- Freeradius-Users - lists.freeradius.org

Re: Radius.Logs
by George Innocent 11 Sep '12

11 Sep '12

> I can authenticated successfully using a test user and the NAS but i check > on the logs and the scripts below keep re-appearing even when there is no > attempt on logging to the NAS. > > rad_recv: Access-Request packet from host 10.250.0.7 port 43677, id=185, > length=70 > > NAS-IP-Address = 10.250.0.17 > > NAS-Identifier = "SAM-pst-clt" > > NAS-Port = 1 > > User-Name = "admin" > > User-Password = "admin" > > Tue Aug 7 15:54:08 2012 : Info: # Executing section authorize from file > /usr/local/etc/raddb/sites-enabled/default > > Tue Aug 7 15:54:08 2012 : Info: +- entering group authorize {...} > > Tue Aug 7 15:54:08 2012 : Info: ++[preprocess] returns ok > > Tue Aug 7 15:54:08 2012 : Info: ++[chap] returns noop > > Tue Aug 7 15:54:08 2012 : Info: ++[mschap] returns noop > > Tue Aug 7 15:54:08 2012 : Info: ++[digest] returns noop > > Tue Aug 7 15:54:08 2012 : Info: [suffix] No '@' in User-Name = "admin", > looking up realm NULL > > Tue Aug 7 15:54:08 2012 : Info: [suffix] No such realm "NULL" > > Tue Aug 7 15:54:08 2012 : Info: ++[suffix] returns noop > > Tue Aug 7 15:54:08 2012 : Info: [eap] No EAP-Message, not doing EAP > > Tue Aug 7 15:54:08 2012 : Info: ++[eap] returns noop > > Tue Aug 7 15:54:08 2012 : Info: ++[files] returns ok > > Tue Aug 7 15:54:08 2012 : Info: ++[expiration] returns noop > > Tue Aug 7 15:54:08 2012 : Info: ++[logintime] returns noop > > Tue Aug 7 15:54:08 2012 : Info: [pap] WARNING: Auth-Type already set. Not > setting to PAP > > Tue Aug 7 15:54:08 2012 : Info: ++[pap] returns noop > > Tue Aug 7 15:54:08 2012 : Info: Found Auth-Type = PAP > > Tue Aug 7 15:54:08 2012 : Info: # Executing group from file > /usr/local/etc/raddb/sites-enabled/default > > Tue Aug 7 15:54:08 2012 : Info: +- entering group PAP {...} > > Tue Aug 7 15:54:08 2012 : Info: [pap] login attempt with password "admin" > > Tue Aug 7 15:54:08 2012 : Info: [pap] Using clear text password "testing" > > Tue Aug 7 15:54:08 2012 : Info: [pap] Passwords don't match > > Tue Aug 7 15:54:08 2012 : Info: ++[pap] returns reject > > Tue Aug 7 15:54:08 2012 : Info: Failed to authenticate the user. > > Tue Aug 7 15:54:08 2012 : Auth: Login incorrect (rlm_pap: CLEAR TEXT > password check failed): [admin/admin] (from client SAM-pst port 1) > > Tue Aug 7 15:54:08 2012 : Info: Using Post-Auth-Type Reject > > Tue Aug 7 15:54:08 2012 : Info: # Executing group from file > /usr/local/etc/raddb/sites-enabled/default > > Tue Aug 7 15:54:08 2012 : Info: +- entering group REJECT {...} > > Tue Aug 7 15:54:08 2012 : Info: [attr_filter.access_reject] expand: > %{User-Name} -> admin > > Tue Aug 7 15:54:08 2012 : Debug: attr_filter: Matched entry DEFAULT at > line 11 > > Tue Aug 7 15:54:08 2012 : Info: ++[attr_filter.access_reject] returns > updated > > Tue Aug 7 15:54:08 2012 : Info: Delaying reject of request 43 for 1 > seconds > > Tue Aug 7 15:54:08 2012 : Debug: Going to the next request > > Tue Aug 7 15:54:08 2012 : Debug: Waking up in 0.9 seconds. > > Tue Aug 7 15:54:09 2012 : Info: Sending delayed reject for request 43 > > Sending Access-Reject of id 185 to 10.250.0.7 port 43677 > > Tue Aug 7 15:54:09 2012 : Debug: Waking up in 4.9 seconds. > > Tue Aug 7 15:54:14 2012 : Info: Cleaning up request 43 ID 185 with > timestamp +519 > Tue Aug 7 15:54:14 2012 : Info: Ready to process requests. > > -- Regards: George Innocent.

1 0

Re: LDAP module file using localhost instead of external?
by Jennifer Mehl 11 Sep '12

11 Sep '12

> On 09/10/2012 11:47 PM, Jennifer Mehl wrote: > >> Here is the output of freeradius -X showing part of the file being read but then ignored?: > > It doesn't look to me like it's ignoring it, which in any event the > server doesn't do. It looks like it's just a different file. It's not > just the hostname that is different. For example: > >> Module: Instantiating module "ucsbnetid" from file /etc/freeradius/modules/ldap >> server = "localhost" >> filter = "(uid=%u)" >> base_filter = "(objectclass=radiusprofile)" > > >> Here is my /etc/freeradius/modules/ldap file (password obfuscated): >> >> server = "directory.ucsb.edu" >> filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" >> base_filter = "(objectclass=ucsbperson)" >> #base_filter = "(objectclass=radiusprofile)" > > ...amongst (many) others. > > You *can't* be editing the same file. Do you have chroot or jails or > similar in use, and if so are you editing the file inside the > chroot/jail or outside? Are you sure you're not leaving backup "file~" > from editors in the directory? Aha, good advice that got me on the right track. Copy/paste foils again: deca:/etc/freeradius/modules# file ldap ldap: UTF-8 Unicode English text I created a new file as ASCII English text and typed everything in manually, and it is now reading my file properly. Now, on to the next part of the troubleshooting process. :-) thank you, Jennifer ================================== Jennifer L. Mehl Director of Information Technology Dept. of Chemistry and Biochemistry 2618 PSBN University of California, Santa Barbara Santa Barbara, CA 93106-9510 mailto: mehl(a)chem.ucsb.edu 805-893-4392 (office) 805-451-7486 (cell) ==================================

1 0

radlogin works, mobile device not
by Mihajlo Joksimovic 11 Sep '12

11 Sep '12

Hi everybody, I've a Problem with my freeradius installation. In the office i have access points, which will authenticate over the freeradius server. Freeradius should look in ldap for username and password. Thats what i get when i try to login with an iphone or ipad. rad_recv: Access-Request packet from host 10.119.12.3 port 1178, id=17, length=199 Message-Authenticator = 0x0842b4ee5b5b8aa8cdfd939570dc1cc3 Service-Type = Framed-User User-Name = "test.user" Framed-MTU = 1488 Called-Station-Id = "204E7FE98E93:test-int" Calling-Station-Id = "145A05C362D4" NAS-Identifier = "aptest03" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200001501646f6d696e697175652e6d6f747a6574 NAS-IP-Address = 10.119.12.3 NAS-Port = 2 NAS-Port-Id = "STA port # 2" +- entering group authorize ++[preprocess] returns ok rlm_realm: No '@' in User-Name = "test.user", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for dominique.motzet WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(objectClass=sambaSamAccount)(!(shadowExpire=1))(uid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=sambaSamAccount)(!(shadowExpire=1))(uid=test.user)) expand: dc=test,dc=local -> dc=test,dc=local rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: starting TLS rlm_ldap: bind as cn=admin,dc=test,dc=local/Testing123 to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=test,dc=local, with filter (&(objectClass=sambaSamAccount)(!(shadowExpire=1))(uid=test.user)) rlm_ldap: checking if remote access for dominique.motzet is allowed by uid rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute userPassword as RADIUS attribute User-Password == "{crypt}$1$cyxWDOrg$J0RAKfQ8wiqboGuKakbNx0" rlm_ldap: LDAP attribute sambaNtPassword as RADIUS attribute NT-Password == 0x3245453043333441393146393533443035414246463830413531433346433037 rlm_ldap: LDAP attribute sambaLmPassword as RADIUS attribute LM-Password == 0x4633413830383632323945384445453438314645364439304239333331374342 rlm_ldap: looking for reply items in directory... rlm_ldap: user test.user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [test.user/<no User-Password attribute>] (from client aptest03 port 2 cli 145A05C362D4) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> test.user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Thx for help. MJ -- Adfinis SyGroup AG Mihajlo Joksimovic, System Engineer Güterstrasse 86 | CH-4053 Basel Tel. 061 333 80 33

4 19

How to Authenticate Users from Multiple IP Adresses Using the MySQL Tables
by Scott Meyer 11 Sep '12

11 Sep '12

Using freeradius 2.1.8 The environment I am working in requires some users to be able to authenticate from multiple ip address and others from only one. How is this accomplished using the MySQL tables?

1 0

LDAP module file using localhost instead of external?
by Jennifer Mehl 10 Sep '12

10 Sep '12

Hello, I have an existing FreeRADIUS setup that is working quite well to authenticate/authorize users for WPA2 wireless to our smbpasswd file. This is 2.1.10+dfsg-2 on Debian Squeeze. I've recently acquired a "captive portal" network device that we are going to use for our guest wireless users. I'm in the process of setting FreeRADIUS for authentication to our campus' LDAP server. I've verified connectivity to the server using the OpenLDAP ldapsearch tools from the same host. However, when I define the server in the /etc/freeradius/modules/ldap files, it doesn't appear to be read properly by FreeRADIUS, which is defaulting instead to 'localhost' instead of our directory server, directory.ucsb.edu, which is defined in the module file. Here is the output of freeradius -X showing part of the file being read but then ignored?: Module: Linked to module rlm_ldap Module: Instantiating module "ucsbnetid" from file /etc/freeradius/modules/ldap ldap ucsbnetid { server = "localhost" port = 389 password = "" identity = "" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "o=notexist" filter = "(uid=%u)" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 40 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } Here is my /etc/freeradius/modules/ldap file (password obfuscated): ldap ucsbnetid { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "directory.ucsb.edu" identity = "uid=chemrad,o=ucsb" password = ******** basedn = "o=ucsb" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=ucsbperson)" #base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 # seconds to wait for LDAP query to finish. default: 20 timeout = 4 # seconds LDAP server has to process the query (server-side # time limit). default: 20 # # LDAP_OPT_TIMELIMIT is set to this value. timelimit = 3 # # This subsection configures the tls related items # that control how FreeRADIUS connects to an LDAP # server. It contains all of the "tls_*" configuration # entries used in older versions of FreeRADIUS. Those # configuration entries can still be used, but we recommend # using these. # tls { # Set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # # The StartTLS operation is supposed to be # used with normal ldap connections instead of # using ldaps (port 689) connections start_tls = no # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/ca/dir/ # certfile = /path/to/radius.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd # Certificate Verification requirements. Can be: # "never" (don't even bother trying) # "allow" (try, but don't fail if the cerificate # can't be verified) # "demand" (fail if the certificate doesn't verify.) # # The default is "allow" # require_cert = "demand" # # seconds to wait for response of the server. (network # failures) default: 10 # # LDAP_OPT_NETWORK_TIMEOUT is set to this value. net_timeout = 1 # } # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${confdir}/ldap.attrmap # Set password_attribute = nspmPassword to get the # user's password from a Novell eDirectory # backend. This will work ONLY IF FreeRADIUS has been # built with the --with-edir configure option. # # See also the following links: # # http://www.novell.com/coolsolutions/appnote/16745.html #https://secure-support.novell.com/KanisaPlatform/Publishing/558/3009668_f.SAL_Public.html # # Novell may require TLS encrypted sessions before returning # the user's password. # # password_attribute = userPassword # Un-comment the following to disable Novell # eDirectory account policy check and intruder # detection. This will work *only if* FreeRADIUS is # configured to build with --with-edir option. # edir_account_policy_check = no # # Group membership checking. Disabled by default. # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames}(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueName s)(uniquemember=%{control:Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # # The following two configuration items are for Active Directory # compatibility. If you see the helpful "operations error" # being returned to the LDAP module, uncomment the next # two lines. # # chase_referrals = yes # rebind = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # THIS WILL ONLY WORK FOR PAP AUTHENTICATION. # # THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP). # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} # set_auth_type = yes # ldap_debug: debug flag for LDAP SDK # (see OpenLDAP documentation). Set this to enable # huge amounts of LDAP debugging on the screen. # You should only use this if you are an LDAP expert. # # default: 0x0000 (no debugging messages) # Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS) ldap_debug = 0x0028 } Thank you for any assistance in troubleshooting this issue… --Jennifer ================================== Jennifer L. Mehl Director of Information Technology Dept. of Chemistry and Biochemistry 2618 PSBN University of California, Santa Barbara Santa Barbara, CA 93106-9510 mailto: mehl -at - chem.ucsb.edu 805-893-4392 (office) 805-451-7486 (cell) ==================================

2 1

Version 2.2.0 is released: upgrade NOW
by Alan DeKok 10 Sep '12

10 Sep '12

We're happy (and sad) to announce 2.2.0. It's been a year since the last release, so it's needed. However, this release announces an issue with unknown certificates in EAP-TLS, PEAP, and EAP-TTLS. Some certificates can overflow a field in the server, causing a crash. See: http://freeradius.org/security.html Everyone should upgrade to 2.2.0 immediately, or obtain a patched version from their vendor. Sorry for the issue. We'll take care to run Coverity more often in the future. FreeRADIUS 2.2.0 Mon 10 Sep 2012 12:00:00 CEST, urgency=medium Feature improvements * 100% configuration file compatible with 2.1.x. The only fix needed is to disallow "hashsize=0" for rlm_passwd * Update Aruba, Alcatel Lucent, APC, BT, PaloAlto, Pureware, Redback, and Mikrotik dictionaries * Switch to using SHA1 for certificate digests instead of MD5. See raddb/certs/*.cnf * Added copyright statements to the dictionaries, so that we know when people are using them. * Better documentation for radrelay and detail file writer. See raddb/modules/radrelay and raddb/radrelay.conf * Added TLS-Cert-Subject-Alt-Name-Email from patch by Luke Howard * Added -F <file> to radwho * Added query timeouts to MySQL driver. Patch from Brian De Wolf. * Add /etc/default/freeradius to debian package. Patch from Matthew Newton * Finalize DHCP and DHCP relay code. It should now work everywhere. See raddb/sites-available/dhcp, src_ipaddr and src_interface. * DHCP capabilitiies are now compiled in by default. It runs as a DHCP server ONLY when manually enabled. * Added one letter expansions: %G - request minute and %I request ID. * Added script to convert ISC DHCP lease files to SQL pools. See scripts/isc2ippool.pl * Added rlm_cache to cache arbitrary attributes. * Added max_use to rlm_ldap to force connection to be re-established after a given number of queries. * Added configtest option to Debian init scripts, and automatic config test on restart. * Added cache config item to rlm_krb5. When set to "no" ticket caching is disabled which may increase performance. Bug fixes * Fix CVE-2012-3547. All users of 2.1.10, 2.1.11, 2.1.12, and 802.1X should upgrade immediately. * Fix typo in detail file writer, to skip writing if the packet was read from this detail file. * Free cached replies when closing resumed SSL sessions. * Fix a number of issues found by Coverity. * Fix memory leak and race condition in the EAP-TLS session cache. Thanks to Phil Mayers for tracking down OpenSSL APIs. * Restrict ATTRIBUTE names to character sets that make sense. * Fix EAP-TLS session Id length so that OpenSSL doesn't get excited. * Fix SQL IPPool logic for non-timer attributes. Closes bug #181 * Change some informational messages to DEBUG rather than error. * Portability fixes for FreeBSD. Closes bug #177 * A much better fix for the _lt__PROGRAM__LTX_preloaded_symbols nonsense. * Safely handle extremely long lines in conf file variable expansion * Fix for Debian bug #606450 * Mutex lock around rlm_perl Clone routines. Patch from Eike Dehling * The passwd module no longer permits "hashsize = 0". Setting that is pointless for a host of reasons. It will also break the server. * Fix proxied inner-tunnel packets sometimes having zero authentication vector. Found by Brian Julin. * Added $(EXEEXT) to Makefiles for portability. Closes bug #188. * Fix minor build issue which would cause rlm_eap to be built twice. * When using "status_check=request" for a home server, the username and password must be specified, or the server will not start. * EAP-SIM now calculates keys from the SIM identity, not from the EAP-Identity. Changing the EAP type via NAK may result in identities changing. Bug reported by Microsoft EAP team. * Use home server src_ipaddr when sending Status-Server packets * Decrypt encrypted ERX attributes in CoA packets. * Fix registration of internal xlat's so %{mschap:...} doesn't disappear after a HUP. * Can now reference tagged attributes in expansions. e.g. %{Tunnel-Type:1} and %{Tunnel-Type:1[0]} now work. * Correct calculation of Message-Authenticator for CoA and Disconnect replies. Patch from Jouni Malinen * Install rad_counter, for managing rlm_counter files. * Add unique index constraint to all SQL flavours so that alternate queries work correctly. * The TTLS diameter decoder is now more lenient. It ignores unknown attributes, instead of rejecting the TTLS session. * Use "globfree" in detail file reader. Prevents very slow leak. Closes bug #207. * Operator =~ shouldn't copy the attribute, like :=. It should instead behave more like ==. * Build main Debian package without SQL dependencies * Use max_queue_size in threading code * Update permissions in raddb/sql/postgresql/admin.sql * Added OpenSSL_add_all_algorithms() to fix issues where OpenSSL wouldn't use methods it knew about. * Add more sanity checks in dynamic_clients code so the server won't crash if it attempts to load a badly formated client definition. <

1 0

using gmail as openid for wiki access ?
by Fred 10 Sep '12

10 Sep '12

Hi freeradius-user, Is it possible to use my gmail account to authenticate on the wiki using openid ? If yes, howto do it ? Best regards, Fred MAISON

2 1

Disconnect Request is not working
by ranjan kumar 10 Sep '12

10 Sep '12

Hi, I am trying to send the disconnect request from radius server to NAS, for that I have returned the RLM_MODULE_UPDATED from my module and in radiusd.conf accounting section edited like this ========================================================= if(updated){ update disconnect { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" Framed-IP-Address = "%{Framed-IP-Address}" Packet-Dst-Port = 1700 } } ========================================================== When I am sending my accounting interim request, got the below message and disconnect request is also not visible in wireshark. ========================================================== entering if (updated) {...} expand: %{User-Name} -> ******** expand: %{Acct-Session-Id} -> 50D6F0C014369761 expand: %{Framed-IP-Address} -> 10.5.127.115 +++[disconnect] returns updated ++- if (updated) returns updated [main_pool] This is not an Accounting-Stop. Return NOOP. ++[main_pool] returns noop } # server Access_Gateway Sending Accounting-Response of id 193 to 10.203.226.70 port 33544 WARNING: Unknown destination 10.203.226.70:1700 for CoA request. Do CoA Fail handler here ========================================================== Please give some guidelines, how to configure the disconnect request and which files has to modify. Thanks, Regards Ranjan

2 1

RADGROUPREPLY QUERY NOT EXECUTED
by Mada 09 Sep '12

09 Sep '12

Have tried several version builds on Centos 5.x - currently using FR 2.1.12 rlm_mysql stops after the group check query and does not execute the group reply query. 19:00:43 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply Sun Sep 9 19:00:43 2012 : Info: [sql] expand: SELECT groupname FROM usergroup Sun Sep 9 19:00:43 2012 : Info: [sql] expand: SELECT id, groupname, attribute,Value, op FROM radgroupcheck Sun Sep 9 19:00:43 2012 : Debug: rlm_sql (sql): Released sql socket id: 4 Queries are listed during module instantiation and queries work when run manually. Have seen similar unresolved thread. Greatly appreciate any help. Thanks ________________________________________________________________ Message sent using DataCom.MW 1.2.0

4 4

TLS / SSL negotiation fails when behind Cisco IP phone
by Dan Lundström 09 Sep '12

09 Sep '12

Hi! We are using EAP/TLS for wired authentication on our networks, in one of our sites the SSL negotiation fails when the client is connected behind a Cisco 7962 IP phone. We have this same setup working on other sites. The phone model varies between the sites, but I cannot find any information about incompatibilities for the particular phone model saying it should be the phone that is causing the problem. I figured that the problem was caused by fragmentation but after adjusting the fragment_size parameter in eap.conf, according to the comments..; # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. ..without any result, i am not sure anymore. When I connect the client directly to a switch port, without the IP phone in-between, everything works perfect. Here comes the relevant part of RADIUS debug output, first session - Without IP phone, directly connected to the switch [ client -> switch ]; ------------------------------------------------------------------------------ Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 0b2e], Certificate [tls] chain-depth=2, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = Xxxx Root CA [tls] --> subject = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> issuer = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> verify return:1 [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = Xxxx Sub CA [tls] --> subject = /DC=com/DC=xxxx/CN=Xxxx Sub CA [tls] --> issuer = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> verify return:1 [tls] chain-depth=0, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = US-LAPJAMIESON.us.xxxx.yyy [tls] --> subject = /CN=US-LAPJAMIESON.us.xxxx.yyy [tls] --> issuer = /DC=com/DC=xxxx/CN=Xxxx Sub CA [tls] --> verify return:1 [tls] TLS_accept: SSLv3 read client certificate A [tls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [tls] TLS_accept: SSLv3 read client key exchange A [tls] <<< TLS 1.0 Handshake [length 0106], CertificateVerify [tls] TLS_accept: SSLv3 read certificate verify A [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [tls] <<< TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 read finished A [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [tls] TLS_accept: SSLv3 write change cipher spec A [tls] >>> TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 write finished A [tls] TLS_accept: SSLv3 flush data [tls] (other): SSL negotiation finished successfully SSL Connection Established ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ Second part - With IP phone in-between [ client -> ipphone -> switch ]; ------------------------------------------------------------------------------ Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 0b2e], Certificate [tls] chain-depth=2, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = Xxxx Root CA [tls] --> subject = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> issuer = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> verify return:1 [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = Xxxx Sub CA [tls] --> subject = /DC=com/DC=xxxx/CN=Xxxx Sub CA [tls] --> issuer = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> verify return:1 --> verify error:num=7:certificate signature failure [tls] >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01 SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> host/US-LAPJAMIESON.us.xxxx.yyy attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 11 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 11 Sending Access-Reject of id 50 to 192.168.207.202 port 1812 EAP-Message = 0x040c0004 Message-Authenticator = 0x00000000000000000000000000000000 ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ I am stuck, any suggestions would be much appreciated. Brgds, //Dan

2 4