freeradius 3 cannot initiate eap-sim,
(1) eap : EAP packet type response id 0 length 56 (1) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = EAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Peer sent Identity (1) (1) eap : Calling eap_sim to process EAP data *(1) eap_sim : Can't initiate EAP-SIM, no RAND1 attribute* (1) ERROR: eap : Failed starting EAP SIM (18) session. EAP sub-module failed (1) eap : Failed in EAP select (1) [eap] = invalid (1) } # authenticate = invalid (1) Failed to authenticate the user. I met this issue when I was trying to use eap-sim module in freeradius 3.0.1
On 26 Mar 2014, at 12:30, Bill Yuan <bycn82@gmail.com> wrote:
(1) eap : EAP packet type response id 0 length 56 (1) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = EAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Peer sent Identity (1) (1) eap : Calling eap_sim to process EAP data (1) eap_sim : Can't initiate EAP-SIM, no RAND1 attribute (1) ERROR: eap : Failed starting EAP SIM (18) session. EAP sub-module failed (1) eap : Failed in EAP select (1) [eap] = invalid (1) } # authenticate = invalid (1) Failed to authenticate the user.
I met this issue when I was trying to use eap-sim module in freeradius 3.0.1
Is reply:EAP-SIM-RAND1 set? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Bill Yuan wrote:
(1) eap : EAP packet type response id 0 length 56 (1) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = EAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Peer sent Identity (1) (1) eap : Calling eap_sim to process EAP data *(1) eap_sim : Can't initiate EAP-SIM, no RAND1 attribute* ... I met this issue when I was trying to use eap-sim module in freeradius 3.0.1
Yes. Read doc/modules/rlm_eap/. Look for SIM. Alan DeKok.
*I configured the user information in the users file, and the info is valid in freeradius2. but somehow, I think the freeradius3 cannot recognize the information,I can see some yellow colour information printed on the **screen as below:* WARNING: [/usr/local/etc/raddb/mods-config/files/authorize]:1 Check item "EAP-Sim-Rand1" found in reply item list for user "1525016114550600@ wlan.mnc001.mcc525.3gppnetwork.org". This attribute MUST go on the first line with the other check items WARNING: [/usr/local/etc/raddb/mods-config/files/authorize]:1 Check item "EAP-Sim-SRES1" found in reply item list for user "1525016114550600@ wlan.mnc001.mcc525.3gppnetwork.org". This attribute MUST go on the first line with the other check items WARNING: [/usr/local/etc/raddb/mods-config/files/authorize]:1 Check item "EAP-Sim-KC1" found in reply item list for user "1525016114550600@ wlan.mnc001.mcc525.3gppnetwork.org". This attribute MUST go on the first line with the other check items WARNING: [/usr/local/etc/raddb/mods-config/files/authorize]:1 Check item "EAP-Sim-Rand2" found in reply item list for user "1525016114550600@ wlan.mnc001.mcc525.3gppnetwork.org". This attribute MUST go on the first line with the other check items WARNING: [/usr/local/etc/raddb/mods-config/files/authorize]:1 Check item "EAP-Sim-SRES2" found in reply item list for user "1525016114550600@ wlan.mnc001.mcc525.3gppnetwork.org". This attribute MUST go on the first line with the other check items WARNING: [/usr/local/etc/raddb/mods-config/files/authorize]:1 Check item "EAP-Sim-KC2" found in reply item list for user "1525016114550600@ wlan.mnc001.mcc525.3gppnetwork.org". This attribute MUST go on the first line with the other check items WARNING: [/usr/local/etc/raddb/mods-config/files/authorize]:1 Check item "EAP-Sim-Rand3" found in reply item list for user "1525016114550600@ wlan.mnc001.mcc525.3gppnetwork.org". This attribute MUST go on the first line with the other check items WARNING: [/usr/local/etc/raddb/mods-config/files/authorize]:1 Check item "EAP-Sim-SRES3" found in reply item list for user "1525016114550600@ wlan.mnc001.mcc525.3gppnetwork.org". This attribute MUST go on the first line with the other check items WARNING: [/usr/local/etc/raddb/mods-config/files/authorize]:1 Check item "EAP-Sim-KC3" found in reply item list for user "1525016114550600@ wlan.mnc001.mcc525.3gppnetwork.org". This attribute MUST go on the first line with the other check items *And when the request comes, I met this error:* *(1) eap_sim : Can't initiate EAP-SIM, no RAND1 attribute* *In my opinion, the freeradius3 has some changes in rlm_files module, and somehow it cannot recognize my user file, so can someone help to give an example user file for EAP-SIM?* On Wed, Mar 26, 2014 at 9:43 PM, Alan DeKok <aland@deployingradius.com>wrote:
Bill Yuan wrote:
(1) eap : EAP packet type response id 0 length 56 (1) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = EAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Peer sent Identity (1) (1) eap : Calling eap_sim to process EAP data *(1) eap_sim : Can't initiate EAP-SIM, no RAND1 attribute* ... I met this issue when I was trying to use eap-sim module in freeradius 3.0.1
Yes. Read doc/modules/rlm_eap/. Look for SIM.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Bill Yuan wrote:
*I configured the user information in the users file, and the info is valid in freeradius2. but somehow, I think the freeradius3 cannot recognize the information,I can see some yellow colour information printed on the **screen as below:* WARNING: [/usr/local/etc/raddb/mods-config/files/authorize]:1 Check item "EAP-Sim-Rand1" found in reply item list for user "1525016114550600@wlan.mnc001.mcc525.3gppnetwork.org". This attribute MUST go on the first line with the other check items
What is hard to understand about that message? You have the wrong information in the file. Do: user EAP-Sim-Rand1 := ... ... Do NOT DO: user ... EAP-Sim-Rand1 := ... Alan DeKok.
On 28 Mar 2014, at 13:45, Alan DeKok <aland@deployingradius.com> wrote:
Bill Yuan wrote:
*I configured the user information in the users file, and the info is valid in freeradius2. but somehow, I think the freeradius3 cannot recognize the information,I can see some yellow colour information printed on the **screen as below:* WARNING: [/usr/local/etc/raddb/mods-config/files/authorize]:1 Check item "EAP-Sim-Rand1" found in reply item list for user "1525016114550600@wlan.mnc001.mcc525.3gppnetwork.org". This attribute MUST go on the first line with the other check items
What is hard to understand about that message? You have the wrong information in the file. Do:
user EAP-Sim-Rand1 := ... ...
Do NOT DO:
user ... EAP-Sim-Rand1 := ...
The guy who wrote the EAP-SIM module made the triplets reply items. I corrected it in master, but didn't want to change the behaviour for 3.0.x. Given that were now emitting warnings for internal server attributes used as reply items, do you want me to backport the changes from master? It'd also include the triplet generation code (to derive triplets using comp128v1/v2/v3 from a Ki). Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Arran Cudbard-Bell wrote:
The guy who wrote the EAP-SIM module made the triplets reply items. I corrected it in master, but didn't want to change the behaviour for 3.0.x.
Oh god... that's annoying as hell.
Given that were now emitting warnings for internal server attributes used as reply items, do you want me to backport the changes from master?
Yes, so long as the rlm_eap_sim module will look in the reply when it can't find the triplets in the config items. Breaking existing configs isn't an option.
It'd also include the triplet generation code (to derive triplets using comp128v1/v2/v3 from a Ki).
Yes, that's nice. Alan DeKok.
*Thanks for the reply,*
What is hard to understand about that message? You have the wrong information in the file. Do:
user EAP-Sim-Rand1 := ... ...
Do NOT DO:
user ... EAP-Sim-Rand1 := ...
*Below is a sample for version2, but can someone please help to re-format it and make it workable for version 3? thanks very much!* 1525016114550600@wlan.mnc001.mcc525.3gppnetwork.org Auth-Type:=EAP, EAP-Type:=SIM EAP-Sim-Rand1 = 0x5950877781B748d2BB3E77569D57A483 EAP-Sim-SRES1 = 0x2Ae04b14, EAP-Sim-KC1 = 0xC7176774EA83cd6f, EAP-Sim-Rand2 = 0xF7E5774BC82A414c9FA108E97A761C4B, EAP-Sim-SRES2 = 0x2311eb24, EAP-Sim-KC2 = 0xBBdf4281D7ab35ff, EAP-Sim-Rand3 = 0xEFB4CD954B654f50BF92D71D326A1F6A, EAP-Sim-SRES3 = 0xE4b8a9e4, EAP-Sim-KC3 = 0xA5c98dabAF2a733b, *I tried to remove the Auth-Type, also tried to move the RAND1 in the same line, but still not working.*
On 28 Mar 2014, at 16:06, Bill Yuan <bycn82@gmail.com> wrote:
Thanks for the reply,
What is hard to understand about that message? You have the wrong information in the file. Do:
user EAP-Sim-Rand1 := ... ...
Do NOT DO:
user ... EAP-Sim-Rand1 := ...
Below is a sample for version2, but can someone please help to re-format it and make it workable for version 3? thanks very much! 1525016114550600@wlan.mnc001.mcc525.3gppnetwork.org Auth-Type:=EAP, EAP-Type:=SIM EAP-Sim-Rand1 = 0x5950877781B748d2BB3E77569D57A483 EAP-Sim-SRES1 = 0x2Ae04b14, EAP-Sim-KC1 = 0xC7176774EA83cd6f, EAP-Sim-Rand2 = 0xF7E5774BC82A414c9FA108E97A761C4B, EAP-Sim-SRES2 = 0x2311eb24, EAP-Sim-KC2 = 0xBBdf4281D7ab35ff, EAP-Sim-Rand3 = 0xEFB4CD954B654f50BF92D71D326A1F6A, EAP-Sim-SRES3 = 0xE4b8a9e4, EAP-Sim-KC3 = 0xA5c98dabAF2a733b,
I tried to remove the Auth-Type, also tried to move the RAND1 in the same line, but still not working. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Try the latest git head, it should now accept either. But to add the triplets as control items, it'd be: 1525016114550600@wlan.mnc001.mcc525.3gppnetwork.org EAP-Sim-Rand1 := <value>, EAP-Sim-SRES1 := <value>, EAP-Sim-KC1 := <value>, EAP-Sim-Rand2 := <value>, EAP-Sim-SRES2 := <value>, EAP-Sim-KC2 := <value>, EAP-Sim-Rand3 := <value>, EAP-Sim-SRES3 := <value>, EAP-Sim-KC3 := <value> The users file format is quite old and doesn't deal with this gracefully. If you don't want the overhead of managing a database, i'd suggest you use sqlite, and add the triplets there instead. It has the added advantage of being more easily scriptable if you need to add or remove subscribers. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
*Seems the rlm_file can parse the user file after I put all attributes into a single line, but still "cannot init, no RAND1 attribute"* On Sat, Mar 29, 2014 at 12:06 AM, Bill Yuan <bycn82@gmail.com> wrote:
*Thanks for the reply,*
What is hard to understand about that message? You have the wrong information in the file. Do:
user EAP-Sim-Rand1 := ... ...
Do NOT DO:
user ... EAP-Sim-Rand1 := ...
*Below is a sample for version2, but can someone please help to re-format it and make it workable for version 3? thanks very much!* 1525016114550600@wlan.mnc001.mcc525.3gppnetwork.org Auth-Type:=EAP, EAP-Type:=SIM EAP-Sim-Rand1 = 0x5950877781B748d2BB3E77569D57A483 EAP-Sim-SRES1 = 0x2Ae04b14, EAP-Sim-KC1 = 0xC7176774EA83cd6f, EAP-Sim-Rand2 = 0xF7E5774BC82A414c9FA108E97A761C4B, EAP-Sim-SRES2 = 0x2311eb24, EAP-Sim-KC2 = 0xBBdf4281D7ab35ff, EAP-Sim-Rand3 = 0xEFB4CD954B654f50BF92D71D326A1F6A, EAP-Sim-SRES3 = 0xE4b8a9e4, EAP-Sim-KC3 = 0xA5c98dabAF2a733b, *I tried to remove the Auth-Type, also tried to move the RAND1 in the same line, but still not working.*
On 28 Mar 2014, at 16:34, Bill Yuan <bycn82@gmail.com> wrote:
Seems the rlm_file can parse the user file after I put all attributes into a single line, but still "cannot init, no RAND1 attribute"
Well, that message has been removed in v3.0.x HEAD so I know you haven't followed my suggestion. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
*Now I am using 3.0.x, and the triplets are in a single line in the user file, seems it has been loaded/parsed during the startup. but still meet this below message,* *(0) ERROR: eap_sim : EAP-SIM-Challenge0 not found(0) ERROR: eap : Failed starting EAP SIM (18) session. EAP sub-module failedit is from the "eap_sim_get_challenge", this message was printed because did not find the Kc1, actually did not find the Rand1 also.* On Sat, Mar 29, 2014 at 12:55 AM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 28 Mar 2014, at 16:34, Bill Yuan <bycn82@gmail.com> wrote:
Seems the rlm_file can parse the user file after I put all attributes into a single line, but still "cannot init, no RAND1 attribute"
Well, that message has been removed in v3.0.x HEAD so I know you haven't followed my suggestion.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 28 Mar 2014, at 17:32, Bill Yuan <bycn82@gmail.com> wrote:
Now I am using 3.0.x, and the triplets are in a single line in the user file, seems it has been loaded/parsed during the startup. but still meet this below message, (0) ERROR: eap_sim : EAP-SIM-Challenge0 not found (0) ERROR: eap : Failed starting EAP SIM (18) session. EAP sub-module failed it is from the "eap_sim_get_challenge", this message was printed because did not find the Kc1, actually did not find the Rand1 also.
OK, the '0' is just a cosmetic bug, it's still searching for the right attributes. Could you add update request { Tmp-String-0 := "%{debug_attr:control:}" } Just before any calls to the EAP module and post the output of running the server with -Xx. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Bill Yuan