Freeradius + AD + WiFi + EAP
FreeRADIUS Version 2.1.9, for host x86_64-redhat-linux-gnu Active Directory - Windows Server 2008 Windows Vista (WPA-TKIP / Protected EAP (PEAP)) Wireless Access Point - CISCO WAP4410N File /etc/raddb/eap.conf eap { .... default_eap_type = peap ... peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } } File /etc/raddb/users DEFAULT Auth-Type = ntlm_auth .... File /etc/raddb/modules/mschap mschap { ... with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" ... } File /etc/raddb/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAINTEST --username=%{mschap:User-Name} --password=%{User-Password}" } Files /etc/raddb/sites-enable/inner-tunnel and /etc/raddb/sites-enable/default authenticate { .... ntlm_auth ... } [root@radiusserver etc]# ntlm_auth --request-nt-key --domain=MYDOMAINTEST --username=testuser01 --password=test NT_STATUS_OK: Success (0x0) [root@radiusserver etc]# net join -U Administrator Enter Administrator's password: Using short domain name -- MYDOMAINTEST Joined 'RADIUSSERVER' to realm 'mydomaintest.com' [root@radiusserver /]# radtest testuser01 test localhost 0 teste123 Sending Access-Request of id 51 to 127.0.0.1 port 1812 User-Name = "testuser01" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=51, length=20 Have any idea ? Where can i find the solution ? When i trying connect (windows vista) freeradius server with wireless over access point i get this error: rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=189, length=189 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001401414e47454c4f4e495c63626f6c616e State = 0x6506f8af6507e17f97933c212e541ba3 Message-Authenticator = 0xbd99142be48ec558c3cbe5102cebc556 Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 1 length 20 Mon Sep 13 10:34:21 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:21 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:21 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:21 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:21 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] EAP Identity Mon Sep 13 10:34:21 2010 : Info: [eap] processing type tls Mon Sep 13 10:34:21 2010 : Info: [tls] Initiate Mon Sep 13 10:34:21 2010 : Info: [tls] Start returned 1 Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 189 to 192.168.155.194 port 2050 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed76fc17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 1. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=190, length=300 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202008319800000007916030100740100007003014c8e2884af2dbe79e59a780b7c801b6a6f024ab05ed1164311f8e2c438576298000018002f00350005000ac009c00ac013c01400320038001300040100002f00000014001200000f616e67656c6f6e695c63626f6c616e000a00080006001700180019000b00020100ff01000100 State = 0xd76dd84ed76fc17a0790fefec05add19 Message-Authenticator = 0x93bc32a345dce54fc50f7bbb50ca7e3f Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 2 length 131 Mon Sep 13 10:34:21 2010 : Info: [eap] Continuing tunnel setup. Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns ok Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:21 2010 : Info: [eap] EAP/peap Mon Sep 13 10:34:21 2010 : Info: [eap] processing type peap Mon Sep 13 10:34:21 2010 : Info: [peap] processing EAP-TLS Mon Sep 13 10:34:21 2010 : Debug: TLS Length 121 Mon Sep 13 10:34:21 2010 : Info: [peap] Length Included Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_verify returned 11 Mon Sep 13 10:34:21 2010 : Info: [peap] (other): before/accept initialization Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: before/accept initialization Mon Sep 13 10:34:21 2010 : Info: [peap] <<< TLS 1.0 Handshake [length 0074], ClientHello Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 read client hello A Mon Sep 13 10:34:21 2010 : Info: [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 write server hello A Mon Sep 13 10:34:21 2010 : Info: [peap] >>> TLS 1.0 Handshake [length 085e], Certificate Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 write certificate A Mon Sep 13 10:34:21 2010 : Info: [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 write server done A Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 flush data Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A Mon Sep 13 10:34:21 2010 : Debug: In SSL Handshake Phase Mon Sep 13 10:34:21 2010 : Debug: In SSL Accept mode Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_process returned 13 Mon Sep 13 10:34:21 2010 : Info: [peap] EAPTLS_HANDLED Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 190 to 192.168.155.194 port 2050 EAP-Message = 0x0103040019c0000008a216030100310200002d03014c8e285d2beeb4138d9eee394a996f4f9eca58f023b887efdda363a09db4bff300002f000005ff01000100160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3130303931333132343233355a170d3130313131323132343233355a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ee3a32108e4f3cbfaa7a92d4bd978ca40fc64b2a47661645c8b68d65044435a66076682fd05fa16778a5af94206ffc638de3ca5a2a99a7 EAP-Message = 0xc92a2cf32a0ee4b8318b2f6b48eed7145b30afb76af66a5ceb89811ae04a70d71efd284ddfacd426825d71a59a319b37da2bba0e088bb66183f25f6522af18a4fbd7104c308440dfd10444b93c8548363aa973a8a926a5dd2cdee98ab4334e76941732723504db3bc0d7f7ecbac57fe09389ef3472ad7b952baf531120d84c6e661360774007a6661c46e00344cec67a5626e1cb85d0a20d037aabb885560b01e2fbef6447971424dafda7b2b47a19a8ea30fa59cb5dfce23c3f2a52f1060bcb84f596fc54f37d8f970203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038201010011f6 EAP-Message = 0x5fe6dfff7362f46ed7015696230b784919f57eb0598b8cc5bc5aaafc91fb345324f2d8c409d3f4e89d7e16da467c611f98599c7e33ac6e6bea988f9dc1daad9102b4a4054f0cc9c6b1621088b3e2cc9d31f14adaea05d494919259f69778be393aab6efb9ddbb8d6a5949ae4c0231ff28820d4984cf5b319c9262a1fffc897ed56371008a993b0353d108a68b022384eb79b6b594d27f55fabc4215d96dde86b0e609bef9c04a2306c7c6b396ae07e9039815f0caec47148b6c5a8d5a353449e9d2b61a7f9c88dc86b90b94cfb3e98b1634da1923ba30d55e652d40c11c93eb5f6f1ee7827e134acbd4cc0f07d0b4d206e8df2fa9ecd78881348c1b157 EAP-Message = 0x2b0004ab308204a73082038f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed66ec17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 2. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=191, length=175 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0xd76dd84ed66ec17a0790fefec05add19 Message-Authenticator = 0x149802ee2e900a377b4953192fd43319 Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 3 length 6 Mon Sep 13 10:34:21 2010 : Info: [eap] Continuing tunnel setup. Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns ok Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:21 2010 : Info: [eap] EAP/peap Mon Sep 13 10:34:21 2010 : Info: [eap] processing type peap Mon Sep 13 10:34:21 2010 : Info: [peap] processing EAP-TLS Mon Sep 13 10:34:21 2010 : Info: [peap] Received TLS ACK Mon Sep 13 10:34:21 2010 : Info: [peap] ACK handshake fragment handler Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_verify returned 1 Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_process returned 13 Mon Sep 13 10:34:21 2010 : Info: [peap] EAPTLS_HANDLED Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 191 to 192.168.155.194 port 2050 EAP-Message = 0x010403fc1940a003020102020900fd77376b6dad365e300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3130303931333132343233355a170d3130313131323132343233355a308193310b3009060355040613024652310f300d0603550408130652616469757331 EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d154c97876aafffd6e2c38d8d030b168f8dce7c480ee5e1f2e70f69b644f539598e82c35141f1fc6df2202d717a8d212224f57bd0a0e5e4f6ad9f86ba16f00651842cbf6a8ab15fd2e788309304f5dc5abd95811697d400a611cb69d60e8957024bd0a4fc7ff1267 EAP-Message = 0xb00fc2f26e74c5858497e66019676175f2cf11049781681ba950f2f9e0fc51045f12655aab1cfc4001e7de1bf7ad11cd4ce5a56cfc64f479d1c3fa84ef41275203b542cf17a0c7ea5d00ebdee20c53a432e0568669d036073870a155f3fac928212cdd0e071c5ae65784c83b6ac840dc198d51c6a59c6b1f6273a8c6c8906e0011842b96391df406225ca95c01649e518e235865d44d4d4d0203010001a381fb3081f8301d0603551d0e04160414e3bc4886052780b7f5e868e9f8c2e8188ee3f8b23081c80603551d230481c03081bd8014e3bc4886052780b7f5e868e9f8c2e8188ee3f8b2a18199a48196308193310b300906035504061302465231 EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900fd77376b6dad365e300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100886a41b64009cfdda5cbf1a1acc3b762ae831896a64568f23615de741e3911de3e1539a9cb018be1f0907182306a6296b2ab29391b905e3376391ab24c830be031aefa5e3ebf9f2bbc4862 EAP-Message = 0xec4672b63eb34dbe Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed569c17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 3. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=192, length=175 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400061900 State = 0xd76dd84ed569c17a0790fefec05add19 Message-Authenticator = 0xd66c19cfcb0a9d15888c2f80c474a5de Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 4 length 6 Mon Sep 13 10:34:21 2010 : Info: [eap] Continuing tunnel setup. Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns ok Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:21 2010 : Info: [eap] EAP/peap Mon Sep 13 10:34:21 2010 : Info: [eap] processing type peap Mon Sep 13 10:34:21 2010 : Info: [peap] processing EAP-TLS Mon Sep 13 10:34:21 2010 : Info: [peap] Received TLS ACK Mon Sep 13 10:34:21 2010 : Info: [peap] ACK handshake fragment handler Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_verify returned 1 Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_process returned 13 Mon Sep 13 10:34:21 2010 : Info: [peap] EAPTLS_HANDLED Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 192 to 192.168.155.194 port 2050 EAP-Message = 0x010500bc1900a8c1e930adad128d2a178d8d7a4c345b4f7ddd981d87e3a364ef65216c0e6485d99f22a335b4c31daf8ff28bac0d0375c0c0d6695cbda1d70898a7e2dfb8ddb5a9df14270422a6820bf42284b766a88d819b3a1f33f4962446a852c8a88469e39707436d52148d4c1277c1dbc2c97b1377dc77dca0cfc3374eb968b54acd07df27089f3c611bfddb24c32dd17da21321da1ff5856723398f2d948e896a051e1cf7ebfd5f5989198f265898af4e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed468c17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 4. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=193, length=175 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061900 State = 0xd76dd84ed468c17a0790fefec05add19 Message-Authenticator = 0x25610017540304c1a783aa7777ba392b Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 5 length 6 Mon Sep 13 10:34:21 2010 : Info: [eap] Continuing tunnel setup. Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns ok Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:21 2010 : Info: [eap] EAP/peap Mon Sep 13 10:34:21 2010 : Info: [eap] processing type peap Mon Sep 13 10:34:21 2010 : Info: [peap] processing EAP-TLS Mon Sep 13 10:34:21 2010 : Info: [peap] Received TLS ACK Mon Sep 13 10:34:21 2010 : Info: [peap] ACK handshake fragment handler Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_verify returned 1 Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_process returned 13 Mon Sep 13 10:34:21 2010 : Info: [peap] EAPTLS_HANDLED Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 193 to 192.168.155.194 port 2050 EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed36bc17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 5. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=194, length=171 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001401414e47454c4f4e495c63626f6c616e Message-Authenticator = 0x7fb8c0c166efca06b16e7f0b2c11acc4 Mon Sep 13 10:34:23 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:23 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:23 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:23 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:23 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:23 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:23 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:23 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:23 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:23 2010 : Info: [eap] EAP packet type response id 0 length 20 Mon Sep 13 10:34:23 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:23 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:23 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:23 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:23 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:23 2010 : Info: [eap] EAP Identity Mon Sep 13 10:34:23 2010 : Info: [eap] processing type tls Mon Sep 13 10:34:23 2010 : Info: [tls] Initiate Mon Sep 13 10:34:23 2010 : Info: [tls] Start returned 1 Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 194 to 192.168.155.194 port 2050 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x08a4aa3d08a5b341b6a6388fbdc863a8 Mon Sep 13 10:34:23 2010 : Info: Finished request 6. Mon Sep 13 10:34:23 2010 : Debug: Going to the next request Mon Sep 13 10:34:23 2010 : Debug: Waking up in 3.3 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=195, length=189 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001401414e47454c4f4e495c63626f6c616e State = 0x08a4aa3d08a5b341b6a6388fbdc863a8 Message-Authenticator = 0xdf84203e0b11202af2cae40b8121d33f Mon Sep 13 10:34:23 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:23 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:23 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:23 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:23 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:23 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:23 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:23 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:23 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:23 2010 : Info: [eap] EAP packet type response id 1 length 20 Mon Sep 13 10:34:23 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:23 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:23 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:23 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:23 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:23 2010 : Info: [eap] EAP Identity Mon Sep 13 10:34:23 2010 : Info: [eap] processing type tls Mon Sep 13 10:34:23 2010 : Info: [tls] Initiate Mon Sep 13 10:34:23 2010 : Info: [tls] Start returned 1 Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 195 to 192.168.155.194 port 2050 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa14ba8cfa149b12d443c6d1514b556f1 Mon Sep 13 10:34:23 2010 : Info: Finished request 7. Mon Sep 13 10:34:23 2010 : Debug: Going to the next request Mon Sep 13 10:34:23 2010 : Debug: Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=196, length=175 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200060311 State = 0xa14ba8cfa149b12d443c6d1514b556f1 Message-Authenticator = 0x59b31ae92c6fc003dd396d83f1ae2595 Mon Sep 13 10:34:23 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:23 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:23 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:23 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:23 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:23 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:23 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:23 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:23 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:23 2010 : Info: [eap] EAP packet type response id 2 length 6 Mon Sep 13 10:34:23 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:23 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:23 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:23 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:23 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:23 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:23 2010 : Info: [eap] EAP NAK Mon Sep 13 10:34:23 2010 : Info: [eap] EAP-NAK asked for EAP-Type/leap Mon Sep 13 10:34:23 2010 : Info: [eap] processing type leap Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: Stage 2 Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: Issuing AP Challenge Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: Successfully initiated Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 196 to 192.168.155.194 port 2050 EAP-Message = 0x0103001f11010008ee1c3a6722d72f04414e47454c4f4e495c63626f6c616e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa14ba8cfa048b92d443c6d1514b556f1 Mon Sep 13 10:34:23 2010 : Info: Finished request 8. Mon Sep 13 10:34:23 2010 : Debug: Going to the next request Mon Sep 13 10:34:23 2010 : Debug: Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=197, length=216 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0203002f11010018e3ecbf5161bbb5bd4cac88fff440256581950b19d079df4c414e47454c4f4e495c63626f6c616e State = 0xa14ba8cfa048b92d443c6d1514b556f1 Message-Authenticator = 0xdff169f98e2fa8a9a0b0b17b022b9733 Mon Sep 13 10:34:23 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:23 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:23 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:23 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:23 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:23 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:23 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:23 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:23 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:23 2010 : Info: [eap] EAP packet type response id 3 length 47 Mon Sep 13 10:34:23 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:23 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:23 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:23 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:23 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:23 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:23 2010 : Info: [eap] EAP/leap Mon Sep 13 10:34:23 2010 : Info: [eap] processing type leap Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: No Cleartext-Password or NT-Password configured for this user Mon Sep 13 10:34:23 2010 : Info: [eap] Handler failed in EAP/leap Mon Sep 13 10:34:23 2010 : Info: [eap] Failed in EAP select Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns invalid Mon Sep 13 10:34:23 2010 : Info: Failed to authenticate the user. Mon Sep 13 10:34:23 2010 : Info: Using Post-Auth-Type Reject Mon Sep 13 10:34:23 2010 : Info: +- entering group REJECT {...} Mon Sep 13 10:34:23 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> MYDOMAINTEST\testuser01 Mon Sep 13 10:34:23 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Sep 13 10:34:23 2010 : Info: ++[attr_filter.access_reject] returns updated Mon Sep 13 10:34:23 2010 : Info: Delaying reject of request 9 for 1 seconds Mon Sep 13 10:34:23 2010 : Debug: Going to the next request Mon Sep 13 10:34:23 2010 : Debug: Waking up in 0.9 seconds. Mon Sep 13 10:34:24 2010 : Info: Sending delayed reject for request 9 Sending Access-Reject of id 197 to 192.168.155.194 port 2050 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000
Kleber Larroyd wrote: If you can't be bothered to explain *why* you're doing this, and *what* is going wrong, then we can't be bothered to read the reams of data you posted. It also helps to *read* the debug output. Really. Alan DeKok.
On 09/13/2010 10:35 AM, Kleber Larroyd wrote:
Have any idea ? Where can i find the solution ? When i trying connect (windows vista) freeradius server *with wireless over access point* i get this error:
In the future please follow the instructions to send the *complete* output of radiusd -X *only*. Also please read the debug output before asking for help, you answer is in the output.
Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: No Cleartext-Password or NT-Password configured for this user
No password means you didn't configure authorization in the inner-tunnel. You test only worked because it wasn't doing TLS and hence never entered the inner-tunnel virtual server. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
Hi,
peap {
default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no
personally, I'd advise that you set those to yes rather than no.
File /etc/raddb/users
DEFAULT Auth-Type = ntlm_auth
you dont need to do this. ever. we do PEAP and dont have such a line - in fact, the only time you need to est this is if you need to break the system in a wierd way
Files /etc/raddb/sites-enable/inner-tunnel and /etc/raddb/sites-enable/default
authenticate { .... ntlm_auth ... }
no no no. leave the inner-tunnel and default exactly as you found them - it will work out of the box. what guide were you following to get this working? I ask because if there is some document out there than it needs to be taken down.
[root@radiusserver etc]# ntlm_auth --request-nt-key --domain=MYDOMAINTEST --username=testuser01 --password=test NT_STATUS_OK: Success (0x0)
good, that bits fine
[root@radiusserver /]# radtest testuser01 test localhost 0 teste123 Sending Access-Request of id 51 to 127.0.0.1 port 1812 User-Name = "testuser01" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=51, length=20
and all thats done is a basic PAP test. you'd need to use more advanced tools such as eapol_test from the wpa_supplicant package for actually simulating a standard Windows client that is doing an EAP method - with an EAP test your packets would be proxied into the inner-tunnel virtual server... alan
participants (4)
-
Alan Buxey -
Alan DeKok -
John Dennis -
Kleber Larroyd