- Freeradius-Users - lists.freeradius.org

Re: rlm_eap_ttls: Cannot tunnel EAP-Type/ttls inside of TTLS
by Darren Shea 01 Nov '12

01 Nov '12

Thanks, Matt - that trick did allow radiusd to complete loading and run! I still have to tweak the proxy.conf file, and I'm crossing my fingers that authentication will work as smoothly as it does on the already running server, but at least radiusd now responds to authentication requests. Thank you, Darren ECPI Western Broadband -----Original Message----- Date: Wed, 31 Oct 2012 21:32:00 +0000 From: Matthew Newton <mcn4(a)leicester.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: rlm_eap_ttls: Cannot tunnel EAP-Type/ttls inside of TTLS Message-ID: <20121031213200.GD6435(a)rootmail.cc.le.ac.uk> Content-Type: text/plain; charset=us-ascii On Wed, Oct 31, 2012 at 03:55:29PM -0500, Darren Shea wrote: > rlm_eap: Loaded and initialized type tls > ttls: default_eap_type = "ttls" > ttls: copy_request_to_tunnel = yes > ttls: use_tunneled_reply = yes > rlm_eap_ttls: Cannot tunnel EAP-Type/ttls inside of TTLS > rlm_eap: Failed to initialize type ttls ... > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "ttls" Try setting that to something other than "ttls". For instance, "mschapv2", to match your PEAP section. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 91, Issue 1 *********************************************** ----- No virus found in this message. Checked by AVG - www.avg.com Version: 2013.0.2742 / Virus Database: 2617/5855 - Release Date: 10/26/12

1 0

User-Name (machine\user) is not the same as MS-CHAP Name (user) from EAP-MSCHAPv2 error
by Gokhan Gunyol 01 Nov '12

01 Nov '12

Hi; We upgraded our radius to Freeradius 2.1.10 version on Ubuntu 32bit from an old version Our problem is windows xp clients cant login to wireless and radius has "User-Name (machine\user) is not the same as MS-CHAP Name (user) from EAP-MSCHAPv2" error mesages At the old version freeradius at exactly same configuration clients had not any problem realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } authtype = MS-CHAP with_ntdomain_hack =yes You can find debug log export at below What we need to do ? BR Gokhan User-Name = "testuser" NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.2" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "001644EF420B" Called-Station-Id = "000B8661DFC4" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0201001101676f6b68616e67756e796f6c Aruba-Essid-Name = "sunet-staff-wpa2" Aruba-Location-Id = "BM_IT_Net_Sys_3c:02" Aruba-Attr-10 = 0x424d5f62696e617369 Message-Authenticator = 0x50f0ec9d540b9d5e24090ea7de41963a # Executing section authorize from file /etc/freeradius/radiusd.conf +- entering group authorize {...} [yenimac] expand: - -> - yenimac: Does not match: Calling-Station-Id = 001644EF420B yenimac: Could not find value pair for attribute Calling-Station-Id ++[yenimac] returns ok [eap] EAP packet type response id 1 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[mschap] returns noop [ldap] performing user authorization for testuser [ldap] expand: (uid=%{mschap:User-Name:-%{User-Name}}) -> (uid=testuser) [ldap] expand: o=univ.edu -> o=univ.edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=univ.edu, with filter (uid=testuser) [ldap] Added User-Password = 0865B10841F6433200C02B4E4A9F468C in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{crypt}zhKZaHH/0ZNmo" [ldap] sambaNtPassword -> NT-Password == 0x3038363542313038343146363433333230304330324234453441394634363843 [ldap] sambaLmPassword -> LM-Password == 0x4643463937353144304431313932343636353044374443444545353833383737 [ldap] radiusAuthType -> Auth-Type == EAP [ldap] looking for reply items in directory... [ldap] user testuser authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! # Executing group from file /etc/freeradius/radiusd.conf +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 154 to 10.200.0.2 port 32795 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1007cea51005d77e23351c7d723e9be1 Finished request 272. Going to the next request rad_recv: Access-Request packet from host 10.200.0.2 port 32795, id=137, length=297 User-Name = "testuser" NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.2" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "001644EF420B" Called-Station-Id = "000B8661DFC4" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0202005719800000004d160301004801000044030150923dd861119125fc2259c6b0bc6056 daa0fbf2c9a746654b172f25019442cd00001600040005000a00090064006200030006001300 12006301000005ff01000100 State = 0x1007cea51005d77e23351c7d723e9be1 Aruba-Essid-Name = "sunet-staff-wpa2" Aruba-Location-Id = "BM_IT_Net_Sys_3c:02" Aruba-Attr-10 = 0x424d5f62696e617369 Message-Authenticator = 0x711e835734fabd4577390bed80cf0722 # Executing section authorize from file /etc/freeradius/radiusd.conf +- entering group authorize {...} [yenimac] expand: - -> - yenimac: Does not match: Calling-Station-Id = 001644EF420B yenimac: Could not find value pair for attribute Calling-Station-Id ++[yenimac] returns ok [eap] EAP packet type response id 2 length 87 [eap] Continuing tunnel setup. ++[eap] returns ok ++[mschap] returns noop [ldap] performing user authorization for testuser [ldap] expand: (uid=%{mschap:User-Name:-%{User-Name}}) -> (uid=testuser) [ldap] expand: o=univ.edu -> o=univ.edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=univ.edu, with filter (uid=testuser) [ldap] Added User-Password = 0865B10841F6433200C02B4E4A9F468C in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{crypt}zhKZaHH/0ZNmo" [ldap] sambaNtPassword -> NT-Password == 0x3038363542313038343146363433333230304330324234453441394634363843 [ldap] sambaLmPassword -> LM-Password == 0x4643463937353144304431313932343636353044374443444545353833383737 [ldap] radiusAuthType -> Auth-Type == EAP [ldap] looking for reply items in directory... [ldap] user testuser authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! # Executing group from file /etc/freeradius/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 77 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0048], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 07af], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 137 to 10.200.0.2 port 32795 EAP-Message = 0x0103040019c0000007f316030100310200002d030150923de9c2b9bb8cd34ef049ee8297b8 d2c2431864dd9f472838bcbf6c1279cf000004000005ff0100010016030107af0b0007ab0007 a80003e8308203e43082034da003020102020200b9300d06092a864886f70d01010505003081 9f310b30090603550406130254523111300f06035504071308497374616e62756c311b301906 0355040a1312536162616e636920556e6976657273697479311a3018060355040b1311496e66 6f726d6174696f6e20546563682e311b301906035504031312536162616e636920556e697665 72736974793127302506092a864886f70d010901161873797361 EAP-Message = 0x646d696e40736162616e6369756e69762e656475301e170d3132303531303130333233355a 170d3135303531303130333233355a30819f310b30090603550406130254523111300f060355 04071308497374616e62756c311b3019060355040a1312536162616e636920556e6976657273 697479311a3018060355040b1311496e666f726d6174696f6e20546563682e311b3019060355 040313125261646975732041757468205365727665723127302506092a864886f70d01090116 1873797361646d696e40736162616e6369756e69762e65647530819f300d06092a864886f70d 010101050003818d0030818902818100a868d32fea2097c26fc7 EAP-Message = 0x06c909e04dffea3289404adeca30535091e4e2b65a36ee9adfe02002bde974063907877737 74e2ef394cef6e918710c7010ce82e41bc97211b8ab3b109377bcee92e67133965afb7e48c4b 2dc1a0e224c721b63b2584c6d16b5a64c4a8f183062baac5d87fdb2250372a4b3fc75f2c3a42 0ec29a5cb90203010001a382012b3082012730090603551d1304023000302c06096086480186 f842010d041f161d4f70656e53534c2047656e65726174656420436572746966696361746530 1d0603551d0e04160414a34c94bbb730604678cc372d518bbbbbe1c43e3a3081cc0603551d23 0481c43081c18014c6c1f74047266b05e67daee7263acf804303 EAP-Message = 0xbd0aa181a5a481a230819f310b30090603550406130254523111300f060355040713084973 74616e62756c311b3019060355040a1312536162616e636920556e6976657273697479311a30 18060355040b1311496e666f726d6174696f6e20546563682e311b3019060355040313125361 62616e636920556e69766572736974793127302506092a864886f70d01090116187379736164 6d696e40736162616e6369756e69762e656475820100300d06092a864886f70d010105050003 8181003b55627e878b84bbfc142e852404b1f5c0d0866cb76d1cd12ce1c45bcc36c2492f4f4b fe4af1b175e79ab4f3eb915085c9e50afd756a44dc758d4d56f4 EAP-Message = 0xff14f1d23ad3d94011923725 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1007cea51104d77e23351c7d723e9be1 Finished request 273. Going to the next request Cleaning up request 258 ID 63 with timestamp +759 rad_recv: Access-Request packet from host 10.200.0.2 port 32795, id=222, length=216 User-Name = "testuser" NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.2" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "001644EF420B" Called-Station-Id = "000B8661DFC4" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020300061900 State = 0x1007cea51104d77e23351c7d723e9be1 Aruba-Essid-Name = "sunet-staff-wpa2" Aruba-Location-Id = "BM_IT_Net_Sys_3c:02" Aruba-Attr-10 = 0x424d5f62696e617369 Message-Authenticator = 0xaedcfb0ad4ddd446ffbad960996ff1fe # Executing section authorize from file /etc/freeradius/radiusd.conf +- entering group authorize {...} [yenimac] expand: - -> - yenimac: Does not match: Calling-Station-Id = 001644EF420B yenimac: Could not find value pair for attribute Calling-Station-Id ++[yenimac] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok ++[mschap] returns noop [ldap] performing user authorization for testuser [ldap] expand: (uid=%{mschap:User-Name:-%{User-Name}}) -> (uid=testuser) [ldap] expand: o=univ.edu -> o=univ.edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=univ.edu, with filter (uid=testuser) [ldap] Added User-Password = 0865B10841F6433200C02B4E4A9F468C in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{crypt}zhKZaHH/0ZNmo" [ldap] sambaNtPassword -> NT-Password == 0x3038363542313038343146363433333230304330324234453441394634363843 [ldap] sambaLmPassword -> LM-Password == 0x4643463937353144304431313932343636353044374443444545353833383737 [ldap] radiusAuthType -> Auth-Type == EAP [ldap] looking for reply items in directory... [ldap] user testuser authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! # Executing group from file /etc/freeradius/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 222 to 10.200.0.2 port 32795 EAP-Message = 0x010403fc1940aa154b4beb99b0651d518b10cde973766e445b091bfdb89d709d3d36d3efcf a451eafe08fa690edc4b432017567af20d482218484a45bf0003ba308203b63082031fa00302 0102020100300d06092a864886f70d010104050030819f310b30090603550406130254523111 300f06035504071308497374616e62756c311b3019060355040a1312536162616e636920556e 6976657273697479311a3018060355040b1311496e666f726d6174696f6e20546563682e311b 301906035504031312536162616e636920556e69766572736974793127302506092a864886f7 0d010901161873797361646d696e40736162616e6369756e6976 EAP-Message = 0x2e656475301e170d3033303331393038343032305a170d3133303331363038343032305a30 819f310b30090603550406130254523111300f06035504071308497374616e62756c311b3019 060355040a1312536162616e636920556e6976657273697479311a3018060355040b1311496e 666f726d6174696f6e20546563682e311b301906035504031312536162616e636920556e6976 6572736974793127302506092a864886f70d010901161873797361646d696e40736162616e63 69756e69762e65647530819f300d06092a864886f70d010101050003818d0030818902818100 b4d46775b459661c4ba537e81197a67c18ab969ba96fb2ad2a7e EAP-Message = 0x0f5a8de0ae0d8b564b1269b32de256c8a526139934887adf8c5d1886da51c3d92ecbb91c01 b07ca4cbae2d4d5edf5962133790fc813ad092478d304e4b5344d63bf2af0607bb3d8de02522 dadb62b8972928232ba581d7a047a1c9187eb4c5549a56f3780b6d0203010001a381ff3081fc 301d0603551d0e04160414c6c1f74047266b05e67daee7263acf804303bd0a3081cc0603551d 230481c43081c18014c6c1f74047266b05e67daee7263acf804303bd0aa181a5a481a230819f 310b30090603550406130254523111300f06035504071308497374616e62756c311b30190603 55040a1312536162616e636920556e6976657273697479311a30 EAP-Message = 0x18060355040b1311496e666f726d6174696f6e20546563682e311b30190603550403131253 6162616e636920556e69766572736974793127302506092a864886f70d010901161873797361 646d696e40736162616e6369756e69762e656475820100300c0603551d13040530030101ff30 0d06092a864886f70d010104050003818100146ceba80178d651a8a31c3e9c0cc9a00f0a4ff1 885f2513befb08f252b0cfcda3db78b749e97c2b81293febd5327166c40d9a1fc660e006b041 be67976381b6610dd938cd1c4dd57bbec9a3f0cf95fce609392ea17400c24acc4dd9c8c1b962 818d9d2ee0081f868984a5b472d757746af53244cffc6c46f741 EAP-Message = 0x939a3cb53a961603 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1007cea51203d77e23351c7d723e9be1 Finished request 274. Going to the next request Cleaning up request 259 ID 58 with timestamp +759 rad_recv: Access-Request packet from host 10.200.0.2 port 32795, id=4, length=216 User-Name = "testuser" NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.2" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "001644EF420B" Called-Station-Id = "000B8661DFC4" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020400061900 State = 0x1007cea51203d77e23351c7d723e9be1 Aruba-Essid-Name = "sunet-staff-wpa2" Aruba-Location-Id = "BM_IT_Net_Sys_3c:02" Aruba-Attr-10 = 0x424d5f62696e617369 Message-Authenticator = 0x66ee7c8a6e9f1922ad84549e4bd66bb6 # Executing section authorize from file /etc/freeradius/radiusd.conf +- entering group authorize {...} [yenimac] expand: - -> - yenimac: Does not match: Calling-Station-Id = 001644EF420B yenimac: Could not find value pair for attribute Calling-Station-Id ++[yenimac] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok ++[mschap] returns noop [ldap] performing user authorization for testuser [ldap] expand: (uid=%{mschap:User-Name:-%{User-Name}}) -> (uid=testuser) [ldap] expand: o=univ.edu -> o=univ.edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=univ.edu, with filter (uid=testuser) [ldap] Added User-Password = 0865B10841F6433200C02B4E4A9F468C in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{crypt}zhKZaHH/0ZNmo" [ldap] sambaNtPassword -> NT-Password == 0x3038363542313038343146363433333230304330324234453441394634363843 [ldap] sambaLmPassword -> LM-Password == 0x4643463937353144304431313932343636353044374443444545353833383737 [ldap] radiusAuthType -> Auth-Type == EAP [ldap] looking for reply items in directory... [ldap] user testuser authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! # Executing group from file /etc/freeradius/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 4 to 10.200.0.2 port 32795 EAP-Message = 0x0105000d19000100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1007cea51302d77e23351c7d723e9be1 Finished request 275. Going to the next request rad_recv: Access-Request packet from host 10.200.0.2 port 32795, id=23, length=402 User-Name = "testuser" NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.2" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "001644EF420B" Called-Station-Id = "000B8661DFC4" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020500c01980000000b61603010086100000820080700e1be39859332693d138b13d7e28ea b48a5f87e939eeb5d0978da9efd0957c2df909e3bcc53330e00981b44ca7eea794e28607d996 80c38bfb6886d6d3f689e4b8e2251eb9fed2f9747f905c664b4d39ced29c4e8eaa87c4479ebe 30a0c817b52eb0e1c6ebe80a3c8adc3c51352752803f9f15746bfef8bba5724e5d475f5d1403 01000101160301002067324c95356ea8cec4f757f37caa1e0bad62558c0e9372b33e9ac4f238 1bbcf6 State = 0x1007cea51302d77e23351c7d723e9be1 Aruba-Essid-Name = "sunet-staff-wpa2" Aruba-Location-Id = "BM_IT_Net_Sys_3c:02" Aruba-Attr-10 = 0x424d5f62696e617369 Message-Authenticator = 0x280d05f5afa8df8132594e3046573b8e # Executing section authorize from file /etc/freeradius/radiusd.conf +- entering group authorize {...} [yenimac] expand: - -> - yenimac: Does not match: Calling-Station-Id = 001644EF420B yenimac: Could not find value pair for attribute Calling-Station-Id ++[yenimac] returns ok [eap] EAP packet type response id 5 length 192 [eap] Continuing tunnel setup. ++[eap] returns ok ++[mschap] returns noop [ldap] performing user authorization for testuser [ldap] expand: (uid=%{mschap:User-Name:-%{User-Name}}) -> (uid=testuser) [ldap] expand: o=univ.edu -> o=univ.edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=univ.edu, with filter (uid=testuser) [ldap] Added User-Password = 0865B10841F6433200C02B4E4A9F468C in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{crypt}zhKZaHH/0ZNmo" [ldap] sambaNtPassword -> NT-Password == 0x3038363542313038343146363433333230304330324234453441394634363843 [ldap] sambaLmPassword -> LM-Password == 0x4643463937353144304431313932343636353044374443444545353833383737 [ldap] radiusAuthType -> Auth-Type == EAP [ldap] looking for reply items in directory... [ldap] user testuser authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! # Executing group from file /etc/freeradius/radiusd.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 182 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 23 to 10.200.0.2 port 32795 EAP-Message = 0x01060031190014030100010116030100201137f7a6559497aeecf8db8a0dafbbc6f6a4014c 362fb22f123f439db04ae04f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1007cea51401d77e23351c7d723e9be1 Finished request 276.

2 1

rlm_eap_ttls: Cannot tunnel EAP-Type/ttls inside of TTLS
by Darren Shea 31 Oct '12

31 Oct '12

I'm trying to migrate a running FreeRADIUS server (on FreeBSD 7) to a virtualized system (on FreeBSD 9). I've got the MySQL database working, and I have copied over the raddb files from the old system to the new one. Unfortunately, radiusd drops out with the error in the subject. It looks like the working system has no problem with tunneling EAP/TTLS through the TTLS tunnel, but this new system is balking. I've read the documentation and examined the FAQ, but no luck. Google is shedding no light on this problem either. Any suggestions? Full radiusd -X output on non-working server ---------------------------------------------------- vBSD1# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "freeradius" main: group = "freeradius" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms listen: port = 1645 listen: type = "auth" listen: port = 1646 listen: type = "acct" radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/aaasvr_key.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/aaasvr_cert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/cacert_aaasvr.pem" tls: private_key_password = "password" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "ttls" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap_ttls: Cannot tunnel EAP-Type/ttls inside of TTLS rlm_eap: Failed to initialize type ttls radiusd.conf[17]: eap: Module instantiation failed. radiusd.conf[2037] Unknown module "eap". radiusd.conf[1984] Failed to parse authenticate section. Partial radiusd -X output on working server ---------------------------------------------------- Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/aaasvr_key.pem" certificate_file = "/usr/local/etc/raddb/certs/aaasvr_cert.pem" CA_file = "/usr/local/etc/raddb/certs/cacert_aaasvr.pem" private_key_password = "password" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "ttls" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Thank you, Darren ECPI Western Broadband

2 1

LDAP attribute mapping
by Arran Cudbard-Bell 31 Oct '12

31 Oct '12

Quick poll. For 3.0 the ldap module will be moving away from using the ldap.attrmap file and instead use a config based mapping. There are a few ways we are considering for organising the mapping. We can use something like the existing unlang: update control { Cleartext-Password := userpassword } update reply { User-Name = radiusUserName } update outer.reply { Reply-Message = radiusReplyMessage } Or something like rlm_rest and rlm_cache: update { control:Cleartext-Password := userpassword reply:User-Name = radiusUserName reply.outer:User-Name = radiusUserName } It really depends on whether people are actually using the full ldap.attrmap, or whether they're just pulling out one or two attributes. Each approach is as efficient as the other performance wise, so it comes down to which one people prefer. Any thoughts? -Arran

5 7

ntlm_auth child domain
by Menard, Yannick 31 Oct '12

31 Oct '12

Hi, I just recently installed an freeradius server , joined the domain and im currently able with ntlm_auth and radtest to authenticate user from our Active directory but I am unable to authenticate using our child domain. For exemple our domain is toto.prive, child domain child.toto.prive I need users from any of those 2 domain to authenticate to our radius. How would I do that in the ntlm_auth module, here is what I have right now: program = "/usr/bin/ntlm_auth --request-nt-key --domain=toto.prive --username=%{mschap:User-Name} --password=%{User-Password}" I am on centos 6.3, I use freeradius rpm from yum. With this config I am able to authenticate a toto.prive user but I am unable to authenticate a child.toto.prive user. Thank you, Yannick Ménard ---------------------------------------------------------------------------------------------------------- Ce courriel a été filtré par ModusGate et Webshield afin de le certifier comme légitime et exempt de virus.

1 0

mysql Connection error
by QASIM RAO 31 Oct '12

31 Oct '12

hi, i am having a problem in free radius, when i connect free radius with db by using ip of db server it is not connecting with db database is installed on localhost so when i give db sever="localhost" it connects with db... please help me in this why radius is doing this ??? regards,

5 7

CentOS 6.3 and FreeRadius - can't authenticate to Unix
by Jacobs, Joseph 30 Oct '12

30 Oct '12

Hello, I'm a new user to Linux and Freeradius. I'm trying to set up Freeradius to authenticate against the local Linux user accounts. I'm having issues getting the "radtest" tool to authenticate against local users in the unix system. I'm using CentOS 6.3 - 64bit (uname - a output Linux Joe2dot0-freeradius 2.6.32-279.el6.x86_64 #1 SMP Fri Jun 22 12:19:21 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux) (Contents of the "etc/redhat-release" file CentOS release 6.3 (Final)) I used YUM to install Freeradius2 (2.1.12-4.el6_3) Here's the output of the "yum list installed" command freeradius.x86_64 2.1.12-4.el6_3 @updates freeradius-utils.x86_64 2.1.12-4.el6_3 @updates I installed the packages as 'root' I'm running 'radtest' while logged in a root. The users file is configured as follows: joe2 Auth-Type := System (I've tried this with both := and =) bob Cleartext-Password := "hello" When I run "radtest bob hello localhost 0 testing1234" *********Successful*********** (I don't use quotes when I input to linux) Here is the debug output from the radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 54241, id=124, length=73 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x0333c5040a7f6b1a6051a1543e5bf4ea # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry bob at line 8 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "hello" [pap] Using clear text password "hello" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 124 to 127.0.0.1 port 54241 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 124 with timestamp +78 Ready to process requests. When I run "radtest joe2 secret localhost 0 testing1234" (I don't use quotes when I input to linux) *************Access-Reject from the server******************** Here is the debug output from the radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 40697, id=134, length=74 User-Name = "joe2" User-Password = "secret" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0xcf3011a6da2e12ec1e1a66746be3c6ad # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "joe2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry joe2 at line 6 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = System # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} ++[unix] returns notfound Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> joe2 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 134 to 127.0.0.1 port 40697 Waking up in 4.9 seconds. Cleaning up request 2 ID 134 with timestamp +212 Ready to process requests. I think I'm having an issue with freeradius reading the shadow file for the passwords, but then again, I'm not sure. One of the steps involved putting the group for freeradius to be "shadow" but there is no "shadow" group in the group file in CentOS 6.3. Here are the output for the ls - l in the etc directory for the password files -rw-r--r--. 1 root root 1579 Oct 29 15:26 passwd ----------. 1 root root 1110 Oct 29 15:26 shadow I also did confirm that I can log into my server using joe2 / secret password. Any help would be appreciated. Thanks, Joe This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

4 6

User authorize with Perl-Script
by Oliver Werner 30 Oct '12

30 Oct '12

Hello, I'm useing FreeRADIUS in Version 2.1.10. I would configure my Switch-Ports Mac-Based. When a Computer wired a Perl-Script should check the Username and gives VLAN back. For a simple Test i don't have some conditions in the Script only outputs: use strict; use warnings; use DBI; ### SwitchUser ### my $pass = $ARGV[0]; print 'Access-Accept'; print 'Cleartext-Password := "'.$pass.'"'; exit 0; my modules/exec looks here: exec { wait = yes program = "/usr/bin/perl /usr/local/test.pl %{User-Name}" input_pairs = request output = reply shell_escape = yes } and my sites-enabled/switch its this: authorize { exec expiration chap } authenticate { chap } post-auth { exec } When i wired with my PC Log Says following: # Executing section authorize from file /etc/freeradius/sites-enabled/switchport +- entering group authorize {...} [php] expand: %{User-Name} -> aa:bb:cc:dd:ee:ff Exec-Program output: Access-AcceptCleartext-Password := "aa:bb:cc:dd:ee:ff" Exec-Program-Wait: plaintext: Access-AcceptCleartext-Password := "aa:bb:cc:dd:ee:ff" Exec-Program: returned: 0 ++[php] returns ok ++[expiration] returns noop [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/switchport +- entering group authenticate {...} [chap] login attempt by "aa:bb:cc:dd:ee:ff" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. } # server switchport Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Anyone knows what is wrong in my Configuration?

3 3

Re: LDAP attribute mapping
by Bruce Nunn 30 Oct '12

30 Oct '12

I pull out only the attributes I need and change ldap.attrmap to match my schema. Personally, I can live with either config method. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> wrote: >Quick poll. > >For 3.0 the ldap module will be moving away from using the ldap.attrmap file and instead use a config based mapping. > >There are a few ways we are considering for organising the mapping. > >We can use something like the existing unlang: > >update control { > Cleartext-Password := userpassword >} > >update reply { > User-Name = radiusUserName >} > >update outer.reply { > Reply-Message = radiusReplyMessage >} > >Or something like rlm_rest and rlm_cache: > >update { > control:Cleartext-Password := userpassword > reply:User-Name = radiusUserName > reply.outer:User-Name = radiusUserName >} > >It really depends on whether people are actually using the full ldap.attrmap, or whether they're just pulling out one or two attributes. Each approach is as efficient as the other performance wise, so it comes down to which one people prefer. > >Any thoughts? > >-Arran > > > > > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Ideal SO and hardware for FreeRadius+MySQL
by fknet 30 Oct '12

30 Oct '12

Hello people! What's the ideal Hardware (processor+memory) to run FreeRadius+MySQL for authentication of 3000 PPPoE users? Thanks Fabrício F Kammer

5 10