Le 11/03/2013 , freeradius-users-request@lists.freeradius.org a écrit :
Date: Mon, 11 Mar 2013 11:50:17 -0400 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: troubles with eap-peap mschapv2 Message-ID: <513DFD39.90108@deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1
Bertrand Poulet wrote:
i try to migrate from FreeRADIUS 1.1.6 (Mandrake) to FreeRADIUS 2.2.0 (from source) on ubuntu12.04. That should be easy. I thought so (from what i read on documentation).
The same supplicant and same AP with old FR is ok, but not with new FR 2.2.0.
What i've done :
I've installed with ./configure; make; make install root@myhost:/usr/local/etc/raddb/certs# make openssl dhparam -out dh 1024 Well... that's the problem. You didn't copy the old certificates over. Instead, you created new ones.
Don't do that. Use the old certs. It will work. I've copied old "certs" directory to the new server. It's still not good. The supplicant can not connect; there is like a loop between ra_recv and sending-access-challenge. the problem is with certs or could it be something else ?
Thanks. the ouput is : rad_recv: Access-Request packet from host 172.20.100.53 port 1645, id=247, length=172 User-Name = "bertrand" Framed-MTU = 1400 Called-Station-Id = "0014.1bb6.4be0" Calling-Station-Id = "844b.f5b8.d423" Cisco-AVPair = "ssid=ipl_dsi" Service-Type = Login-User Message-Authenticator = 0x508e5e0ee37be030c0d4c6e4002d5b60 EAP-Message = 0x0202000d016265727472616e64 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "642" NAS-Port = 642 NAS-IP-Address = 172.20.100.53 NAS-Identifier = "net-ap-A1-1-53" Tue Mar 12 15:10:20 2013 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Tue Mar 12 15:10:20 2013 : Info: +- entering group authorize {...} Tue Mar 12 15:10:20 2013 : Info: ++[preprocess] returns ok Tue Mar 12 15:10:20 2013 : Info: ++[chap] returns noop Tue Mar 12 15:10:20 2013 : Info: ++[mschap] returns noop Tue Mar 12 15:10:20 2013 : Info: ++[digest] returns noop Tue Mar 12 15:10:20 2013 : Info: [suffix] No '@' in User-Name = "bertrand", looking up realm NULL Tue Mar 12 15:10:20 2013 : Info: [suffix] No such realm "NULL" Tue Mar 12 15:10:20 2013 : Info: ++[suffix] returns noop Tue Mar 12 15:10:20 2013 : Info: [eap] EAP packet type response id 2 length 13 Tue Mar 12 15:10:20 2013 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Mar 12 15:10:20 2013 : Info: ++[eap] returns updated Tue Mar 12 15:10:20 2013 : Debug: WARNING: Found User-Password == "...". Tue Mar 12 15:10:20 2013 : Debug: WARNING: Are you sure you don't mean Cleartext-Password? Tue Mar 12 15:10:20 2013 : Debug: WARNING: See "man rlm_pap" for more information. Tue Mar 12 15:10:20 2013 : Info: [files] users: Matched entry bertrand at line 207 Tue Mar 12 15:10:20 2013 : Info: ++[files] returns ok Tue Mar 12 15:10:20 2013 : Info: ++[expiration] returns noop Tue Mar 12 15:10:20 2013 : Info: ++[logintime] returns noop Tue Mar 12 15:10:20 2013 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Mar 12 15:10:20 2013 : Info: ++[pap] returns noop Tue Mar 12 15:10:20 2013 : Info: Found Auth-Type = EAP Tue Mar 12 15:10:20 2013 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default Tue Mar 12 15:10:20 2013 : Info: +- entering group authenticate {...} Tue Mar 12 15:10:20 2013 : Info: [eap] EAP Identity Tue Mar 12 15:10:20 2013 : Info: [eap] processing type tls Tue Mar 12 15:10:20 2013 : Info: [tls] Initiate Tue Mar 12 15:10:20 2013 : Info: [tls] Start returned 1 Tue Mar 12 15:10:20 2013 : Info: ++[eap] returns handled Sending Access-Challenge of id 247 to 172.20.100.53 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x131466f213177f9f58f8ed5fb507e76c Tue Mar 12 15:10:20 2013 : Info: Finished request 0. Tue Mar 12 15:10:20 2013 : Debug: Going to the next request Tue Mar 12 15:10:20 2013 : Debug: Waking up in 4.9 seconds. Tue Mar 12 15:10:25 2013 : Info: Cleaning up request 0 ID 247 with timestamp +8 Tue Mar 12 15:10:25 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Mar 12 15:10:25 2013 : Debug: WARNING: !! EAP session for state 0x131466f213177f9f did not finish! Tue Mar 12 15:10:25 2013 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Tue Mar 12 15:10:25 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Mar 12 15:10:25 2013 : Info: Ready to process requests. rad_recv: Access-Request packet from host 172.20.100.53 port 1645, id=247, length=172 User-Name = "bertrand" Framed-MTU = 1400 Called-Station-Id = "0014.1bb6.4be0" Calling-Station-Id = "844b.f5b8.d423" Cisco-AVPair = "ssid=ipl_dsi" Service-Type = Login-User Message-Authenticator = 0x508e5e0ee37be030c0d4c6e4002d5b60 EAP-Message = 0x0202000d016265727472616e64 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "642" NAS-Port = 642 NAS-IP-Address = 172.20.100.53 NAS-Identifier = "net-ap-A1-1-53" Tue Mar 12 15:10:25 2013 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Tue Mar 12 15:10:25 2013 : Info: +- entering group authorize {...} Tue Mar 12 15:10:25 2013 : Info: ++[preprocess] returns ok Tue Mar 12 15:10:25 2013 : Info: ++[chap] returns noop Tue Mar 12 15:10:25 2013 : Info: ++[mschap] returns noop Tue Mar 12 15:10:25 2013 : Info: ++[digest] returns noop Tue Mar 12 15:10:25 2013 : Info: [suffix] No '@' in User-Name = "bertrand", looking up realm NULL Tue Mar 12 15:10:25 2013 : Info: [suffix] No such realm "NULL" Tue Mar 12 15:10:25 2013 : Info: ++[suffix] returns noop Tue Mar 12 15:10:25 2013 : Info: [eap] EAP packet type response id 2 length 13 Tue Mar 12 15:10:25 2013 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Mar 12 15:10:25 2013 : Info: ++[eap] returns updated Tue Mar 12 15:10:25 2013 : Debug: WARNING: Found User-Password == "...". Tue Mar 12 15:10:25 2013 : Debug: WARNING: Are you sure you don't mean Cleartext-Password? Tue Mar 12 15:10:25 2013 : Debug: WARNING: See "man rlm_pap" for more information. Tue Mar 12 15:10:25 2013 : Info: [files] users: Matched entry bertrand at line 207 Tue Mar 12 15:10:25 2013 : Info: ++[files] returns ok Tue Mar 12 15:10:25 2013 : Info: ++[expiration] returns noop Tue Mar 12 15:10:25 2013 : Info: ++[logintime] returns noop Tue Mar 12 15:10:25 2013 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Mar 12 15:10:25 2013 : Info: ++[pap] returns noop Tue Mar 12 15:10:25 2013 : Info: Found Auth-Type = EAP Tue Mar 12 15:10:25 2013 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default Tue Mar 12 15:10:25 2013 : Info: +- entering group authenticate {...} Tue Mar 12 15:10:25 2013 : Info: [eap] EAP Identity Tue Mar 12 15:10:25 2013 : Info: [eap] processing type tls Tue Mar 12 15:10:25 2013 : Info: [tls] Initiate Tue Mar 12 15:10:25 2013 : Info: [tls] Start returned 1 Tue Mar 12 15:10:25 2013 : Info: ++[eap] returns handled Sending Access-Challenge of id 247 to 172.20.100.53 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb07a7177b07968b416db63d319887c15 Tue Mar 12 15:10:25 2013 : Info: Finished request 1. Tue Mar 12 15:10:25 2013 : Debug: Going to the next request Tue Mar 12 15:10:25 2013 : Debug: Waking up in 4.9 seconds. Tue Mar 12 15:10:30 2013 : Info: Cleaning up request 1 ID 247 with timestamp +13 Tue Mar 12 15:10:30 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Mar 12 15:10:30 2013 : Debug: WARNING: !! EAP session for state 0xb07a7177b07968b4 did not finish! Tue Mar 12 15:10:30 2013 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Tue Mar 12 15:10:30 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Mar 12 15:10:30 2013 : Info: Ready to process requests. rad_recv: Access-Request packet from host 172.20.100.53 port 1645, id=247, length=172 User-Name = "bertrand" Framed-MTU = 1400 Called-Station-Id = "0014.1bb6.4be0" Calling-Station-Id = "844b.f5b8.d423" Cisco-AVPair = "ssid=ipl_dsi" Service-Type = Login-User Message-Authenticator = 0x508e5e0ee37be030c0d4c6e4002d5b60 EAP-Message = 0x0202000d016265727472616e64 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "642" NAS-Port = 642 NAS-IP-Address = 172.20.100.53 NAS-Identifier = "net-ap-A1-1-53" ....
Bertrand Poulet wrote:
I've copied old "certs" directory to the new server. It's still not good.
See http://deployingradius.com/ There is detailed documentation for debugging EAP. As in 10-15 pages, with screen shots, instructions for what to do, comments as to what typically goes wrong, and how to fix it.
The supplicant can not connect; there is like a loop between ra_recv and sending-access-challenge. the problem is with certs or could it be something else ?
The problem is likely the certificates. Debugging it is not hard. Just tedious. Alan DeKok.
On 12/03/13 14:23, Bertrand Poulet wrote:
Tue Mar 12 15:10:20 2013 : Info: # Executing section authorize from file
When you make debug output, please just use: radiusd -X Don't use the other arguments; they just create noise and volume (timestamps) that are basically irrelevant.
Tue Mar 12 15:10:20 2013 : Info: +- entering group authenticate {...} Tue Mar 12 15:10:20 2013 : Info: [eap] EAP Identity Tue Mar 12 15:10:20 2013 : Info: [eap] processing type tls Tue Mar 12 15:10:20 2013 : Info: [tls] Initiate Tue Mar 12 15:10:20 2013 : Info: [tls] Start returned 1 Tue Mar 12 15:10:20 2013 : Info: ++[eap] returns handled Sending Access-Challenge of id 247 to 172.20.100.53 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x131466f213177f9f58f8ed5fb507e76c Tue Mar 12 15:10:20 2013 : Info: Finished request 0. Tue Mar 12 15:10:20 2013 : Debug: Going to the next request Tue Mar 12 15:10:20 2013 : Debug: Waking up in 4.9 seconds. Tue Mar 12 15:10:25 2013 : Info: Cleaning up request 0 ID 247 with timestamp +8 Tue Mar 12 15:10:25 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Mar 12 15:10:25 2013 : Debug: WARNING: !! EAP session for state 0x131466f213177f9f did not finish!
This fails really REALLY early in the EAP setup. The certs haven't even been exchanged yet. Start checking other things - check the network path, firewalls, MTU, etc. because it doesn't look like you're receiving the PEAP start - just the initial EAP identity.
participants (3)
-
Alan DeKok -
Bertrand Poulet -
Phil Mayers