade2e618b7addf29844732d923ca1103395642bd3f9c230d4aace EAP-Message = 0xb77b9b2e3f96436860556ece59ee48b29a57b7824847e851a6829cc9dbefe96b24e9fb66d03e368cdcd4e40c7a7b66230203010001a381f43081f1301d0603551d0e0416041433bfd1100827d8643dcde9ca1ce76b25f46446913081c10603551d230481b93081b6801433bfd1100827d8643dcde9ca1ce76b25f4644691a18192a4818f30818c310b300906035504061302434f311830160603550408130f56616c6c652064656c204361756361310d300b0603550407130443616c69311e301c060355040a1315556e6976657273696461642064656c2056616c6c6531343032060355040b132b4f666963696e6120646520496e666f726d61746963 EAP-Message = 0x6120792054656c65636f6d756e69636163696f6e6573820900f12ab1347a5cd9df300c0603551d13040530030101ff300d06092a864886f70d0101040500038181003e06154dfd6945605d183a420498b80e43472ddc37ba210af99451122c28c0f9c0fe3a8c35e5fbf834e8c9359cab9c8a5178c6e93656d1aa4a90a40114d600bdc2698199b4adb031c83633ac990f05f42244a771769d888393d4c183f71cfdbaad74a467189ae89427f68d1e55ac68320bc63370dac576cfeaa005fc9855ef5e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb649f7b9cfb7b8ccdb805d8a851a27d4 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.20.7:55049, id=144, length=335 User-Name = "pepe" NAS-IP-Address = 192.168.20.7 Called-Station-Id = "00-0c-41-b1-37-07" Calling-Station-Id = "00-0b-7d-0f-f7-35" NAS-Identifier = "Linksys BEFW11S4-V4.X" State = 0xb649f7b9cfb7b8ccdb805d8a851a27d4 Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x023500c01980000000b616030100861000008200804c70cebbcbafc5324563c330bf527a29c11a0483bfbfe450087e2531c08d2b8e713189e5555aeb166d477c9d8358ce9ca819b1afd8c491420cab162935ec1b80c69d3af8474a71b3460afbd52372954f74d977897c13698b53c4cf5209caafaf2fa6d7ba8cd952252e7697c0cdcd7731ee589048bbc1475bae28bc1aae0f0a0a1403010001011603010020096180b7dfa708498a1aeae672b4551b669c5fc6ae79622650efb3a10336b136 Message-Authenticator = 0xf47a9e90b06d8a38556ab39d5d345e7d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 rlm_eap: EAP packet type response id 53 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 144 to 192.168.20.7:55049 EAP-Message = 0x0136003119001403010001011603010020d03bfe69fdf6584b1d6882152fe7eb203fa22ba4852aae206dfc4196ab7659cd Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6500c067b47a56e3d7eb39eb1f51f75d Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.20.7:55048, id=145, length=149 User-Name = "pepe" NAS-IP-Address = 192.168.20.7 Called-Station-Id = "00-0c-41-b1-37-07" Calling-Station-Id = "00-0b-7d-0f-f7-35" NAS-Identifier = "Linksys BEFW11S4-V4.X" State = 0x6500c067b47a56e3d7eb39eb1f51f75d Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x023600061900 Message-Authenticator = 0xc9b738b4a99d700ff9f05aacd6343fdf Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 rlm_eap: EAP packet type response id 54 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 145 to 192.168.20.7:55048 EAP-Message = 0x0137002019001703010015139bfe6db0aca01e9c03e24c58b78467857d4be279 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e15c0c8c154169e15a6597e59ff063f Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.20.7:55048, id=146, length=175 User-Name = "pepe" NAS-IP-Address = 192.168.20.7 Called-Station-Id = "00-0c-41-b1-37-07" Calling-Station-Id = "00-0b-7d-0f-f7-35" NAS-Identifier = "Linksys BEFW11S4-V4.X" State = 0x0e15c0c8c154169e15a6597e59ff063f Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0237002019001703010015c074abf8e34854264935655f3a9f33dc72cf409bca Message-Authenticator = 0x33d50e786188aa6c15d1d581e93976c7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 rlm_eap: EAP packet type response id 55 length 32 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - pepe rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of pepe PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to pepe Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 rlm_eap: EAP packet type response id 55 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 146 to 192.168.20.7:55048 EAP-Message = 0x013800351900170301002a0d4aa1f3ae3837a8cb3f1823ce849e91f05b2b62a808621970c414f055fd2a41e83218f896985e63e9f2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbc2a6b2ebc6704039852f97fd53633f3 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.20.7:55050, id=147, length=229 User-Name = "pepe" NAS-IP-Address = 192.168.20.7 Called-Station-Id = "00-0c-41-b1-37-07" Calling-Station-Id = "00-0b-7d-0f-f7-35" NAS-Identifier = "Linksys BEFW11S4-V4.X" State = 0xbc2a6b2ebc6704039852f97fd53633f3 Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x023800561900170301004b0c6b58d944b8e5207dcc18641ebdd59dfe6c2c5e2cdeeb8c566316839b67d6279030b3480e61e635b0abe6862b2725c463ff23de791f75b5fd563cd0e41f0b9cc88dbb3a7a11c699547f93 Message-Authenticator = 0xf56c53360d6d6b4d44c2d586bb6027d6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 rlm_eap: EAP packet type response id 56 length 86 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to pepe PEAP: Adding old state with 71 1d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 rlm_eap: EAP packet type response id 56 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: group authenticate returns reject for request 6 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 147 to 192.168.20.7:55050 EAP-Message = 0x013900261900170301001b8f31916149f1767ba59d80746534182ee04d12cd8bc72aa59d0310 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2518cc6fe36775cf22af6b0801873445 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.20.7:55050, id=148, length=181 User-Name = "pepe" NAS-IP-Address = 192.168.20.7 Called-Station-Id = "00-0c-41-b1-37-07" Calling-Station-Id = "00-0b-7d-0f-f7-35" NAS-Identifier = "Linksys BEFW11S4-V4.X" State = 0x2518cc6fe36775cf22af6b0801873445 Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x023900261900170301001bf5d93fbbc88f93d5d9886ccd2e16d37fc67244f08b25213e49d54b Message-Authenticator = 0xf510098b504d463f41750e04aae0ed5d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 rlm_eap: EAP packet type response id 57 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: group authenticate returns invalid for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 141 with timestamp 42d40500 Cleaning up request 1 ID 142 with timestamp 42d40500 Cleaning up request 2 ID 143 with timestamp 42d40500 Cleaning up request 3 ID 144 with timestamp 42d40500 Cleaning up request 4 ID 145 with timestamp 42d40500 Cleaning up request 5 ID 146 with timestamp 42d40500 Cleaning up request 6 ID 147 with timestamp 42d40500 Sending Access-Reject of id 148 to 192.168.20.7:55050 EAP-Message = 0x04390004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 7 ID 148 with timestamp 42d40500 Nothing to do. Sleeping until we see a request. -----

2 3

rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication
by melvin 12 Jul '05

12 Jul '05

Hi all, I've read many emails regarding "rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication". Some say you need to you need to tell the server what the user's correct password is and use plaint text password. But may I know where to tell the server to user plain text password?Is it in the radiusd.conf or eap.conf? rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for melvin with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: group Auth-Type returns reject for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE cheers, melvin

2 1

PEAP -> Why tls ?? Beginer question
by Michael Langer 12 Jul '05

12 Jul '05

Hi, i get the listet log. The freeradius server identify the request as EAP. But why it startet rlm_eap_tls? I thought he gots the message, notice its EAP and take the password from users (file). But it start tls handshake, and fails. (Where i can see how rlm_eap, rlm_eap_tls is configured?) Second queston, why no decision occurs, i found no reject or accept!? Thx for your help Michael LOG: rad_recv: Access-Request packet from host 192.168.1.3:1812, id=39, length=98 NAS-IP-Address = 192.168.1.3 NAS-Port = 50010 NAS-Port-Type = Ethernet User-Name = "test" Calling-Station-Id = "00-04-75-DA-4C-C8" Service-Type = Framed-User EAP-Message = 0x020100090174657374 Message-Authenticator = 0xe6b2e1c93f52004f14bc268c7894ecfd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry test at line 54 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 39 to 192.168.1.3:1812 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x163120a63f7aadd336b0e76ac31c0c17 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.3:1812, id=40, length=187 NAS-IP-Address = 192.168.1.3 NAS-Port = 50010 NAS-Port-Type = Ethernet User-Name = "test" Calling-Station-Id = "00-04-75-DA-4C-C8" Service-Type = Framed-User State = 0x163120a63f7aadd336b0e76ac31c0c17 EAP-Message = 0x0202005019800000004616030100410100003d030142d27e6d475fe32bebed7ae37075c341 be0fadba80a11c04f8c468ea02ff68cf00001600040005000a00090064006200030006001300 1200630100 Message-Authenticator = 0x4b27203775b97e4a9a3d543a7cba95ea Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry test at line 54 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 05ae], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 40 to 192.168.1.3:1812 EAP-Message = 0x0103040a19c00000060b160301004a02000046030142d28da92d2e3dce36fa41299b41b3fc eb9337e0419cc9955f8b503ad12741e7200a3d67a894ec4885fa5638a70585a57dd1bbd308a7 e196f4321a4bedc481a1ea00040016030105ae0b0005aa0005a70002723082026e308201d7a0 03020102020900c54a18eee8c82a38300d06092a864886f70d0101040500306d310b30090603 55040613024445311630140603550408130d4e69656465727361636873656e3111300f060355 0407130848616e6e6f766572310c300a060355040a130346484831133011060355040b130a49 6e666f726d6174696b3110300e06035504031307696473526f6f EAP-Message = 0x74301e170d3035303632343130323030315a170d3036303632343130323030315a306c310b 3009060355040613024445311630140603550408130d4e69656465727361636873656e311130 0f0603550407130848616e6e6f766572310c300a060355040a13034648483113301106035504 0b130a496e666f726d6174696b310f300d0603550403130669647353727630819f300d06092a 864886f70d010101050003818d0030818902818100c41bbdefa0e18b7a86822e40a288bde770 208e2d664594692a0f29d6e17136c8bbcd069ff636f713d199bdf76fbda405cd94f2dfefd2fa 32d4b6cc7b54858519b304e911fbcf2441e1a4ba3b3e43413198 EAP-Message = 0xbd985b957133ad10246bf90575d1dc33d20c06720f4cb6f6fe2e3ab749bac6ca0cc182d144 d38945377be15bb03f510203010001a317301530130603551d25040c300a06082b0601050507 0301300d06092a864886f70d0101040500038181004a500df63d64c6068e07e6114f7b2b317b 998ecf50b5e4493087776e204c59f6e8ea54150c473d694ccf6892a07f497de3c8b19668ba1a ccc40d9c6a56141de74fe7613e30979eb17f3ffdd52a6ddab7c3858eda356fe7c0fc7de24f61 637c7bfe98d71a5e949609574cdaa3d9cd0453bf09c5c57df30dc7ff1827baf4a1dbeb00032f 3082032b30820294a003020102020900c54a18eee8c82a36300d EAP-Message = 0x06092a864886f70d0101040500306d310b3009060355040613024445311630140603550408 130d4e69656465727361636873656e3111300f0603550407130848616e6e6f766572310c300a 060355040a130346484831133011060355040b130a496e666f726d6174696b3110300e060355 04031307696473526f6f74301e170d3035303632343130313834395a170d3037303632343130 313834395a306d310b3009060355040613024445311630140603550408130d4e696564657273 61636873656e3111300f0603550407130848616e6e6f766572310c300a060355040a13034648 4831133011060355040b130a496e666f726d6174696b3110300e EAP-Message = 0x06035504031307696473526f6f7430819f300d06092a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d3082dd717b8f84c8e57ba72651e779 Finished request 1 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 39 with timestamp 42d28da9 Cleaning up request 1 ID 40 with timestamp 42d28da9 Nothing to do. Sleeping until we see a request. -- Weitersagen: GMX DSL-Flatrates mit Tempo-Garantie!

2 5

problems authenticating
by jck-freeradius＠southwestern.edu 12 Jul '05

12 Jul '05

I am trying to do EAP-PEAP, using FreeRadius 1.0.4. Here are the debug logs, at the breaking points: rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 8 rlm_mschap: Told to do MS-CHAPv2 for johnk with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 8 modcall: group Auth-Type returns reject for request 8 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 8 modcall: group authenticate returns reject for request 8 auth: Failed to validate the user. Login incorrect: [johnk/<no User-Password attribute>] (from client localhost port 0) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE and again later on... eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 9 modcall: group authenticate returns invalid for request 9 auth: Failed to validate the user. Login incorrect: [johnk/<no User-Password attribute>] (from client xXxXx1100 port 821 cli 000e.35b5.eb8f) Here is how my two auth sections look: radiusd.conf: authorize { preprocess auth_log mschap eap sql } authenticate { Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap eap } Here are a few excerpts from eap.conf: eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # default_eap_type = mschapv2 .... peap { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # PEAP tunnel, we recommend using MS-CHAPv2, # as that is the default type supported by # Windows clients. default_eap_type = mschapv2 } My thoughts are that SQL and MSCHAP should be in the authorization section, and MSCHAP and EAP should be in authentication. I have tried this, and it does not work for me. I really have no idea of what I am doing, although I have read the documentation. I am storing NTLM passwords in my SQL server. mysql> select * from radcheck where UserName = "johnk"; +------+----------+---------------+----+-------------------------------------------------------------------+ | id | UserName | Attribute | op | Value | +------+----------+---------------+----+-------------------------------------------------------------------+ | 1490 | johnk | User-Password | == | 0393A990E3426721695109AB020K4E1C:FBFR81520C5BDDENOTREALPASSWORD33 | +------+----------+---------------+----+-------------------------------------------------------------------+ 1 row in set (0.00 sec) (The password above has been assigned a false value) mysql> select * from usergroup where UserName = "johnk"; +------+----------+------------+ | id | UserName | GroupName | +------+----------+------------+ | 2502 | johnk | pirate | +------+----------+------------+ 1 row in set (0.01 sec) mysql> select * from radgroupreply; +----+------------+---------------------------+----+----------+------+ | id | GroupName | Attribute | op | Value | prio | +----+------------+---------------------------+----+----------+------+ | 39 | pirate | Tunnel-Medium-Type:0 | = | IEEE-802 | 0 | | 40 | pirate | Tunnel-Type:0 | = | VLAN | 0 | | 41 | pirate | Tunnel-Private-Group-ID:0 | = | 111 | 0 | +----+------------+---------------------------+----+----------+------+ 3 rows in set (0.00 sec) What can be suggested, so that my authentication phase goes as well as my authorization phase? --johnk

3 12

need help configuring ntlm_auth w/ freeradius 1.0.1
by Ken George 12 Jul '05

12 Jul '05

Alan as you suggested (thanks) I have commented out LDAP and I am now attempting to authenticate via ntlm_auth. I've configured and started Samba and windindd. I can authenticate via ntlm_auth outside of Freeradius, but not with it. I KNOW THE PROBLEM IS WITH MY CONFIGURATION AND NOT FREERADIUS! I'd appreciate help in locating / understanding what I have misconfigured? Also, my final goal is to authenticate clients to a Cisco Aironet 1200 via our Windows 2003 Active Directory usernames and passwords is ntlm_auth the correct method to use? [root@phllnxsrv01 raddb]# ntlm_auth --username="test ops" --password=xxxxxx --domain=usmisgnet --request-NT-key NT_STATUS_OK: Success (0x0) Below are the ntlm_auth section of radiusd.conf and the radtest string used and the debug output from the other window. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } radtest "test ops" xxxxxx localhost 0 testing123 radiusd -xxyz -l stdout Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf [NORMAL OUTPUT SUPPRESSED] Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32784, id=232, length=60 --- Walking the entire request list --- Waking up in 31 seconds... Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) Threads: total/active/spare threads = 5/0/5 User-Name = "test ops" User-Password = "m1sg0ps" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_lowerpair: User-Name now 'test ops' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test ops", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "test ops", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [test ops] (from client localhost port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 127.0.0.1:32784, id=232, length=60 Sending Access-Reject of id 232 to 127.0.0.1:32784 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 232 with timestamp 42d3e0ec Nothing to do. Sleeping until we see a request. Ken George Systems and Network Engineering Mi Services Group, Inc. +1 610-230-2500 x129

2 1

RE: need help configuring ntlm_auth w/ freeradius 1.0.1
by Guy Davies 12 Jul '05

12 Jul '05

Hi Ken, [..snip..] > > Below are the ntlm_auth section of radiusd.conf and the > radtest string used and the debug output from the other window. > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --username=%{Stripped-User-Name:-%{User-Name:-None}} > --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00}" > } > > radtest "test ops" xxxxxx localhost 0 testing123 > > radiusd -xxyz -l stdout > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /etc/raddb/proxy.conf > Config: including file: /etc/raddb/clients.conf > Config: including file: /etc/raddb/snmp.conf > Config: including file: /etc/raddb/eap.conf > Config: including file: /etc/raddb/sql.conf > > [NORMAL OUTPUT SUPPRESSED] > Listening on authentication *:1812 > Listening on accounting *:1813 > Listening on proxy *:1814 > Ready to process requests. > rad_recv: Access-Request packet from host 127.0.0.1:32784, > id=232, length=60 > --- Walking the entire request list --- > Waking up in 31 seconds... > Thread 1 got semaphore > Thread 1 handling request 0, (1 handled so far) > Threads: total/active/spare threads = 5/0/5 > User-Name = "test ops" > User-Password = "m1sg0ps" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 0 It looks like there's no NT Domain in the RADIUS request. It's certainly not in the output above. > rad_lowerpair: User-Name now 'test ops' > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "test ops", looking up realm NULL > rlm_realm: No such realm "NULL" Yep, there you go, there is no REALM associated with this username so the REALM NULL is assumed but it hasn't been configured for that REALM. I would expect the username to be sent as <REALM>\<username> by a standard M$ supplicant. Are you just telling it to use your windows credentials? Rgds, Guy > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_realm: No '\' in User-Name = "test ops", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "ntdomain" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > modcall[authorize]: module "files" returns notfound for request 0 > modcall: group authorize returns ok for request 0 > auth: No authenticate method (Auth-Type) configuration found for the > request: Rejecting the user > auth: Failed to validate the user. > Login incorrect: [test ops] (from client localhost port 0) > Delaying request 0 for 1 seconds Finished request 0 Going to > the next request Thread 1 waiting to be assigned a request > rad_recv: Access-Request packet from host 127.0.0.1:32784, > id=232, length=60 Sending Access-Reject of id 232 to 127.0.0.1:32784 > --- Walking the entire request list --- > Waking up in 3 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 232 with timestamp 42d3e0ec > Nothing to do. Sleeping until we see a request. > > > > > Ken George > Systems and Network Engineering > Mi Services Group, Inc. > +1 610-230-2500 x129 > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

log_badlogins
by Edward Rempala 12 Jul '05

12 Jul '05

When I run this script I get [root@auth bin]# ./log_badlogins Could not open file none [root@auth bin]# What can I do to fix this?

2 2

Password with comma fail with LDAP
by Turtiainen, Tero 12 Jul '05

12 Jul '05

Hi, We have FreeRADIUS 0.9.3 using LDAP for authorisation. We now have a problem that for example password with certain characters is cut. For example password "test,ing" is cut to "test". This is caused by the gettoken function in src/lib/token.c which is used by the rlm_ldap module. Google search seems to indicate that the same problem has been with the SQL-module which also uses gettoken. This kind of behaviour is of course quite evil. Is our problem unique? This seems so obvious problem that I would guess that it has been encountered before. I looked at the CVS version and my guess is that this has not been fixed. I made a quick test fix by replacing all occurences of gettoken in src/modules/rlm_ldap/rlm_ldap.c with getbareword-function (also in src/lib/token.c) which does not care about the tokens and thus does not cut the attribute value if it contains comma, semicolon, brace or any other of the magic characters. Does this fix break more things than it fixes? Is it a valid fix in this case? Any better solutions? -- Tero Turtiainen Telecom, Media & Entertainment Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

1 0

Someone have Toplogie: Windows - Cisco 3550 - Freeradius
by Michael Langer 12 Jul '05

12 Jul '05

Hi, sorry i ask it some time ago, but get no answer. I there anybody who have this configuration? Windows (2k or XP) - Ciscoc 3550 - Freeradius? I have read that some people get problem and use other radius servers. Michael Langer -- Weitersagen: GMX DSL-Flatrates mit Tempo-Garantie! Ab 4,99 Euro/Monat: http://www.gmx.net/de/go/dsl

1 0

Download
by Shepherd, Dave 12 Jul '05

12 Jul '05

I'm having trouble downloading from: ftp://ftp.freeradius.org/pub/radius I've tried 1.0.4, 1.0.3 from the website. I've also tried to use fireFTP and plain old ftp but with no luck. The ftp.freeradius.org hostname resolves to 62.24.0.50 OK Is the site known to be down? Dave

1 0