- Freeradius-Users - lists.freeradius.org

Need help: login incorrect with FR 2.2.1
by Wang, Yu 16 May '13

16 May '13

Hello, I upgraded FR from 2.1.10 to 2.2.1. Everything went well except about 25% of our wireless users cannot authenticate after the upgrade. The backend authentication server is Active Directory and we use ntlm_auth from winbind to pass MSCHAPv2 response from FR to AD. After upgrade FR, I also restart winbindd, smbd, and nmbd. For the users who cannot authenticate, I found that reset password would resolve the issue. However we have over 50,000 users. Our helpdesk would be overwhelmed to help 13k users to change their password. So I had to roll back to 2.1.10 and the users I know who cannot authenticate with 2.2.1 were able to authenticate again with 2.1.10 without changing password. Here is radiusd -X for one user's failed authentication. On AD Event Log it shows error 0xC000006A An incorrect password was supplied. And on radius side, it shows Login incorrect (mschap_ad: External script says Logon failure (0xc000006d)). What changes in the new code could affects mschap handling? Or what should I do to make 2.2.1 work without forcing users to reset their password? Thanks for your help. If you need more information, please let me know and I'll post them. Yu Wang Network Architect FSU ======================radiusd -X ===================================== rad_recv: Access-Request packet from host 192.168.255.233 port 32846, id=112, length=343 User-Name = "myusername" NAS-IP-Address = 192.168.255.200 NAS-IPv6-Address = ::1 NAS-Port = 0 NAS-Identifier = "192.168.255.233" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "8C58779F3105" Called-Station-Id = "000B860E2A80" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020a006b190017030100608bfce27df6c312388e67d06a84921c88cbeb2729d13da08d98f6cd46cab227836f576e262c5543a0cfc8aaaac88dc02450477cac6b06a3c816ac01090b848190401617a0a19eb2b79a1e49f d687087b02918d5e588764ab0f07c03d9eecf9f80 State = 0x5858357f50522cd58c1225ecc15d6edb Aruba-Essid-Name = "FSUSecure" Aruba-Location-Id = "wg-a105-4012-Rm.wlan.fsu.edu" Aruba-AP-Group = "wlan" Aruba-Device-Type = "iPhone" Message-Authenticator = 0x245bb0a5f3165db6d047fb13cfb41042 server virtual.dot1x_1814 { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myusername", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myusername" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 10 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814 +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00411a020a003c31c8a5f4da7f3f5fee24c0f8c2a0ad12390000000000000000d1ec3781f44920bf27bd2445d0d4db58c2f199c141667c0100616d61313263 server virtual.dot1x_1814 { [peap] Setting User-Name to myusername Sending tunneled request EAP-Message = 0x020a00411a020a003c31c8a5f4da7f3f5fee24c0f8c2a0ad12390000000000000000d1ec3781f44920bf27bd2445d0d4db58c2f199c141667c0100616d61313263 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "myusername" State = 0x9e97c83a9e9dd2677d1fae1010f8f18d server virtual.dot1x_1814_inner_tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel +- entering group authorize {...} ++? if ((outer.request:EAP-Message) ) ?? Evaluating (outer.request:EAP-Message) -> TRUE ++? if ((outer.request:EAP-Message) ) -> TRUE ++- entering if ((outer.request:EAP-Message) ) {...} expand: %{request:User-Name} -> myusername +++[outer.request] returns notfound expand: %{request:User-Name} -> myusername +++[reply] returns notfound ++- if ((outer.request:EAP-Message) ) returns notfound ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) expand: %{request:User-Name} -> myusername ? Evaluating ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "myusername", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myusername" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++? if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) ?? Evaluating (outer.request:EAP-Message) -> TRUE expand: local.MY.realm -> local.MY.realm WARNING: No such configuration item local.MY.realm expand: %{config:local.MY.realm} -> ? Evaluating (Realm != "%{config:local.MY.realm}" ) -> TRUE ++? if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) -> TRUE ++- entering if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) {...} expand: Realm is '%{Realm}' on Inside -> Realm is 'NULL' on Inside +++[outer.reply] returns ok ++- if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) returns ok [eap] EAP packet type response id 10 length 65 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 8 ++[files] returns ok ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) expand: %{request:User-Name} -> myusername ? Evaluating ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++- entering else else {...} [ldap-mds] performing user authorization for myusername [ldap-mds] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap-mds] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(!(uid=lib-guest*))) -> (&(uid=myusername)(!(uid=lib-guest*))) [ldap-mds] expand: dc=fsu,dc=edu -> dc=fsu,dc=edu [ldap-mds] ldap_get_conn: Checking Id: 0 [ldap-mds] ldap_get_conn: Got Id: 0 [ldap-mds] performing search in dc=fsu,dc=edu, with filter (&(uid=myusername)(!(uid=lib-guest*))) [ldap-mds] looking for check items in directory... [ldap-mds] ntPassword -> NT-Password == 0x4444333431333443313741333642433142444136383333324232323239443431 [ldap-mds] looking for reply items in directory... [ldap-mds] employeeStatus -> My-Local-employeeStatus = "Active" [ldap-mds] ldap_release_conn: Release Id: 0 +++[ldap-mds] returns ok ++- else else returns ok rlm_perl: RAD_REQUEST: User-Name = myusername rlm_perl: RAD_REQUEST: EAP-Message = 0x020a00411a020a003c31c8a5f4da7f3f5fee24c0f8c2a0ad12390000000000000000d1ec3781f44920bf27bd2445d0d4db58c2f199c141667c0100616d61313263 rlm_perl: RAD_REQUEST: Realm = NULL rlm_perl: RAD_REQUEST: EAP-Type = MS-CHAP-V2 rlm_perl: RAD_REQUEST: Stripped-User-Name = myusername rlm_perl: RAD_REQUEST: State = 0x9e97c83a9e9dd2677d1fae1010f8f18d rlm_perl: RAD_REQUEST: FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Assign myusername to VLAN employee2b. rlm_perl: Added pair User-Name = myusername rlm_perl: Added pair EAP-Message = 0x020a00411a020a003c31c8a5f4da7f3f5fee24c0f8c2a0ad12390000000000000000d1ec3781f44920bf27bd2445d0d4db58c2f199c141667c0100616d61313263 rlm_perl: Added pair Realm = NULL rlm_perl: Added pair EAP-Type = MS-CHAP-V2 rlm_perl: Added pair Stripped-User-Name = myusername rlm_perl: Added pair State = 0x9e97c83a9e9dd2677d1fae1010f8f18d rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Added pair User-Name = myusername rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair My-Local-employeeStatus = Active rlm_perl: Added pair Tunnel-Private-Group-Id = employee2b rlm_perl: Added pair NT-Password = 0x4444333431333443313741333642433142444136383333324232323239443431 rlm_perl: Added pair Ldap-UserDn = uid=myusername,dc=users,dc=fsu,dc=edu rlm_perl: Added pair Auth-Type = EAP ++[perl_dot1x] returns updated expand: %{Realm} -> NULL ++- entering switch %{Realm} {...} +++- switch %{Realm} returns updated ++- group authorize returns updated ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap_ad] Found NT-Password [mschap_ad] Creating challenge hash with username: myusername [mschap_ad] Client is using MS-CHAPv2 for myusername, we need NT-Password [mschap_ad] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap_ad] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=myusername [mschap_ad] No NT-Domain was found in the User-Name. [mschap_ad] expand: %{mschap:NT-Domain} -> [mschap_ad] ... expanding second conditional [mschap_ad] expand: --domain=%{%{mschap:NT-Domain}:-FSU} -> --domain=FSU [mschap_ad] Creating challenge hash with username: myusername [mschap_ad] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=671fda289ab79035 [mschap_ad] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=d1ec3781f44920bf27bd2445d0d4db58c2f199c141667c01 Exec output: Logon failure (0xc000006d) Exec plaintext: Logon failure (0xc000006d) [mschap_ad] Exec: program returned: 1 [mschap_ad] External script failed. [mschap_ad] FAILED: MS-CHAP2-Response is incorrect ++[mschap_ad] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect (mschap_ad: External script says Logon failure (0xc000006d)): [myusername] (from client aruba233 port 0 via TLS tunnel) Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> myusername attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated } # server virtual.dot1x_1814_inner_tunnel [peap] Got tunneled reply code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled } # server virtual.dot1x_1814 Sending Access-Challenge of id 112 to 192.168.255.233 port 32846 Reply-Message = "Realm is 'NULL' on Inside" EAP-Message = 0x010b002b19001703010020c717f8462edd4b081a4cab8c17a2a77939f2b7ed8f45477fa43ca7ae59cdded3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5858357f51532cd58c1225ecc15d6edb Finished request 91419. Going to the next request ======================================================================================== rad_recv: Access-Request packet from host 192.168.255.233 port 32846, id=185, length=343 User-Name = "myusername" NAS-IP-Address = 192.168.255.200 NAS-IPv6-Address = ::1 NAS-Port = 0 NAS-Identifier = "192.168.255.233" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "8C58779F3105" Called-Station-Id = "000B860E2A80" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020a006b190017030100601fa8cfb41d8a736603cccfac039a1e796b70c551d0229a7054620a3569e504875e69eb4f348dc1db446dc778c0c797ce8df3680674d1cf083167c839473737483bbf4564cbca6a2ab0e045b dc7549f45664c3aca1497463410664e0ae91cee39 State = 0xcbac7161c3a6687448dbbe7553b6baed Aruba-Essid-Name = "FSUSecure" Aruba-Location-Id = "wg-a105-4012-Rm.wlan.fsu.edu" Aruba-AP-Group = "wlan" Aruba-Device-Type = "iPhone" Message-Authenticator = 0x5eebfb60034622676aaa614c5dec1ec8 server virtual.dot1x_1814 { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myusername", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myusername" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 10 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814 +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00411a020a003c3167b550c58cc6458a22569f9b3d545f240000000000000000b27cc6b8b53cd52cefd00805875b297ede8772635050987500616d61313263 server virtual.dot1x_1814 { [peap] Setting User-Name to myusername Sending tunneled request EAP-Message = 0x020a00411a020a003c3167b550c58cc6458a22569f9b3d545f240000000000000000b27cc6b8b53cd52cefd00805875b297ede8772635050987500616d61313263 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "myusername" State = 0xa7e44290a7ee58094f4ed0f3925b59a6 server virtual.dot1x_1814_inner_tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel +- entering group authorize {...} ++? if ((outer.request:EAP-Message) ) ?? Evaluating (outer.request:EAP-Message) -> TRUE ++? if ((outer.request:EAP-Message) ) -> TRUE ++- entering if ((outer.request:EAP-Message) ) {...} expand: %{request:User-Name} -> myusername +++[outer.request] returns notfound expand: %{request:User-Name} -> myusername +++[reply] returns notfound ++- if ((outer.request:EAP-Message) ) returns notfound ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) expand: %{request:User-Name} -> myusername ? Evaluating ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "myusername", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myusername" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++? if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) ?? Evaluating (outer.request:EAP-Message) -> TRUE expand: local.MY.realm -> local.MY.realm WARNING: No such configuration item local.MY.realm expand: %{config:local.MY.realm} -> ? Evaluating (Realm != "%{config:local.MY.realm}" ) -> TRUE ++? if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) -> TRUE ++- entering if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) {...} expand: Realm is '%{Realm}' on Inside -> Realm is 'NULL' on Inside +++[outer.reply] returns ok ++- if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) returns ok [eap] EAP packet type response id 10 length 65 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 8 ++[files] returns ok ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) expand: %{request:User-Name} -> myusername ? Evaluating ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++- entering else else {...} [ldap-mds] performing user authorization for myusername [ldap-mds] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap-mds] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(!(uid=lib-guest*))) -> (&(uid=myusername)(!(uid=lib-guest*))) [ldap-mds] expand: dc=fsu,dc=edu -> dc=fsu,dc=edu [ldap-mds] ldap_get_conn: Checking Id: 0 [ldap-mds] ldap_get_conn: Got Id: 0 [ldap-mds] performing search in dc=fsu,dc=edu, with filter (&(uid=myusername)(!(uid=lib-guest*))) [ldap-mds] looking for check items in directory... [ldap-mds] ntPassword -> NT-Password == 0x4444333431333443313741333642433142444136383333324232323239443431 [ldap-mds] looking for reply items in directory... [ldap-mds] employeeStatus -> My-Local-employeeStatus = "Active" [ldap-mds] ldap_release_conn: Release Id: 0 +++[ldap-mds] returns ok ++- else else returns ok rlm_perl: RAD_REQUEST: User-Name = myusername rlm_perl: RAD_REQUEST: EAP-Message = 0x020a00411a020a003c3167b550c58cc6458a22569f9b3d545f240000000000000000b27cc6b8b53cd52cefd00805875b297ede8772635050987500616d61313263 rlm_perl: RAD_REQUEST: Realm = NULL rlm_perl: RAD_REQUEST: EAP-Type = MS-CHAP-V2 rlm_perl: RAD_REQUEST: Stripped-User-Name = myusername rlm_perl: RAD_REQUEST: State = 0xa7e44290a7ee58094f4ed0f3925b59a6 rlm_perl: RAD_REQUEST: FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Assign myusername to VLAN employee2b. rlm_perl: Added pair User-Name = myusername rlm_perl: Added pair EAP-Message = 0x020a00411a020a003c3167b550c58cc6458a22569f9b3d545f240000000000000000b27cc6b8b53cd52cefd00805875b297ede8772635050987500616d61313263 rlm_perl: Added pair Realm = NULL rlm_perl: Added pair EAP-Type = MS-CHAP-V2 rlm_perl: Added pair Stripped-User-Name = myusername rlm_perl: Added pair State = 0xa7e44290a7ee58094f4ed0f3925b59a6 rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Added pair User-Name = myusername rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair My-Local-employeeStatus = Active rlm_perl: Added pair Tunnel-Private-Group-Id = employee2b rlm_perl: Added pair NT-Password = 0x4444333431333443313741333642433142444136383333324232323239443431 rlm_perl: Added pair Ldap-UserDn = uid=myusername,dc=users,dc=fsu,dc=edu rlm_perl: Added pair Auth-Type = EAP ++[perl_dot1x] returns updated expand: %{Realm} -> NULL ++- entering switch %{Realm} {...} +++- switch %{Realm} returns updated ++- group authorize returns updated ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap_ad] Found NT-Password [mschap_ad] Creating challenge hash with username: myusername [mschap_ad] Client is using MS-CHAPv2 for myusername, we need NT-Password [mschap_ad] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap_ad] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=myusername [mschap_ad] No NT-Domain was found in the User-Name. [mschap_ad] expand: %{mschap:NT-Domain} -> [mschap_ad] ... expanding second conditional [mschap_ad] expand: --domain=%{%{mschap:NT-Domain}:-FSU} -> --domain=FSU [mschap_ad] Creating challenge hash with username: myusername [mschap_ad] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=c8b28e6460a5a132 [mschap_ad] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=b27cc6b8b53cd52cefd00805875b297ede87726350509875 Exec output: Logon failure (0xc000006d) Exec plaintext: Logon failure (0xc000006d) [mschap_ad] Exec: program returned: 1 [mschap_ad] External script failed. [mschap_ad] FAILED: MS-CHAP2-Response is incorrect ++[mschap_ad] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect (mschap_ad: External script says Logon failure (0xc000006d)): [myusername] (from client aruba233 port 0 via TLS tunnel) Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> myusername attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated } # server virtual.dot1x_1814_inner_tunnel [peap] Got tunneled reply code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled } # server virtual.dot1x_1814 Sending Access-Challenge of id 185 to 192.168.255.233 port 32846 Reply-Message = "Realm is 'NULL' on Inside" EAP-Message = 0x010b002b19001703010020e64116a3874fb2f1731c248a0424a0ea316a859f4831ed7585f3ac3fe11ed5e1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcbac7161c2a7687448dbbe7553b6baed Finished request 91531. Going to the next request ====================end of radiusd -X =======================================

2 1

Any One-Time password system.
by Sergii Bieliaievskyi 16 May '13

16 May '13

Hello. I am new here. And my first message concerns One-Time password authentication. I have a problem with installing rlm_smsotp + http://wiki.freeradius.org/modules/Rlm_smsotp. I am always getting an error "/var/run/smsotp_socket No such file or directory". I am sure that smsotp_socket exists and has appropiate permission (i even tryed to run freeradius with root privileges). After some researches i conclude that the problem is in rlm_smsotp module. I cann`t find any other couse of the problem. Breaf information about my system and soft versions. FreeBSD 9.1 FreeRADIUS 2.2.0 log============================================================ rad_recv: Access-Request packet from host 172.16.17.0 port 1645, id=79, length=64 Framed-Protocol = PPP User-Name = "test_user" User-Password = "test_pass" Service-Type = Framed-User NAS-IP-Address = 172.16.17.0 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> 172.16.17.0 [auth_log] expand: /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radacct/172.16.17.0/auth-detail-20130513 [auth_log] /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radacct/172.16.17.0/auth-detail-20130513 [auth_log] expand: %t -> Mon May 13 16:51:36 2013 ++[auth_log] returns ok ++[smsotp] returns ok [suffix] No '@' in User-Name = "test_user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql] expand: %{User-Name} -> test_user [sql] sql_set_user escaped user --> 'test_user' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test_user' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test_user' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test_user' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Everyone' ORDER BY id [sql] User found in group Everyone [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Everyone' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok rlm_checkval: Could not find item named Calling-Station-Id in request rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = smsotp # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group smsotp {...} [pap] login attempt with password "test_pass" [pap] Using clear text password "test_pass" [pap] User authenticated successfully ++[pap] returns ok rlm_smsotp: smsotp_connect: connect(/var/run/smsotp_socket): No such file or directory ++[smsotp] returns fail Failed to authenticate the user. Login incorrect: [test_user/test_pass] (from client DMcore port 0) Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test_user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 79 to 172.16.17.0 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 79 with timestamp +11 Ready to process requests. Can anybody advise me simple way of implementation OTP with freeradius2 and daloradius as a frontend? Or maybe there is a solution for rlm_smsotp/ Thank you. -- ------------------------------ PRIVILEGED AND CONFIDENTIAL COMMUNICATION This e-mail transmission, and any documents, files or previous e-mail messages attached to it, may contain confidential information that is legally privileged. If you are not the intended recipient or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is strictly prohibited. If you have received this transmission in error, please: (1) immediately notify me by reply e-mail, or by collect telephone call; and (2) destroy the original transmission and its attachments without reading or saving in any manner.

10 31

Problem with PAP autentification on freeradius-3.0.0
by BALSIANOK, Peter 16 May '13

16 May '13

Hi, I have problem with PAP autentification on freeradius-3.0.0, but on freeradius-2.2.1 everythink works correct. Could you please help me, thx. Debug output for freeradius-3.0.0: radiusd@tdrad1test:/storage/app/radius/raddb/auth-new$ /storage/app/radius/freeradius-3.0.0/sbin/radiusd -X -d /storage/app/radius/raddb/auth-new radiusd: FreeRADIUS Version 3.0.0, for host x86_64-unknown-linux-gnu, built on May 14 2013 at 16:22:54 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... ... Listening on proxy address * port 0 Listening on auth address * port 1812 as server default Listening on auth address * port 1645 as server default Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 50633, id=15, length=115 NAS-Port-Type = Virtual Service-Type = Framed-User Calling-Station-Id = "421905012405" Called-Station-Id = "l2tp.vps" Framed-Protocol = PPP User-Name = "l2tp(a)radiustest.sk" User-Password = "l2tp" Connect-Info = "8640000" NAS-IP-Address = 213.151.234.114 (0) # Executing section authorize from file /storage/app/radius/raddb/auth-new/sites-enabled/default (0) group authorize { (0) - entering group authorize {...} (0) [chap] = noop (0) suffix : Looking up realm "radiustest.sk" for User-Name = "l2tp(a)radiustest.sk" (0) suffix : Found realm "DEFAULT" (0) suffix : Adding Stripped-User-Name = "l2tp" (0) suffix : Adding Realm = "DEFAULT" (0) suffix : Authentication realm is LOCAL. (0) [suffix] = ok rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Called-Station-Id = l2tp.vps rlm_perl: Added pair Calling-Station-Id = 421905012405 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = l2tp(a)radiustest.sk rlm_perl: Added pair User-Password = l2tp rlm_perl: Added pair Connect-Info = 8640000 rlm_perl: Added pair Realm = DEFAULT rlm_perl: Added pair Stripped-User-Name = l2tp rlm_perl: Added pair NAS-IP-Address = 213.151.234.114 rlm_perl: Added pair Current-Time = 1368711260 rlm_perl: Added pair Password-With-Header = {SSHA}cAgh2LCe5649EzEAbc+nAfIOvOyOJSmU+sKiPA== rlm_perl: Added pair VPDN_SERVICE_ID = User-GPRS-L2TP (0) [perl] = ok (0) [pap] = updated (0) Found Auth-Type = PAP (0) # Executing group from file /storage/app/radius/raddb/auth-new/sites-enabled/default (0) group PAP { (0) - entering group PAP {...} (0) pap : login attempt with password "l2tp" (0) pap : Using SSHA encryption. (0) ERROR: pap : SSHA password check failed (0) pap : Passwords don't match (0) [pap] = reject (0) Failed to authenticate the user. (0) Login incorrect (pap: SSHA password check failed): [l2tp(a)radiustest.sk/l2tp] (from client localhost port 0 cli 421905012405) Debug output for freeradius-2.2.1: radiusd@tdrad1test:/storage/app/radius/raddb/auth$ /storage/app/radius/freeradius/sbin/radiusd -X -d /storage/app/radius/raddb/auth radiusd: FreeRADIUS Version 2.2.1, for host x86_64-unknown-linux-gnu, built on May 2 2013 at 09:22:02 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... ... Listening on authentication address * port 1812 Listening on authentication address * port 1645 Listening on proxy address * port 37677 Listening on command file ../../log/radius/radius_auth.sock Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 57436, id=196, length=115 NAS-Port-Type = Virtual Service-Type = Framed-User Calling-Station-Id = "421905012405" Called-Station-Id = "l2tp.vps" Framed-Protocol = PPP User-Name = "l2tp(a)radiustest.sk" User-Password = "l2tp" Connect-Info = "8640000" NAS-IP-Address = 213.151.234.114 # Executing section authorize from file /storage/app/radius/raddb/auth/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [suffix] Looking up realm "radiustest.sk" for User-Name = "l2tp(a)radiustest.sk" [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "l2tp" [suffix] Adding Realm = "DEFAULT" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[files] returns noop rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Called-Station-Id = l2tp.vps rlm_perl: Added pair Calling-Station-Id = 421905012405 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = l2tp(a)radiustest.sk rlm_perl: Added pair User-Password = l2tp rlm_perl: Added pair Connect-Info = 8640000 rlm_perl: Added pair Realm = DEFAULT rlm_perl: Added pair Stripped-User-Name = l2tp rlm_perl: Added pair NAS-IP-Address = 213.151.234.114 rlm_perl: Added pair Current-Time = 1368709398 rlm_perl: Added pair Password-With-Header = {SSHA}cAgh2LCe5649EzEAbc+nAfIOvOyOJSmU+sKiPA== rlm_perl: Added pair VPDN_SERVICE_ID = User-GPRS-L2TP ++[perl] returns ok [pap] Normalizing SSHA1-Password from base64 encoding ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /storage/app/radius/raddb/auth/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "l2tp" [pap] Using SSHA encryption. [pap] User authenticated successfully ++[pap] returns ok Login OK: [l2tp(a)radiustest.sk/l2tp] (from client localhost port 0 cli 421905012405) Peter Balšianok Data Service Operation Coordinator, Voice & Data Services Operations Orange Slovensko, a. s. Metodova 8, 821 08 Bratislava tel: +421 908 00 2405 mobil: +421 905 012 405 e-mail: peter.balsianok(a)orange.sk<mailto:peter.balsianok@orange.sk>

2 1

Basic question to authenticate switches and Linux boxes
by Roberto Carna 16 May '13

16 May '13

Dear, I'm new at Freeredius as an AAA sever in a Linux box and I need to authenticate Allied switches and Debian/Centos boxes. What package/module do I have to install in adition to freeradius ??? And what authentication procedure do I have ti use in order to let universal AAA ??? Thanks a lot, Roberto "the locu abierto"

4 5

Radius Change IP
by Sokphak TOUCH 16 May '13

16 May '13

Hello All, I have one radius server is on services. Because of network changed, I need to change IP address of this server. Could you please let me know after changing IP does radius will be working as normal? And what are the thing should I consider? Thanks everyone for your input Regards, Sokphak

2 3

accessing subtypes (tlv)
by Juan Pablo L. 15 May '13

15 May '13

Hi, i have downloaded and installed freeradius from git master FreeRADIUS Version 3.0.0 (git #7a9281c), i m developing a module to do some charging based on 3gpp2 standards for a cdma network, i have modified the dictionary to reflect a subtype in one of the attributes: ATTRIBUTE 3GPP2-Prepaid-acct-Capability 91 tlvATTRIBUTE 3GPP2-Prepaid-acct-Capability-AvailableInClient 91.1 integer but i m having trouble accesing 3GPP2-Prepaid-acct-Capability-AvailableInClient, basically i dont know how and i cant find an example in the code so far. when i do: ppac = pairfind(request->packet->vps,91.1,5535,TAG_ANY)orppac = pairfind(request->packet->vps,91,5535,TAG_ANY) they both return null. any hint will be appreciated as to how can i access the values in the subtypesof any tlv-type attribute. the other option is just put back the dictionary to octect type and access the values manuallybut i know this version of freeradius supports tlv so i would like to find a way to do it using freeradius capabilities. thanks!

2 2

Re: FreeRadius Ceritificate Migration
by John Dennis 15 May '13

15 May '13

Thank you for including the full debug. Here is the section from the rlm_eap_tls initialization. > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > CA_path = "/usr/local/etc/raddb/certs/roots" > pem_file_type = yes > private_key_file = "/usr/local/etc/raddb/certs/servercert.pem" > certificate_file = "/usr/local/etc/raddb/certs/servercert.pem" > private_key_password = "********" > dh_file = "/usr/local/etc/raddb/certs/dh" > random_file = "/usr/local/etc/raddb/certs/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" > ecdh_curve = "prime256v1" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > verify { > } > ocsp { > enable = no > override_cert_url = yes > url = "http://127.0.0.1/ocsp/" > use_nonce = yes > timeout = 0 > softfail = no > } > } A couple of things immediately jump out at me. This is not the default configuration. First of all there is no CA_file configured (only CA_path). You must have commented that out or deleted it. That means you can't use a bundled CA file. Secondly the CA_path is not the default either, you've got /usr/local/etc/raddb/certs/roots. Does that directory exist? But more importantly can radiusd execute the directory and read it's contents? These are file/directory permission issues. In radiusd.conf are user and group variables, these are the user and group respectively that radiusd runs as *after* it initializes. I'm not sure if OpenSSL reads the CA files before or after radiusd drops privileges from root to the user/group specified in radiusd.conf. But at the time OpenSSL reads the files it has to have permission to traverse into the directory (execute permission) and have read permission on the files to read their contents. If you're not sure if radiusd is reading the CA files or not it's easy to verify by running radiusd under strace (hint: use -o to direct the output to a file and then search for your CA_path) you should see the directory being opened and files being read. If there are permission problems you'll see error information in the strace output. HTH, John -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 1

Free radius as Proxy EAP-PEAP-GTC User-Password is never set
by Sankalp Dubey 15 May '13

15 May '13

Hi Is EAP-PEAP-GTC User-Password is set while using Free Radius as a proxy? We have a radius server which does not understand EAP. We want to authenticate the WiFi clients with this server. In order to achieve this we have configured the Free Radius as proxy (EAP-PEAP-GTC). But this does not seems to be working as at our server end we do not receive clear text password. Here is the radiusd debug output: main { name = "radiusd" prefix = "/home/freeradius" localstatedir = "/home/freeradius/var" sbindir = "/home/freeradius/sbin" logdir = "/home/freeradius/var/log/radius" run_dir = "/home/freeradius/var/run/radiusd" libdir = "/home/freeradius/lib" radacctdir = "/home/freeradius/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/home/freeradius/var/run/radiusd/radiusd.pid" checkrad = "/home/freeradius/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm DEVLAB { authhost = 10.141.148.91:1812 secret = testing123 } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client netmotion { ipaddr = 10.141.150.34 require_message_authenticator = no secret = "testing123" nastype = "other" } client wifi { ipaddr = 10.141.148.220 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /home/freeradius/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /home/freeradius/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /home/freeradius/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /home/freeradius/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /home/freeradius/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /home/freeradius/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /home/freeradius/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /home/freeradius/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /home/freeradius/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /home/freeradius/etc/raddb/modules/unix unix { radwtmp = "/home/freeradius/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /home/freeradius/etc/raddb/eap.conf eap { default_eap_type = "gtc" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/home/freeradius/etc/raddb/certs" pem_file_type = yes private_key_file = "/home/freeradius/etc/raddb/certs/server.pem" certificate_file = "/home/freeradius/etc/raddb/certs/server.pem" CA_file = "/home/freeradius/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/home/freeradius/etc/raddb/certs/dh" random_file = "/home/freeradius/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/home/freeradius/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "gtc" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = no virtual_server = "proxy-inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /home/freeradius/etc/raddb/modules/preprocess preprocess { huntgroups = "/home/freeradius/etc/raddb/huntgroups" hints = "/home/freeradius/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /home/freeradius/etc/raddb/huntgroups reading pairlist file /home/freeradius/etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /home/freeradius/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /home/freeradius/etc/raddb/modules/files files { usersfile = "/home/freeradius/etc/raddb/users" acctusersfile = "/home/freeradius/etc/raddb/acct_users" preproxy_usersfile = "/home/freeradius/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /home/freeradius/etc/raddb/users reading pairlist file /home/freeradius/etc/raddb/acct_users reading pairlist file /home/freeradius/etc/raddb/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /home/freeradius/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /home/freeradius/etc/raddb/modules/detail detail { detailfile = "/home/freeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /home/freeradius/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/home/freeradius/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /home/freeradius/etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /home/freeradius/etc/raddb/modules/radutmp radutmp { filename = "/home/freeradius/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /home/freeradius/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/home/freeradius/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /home/freeradius/etc/raddb/attrs.access_reject } # modules } # server server proxy-inner-tunnel { # from file /home/freeradius/etc/raddb/sites-enabled/proxy-inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } # modules } # server server inner-tunnel { # from file /home/freeradius/etc/raddb/sites-enabled/inner-tunnel modules { Module: Creating Auth-Type = inner-eap Module: Checking authenticate {...} for more modules to load Module: Instantiating module "inner-eap" from file /home/freeradius/etc/raddb/modules/inner-eap eap inner-eap { default_eap_type = "gtc" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Enter your Security Code innear-eap: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/home/freeradius/etc/raddb/certs/server.pem" certificate_file = "/home/freeradius/etc/raddb/certs/server.pem" CA_file = "/home/freeradius/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/home/freeradius/etc/raddb/certs/dh" random_file = "/home/freeradius/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/home/freeradius/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 51628 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /home/freeradius/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.141.150.34 port 50001, id=159, length=88 NAS-Identifier = "symc-2k8-150-34" User-Name = "user3" Calling-Station-Id = "0000005e5554" EAP-Message = 0x0200000a017573657233 Message-Authenticator = 0x2863faee4523a276cbac192585bb7c6c # Executing section authorize from file /home/freeradius/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user3", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /home/freeradius/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type gtc [gtc] expand: Password: -> Password: ++[eap] returns handled Sending Access-Challenge of id 159 to 10.141.150.34 port 50001 EAP-Message = 0x0101000f0650617373776f72643a20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0f2467dc0f2561157cc843c3aeb740bb Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.141.150.34 port 50001, id=160, length=103 NAS-Identifier = "symc-2k8-150-34" User-Name = "user3" Calling-Station-Id = "0000005e5554" EAP-Message = 0x0201000703190d Message-Authenticator = 0x9ca44cf06d9b92a8d8423fdfe6a12c71 State = 0x0f2467dc0f2561157cc843c3aeb740bb # Executing section authorize from file /home/freeradius/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user3", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 7 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /home/freeradius/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 160 to 10.141.150.34 port 50001 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0f2467dc0e267e157cc843c3aeb740bb Finished request 1. Going to the next request Waking up in 4.9 seconds.

2 8

Re: FreeRadius Ceritificate Migration
by John Dennis 14 May '13

14 May '13

On 05/14/2013 12:01 PM, Mitch Yackobeck wrote: > Good morning John, > > I appologize for making myself look like a moron. The original message > had actually been sent to someone who was helping me to potentially work > thru some issues that we were seeing and trying to work out. I > attempted to modify the message in haste and get some input from the > group and it appears that I severely bungled that one up. I've learned > my lesson in humility as I actually went back and read what I had done > and like yourself could not make true heads or tails of that first > paragraph. > > The ultimate goal we are trying to achieve here is this; we are > potentially going to be changing our certificate structure in our > classroom networks. We are looking to have a way to have clients that > have not been converted to the new certificate structure as well as > those that have been converted able to authenticate simultaneously using > the same wireless SSID and FreeRadius server. We use Novell eDir for > the backend services on the classroom side with FreeRadius > authenticating our wireless users at the root of the tree. For > authentication purposes we have moved from passing the username and > password via 802.1X on the Novell Client to an EAP-TLS user certificate > installed in the computer certificate store so that the system is > already authenticated to the network prior to a user attempting to login > and remains connected even after login. > > What I was trying to convey is that I've spent some time over the last > couple of weeks upgrading my test environment from an older version of > FreeRadius to the latest available. On that test server, I have both > its test certificates and our production server certificates loaded up > using a single file. Using the certs specific to the test server, > everything works as expected, when I attempt to use the certs from the > production server, thats when things go a little pear shaped. Initially > it appears that the server is able to read the client certificate enough > to recognize that the information is available, but when it requests > further details, it fails to find the CA applicaple to the client cert > and bombs out a reject. See below for a capture of the client > authentication attempt. > > I'm wondering if this type of setup is actually possible or if there is > some switch that someone knows of somewhere in the config that perhaps I > have missed. > > Any help would be appreciated. Thank you Mitch, this is much more lucid. I'll try to help as best I can but you're still making it difficult. We ask for the output of radiusd -X in plain text format for a reason (not edited snippets). Why? Well for starters it contains all sorts of essential information that you've deleted. At the very most basic level what FreeRADIUS version are you using? But it also tells us other things, such as how the server is configured, what files it's reading, etc. But in any event what you want to accomplish should work. Let me give you some basic information and things to look at. First of all I notice you're reading your configuration from /usr/local/etc/raddb, some people get confused because /etc/raddb is a common location and they edit the wrong files. Make sure you're editing the files the server is loading. Also, make sure the location of the cert directory in the config is what you expect and is where you've installed your CA root certs (had the full debug been posting we could have verified this). Cert verification may involve a chain of CA certs, each of which must validate, until a trusted root is reached. Every CA cert in the chain must be available, either because the client passes it or because you've installed it. Therefore it would be good to verify whether the client cert issuer is the only cert necessary or not and if not have you installed the intermediaries. But since you said you were able to manually verify the client cert via the openssl command line tool that's probably not the issue. But did you verify you've configured FreeRADIUS to use the same CA as the command line tool? OpenSSL has two basic ways it can access multiple CA certs, you either concatenate them in a "bundle" file and set the CA_file to that, or you set the CA_path and OpenSSL will look for certs in the directory. Sounds like you decided to populate the CA_path with individual certs. Do they have file extensions? Did you set the CA_path variable correctly? (the debug log would have helped answer this). It's a shame the cbtls_verify function in rlm_eap_tls.c does not print the certificate (via X509_print_ex()) when verification fails, being able to see the contents of the cert can be immensely helpful. Looking at your error messages my best guess is that OpenSSL cannot locate one or more of the issuer certs, the most likely cause of this is misconfiguration of either the CA_file or CA_path variable, or the contents found at those locations. See the man page for SSL_CTX_load_verify_locations for details on what OpenSSL expects and confirm your FreeRADIUS config matches it (also verify in the debug output the server is loading what you expect it to load and not something else). -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

1 0

radperf
by Bruce Bauman 14 May '13

14 May '13

We'd like to use radperf to test the performance impact of configuration changes to our FreeRadius server before putting the changes into production. Several recent posts have mentioned that radperf is not currently available for download. Alan DeKok had mentioned a few months back that he was going to release an improved version. Any update on this? Thanks. Bruce Bauman - Systems Administrator Rutgers University Office of Information Technology Campus Computing Services - Central Systems and Services Office ~ (848) 445-6363

1 0