Hi! If you still have no luck with 1.1.7 proxying mschapv2, try to move to 2.0.1 with patches in event.c discussed yesterday in freeradius-users. I'm trying to do the same authentication - extract MS-CHAPv2 from PEAP and authorize inner request against external RADIUS server. With 2.0.1 and a patch at least eapol_test passes authorization. Andrew Olson wrote:
Hello,
I'm having trouble getting freeradius-1.1.7 to proxy PEAP-mshcapv2 to another RADIUS server. My other server doesn't do EAP, so I'm just sending mschapv2 achieved with proxy_tunneled_request_as_eap = no in eap.conf.
When I proxy to my other server, I get back an Access-Accept packet. Then, freeradius sends an Access Challenge to the client, receives a response and then things appear to break.
I am able to successfully authenticate users with PEAP by defining them locally in the users file. Additionally, I have gotten TTLS to work by proxying to another server, it's just PEAP that I'm having problems with.
The differing line in the debug seems to be: <proxied> eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2
-vs-
<non-proxied>
eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response.
I'm running a pretty standard config, I think. I can send copies of it, if that would help.
Thanks, Andrew Olson
The complete proxied debug starting with the Access-Request is as follows:
Sending Access-Request of id 0 to 198.82.247.36 port 1812 User-Name = "anolson" NAS-IP-Address := 198.82.245.57 MS-CHAP-Challenge = 0x85feba9cbed9e9191bf72a29f0f82312 MS-CHAP2-Response = 0x0700b776d1433b4d6dab43d5bde9163e8b450000000000000000ee7fcb070f3766e7e7b0f198b72754b44a9ef0255d712db1
Proxy-State = 0x3136 Service-Type := Framed-User Waking up in 6 seconds... rad_recv: Access-Accept packet from host 198.82.247.36:1812, id=0, length=189 Filter-Id = "CNS_NET1" MS-CHAP2-Success = 0x07533d43433041424443323542333046453444414131394238363737413941334136454631364134454634
MS-MPPE-Send-Key = 0x7b5fcacde0c3798261894df701a5cdd5 MS-MPPE-Recv-Key = 0x3900c03d5b5851da66e8fb27d90077f9 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x0000000e Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 6 PEAP: Passing reply from proxy back into the tunnel. PEAP: Passing reply back for EAP-MS-CHAP-V2 0x8170500 2 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 6 rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x8170500 2. rlm_eap_mschapv2: Authentication succeeded. MSCHAP Success modcall[post-proxy]: module "eap" returns ok for request 6 modcall: leaving group post-proxy (returns ok) for request 6 POST-PROXY 2 POST-AUTH 2 PEAP: Got reply 11 PEAP: Got tunneled Access-Challenge PEAP: Reply was handled modcall[post-proxy]: module "eap" returns ok for request 6 modcall: leaving group post-proxy (returns ok) for request 6 Sending Access-Challenge of id 16 to 128.173.10.131 port 56945 EAP-Message = 0x0107005b190017030100502c303c60e1337bcb4c17a281f71910d23777fd5f4a4d5aefab92a23ff28a993aa17ebc2d6bd7567b9386fec7c4e6f2f7ae4c4655a8492000e0e473fc7e8be63a1bf372449cba9f795dc6535b04648cdb
Message-Authenticator = 0x00000000000000000000000000000000 State = 0x23a96486ec5dbd008e1eddcee31dfa93 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 128.173.10.131:56945, id=17, length=151 User-Name = "anolson" State = 0x23a96486ec5dbd008e1eddcee31dfa93 EAP-Message = 0x0207005419800000004e170301002050f4490743b89308d9bb84f411a1629e7b6f06dd6c02c2525747560f657f63d117030100209d0c853d82e17d05938ab49201447c135a90d068d1641a23db5fc04cfcc0dd08
Message-Authenticator = 0x3c828120c544cde1b5d4366b7e735350 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "anolson", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 84 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall[authorize]: module "files" returns notfound for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to anolson PEAP: Adding old state with dc 84 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "anolson", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 57 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 PEAP: Calling authenticate in order to initiate tunneled EAP session. Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 PEAP: Can't handle the return code 4 rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 10 with timestamp 47a8d136 Cleaning up request 1 ID 11 with timestamp 47a8d136 Cleaning up request 2 ID 12 with timestamp 47a8d136 Cleaning up request 3 ID 13 with timestamp 47a8d136 Cleaning up request 4 ID 14 with timestamp 47a8d136 Cleaning up request 5 ID 15 with timestamp 47a8d136 Cleaning up request 6 ID 16 with timestamp 47a8d136 Sending Access-Reject of id 17 to 128.173.10.131 port 56945 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 7 ID 17 with timestamp 47a8d136 Nothing to do. Sleeping until we see a request.
The complete non-proxied debug starting with the final Access-Challenge is as follows:
Sending Access-Challenge of id 18 to 128.173.10.131 port 56939 EAP-Message = 0x0108002b190017030100206ae9bd54b7c0124979401818f662bec45aea2853b277e8dda897e8a645571887
Message-Authenticator = 0x00000000000000000000000000000000 State = 0x00e512dd6dbcc968bffd9f8b8dc13bc4 Finished request 40 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 128.173.10.131:56939, id=19, length=166 User-Name = "andrew" State = 0x00e512dd6dbcc968bffd9f8b8dc13bc4 EAP-Message = 0x0208006419800000005e1703010020a0257f0df72e93adb495d9ab98f8e65ee4b526e563dd80bcdd464a3735f1d83417030100304c5de1fa016827d3181b8a26a7a31091f8f4474167c5424e0b51913e0ede50c14e04ec233670bd9888b1ea89ed510131
Message-Authenticator = 0xf3079323771a635bac1bdaa00b2e850f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 41 modcall[authorize]: module "preprocess" returns ok for request 41 modcall[authorize]: module "chap" returns noop for request 41 modcall[authorize]: module "mschap" returns noop for request 41 rlm_realm: No '@' in User-Name = "andrew", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 41 rlm_eap: EAP packet type response id 8 length 100 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 41 users: Matched entry andrew at line 53 modcall[authorize]: module "files" returns ok for request 41 modcall: leaving group authorize (returns updated) for request 41 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 41 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 41 modcall: leaving group authenticate (returns ok) for request 41 Sending Access-Accept of id 19 to 128.173.10.131 port 56939 MS-MPPE-Recv-Key = 0x1aa22f77848e2c89b4a6681bd67b45483d25b05232dd9e37748bba578fff2700 MS-MPPE-Send-Key = 0x62d67197e6bfbce385f1b6e2ccd03c183281bca70e810a79cd85e7d2a38d654d EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "andrew" Finished request 41 Going to the next request Waking up in 6 seconds...
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Best wishes, Dmitry Sergienko (SDA104-RIPE) Trifle Co., Ltd.