eap-tls authentication with free radius 1.1.6
anoop_c at sifycorp.com
anoop_c at sifycorp.com
Thu May 10 13:32:56 CEST 2007
Hi all
I am trying to do eap-tls authentication with 1.1.6.My xp client is saying attempting to authenticate.
So in the output i got when i tried to connect in debug mode is
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /etc/raddb/proxy.conf
Config: including file: /etc/raddb/clients.conf
Config: including file: /etc/raddb/snmp.conf
Config: including file: /etc/raddb/eap.conf
Config: including file: /etc/raddb/sql.conf
main: prefix = \\\"/usr/local\\\"
main: localstatedir = \\\"/usr/local/var\\\"
main: logdir = \\\"/usr/local/var/log/radius\\\"
main: libdir = \\\"/usr/local/lib\\\"
main: radacctdir = \\\"/usr/local/var/log/radius/radacct\\\"
main: hostname_lookups = no
main: snmp = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file = \\\"/usr/local/var/log/radius/radius.log\\\"
main: log_auth = no
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile = \\\"/usr/local/var/run/radiusd/radiusd.pid\\\"
main: user = \\\"(null)\\\"
main: group = \\\"(null)\\\"
main: usercollide = no
main: lower_user = \\\"no\\\"
main: lower_pass = \\\"no\\\"
main: nospace_user = \\\"no\\\"
main: nospace_pass = \\\"no\\\"
main: checkrad = \\\"/usr/local/sbin/checkrad\\\"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
proxy: post_proxy_authorize = no
proxy: wake_all_if_all_dead = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
Using deprecated naslist file. Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded exec
exec: wait = yes
exec: program = \\\"(null)\\\"
exec: input_pairs = \\\"request\\\"
exec: output_pairs = \\\"(null)\\\"
exec: packet_type = \\\"(null)\\\"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded System
unix: cache = no
unix: passwd = \\\"(null)\\\"
unix: shadow = \\\"(null)\\\"
unix: group = \\\"(null)\\\"
unix: radwtmp = \\\"/usr/local/var/log/radius/radwtmp\\\"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
eap: default_eap_type = \\\"tls\\\"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug = no
tls: rsa_key_exchange = no
tls: dh_key_exchange = yes
tls: rsa_key_length = 512
tls: dh_key_length = 512
tls: verify_depth = 0
tls: CA_path = \\\"(null)\\\"
tls: pem_file_type = yes
tls: private_key_file = \\\"/etc/1x/07xwifi.pem\\\"
tls: certificate_file = \\\"/etc/1x/07xwifi.pem\\\"
tls: CA_file = \\\"/etc/1x/root.pem\\\"
tls: private_key_password = \\\"password\\\"
tls: dh_file = \\\"/etc/1x/DH\\\"
tls: random_file = \\\"/etc/1x/random\\\"
tls: fragment_size = 1024
tls: include_length = yes
tls: check_crl = no
tls: check_cert_cn = \\\"(null)\\\"
tls: cipher_list = \\\"(null)\\\"
tls: check_cert_issuer = \\\"(null)\\\"
rlm_eap_tls: Loading the certificate file as a chain
rlm_eap: Loaded and initialized type tls
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = \\\"/etc/raddb/huntgroups\\\"
preprocess: hints = \\\"/etc/raddb/hints\\\"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
realm: format = \\\"suffix\\\"
realm: delimiter = \\\"@\\\"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = \\\"/etc/raddb/users\\\"
files: acctusersfile = \\\"/etc/raddb/acct_users\\\"
files: preproxy_usersfile = \\\"/etc/raddb/preproxy_users\\\"
files: compat = \\\"no\\\"
Module: Instantiated files (files)
Module: Loaded PAP
pap: encryption_scheme = \\\"crypt\\\"
pap: auto_header = yes
Module: Instantiated pap (pap)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = \\\"User-Name, Acct-Session-Id, NAS-IP-Address,
Client-IP-Addre ss, NAS-Port\\\"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile =
\\\"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/de
tail-%Y%m%d\\\"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = \\\"/usr/local/var/log/radius/radutmp\\\"
radutmp: username = \\\"%{User-Name}\\\"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.0.50:1026, id=0, length=197
Message-Authenticator = 0x58682b62b2334fb6e661df414bc30e61
Service-Type = Framed-User
User-Name = \\\"anoop07\\\"
Framed-MTU = 1488
Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\"
Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\"
NAS-Identifier = \\\"D-Link Access Point\\\"
NAS-Port-Type = Wireless-802.11
Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\"
EAP-Message = 0x0200000c01616e6f6f703037
NAS-IP-Address = 192.168.0.50
NAS-Port = 1
NAS-Port-Id = \\\"STA port # 1\\\"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module \\\"preprocess\\\" returns ok for request 0
rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm
NULL
rlm_realm: No such realm \\\"NULL\\\"
modcall[authorize]: module \\\"suffix\\\" returns noop for request 0
rlm_eap: EAP packet type response id 0 length 12
rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation
modcall[authorize]: module \\\"eap\\\" returns updated for request 0
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 172
modcall[authorize]: module \\\"files\\\" returns ok for request 0
rlm_pap: WARNING! No \\\"known good\\\" password found for the user.
Authentication m ay fail because of this.
modcall[authorize]: module \\\"pap\\\" returns noop for request 0
modcall: leaving group authorize (returns updated) for request 0
rad_check_password: Found Auth-Type EAP
auth: type \\\"EAP\\\"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: EAP Identity
rlm_eap: processing type tls
rlm_eap_tls: Requiring client certificate
rlm_eap_tls: Initiate
rlm_eap_tls: Start returned 1
modcall[authenticate]: module \\\"eap\\\" returns handled for request 0
modcall: leaving group authenticate (returns handled) for request 0
Sending Access-Challenge of id 0 to 192.168.0.50 port 1026
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x010100060d20
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xf149907fc590a6e39f01cbbd9619107b
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.0.50:1026, id=1, length=299
Message-Authenticator = 0x4fd5a9fe11d848f8f7a1324997be4a8e
Service-Type = Framed-User
User-Name = \\\"anoop07\\\"
Framed-MTU = 1488
State = 0xf149907fc590a6e39f01cbbd9619107b
Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\"
Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\"
NAS-Identifier = \\\"D-Link Access Point\\\"
NAS-Port-Type = Wireless-802.11
Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\"
EAP-Message = 0x020100600d800000005616030100510100004d03014642cb0590f008
20866efd284d568c69cde48b6530bced71bd7a674a2a46e36e103102d6b9e079cbcf0242e2192803
fe40001600040005000a000900640062000300060013001200630100
NAS-IP-Address = 192.168.0.50
NAS-Port = 1
NAS-Port-Id = \\\"STA port # 1\\\"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
modcall[authorize]: module \\\"preprocess\\\" returns ok for request 1
rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm
NULL
rlm_realm: No such realm \\\"NULL\\\"
modcall[authorize]: module \\\"suffix\\\" returns noop for request 1
rlm_eap: EAP packet type response id 1 length 96
rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation
modcall[authorize]: module \\\"eap\\\" returns updated for request 1
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 172
modcall[authorize]: module \\\"files\\\" returns ok for request 1
rlm_pap: WARNING! No \\\"known good\\\" password found for the user.
Authentication m ay fail because of this.
modcall[authorize]: module \\\"pap\\\" returns noop for request 1
modcall: leaving group authorize (returns updated) for request 1
rad_check_password: Found Auth-Type EAP
auth: type \\\"EAP\\\"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 1
rlm_eap: Request found, released from the list
rlm_eap: EAP/tls
rlm_eap: processing type tls
rlm_eap_tls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
(other): before/accept initialization
TLS_accept: before/accept initialization
rlm_eap_tls: <<< TLS 1.0 Handshake [length 0051], ClientHello
TLS_accept: SSLv3 read client hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello
TLS_accept: SSLv3 write server hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 04bf], Certificate
TLS_accept: SSLv3 write certificate A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 004c], CertificateRequest
TLS_accept: SSLv3 write certificate request A
TLS_accept: SSLv3 flush data
TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
eaptls_process returned 13
modcall[authenticate]: module \\\"eap\\\" returns handled for request 1
modcall: leaving group authenticate (returns handled) for request 1
Sending Access-Challenge of id 1 to 192.168.0.50 port 1026
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x0102040a0dc000000564160301004a0200004603014642cb066051eb
4f14285a58bcd1249829d97ad27f846524d57f7a25b0a3981720143a0cfecdd12ac8ec78c09d87f3
05ba498dcfe95c07b2b76e9b8510cfc644fd00040016030104bf0b0004bb0004b800022c30820228
30820191a003020102020101300d06092a864886f70d0101040500303b310b300906035504061302
494e310b300906035504081302544e310d300b060355040a1304536966793110300e060355040313
0730377877696669301e170d3037303131323135333533305a170d3038303131323135333533305a
3060310b300906035504061302494e310b3009060355040813
EAP-Message = 0x02544e310d300b060355040a1304536966793110300e060355040313
07303778776966693123302106092a864886f70d0109011614616e6f6f705f634073696679636f72
702e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d2bbbe35bc8a
47709632284aff484695385e69c3522f63da46834f9586a420bda380889693fa77fedd9ed4290e6f
9ff4436721775294fc65a38fea098f18975b34b5063de27220e18a07d433cbb6e19aeb3f84b012f7
c20071dd280457a932634bbe50f438cc2ee6f4d65fa395a10bdecc4bf9087979ec45af000940e186
ed290203010001a317301530130603551d25040c300a06082b
EAP-Message = 0x06010505070301300d06092a864886f70d0101040500038181000afe
a7f2a8a9cffe60baa8f779353c523457f8237faeff81ba5f2c22664c70b6b2fb58c8967ca4a4c847
b80e1d5a6cc4558ffa1d161614f374d8b5efd565aa66045b192b3ac3da82c81c4a99fc10cfe473f9
ac258ef99b16cbd335004677694a05addae48c6a9dcdb26b86ddb56c635266c33c7de75865435326
92e5220d30b100028630820282308201eba003020102020100300d06092a864886f70d0101040500
303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453
6966793110300e0603550403130730377877696669301e170d
EAP-Message = 0x3037303131323135333435305a170d3038303131323135333435305a
303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453
6966793110300e060355040313073037787769666930819f300d06092a864886f70d010101050003
818d0030818902818100ba8b07a479bb6ce9adf2d8bc6ac9cf214506dfc039cb10c3b4d27d1bbc08
2caff0bb77424819728977f04b32e231a3c4755a65823b366f1a604f15ce6c499883ab7d2757a5a2
c07a11e75b7a00d6c55a8fb7443b202a25a3cdaad39579b2d8f4c09c974056f0c8666fff754d5748
36fcaf105200fcd5df5158e2b387310c4ed90203010001a381
EAP-Message = 0x95308192301d0603551d0e041604149eda6f69065423
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x2fdcf333629491d0e1c1ee647458de64
Finished request 1
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.0.50:1026, id=2, length=209
Message-Authenticator = 0x4ad9312009d92ce8a0efb591a5179928
Service-Type = Framed-User
User-Name = \\\"anoop07\\\"
Framed-MTU = 1488
State = 0x2fdcf333629491d0e1c1ee647458de64
Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\"
Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\"
NAS-Identifier = \\\"D-Link Access Point\\\"
NAS-Port-Type = Wireless-802.11
Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\"
EAP-Message = 0x020200060d00
NAS-IP-Address = 192.168.0.50
NAS-Port = 1
NAS-Port-Id = \\\"STA port # 1\\\"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
modcall[authorize]: module \\\"preprocess\\\" returns ok for request 2
rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm
NULL
rlm_realm: No such realm \\\"NULL\\\"
modcall[authorize]: module \\\"suffix\\\" returns noop for request 2
rlm_eap: EAP packet type response id 2 length 6
rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation
modcall[authorize]: module \\\"eap\\\" returns updated for request 2
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 172
modcall[authorize]: module \\\"files\\\" returns ok for request 2
rlm_pap: WARNING! No \\\"known good\\\" password found for the user.
Authentication m ay fail because of this.
modcall[authorize]: module \\\"pap\\\" returns noop for request 2
modcall: leaving group authorize (returns updated) for request 2
rad_check_password: Found Auth-Type EAP
auth: type \\\"EAP\\\"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 2
rlm_eap: Request found, released from the list
rlm_eap: EAP/tls
rlm_eap: processing type tls
rlm_eap_tls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake fragment handler
eaptls_verify returned 1
eaptls_process returned 13
modcall[authenticate]: module \\\"eap\\\" returns handled for request 2
modcall: leaving group authenticate (returns handled) for request 2
Sending Access-Challenge of id 2 to 192.168.0.50 port 1026
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x0103016e0d80000005647ec1c9e4d07a608e0e6dcd730f3063060355
1d23045c305a80149eda6f690654237ec1c9e4d07a608e0e6dcd730fa13fa43d303b310b30090603
5504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e06
03550403130730377877696669820100300c0603551d13040530030101ff300d06092a864886f70d
0101040500038181006b514f008b6a77757fc73ddbe9d54e4ea925a1ab9ce80ad7895d6d19661d8b
8558d0e359876aac023aa52d4273e00407b9b588b30dbc35c5911bc89d2d99677e0ec8dea17fece3
5d0b4dfab8775ba73eaeb0a0998bcdf1437cff0a1031f6a5b1
EAP-Message = 0x7e8bcdc01e2e964cb256f49d947eea2cfd42989aef397fa438be294f
a3dc7a3d160301004c0d000044020102003f003d303b310b300906035504061302494e310b300906
035504081302544e310d300b060355040a1304536966793110300e06035504031307303778776966
690e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8312be86097e0bba014e67facd670e26
Finished request 2
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.0.50:1026, id=3, length=209
Message-Authenticator = 0xd1d028ef0c35ada1104dae076b233114
Service-Type = Framed-User
User-Name = \\\"anoop07\\\"
Framed-MTU = 1488
State = 0x8312be86097e0bba014e67facd670e26
Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\"
Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\"
NAS-Identifier = \\\"D-Link Access Point\\\"
NAS-Port-Type = Wireless-802.11
Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\"
EAP-Message = 0x020300060d00
NAS-IP-Address = 192.168.0.50
NAS-Port = 1
NAS-Port-Id = \\\"STA port # 1\\\"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
modcall[authorize]: module \\\"preprocess\\\" returns ok for request 3
rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm
NULL
rlm_realm: No such realm \\\"NULL\\\"
modcall[authorize]: module \\\"suffix\\\" returns noop for request 3
rlm_eap: EAP packet type response id 3 length 6
rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation
modcall[authorize]: module \\\"eap\\\" returns updated for request 3
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 172
modcall[authorize]: module \\\"files\\\" returns ok for request 3
rlm_pap: WARNING! No \\\"known good\\\" password found for the user.
Authentication m ay fail because of this.
modcall[authorize]: module \\\"pap\\\" returns noop for request 3
modcall: leaving group authorize (returns updated) for request 3
rad_check_password: Found Auth-Type EAP
auth: type \\\"EAP\\\"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 3
rlm_eap: Request found, released from the list
rlm_eap: EAP/tls
rlm_eap: processing type tls
rlm_eap_tls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake fragment handler
eaptls_verify returned 1
eaptls_process returned 13
modcall[authenticate]: module \\\"eap\\\" returns handled for request 3
modcall: leaving group authenticate (returns handled) for request 3
Sending Access-Challenge of id 3 to 192.168.0.50 port 1026
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x0104000a0d8000000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xc08d54ac02795c8e31c2f7865a609bd5
Finished request 3
Going to the next request
Waking up in 6 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 0 with timestamp 4642cb06
Cleaning up request 1 ID 1 with timestamp 4642cb06
Cleaning up request 2 ID 2 with timestamp 4642cb06
Cleaning up request 3 ID 3 with timestamp 4642cb06
Nothing to do. Sleeping until we see a request.
[root at anoop raddb]#
Regards
Anoop
essage: 3
Date: Thu, 10 May 2007 11:45:42 +0200
From: inverse <inverse at ngi.it>
Subject: Re: eap-tls authentication with free radius 1.1.5
To: \"FreeRadius users mailing list\"
<freeradius-users at lists.freeradius.org>
Message-ID:
<32deb3e30705100245t4c9ff9cay66d7c99ea0e34a44 at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
On 5/10/07, anoop_c at sifycorp.com <anoop_c at sifycorp.com> wrote:
anoop, please fix your quoting.
Configurations are not interchangeable between the snapshot tree,
1.1.5 and 1.1.6
More information about the Freeradius-Users
mailing list