Hi Everyone, I just followed the steps @ http://www.howtoforge.com/wifi-authentication-accounting-with-freeradius-on-... This is the output of radiusd -X -z [root@wifi ~]# radiusd -X -z Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "windose" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.0.201:2048, id=0, length=123 User-Name = "scott" NAS-IP-Address = 10.10.0.201 Called-Station-Id = "001d7e2fa43c" Calling-Station-Id = "0014a4439321" NAS-Identifier = "001d7e2fa43c" NAS-Port = 49 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a0173636f7474 Message-Authenticator = 0xc091f4c08c545d39e360712a422185d2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "scott", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "scott" rlm_realm: Proxying request from user scott to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 rlm_eap: Request is supposed to be proxied to Realm NULL. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 157 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 There was no response configured: rejecting request 0 Server rejecting request 0. Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 10.10.0.201 port 2048 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 48d17a05 Nothing to do. Sleeping until we see a request. The windows box requests credentials for connection to the network. I am using scott passwd scott as listed in the users in radius directory. What I am missing ? Thanks in advance. Scott
rlm_realm: No '@' in User-Name = "scott", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "scott" rlm_realm: Proxying request from user scott to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 rlm_eap: Request is supposed to be proxied to Realm NULL. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 0
You are using outdated version of the server in which realm NULL is active in proxy.conf. Update. Processing peap with virtual servers works great "out of the box". Or comment that entry out and try again. Ivan Kalik Kalik Informatika ISP
Hi, I commented out realms in proxy.conf This is the output of radiusd -X -z I am still getting rlm_realm: No '@' in User-Name = "scott", looking up realm NULL.. Message-Authenticator = 0x1fbb1743154dc6aa8cd2ecbdd581ed69 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "scott", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry scott at line 3 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 02a5], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 10.10.0.201 port 2048 EAP-Message = 0x010303081900160301004a02000046030148d270a174e83ec6b53b03df4ea22ff71e419b2de79c2a0c4f7e51035129b6982047db479901c5a2b337c7592a6c3e9d73dd65ebaae67c259ac51781e4746abc4e00040016030102a50b0002a100029e00029b3082029730820200a003020102020101300d06092a864886f70d0101050500308184310b3009060355040613025553310d300b0603550408130455746168311730150603550407130e53616c74204c616b6520436974793111300f060355040a1308515349436f72702e3119301706035504031310776966692e717369636f72702e636f6d311f301d06092a864886f70d0109011610726f6f EAP-Message = 0x7440717369636f72702e636f6d301e170d3038303931303139313533345a170d3039303931303139313533345a308184310b3009060355040613025553310d300b0603550408130455746168311730150603550407130e53616c74204c616b6520436974793111300f060355040a1308515349436f72702e3119301706035504031310776966692e717369636f72702e636f6d311f301d06092a864886f70d0109011610726f6f7440717369636f72702e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ea33b7b4a37f308cda4bea2de4254e01abe8e2cea27f7269fa54f4c10a74de86ea229053cf0a57b190951512 EAP-Message = 0xdae1d2c4c8ee76ae3fb97ec2a682e35f85debc302a10c6bbe3edcb1cb600a9434b68e1e9cd5d69773586f9561b0308e50de2f48ea740e744cf8f216942043a570cd92e80130271a271fe7a171f9cc114313262fb0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181000fc387ed16183b3cfbfcf86b41a14ab7fcb083317fb48ed28d31673f6bbdcdf9c93551cdd05bd9d93fbd6c950e94e4aa6512acd82bddc4a39531a230a0c86afde37ad76a7ec3f69b2fee86a870f789f1fa20b48e5902f20672ad33c21b7758f6495e4f65217ec357504f070e6b720cc5ae68a5a785ba5469 EAP-Message = 0x2b9c9d21007d9a2416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8a7dad9c7c57aec946dd0e6e8c74360b Any suggestions ? thanks Scott --- On Wed, 9/17/08, tnt@kalik.net <tnt@kalik.net> wrote: From: tnt@kalik.net <tnt@kalik.net> Subject: Re: XP windows Validating identity blues To: freeradius-users@lists.freeradius.org Date: Wednesday, September 17, 2008, 4:01 PM
rlm_realm: No '@' in User-Name = "scott", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "scott" rlm_realm: Proxying request from user scott to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 rlm_eap: Request is supposed to be proxied to Realm NULL. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 0
You are using outdated version of the server in which realm NULL is active in proxy.conf. Update. Processing peap with virtual servers works great "out of the box". Or comment that entry out and try again. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
scott woodard -
tnt@kalik.net