Authentication using LDAP for 802.1x
Hi all We have deployed FreeRADIUS on OS X before, but our configuration was rather ugly. What we would do is authenticate users locally, having the machine attached to our OpenDirectory server directly using the Connect Network Account Server functionality provided by OS X. I have seen this question getting asked a lot but still wasn't able to fill my gap in understanding the whole process. We're now using FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu As a start, I'm now trying to get a simple user authentication working. What I have done so far is defining ldap {} in the ldap module and added ldap into the authorize {} section. I also uncommented Auth-Type LDAP { ldap } in the authenticate {} section. <= Bad?! The same for the virtual inner-tunnel. When I run radtest from my laptop, the authentication is successful: $ radtest a4 whatever 192.168.1.231 18120 secret Sending Access-Request of id 18 to 192.168.1.231 port 1812 User-Name = "a4" User-Password = "whatever" NAS-IP-Address = 192.168.17.1 NAS-Port = 18120 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 192.168.1.231 port 1812, id=18, length=20 When I try to authorize a supplicant connected to our switch which is configured to be the authenticator, debug shows me the following: ... rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=73, length=217 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x020b0007016134 Message-Authenticator = 0xa3eaf856385eef096a4a8da0a9b938c3 Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 7 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for a4 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> a4 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=a4) [ldap] expand: dc=ldap,dc=hopro,dc=edu -> dc=ldap,dc=hopro,dc=edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.hopro.edu:389, authentication 0 [ldap] bind as / to ldap.hopro.edu:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=ldap,dc=hopro,dc=edu, with filter (uid=a4) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user a4 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 73 to 192.168.99.99 port 1645 EAP-Message = 0x010c00160410f7b955ffcad777bb64a0c2591f2a1852 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab1bf9b7ab17fdd1d339d19378335aaa Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=74, length=234 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x020c00060315 Message-Authenticator = 0x265e5392ae96ffd2f0c96666a02c9035 Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" State = 0xab1bf9b7ab17fdd1d339d19378335aaa NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 12 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for a4 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> a4 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=a4) [ldap] expand: dc=ldap,dc=hopro,dc=edu -> dc=ldap,dc=hopro,dc=edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=ldap,dc=hopro,dc=edu, with filter (uid=a4) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user a4 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 74 to 192.168.99.99 port 1645 EAP-Message = 0x010d00061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab1bf9b7aa16ecd1d339d19378335aaa Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=75, length=356 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x020d008015800000007616030100710100006d030151c19a457c2d148d872abd670c09fe7719d9b316318eb0134b0db1b5ce12e57700003200ffc00ac009c007c008c014c013c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a00330039001601000012000a00080006001700180019000b00020100 Message-Authenticator = 0x474af0e5e41006c5947328ada905bf63 Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" State = 0xab1bf9b7aa16ecd1d339d19378335aaa NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 13 length 128 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 118 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0071], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 0039], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 084f], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 75 to 192.168.99.99 port 1645 EAP-Message = 0x010e040015c0000009eb160301003902000035030151c19a44f7368e4456fc7b31270848d83dbe071b6969f1e6f9d0d7adb8527c9400c01400000dff01000100000b000403000102160301084f0b00084b0008480003a33082039f30820287a003020102020101300d06092a864886f70d010105050030818f310b3009060355040613024348310b3009060355040813025a483110300e060355040713075a75657269636831253023060355040a131c4b616e746f6e73736368756c6520486f68652050726f6d656e616465311f301d06092a864886f70d010901161069637461646d696e406b7368702e636831193017060355040313107261646975 EAP-Message = 0x732e686f70726f2e656475301e170d3132313231393130353634305a170d3133313231393130353634305a307d310b3009060355040613024348310b3009060355040813025a4831253023060355040a131c4b616e746f6e73736368756c6520486f68652050726f6d656e61646531193017060355040313107261646975732e686f70726f2e656475311f301d06092a864886f70d010901161069637461646d696e406b7368702e636830820122300d06092a864886f70d01010105000382010f003082010a0282010100bdd4065ec39decc5191947b7fae6df68b82333bce018385b48d641bfde2d9ba6294a786cd7e15b7d1824591d077af2a4c2fe EAP-Message = 0x7e66cbccd3f279171bb3e77936b8e6a92cbb0e17eb0abbcdac9945db8c11af0074d9480d263664e17d021663e0694dbfe839def4202ddede6958974bc82e8023c68adc741ab7c9e64027171b32d0d04c3e93cf1bd49947e3e462ed368fb71e8ce9fcff7414fe921494836b128635e0004e8ce29dc26a919f58d7c91f7181dcb1a71e404960f04ba20c51d42ff3872c3335cbb612ac48c6234a326c9d83f6416e32a070f6307496ca83066f071d92b29732c4045105a726e359388542437214e6480df09c8e4ce4149f53da2b449d0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000382 EAP-Message = 0x0101000e14a8494074acd8a45fb6b8e3a4ed0966823b82d9aa29417ccfd1b47764a8ae60cf65b6cf411e686e0fd8748ca655495d30408f12afef47897e31af44e8833601af028f101df0a2534f680ce10df4c7d88c312af4a5b2fc3711d2ce021bbe0ab4e439d095c102005dbce074a0a90767729ea3f1edb88b2c7d4b9e5f727cb10c5309afb41d0acdd75548de5508de058b2d684e1390fe1d917da97c34bbc13548ef1fc71aa8b4bf52dc76ccaa537f96b2460e56faa0ed34b1a3b5e4d6b3f10458883ba6bf4cb38f9096300181038c2d471e21bb4a9184d7521ba143fcf19608677da5b9e3ecce9b4d47d6f0a3b44c85380c1bd4cd15e325160d28 EAP-Message = 0x324bf7e31c3b00049f308204 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab1bf9b7a915ecd1d339d19378335aaa Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=76, length=234 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x020e00061500 Message-Authenticator = 0x37d15b32cc7d6ece0c91b13551cd0b93 Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" State = 0xab1bf9b7a915ecd1d339d19378335aaa NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 14 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 76 to 192.168.99.99 port 1645 EAP-Message = 0x010f040015c0000009eb9b30820383a003020102020900b75f4cb4031a50e3300d06092a864886f70d010105050030818f310b3009060355040613024348310b3009060355040813025a483110300e060355040713075a75657269636831253023060355040a131c4b616e746f6e73736368756c6520486f68652050726f6d656e616465311f301d06092a864886f70d010901161069637461646d696e406b7368702e636831193017060355040313107261646975732e686f70726f2e656475301e170d3132313231393130353634305a170d3133313231393130353634305a30818f310b3009060355040613024348310b3009060355040813025a48 EAP-Message = 0x3110300e060355040713075a75657269636831253023060355040a131c4b616e746f6e73736368756c6520486f68652050726f6d656e616465311f301d06092a864886f70d010901161069637461646d696e406b7368702e636831193017060355040313107261646975732e686f70726f2e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100d63a0ad9924d4bbf29ea25b2abfa17eb9d47e36ad480ce8dc1ec454aaf6470396a570eebeec3363c818882061081437e5367266e30b91be77f4e37ea9a01e56221dcbeb6f52c2157da7a74b5b024f98e3f45670aa8b6968c4b939c6b80302c318bf66f63d4f116 EAP-Message = 0x450cbb35f51f3565e121276f7fa61f2a326d432cc0cfbb94411671b3a3e3db42879419f0e18b86ba020a8d5c6e8c817f755891eb10876a57194f57780baef2b90997c16b03aab89d66833765b711bb66453be64883c0265ddc50c761525902e16cbfc7567962037f2b1ddd49e700ea4f94a55864ef801aad3315c688de2e6e15141ccedcdc016745a3ad46aef6223c66cadab19fe17cc3b7a50203010001a381f73081f4301d0603551d0e0416041442c8e782326f14866e14f0328f22ef21e5dca7683081c40603551d230481bc3081b9801442c8e782326f14866e14f0328f22ef21e5dca768a18195a4819230818f310b3009060355040613024348 EAP-Message = 0x310b3009060355040813025a483110300e060355040713075a75657269636831253023060355040a131c4b616e746f6e73736368756c6520486f68652050726f6d656e616465311f301d06092a864886f70d010901161069637461646d696e406b7368702e636831193017060355040313107261646975732e686f70726f2e656475820900b75f4cb4031a50e3300c0603551d13040530030101ff300d06092a864886f70d010105050003820101000b570cdc802ec347643ce7e5a81cd487273f8eb79f7580d9423e0ac121c39d23b8d7e606fa291515bfa8e232e845b04788cb14bbac1e67cdeded46cdead9957a88eb3c04075cbb2f9d66c81451f7 EAP-Message = 0xc982a3f0ae66f5d41f3c2ff9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab1bf9b7a814ecd1d339d19378335aaa Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=77, length=234 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x020f00061500 Message-Authenticator = 0x49c786eea0efa3a358db3c5c61d82830 Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" State = 0xab1bf9b7a814ecd1d339d19378335aaa NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 15 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 77 to 192.168.99.99 port 1645 EAP-Message = 0x011002091580000009eb6cf7c88612440aaa64dd8ca6d9533e4bd26a893bbee70e343d13c54accb14ee61b9e7ec6ee78090b76e0e353da5da86cfeb3f2c9381011e5f25cfb755e4dbcc8a78f37d906019e5a2c2225a03a5f2318e3bf8c56eb0b43ad64ac8ddebb84ca1352b5a80b4a8c8757c5a37352508833404ebd868c5dd0cc92b3df240cf05b1e721b7a90d8e0a060e4834fff2dc79a04353dab2492381d4488ab7e92257f4ed7fb3eb4053e22a3160301014b0c0001470300174104e284bd8b7ec8e3510d4a6bb593e671a0945af1e997ce5cc010d13fd0e76a68e71c034e1412d7fc4b26233ca3df8dba3463719b1fa33f4ab4934a7208005205 EAP-Message = 0x5f010042df9b97e266190e04d0b6ea3fdaf36282b104caaee17a75acbccf6e74e427b6fa6a600c9db92fcbe7e34cffc49deb6a2e3949e17692845c03a7ab92d4daf19bee3788c1afcf23fbc5c9ddd487f335bd83d238cfe52f80ca59a6cc6ad58b3ecb7502ab687184733c42cd5de45e06cd101ae2e41f4943c01ac3379e928240ac532451599dce12979065ad088a056130f57d119038f40003d55fcebe5edd0acde65036f24fd69cc0fda63ff408c25ee9c3ad100bf0a90d6031a0034d064b8ecf8a5323d79e7d7b764d08105ea8c35c7548983060ce8f8577909b8a2c2049d78f99b0acc37a55b993519f1e475b7b4f9fff67e943f61c7a9f4a18fd EAP-Message = 0x05b6bbbc248c16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab1bf9b7af0becd1d339d19378335aaa Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=78, length=372 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x021000901580000000861603010046100000424104ee7b81c5eb47db38fd9999628065d8bc69504fd008ffcce581bf49a5dc349fac012b27f4d21db7352c31e8be8bc097f9fd3414f7160990963cd9ad8e53166e951403010001011603010030ed341f879e3591dedc6633d8a0376280178fe300950d293b30747d15b35f4867c69765e98c2f0a15bcb95a992cbc77a4 Message-Authenticator = 0xe7c4329c24d68ad3919250d82c96961a Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" State = 0xab1bf9b7af0becd1d339d19378335aaa NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 16 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 134 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 78 to 192.168.99.99 port 1645 EAP-Message = 0x0111004515800000003b1403010001011603010030b0518066786178044d44483eb37026fdd8406df7f6eaae28282bc696f782e64198a16f06ecde63a263375845bf3304f7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab1bf9b7ae0aecd1d339d19378335aaa Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=79, length=275 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x0211002f1580000000251503010020f0c878ea3889abbd6850566e4a4b6b5e5777dc3f5e0f11789e9a9430219cc5b3 Message-Authenticator = 0x69b565f9da2f3112f04fc8a2197444a4 Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" State = 0xab1bf9b7ae0aecd1d339d19378335aaa NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 17 length 47 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 37 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Alert [length 0002], warning close_notify TLS Alert read:warning:close notify [ttls] WARNING: No data inside of the tunnel. [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] SSL_read Error [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> a4 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 79 to 192.168.99.99 port 1645 EAP-Message = 0x04110004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. ...
[ttls] WARNING: No data inside of the tunnel.
At this moment, I cannot wrap my mind around what is going on here. I understand that ldap tries to authenticate the user by itself, instead of handing it to the LDAP server. But what is different when I run radtest? Debug from radtest: ... # Executing group from file /etc/freeradius/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "a4" with password "whatever" [ldap] user DN: uid=a4,cn=users,dc=ldap,dc=hopro,dc=edu [ldap] (re)connect to ldap.hopro.edu:389, authentication 1 [ldap] bind as uid=a4,cn=users,dc=ldap,dc=hopro,dc=edu/whatever to ldap.hopro.edu:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user a4 authenticated successfully ++[ldap] returns ok ... Would someone from you guys guide me in the right direction? Thank you in advance Marco
On 19.06.2013 14:11, Marco Streich wrote:
Hi all
We have deployed FreeRADIUS on OS X before, but our configuration was rather ugly. What we would do is authenticate users locally, having the machine attached to our OpenDirectory server directly using the Connect Network Account Server functionality provided by OS X.
I have seen this question getting asked a lot but still wasn't able to fill my gap in understanding the whole process.
I will make it short and easy. You can't do LDAP authentication with 802.1x. EAP needs the password of the user in cleartext. if it's not in your ldap, you're screwed. And the debug log explains it :
WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
[snip]
At this moment, I cannot wrap my mind around what is going on here.
I understand that ldap tries to authenticate the user by itself, instead of handing it to the LDAP server. But what is different when I run radtest?
Debug from radtest: ... # Executing group from file /etc/freeradius/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "a4" with password "whatever" [ldap] user DN: uid=a4,cn=users,dc=ldap,dc=hopro,dc=edu [ldap] (re)connect to ldap.hopro.edu:389, authentication 1 [ldap] bind as uid=a4,cn=users,dc=ldap,dc=hopro,dc=edu/whatever to ldap.hopro.edu:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user a4 authenticated successfully ++[ldap] returns ok ...
This works because you're doing PAP. with radtest the user password is sent in cleartext. so YES you can authenticate with ldap because you can BIND to the ldap with the provided password. you don't have this password with 802.1x/EAP. you work only with challenges, hash and keys. Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mail: olivier@heliosnet.org
On 19.06.2013 14:58, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
I will make it short and easy.
You can't do LDAP authentication with 802.1x. EAP needs the password of the user in cleartext. if it's not in your ldap, you're screwed.
..EAP-TTLS/PAP ? ;-)
yeah. ok. missed this one :p I'm so used to do mschapv2 with eap that I tend to forget this possibility. (and I do it with ldap, but with edir. I love edir.) Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mail: olivier@heliosnet.org
On Wed, Jun 19, 2013 at 02:49:21PM +0200, Olivier Beytrison wrote:
On 19.06.2013 14:11, Marco Streich wrote:
We have deployed FreeRADIUS on OS X before, but our configuration was rather ugly. What we would do is authenticate users locally, having the machine attached to our OpenDirectory server directly using the Connect Network Account Server functionality provided by OS X.
I will make it short and easy.
You can't do LDAP authentication with 802.1x. EAP needs the password of the user in cleartext. if it's not in your ldap, you're screwed.
Not entirely true. With PAP (which is what radtest is doing) then you can work without a cleartext password as auth is (generally) based on a ldap bind. With EAP-TTLS/PAP, you can also work with just the hash in ldap, as (same as clear PAP) you get the password from the client to do a bind with. With EAP-TTLS/MSCHAP or PEAP/EAP-MSCHAP etc you need the cleartext password from ldap - auth is done by checking this in FreeRADIUS, not by a bind to ldap.
[ldap] login attempt by "a4" with password "whatever" [ldap] user DN: uid=a4,cn=users,dc=ldap,dc=hopro,dc=edu [ldap] (re)connect to ldap.hopro.edu:389, authentication 1 [ldap] bind as uid=a4,cn=users,dc=ldap,dc=hopro,dc=edu/whatever to ldap.hopro.edu:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user a4 authenticated successfully ++[ldap] returns ok
This works because you're doing PAP. with radtest the user password is sent in cleartext. so YES you can authenticate with ldap because you can BIND to the ldap with the provided password.
you don't have this password with 802.1x/EAP. you work only with challenges, hash and keys.
Apple OS X can do EAP-TTLS/PAP as far as I am aware (native Windows < 8 can't), so this should work. I don't recognise the error you're getting, though - it looks like the client gave up and sent an empty packet. Note you don't need ldap configured in the outer for 802.1X to work - the outer is just doing EAP. It's the inner that will need the ldap modules. Some other comments - Upgrade from 2.1.12 to 2.2.x, as there are security issues pre 2.2.x. Save yourself some round trip packets by setting default_eap_type = ttls in eap.conf Save yourself some LDAP lookups by removing ldap from the outer. Cheers Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi,
Some other comments -
Upgrade from 2.1.12 to 2.2.x, as there are security issues pre 2.2.x.
Save yourself some round trip packets by setting default_eap_type = ttls in eap.conf
Save yourself some LDAP lookups by removing ldap from the outer.
..and save some more hits to LDAP by wrapping the call to it in the authorization stage to just the EAP Identity packet :-) alan
On 19.06.2013 16:02, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Some other comments -
Upgrade from 2.1.12 to 2.2.x, as there are security issues pre 2.2.x.
Save yourself some round trip packets by setting default_eap_type = ttls in eap.conf
Save yourself some LDAP lookups by removing ldap from the outer.
..and save some more hits to LDAP by wrapping the call to it in the authorization stage to just the EAP Identity packet :-)
That's pretty interesting, what's the if() you're doing to achieve that? -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mail: olivier@heliosnet.org
On 19/06/13 15:32, Olivier Beytrison wrote:
On 19.06.2013 16:02, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Some other comments -
Upgrade from 2.1.12 to 2.2.x, as there are security issues pre 2.2.x.
Save yourself some round trip packets by setting default_eap_type = ttls in eap.conf
Save yourself some LDAP lookups by removing ldap from the outer.
..and save some more hits to LDAP by wrapping the call to it in the authorization stage to just the EAP Identity packet :-)
That's pretty interesting, what's the if() you're doing to achieve that?
He he he... if I recall correctly I came up with something like: server inner-tunnel { authorize { eap # stop processing authorize on eap identity or mschap success/fail if ((EAP-Type == 1) || (EAP-Message[0] =~ /^0x02..00061a..$/)) { noop } else { # rest of config goes here } } } Note however that you can avoid this in "master" versions of the server with: server inner-tunnel { authorize { eap { ok = return } } } ...as the EAP module was updated to return "ok" on identity/mschap responses. Yet another reason to upgrade!
Hi,
He he he... if I recall correctly I came up with something like:
yes, thats the one. quoted as 'most evil unlang ever' if I recall have used it on many occasions...does the job well
...as the EAP module was updated to return "ok" on identity/mschap responses. Yet another reason to upgrade!
yep...as well as proper pools of LDAP servers in 3.x alan
On 19/06/13 13:11, Marco Streich wrote:
When I run radtest from my laptop, the authentication is successful:
radtest does not send eap. Download the wpa_supplicant sources and compile eapol_test to test EAP.
WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?
This suggests your LDAP server does not contain, or is not returning, password info. So auth would probably have failed...
[ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Alert [length 0002], warning close_notify TLS Alert read:warning:close notify [ttls] WARNING: No data inside of the tunnel.
...except it never gets as far as the inner tunnel because the client drops the EAP session. Most likely the client doesn't trust the server cert.
Hi, do you have a user who can read the password in the ldap. It might be in raddb/modules/ldap ldap { server = ldap.yourorg.com login = "cn=admin,o=My Org,c=US" password = mypass basedn = "ou=users,dc=yourorg,dc=com" filter = "(posixAccount)(uid=%u))" } 2013/6/19 Marco Streich <marco.streich@kshp.ch>
Hi all
We have deployed FreeRADIUS on OS X before, but our configuration was rather ugly. What we would do is authenticate users locally, having the machine attached to our OpenDirectory server directly using the Connect Network Account Server functionality provided by OS X.
I have seen this question getting asked a lot but still wasn't able to fill my gap in understanding the whole process.
We're now using FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu
As a start, I'm now trying to get a simple user authentication working. What I have done so far is defining ldap {} in the ldap module and added ldap into the authorize {} section.
I also uncommented Auth-Type LDAP { ldap } in the authenticate {} section. <= Bad?!
The same for the virtual inner-tunnel.
When I run radtest from my laptop, the authentication is successful:
$ radtest a4 whatever 192.168.1.231 18120 secret
Sending Access-Request of id 18 to 192.168.1.231 port 1812 User-Name = "a4" User-Password = "whatever" NAS-IP-Address = 192.168.17.1 NAS-Port = 18120 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 192.168.1.231 port 1812, id=18, length=20
When I try to authorize a supplicant connected to our switch which is configured to be the authenticator, debug shows me the following:
... rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=73, length=217 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x020b0007016134 Message-Authenticator = 0xa3eaf856385eef096a4a8da0a9b938c3 Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 7 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for a4 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> a4 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=a4) [ldap] expand: dc=ldap,dc=hopro,dc=edu -> dc=ldap,dc=hopro,dc=edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.hopro.edu:389, authentication 0 [ldap] bind as / to ldap.hopro.edu:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=ldap,dc=hopro,dc=edu, with filter (uid=a4) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user a4 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 73 to 192.168.99.99 port 1645 EAP-Message = 0x010c00160410f7b955ffcad777bb64a0c2591f2a1852 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab1bf9b7ab17fdd1d339d19378335aaa Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=74, length=234 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x020c00060315 Message-Authenticator = 0x265e5392ae96ffd2f0c96666a02c9035 Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" State = 0xab1bf9b7ab17fdd1d339d19378335aaa NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 12 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for a4 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> a4 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=a4) [ldap] expand: dc=ldap,dc=hopro,dc=edu -> dc=ldap,dc=hopro,dc=edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=ldap,dc=hopro,dc=edu, with filter (uid=a4) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user a4 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 74 to 192.168.99.99 port 1645 EAP-Message = 0x010d00061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab1bf9b7aa16ecd1d339d19378335aaa Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=75, length=356 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x020d008015800000007616030100710100006d030151c19a457c2d148d872abd670c09fe7719d9b316318eb0134b0db1b5ce12e57700003200ffc00ac009c007c008c014c013c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a00330039001601000012000a00080006001700180019000b00020100 Message-Authenticator = 0x474af0e5e41006c5947328ada905bf63 Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" State = 0xab1bf9b7aa16ecd1d339d19378335aaa NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 13 length 128 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 118 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0071], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 0039], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 084f], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 75 to 192.168.99.99 port 1645 EAP-Message = 0x010e040015c0000009eb160301003902000035030151c19a44f7368e4456fc7b31270848d83dbe071b6969f1e6f9d0d7adb8527c9400c01400000dff01000100000b000403000102160301084f0b00084b0008480003a33082039f30820287a003020102020101300d06092a864886f70d010105050030818f310b3009060355040613024348310b3009060355040813025a483110300e060355040713075a75657269636831253023060355040a131c4b616e746f6e73736368756c6520486f68652050726f6d656e616465311f301d06092a864886f70d010901161069637461646d696e406b7368702e636831193017060355040313107261646975 EAP-Message = 0x732e686f70726f2e656475301e170d3132313231393130353634305a170d3133313231393130353634305a307d310b3009060355040613024348310b3009060355040813025a4831253023060355040a131c4b616e746f6e73736368756c6520486f68652050726f6d656e61646531193017060355040313107261646975732e686f70726f2e656475311f301d06092a864886f70d010901161069637461646d696e406b7368702e636830820122300d06092a864886f70d01010105000382010f003082010a0282010100bdd4065ec39decc5191947b7fae6df68b82333bce018385b48d641bfde2d9ba6294a786cd7e15b7d1824591d077af2a4c2fe EAP-Message = 0x7e66cbccd3f279171bb3e77936b8e6a92cbb0e17eb0abbcdac9945db8c11af0074d9480d263664e17d021663e0694dbfe839def4202ddede6958974bc82e8023c68adc741ab7c9e64027171b32d0d04c3e93cf1bd49947e3e462ed368fb71e8ce9fcff7414fe921494836b128635e0004e8ce29dc26a919f58d7c91f7181dcb1a71e404960f04ba20c51d42ff3872c3335cbb612ac48c6234a326c9d83f6416e32a070f6307496ca83066f071d92b29732c4045105a726e359388542437214e6480df09c8e4ce4149f53da2b449d0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000382 EAP-Message = 0x0101000e14a8494074acd8a45fb6b8e3a4ed0966823b82d9aa29417ccfd1b47764a8ae60cf65b6cf411e686e0fd8748ca655495d30408f12afef47897e31af44e8833601af028f101df0a2534f680ce10df4c7d88c312af4a5b2fc3711d2ce021bbe0ab4e439d095c102005dbce074a0a90767729ea3f1edb88b2c7d4b9e5f727cb10c5309afb41d0acdd75548de5508de058b2d684e1390fe1d917da97c34bbc13548ef1fc71aa8b4bf52dc76ccaa537f96b2460e56faa0ed34b1a3b5e4d6b3f10458883ba6bf4cb38f9096300181038c2d471e21bb4a9184d7521ba143fcf19608677da5b9e3ecce9b4d47d6f0a3b44c85380c1bd4cd15e325160d28 EAP-Message = 0x324bf7e31c3b00049f308204 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab1bf9b7a915ecd1d339d19378335aaa Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=76, length=234 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x020e00061500 Message-Authenticator = 0x37d15b32cc7d6ece0c91b13551cd0b93 Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" State = 0xab1bf9b7a915ecd1d339d19378335aaa NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 14 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 76 to 192.168.99.99 port 1645 EAP-Message = 0x010f040015c0000009eb9b30820383a003020102020900b75f4cb4031a50e3300d06092a864886f70d010105050030818f310b3009060355040613024348310b3009060355040813025a483110300e060355040713075a75657269636831253023060355040a131c4b616e746f6e73736368756c6520486f68652050726f6d656e616465311f301d06092a864886f70d010901161069637461646d696e406b7368702e636831193017060355040313107261646975732e686f70726f2e656475301e170d3132313231393130353634305a170d3133313231393130353634305a30818f310b3009060355040613024348310b3009060355040813025a48 EAP-Message = 0x3110300e060355040713075a75657269636831253023060355040a131c4b616e746f6e73736368756c6520486f68652050726f6d656e616465311f301d06092a864886f70d010901161069637461646d696e406b7368702e636831193017060355040313107261646975732e686f70726f2e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100d63a0ad9924d4bbf29ea25b2abfa17eb9d47e36ad480ce8dc1ec454aaf6470396a570eebeec3363c818882061081437e5367266e30b91be77f4e37ea9a01e56221dcbeb6f52c2157da7a74b5b024f98e3f45670aa8b6968c4b939c6b80302c318bf66f63d4f116 EAP-Message = 0x450cbb35f51f3565e121276f7fa61f2a326d432cc0cfbb94411671b3a3e3db42879419f0e18b86ba020a8d5c6e8c817f755891eb10876a57194f57780baef2b90997c16b03aab89d66833765b711bb66453be64883c0265ddc50c761525902e16cbfc7567962037f2b1ddd49e700ea4f94a55864ef801aad3315c688de2e6e15141ccedcdc016745a3ad46aef6223c66cadab19fe17cc3b7a50203010001a381f73081f4301d0603551d0e0416041442c8e782326f14866e14f0328f22ef21e5dca7683081c40603551d230481bc3081b9801442c8e782326f14866e14f0328f22ef21e5dca768a18195a4819230818f310b3009060355040613024348 EAP-Message = 0x310b3009060355040813025a483110300e060355040713075a75657269636831253023060355040a131c4b616e746f6e73736368756c6520486f68652050726f6d656e616465311f301d06092a864886f70d010901161069637461646d696e406b7368702e636831193017060355040313107261646975732e686f70726f2e656475820900b75f4cb4031a50e3300c0603551d13040530030101ff300d06092a864886f70d010105050003820101000b570cdc802ec347643ce7e5a81cd487273f8eb79f7580d9423e0ac121c39d23b8d7e606fa291515bfa8e232e845b04788cb14bbac1e67cdeded46cdead9957a88eb3c04075cbb2f9d66c81451f7 EAP-Message = 0xc982a3f0ae66f5d41f3c2ff9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab1bf9b7a814ecd1d339d19378335aaa Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=77, length=234 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x020f00061500 Message-Authenticator = 0x49c786eea0efa3a358db3c5c61d82830 Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" State = 0xab1bf9b7a814ecd1d339d19378335aaa NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 15 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 77 to 192.168.99.99 port 1645 EAP-Message = 0x011002091580000009eb6cf7c88612440aaa64dd8ca6d9533e4bd26a893bbee70e343d13c54accb14ee61b9e7ec6ee78090b76e0e353da5da86cfeb3f2c9381011e5f25cfb755e4dbcc8a78f37d906019e5a2c2225a03a5f2318e3bf8c56eb0b43ad64ac8ddebb84ca1352b5a80b4a8c8757c5a37352508833404ebd868c5dd0cc92b3df240cf05b1e721b7a90d8e0a060e4834fff2dc79a04353dab2492381d4488ab7e92257f4ed7fb3eb4053e22a3160301014b0c0001470300174104e284bd8b7ec8e3510d4a6bb593e671a0945af1e997ce5cc010d13fd0e76a68e71c034e1412d7fc4b26233ca3df8dba3463719b1fa33f4ab4934a7208005205 EAP-Message = 0x5f010042df9b97e266190e04d0b6ea3fdaf36282b104caaee17a75acbccf6e74e427b6fa6a600c9db92fcbe7e34cffc49deb6a2e3949e17692845c03a7ab92d4daf19bee3788c1afcf23fbc5c9ddd487f335bd83d238cfe52f80ca59a6cc6ad58b3ecb7502ab687184733c42cd5de45e06cd101ae2e41f4943c01ac3379e928240ac532451599dce12979065ad088a056130f57d119038f40003d55fcebe5edd0acde65036f24fd69cc0fda63ff408c25ee9c3ad100bf0a90d6031a0034d064b8ecf8a5323d79e7d7b764d08105ea8c35c7548983060ce8f8577909b8a2c2049d78f99b0acc37a55b993519f1e475b7b4f9fff67e943f61c7a9f4a18fd EAP-Message = 0x05b6bbbc248c16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab1bf9b7af0becd1d339d19378335aaa Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=78, length=372 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x021000901580000000861603010046100000424104ee7b81c5eb47db38fd9999628065d8bc69504fd008ffcce581bf49a5dc349fac012b27f4d21db7352c31e8be8bc097f9fd3414f7160990963cd9ad8e53166e951403010001011603010030ed341f879e3591dedc6633d8a0376280178fe300950d293b30747d15b35f4867c69765e98c2f0a15bcb95a992cbc77a4 Message-Authenticator = 0xe7c4329c24d68ad3919250d82c96961a Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" State = 0xab1bf9b7af0becd1d339d19378335aaa NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 16 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 134 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 78 to 192.168.99.99 port 1645 EAP-Message = 0x0111004515800000003b1403010001011603010030b0518066786178044d44483eb37026fdd8406df7f6eaae28282bc696f782e64198a16f06ecde63a263375845bf3304f7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab1bf9b7ae0aecd1d339d19378335aaa Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.99.99 port 1645, id=79, length=275 User-Name = "a4" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9000 Called-Station-Id = "AC-A0-16-58-EB-07" Calling-Station-Id = "00-23-32-CF-1D-A2" EAP-Message = 0x0211002f1580000000251503010020f0c878ea3889abbd6850566e4a4b6b5e5777dc3f5e0f11789e9a9430219cc5b3 Message-Authenticator = 0x69b565f9da2f3112f04fc8a2197444a4 Cisco-AVPair = "audit-session-id=C0A863630000062C77AFDED6" NAS-Port-Type = Ethernet NAS-Port = 50007 NAS-Port-Id = "GigabitEthernet0/7" State = 0xab1bf9b7ae0aecd1d339d19378335aaa NAS-IP-Address = 192.168.99.99 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a4", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 17 length 47 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 37 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Alert [length 0002], warning close_notify TLS Alert read:warning:close notify [ttls] WARNING: No data inside of the tunnel. [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] SSL_read Error [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> a4 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 79 to 192.168.99.99 port 1645 EAP-Message = 0x04110004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. ...
[ttls] WARNING: No data inside of the tunnel.
At this moment, I cannot wrap my mind around what is going on here.
I understand that ldap tries to authenticate the user by itself, instead of handing it to the LDAP server. But what is different when I run radtest?
Debug from radtest: ... # Executing group from file /etc/freeradius/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "a4" with password "whatever" [ldap] user DN: uid=a4,cn=users,dc=ldap,dc=hopro,dc=edu [ldap] (re)connect to ldap.hopro.edu:389, authentication 1 [ldap] bind as uid=a4,cn=users,dc=ldap,dc=hopro,dc=edu/whatever to ldap.hopro.edu:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user a4 authenticated successfully ++[ldap] returns ok ...
Would someone from you guys guide me in the right direction?
Thank you in advance
Marco
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- -- Un saludo. ____________________ Roberto Ortega Profesor de Informática. http://www.proyectoret.es Escuelas San José Valencia Avd.Cortes Valencianas nº1 46015 Valencia R4600489A Tf:963499011 ext. 262 Fax:963488835 http://www.escuelassj.com No imprimas este correo si no es necesario. Protejamos el medio ambiente.
participants (6)
-
A.L.M.Buxey＠lboro.ac.uk -
Marco Streich -
Matthew Newton -
Olivier Beytrison -
Phil Mayers -
Roberto Ortega Ramiro