EAP-TLS certificate problem
Hi, everybody I have used pre-shipped certificates of Freeradius for testing purpose. This testing was succeed with a test user 'bob', with files authentication. Now in the next step I wanna authenticate a user from my Database with Digital certificates. When i authenticate the user, server side confirm and send "Access-Accept" packet, but at client, following error occurs. " No Message-Authenticator attribute found Incoming RADIUS packet did not have correct Message-Authenticator - dropped STA 02:00:00:00:00:01: No RADIUS RX handler found (type=0 code=2 id=0) - dropping packet" I googled this problem and found a solution that the user Auth-type is set to Accept (I manually checked the user in Database , and its Auth-Type was Accept) and this type prevent further process. Now my question is that , could I continue EAP-TLS authentication, regardless of Auth-Type is set to Accept??? Thanks in advance
On 19/02/13 09:11, Muhammad Nadeem wrote:
Hi, everybody I have used pre-shipped certificates of Freeradius for testing purpose. This testing was succeed with a test user 'bob', with files authentication. Now in the next step I wanna authenticate a user from my Database with Digital certificates. When i authenticate the user, server side confirm and send "Access-Accept" packet, but at client, following error occurs. " No Message-Authenticator attribute found Incoming RADIUS packet did not have correct Message-Authenticator - dropped STA 02:00:00:00:00:01: No RADIUS RX handler found (type=0 code=2 id=0) - dropping packet"
I googled this problem and found a solution that the user Auth-type is set to Accept (I manually checked the user in Database , and its Auth-Type was Accept) and this type prevent further process.
Yes
Now my question is that , could I continue EAP-TLS authentication, regardless of Auth-Type is set to Accept???
No. Don't set Auth-Type unless you know what you're doing.
On 2/19/13, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 19/02/13 09:11, Muhammad Nadeem wrote:
Hi, everybody I have used pre-shipped certificates of Freeradius for testing purpose. This testing was succeed with a test user 'bob', with files authentication. Now in the next step I wanna authenticate a user from my Database with Digital certificates. When i authenticate the user, server side confirm and send "Access-Accept" packet, but at client, following error occurs. " No Message-Authenticator attribute found Incoming RADIUS packet did not have correct Message-Authenticator - dropped STA 02:00:00:00:00:01: No RADIUS RX handler found (type=0 code=2 id=0) - dropping packet"
I googled this problem and found a solution that the user Auth-type is set to Accept (I manually checked the user in Database , and its Auth-Type was Accept) and this type prevent further process.
Yes
Now my question is that , could I continue EAP-TLS authentication, regardless of Auth-Type is set to Accept???
No. Don't set Auth-Type unless you know what you're doing. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ok thanx, I suucceed to authenticate the users from a database. But when i setup the same setup on another machine, I was failed :( The following output is the debug output of the freeradius server. (I think EAP NAK,, is creating problems). Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.112 port 35397, id=0, length=132 User-Name = "001AAD3F8165" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001101303031414144334638313635 Message-Authenticator = 0xebcf3f94a32bf89eaabf4be3b2ce493b # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "001AAD3F8165", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [eap] EAP packet type response id 0 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> 001AAD3F8165 [sql] sql_set_user escaped user --> '001AAD3F8165' rlm_sql (sql): Reserving sql socket id: 9 [sql] expand: SELECT '1' AS RC_ID,'%{SQL-USER-NAME}' AS USERNAME,'Auth-Type' AS Attribute, AAA_GETVALUETOCHECKWITRIBE('%{SQL-User-Name}') AS Value,':=' AS op FROM dual ORDER BY RC_ID -> SELECT '1' AS RC_ID,'001AAD3F8165' AS USERNAME,'Auth-Type' AS Attribute, AAA_GETVALUETOCHECKWITRIBE('001AAD3F8165') AS Value,':=' AS op FROM dual ORDER BY RC_ID [sql] User found in radcheck table [sql] expand: select rownum, '%{SQL-USER-NAME}', RR_ATTRIBUTE, RR_VALUE, RR_OP FROM AAA_TBLRADREPLY where PI_PROFILEID in (SELECT PI_PROFILEID FROM SM_TBLSUBSIDENTIFICATIONS WHERE SI_IDENTIFICATION = upper(replace('%{SQL-USER-NAME}',':','')) ) AND NE_ELEMENTID in (SELECT NE_ELEMENTID FROM NC_TBLNEACESSCONF WHERE NEAC_IPADDRESS = '%{NAS-IP-Address}') -> select rownum, '001AAD3F8165', RR_ATTRIBUTE, RR_VALUE, RR_OP FROM AAA_TBLRADREPLY where PI_PROFILEID in (SELECT PI_PROFILEID FROM SM_TBLSUBSIDENTIFICATIONS WHERE SI_IDENTIFICATION = upper(replace('001AAD3F8165',':','')) ) AND NE_ELEMENTID in (SELECT NE_ELEMENTID FROM NC_TBLNEACESSCONF WHERE NEAC_IPADDRESS = '127.0.0.1') rlm_sql (sql): Released sql socket id: 9 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = Accept Found Auth-Type = EAP Warning: Found 2 auth-types on request for user '001AAD3F8165' # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.0.112 port 35397 Qos-Policing-Profile-Name := "128K_UL" Qos-Metering-Profile-Name := "512K_DL" Context-Name := "Postpaid-VR" DHCP-Max-Leases := 1 Forward-Policy := "in:nonpayment_redirect_post" HTTP-Redirect-Profile-Name := "nonpayment_redirect" EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb13fd7b2b13eda2327535c6f1b5e461f Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.112 port 35397, id=1, length=139 User-Name = "001AAD3F8165" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060300 State = 0xb13fd7b2b13eda2327535c6f1b5e461f Message-Authenticator = 0x568912b7d14f9d2ed1a8cad6e4504182 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "001AAD3F8165", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> 001AAD3F8165 [sql] sql_set_user escaped user --> '001AAD3F8165' rlm_sql (sql): Reserving sql socket id: 8 [sql] expand: SELECT '1' AS RC_ID,'%{SQL-USER-NAME}' AS USERNAME,'Auth-Type' AS Attribute, AAA_GETVALUETOCHECKWITRIBE('%{SQL-User-Name}') AS Value,':=' AS op FROM dual ORDER BY RC_ID -> SELECT '1' AS RC_ID,'001AAD3F8165' AS USERNAME,'Auth-Type' AS Attribute, AAA_GETVALUETOCHECKWITRIBE('001AAD3F8165') AS Value,':=' AS op FROM dual ORDER BY RC_ID [sql] User found in radcheck table [sql] expand: select rownum, '%{SQL-USER-NAME}', RR_ATTRIBUTE, RR_VALUE, RR_OP FROM AAA_TBLRADREPLY where PI_PROFILEID in (SELECT PI_PROFILEID FROM SM_TBLSUBSIDENTIFICATIONS WHERE SI_IDENTIFICATION = upper(replace('%{SQL-USER-NAME}',':','')) ) AND NE_ELEMENTID in (SELECT NE_ELEMENTID FROM NC_TBLNEACESSCONF WHERE NEAC_IPADDRESS = '%{NAS-IP-Address}') -> select rownum, '001AAD3F8165', RR_ATTRIBUTE, RR_VALUE, RR_OP FROM AAA_TBLRADREPLY where PI_PROFILEID in (SELECT PI_PROFILEID FROM SM_TBLSUBSIDENTIFICATIONS WHERE SI_IDENTIFICATION = upper(replace('001AAD3F8165',':','')) ) AND NE_ELEMENTID in (SELECT NE_ELEMENTID FROM NC_TBLNEACESSCONF WHERE NEAC_IPADDRESS = '127.0.0.1') rlm_sql (sql): Released sql socket id: 8 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = Accept Found Auth-Type = EAP Warning: Found 2 auth-types on request for user '001AAD3F8165' # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for bad type 0 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> 001AAD3F8165 [sql] sql_set_user escaped user --> '001AAD3F8165' ++[sql] returns noop [attr_filter.access_reject] expand: %{User-Name} -> 001AAD3F8165 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 1 to 192.168.0.112 port 35397 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 0 with timestamp +7 Waking up in 0.9 seconds. Cleaning up request 1 ID 1 with timestamp +7 Ready to process requests.
On 02/19/2013 09:16 AM, Muhammad Nadeem wrote:
On 2/19/13, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 19/02/13 09:11, Muhammad Nadeem wrote:
Hi, everybody I have used pre-shipped certificates of Freeradius for testing purpose. This testing was succeed with a test user 'bob', with files authentication. Now in the next step I wanna authenticate a user from my Database with Digital certificates. When i authenticate the user, server side confirm and send "Access-Accept" packet, but at client, following error occurs. " No Message-Authenticator attribute found Incoming RADIUS packet did not have correct Message-Authenticator - dropped STA 02:00:00:00:00:01: No RADIUS RX handler found (type=0 code=2 id=0) - dropping packet"
I googled this problem and found a solution that the user Auth-type is set to Accept (I manually checked the user in Database , and its Auth-Type was Accept) and this type prevent further process.
Yes
Now my question is that , could I continue EAP-TLS authentication, regardless of Auth-Type is set to Accept???
No. Don't set Auth-Type unless you know what you're doing.
Doesn't look like you actually heeded this advice does it? Hint, look at your select statement. You're setting the Auth-Type.
Ok thanx, I suucceed to authenticate the users from a database. But when i setup the same setup on another machine, I was failed :( The following output is the debug output of the freeradius server. (I think EAP NAK,, is creating problems). [sql] expand: SELECT '1' AS RC_ID,'%{SQL-USER-NAME}' AS USERNAME,'Auth-Type' AS Attribute, AAA_GETVALUETOCHECKWITRIBE('%{SQL-User-Name}') AS Value,':=' AS op FROM dual ORDER BY RC_ID -> SELECT '1' AS RC_ID,'001AAD3F8165' AS USERNAME,'Auth-Type' AS Attribute, AAA_GETVALUETOCHECKWITRIBE('001AAD3F8165') AS Value,':=' AS op FROM dual ORDER BY RC_ID [sql] User found in radcheck table
Found Auth-Type = Accept Found Auth-Type = EAP Warning: Found 2 auth-types on request for user '001AAD3F8165'
-- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
Muhammad Nadeem wrote:
I suucceed to authenticate the users from a database. But when i setup the same setup on another machine, I was failed :( The following output is the debug output of the freeradius server. (I think EAP NAK,, is creating problems).
Yes. Read the debug output.
[eap] EAP NAK [eap] NAK asked for bad type 0 [eap] Failed in EAP select
The client is broken. Don't blame FreeRADIUS. Go fix the client. Alan DeKok.
participants (4)
-
Alan DeKok -
John Dennis -
Muhammad Nadeem -
Phil Mayers