PEAP mschapv2 Proxy not working.

Dmitry Sergienko trooper+freeradius+users at email.dp.ua
Wed Feb 6 14:16:45 CET 2008


Hi!

If you still have no luck with 1.1.7 proxying mschapv2, try to move to 2.0.1 with patches in event.c discussed yesterday 
in freeradius-users. I'm trying to do the same authentication - extract MS-CHAPv2 from PEAP and authorize inner request 
against external RADIUS server. With 2.0.1 and a patch at least eapol_test passes authorization.

Andrew Olson wrote:
> Hello,
> 
> I'm having trouble getting freeradius-1.1.7 to proxy PEAP-mshcapv2 to 
> another RADIUS server.  My other server doesn't do EAP, so I'm just 
> sending mschapv2 achieved with proxy_tunneled_request_as_eap = no in 
> eap.conf.
> 
> When I proxy to my other server, I get back an Access-Accept packet.  
> Then, freeradius sends an Access Challenge to the client, receives a 
> response and then things appear to break.
> 
> I am able to successfully authenticate users with PEAP by defining them 
> locally in the users file.  Additionally, I have gotten TTLS to work by 
> proxying to another server, it's just PEAP that I'm having problems with.
> 
> The differing line in the debug seems to be:
> <proxied>
>   eaptls_process returned 7
>   rlm_eap_peap: EAPTLS_OK
>   rlm_eap_peap: Session established.  Decoding tunneled attributes.
>   rlm_eap_peap: EAP type mschapv2
> 
> -vs-
> 
> <non-proxied>
> 
>   eaptls_process returned 7
>   rlm_eap_peap: EAPTLS_OK
>   rlm_eap_peap: Session established.  Decoding tunneled attributes.
>   rlm_eap_peap: Received EAP-TLV response.
> 
> 
> I'm running a pretty standard config, I think.  I can send copies of it, 
> if that would help.
> 
> Thanks,
> Andrew Olson
> 
> 
> The complete proxied debug starting with the Access-Request is as follows:
> 
> Sending Access-Request of id 0 to 198.82.247.36 port 1812
>         User-Name = "anolson"
>         NAS-IP-Address := 198.82.245.57
>         MS-CHAP-Challenge = 0x85feba9cbed9e9191bf72a29f0f82312
>         MS-CHAP2-Response = 
> 0x0700b776d1433b4d6dab43d5bde9163e8b450000000000000000ee7fcb070f3766e7e7b0f198b72754b44a9ef0255d712db1 
> 
>         Proxy-State = 0x3136
>         Service-Type := Framed-User
> Waking up in 6 seconds...
> rad_recv: Access-Accept packet from host 198.82.247.36:1812, id=0, 
> length=189
>         Filter-Id = "CNS_NET1"
>         MS-CHAP2-Success = 
> 0x07533d43433041424443323542333046453444414131394238363737413941334136454631364134454634 
> 
>         MS-MPPE-Send-Key = 0x7b5fcacde0c3798261894df701a5cdd5
>         MS-MPPE-Recv-Key = 0x3900c03d5b5851da66e8fb27d90077f9
>         MS-MPPE-Encryption-Policy = 0x00000001
>         MS-MPPE-Encryption-Types = 0x0000000e
>   Processing the post-proxy section of radiusd.conf
> modcall: entering group post-proxy for request 6
>   PEAP: Passing reply from proxy back into the tunnel.
>   PEAP: Passing reply back for EAP-MS-CHAP-V2 0x8170500 2
>   Processing the post-proxy section of radiusd.conf
> modcall: entering group post-proxy for request 6
>   rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 
> 0x8170500 2.
>   rlm_eap_mschapv2: Authentication succeeded.
> MSCHAP Success
>   modcall[post-proxy]: module "eap" returns ok for request 6
> modcall: leaving group post-proxy (returns ok) for request 6
>   POST-PROXY 2
>   POST-AUTH 2
>  PEAP: Got reply 11
>   PEAP: Got tunneled Access-Challenge
>   PEAP: Reply was handled
>   modcall[post-proxy]: module "eap" returns ok for request 6
> modcall: leaving group post-proxy (returns ok) for request 6
> Sending Access-Challenge of id 16 to 128.173.10.131 port 56945
>         EAP-Message = 
> 0x0107005b190017030100502c303c60e1337bcb4c17a281f71910d23777fd5f4a4d5aefab92a23ff28a993aa17ebc2d6bd7567b9386fec7c4e6f2f7ae4c4655a8492000e0e473fc7e8be63a1bf372449cba9f795dc6535b04648cdb 
> 
>         Message-Authenticator = 0x00000000000000000000000000000000
>         State = 0x23a96486ec5dbd008e1eddcee31dfa93
> Finished request 6
> Going to the next request
> Waking up in 6 seconds...
> rad_recv: Access-Request packet from host 128.173.10.131:56945, id=17, 
> length=151
>         User-Name = "anolson"
>         State = 0x23a96486ec5dbd008e1eddcee31dfa93
>         EAP-Message = 
> 0x0207005419800000004e170301002050f4490743b89308d9bb84f411a1629e7b6f06dd6c02c2525747560f657f63d117030100209d0c853d82e17d05938ab49201447c135a90d068d1641a23db5fc04cfcc0dd08 
> 
>         Message-Authenticator = 0x3c828120c544cde1b5d4366b7e735350
>   Processing the authorize section of radiusd.conf
> modcall: entering group authorize for request 7
>   modcall[authorize]: module "preprocess" returns ok for request 7
>   modcall[authorize]: module "chap" returns noop for request 7
>   modcall[authorize]: module "mschap" returns noop for request 7
>     rlm_realm: No '@' in User-Name = "anolson", looking up realm NULL
>     rlm_realm: No such realm "NULL"
>   modcall[authorize]: module "suffix" returns noop for request 7
>   rlm_eap: EAP packet type response id 7 length 84
>   rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
>   modcall[authorize]: module "eap" returns updated for request 7
>   modcall[authorize]: module "files" returns notfound for request 7
> modcall: leaving group authorize (returns updated) for request 7
>   rad_check_password:  Found Auth-Type EAP
> auth: type "EAP"
>   Processing the authenticate section of radiusd.conf
> modcall: entering group authenticate for request 7
>   rlm_eap: Request found, released from the list
>   rlm_eap: EAP/peap
>   rlm_eap: processing type peap
>   rlm_eap_peap: Authenticate
>   rlm_eap_tls: processing TLS
> rlm_eap_tls:  Length Included
>   eaptls_verify returned 11
>   eaptls_process returned 7
>   rlm_eap_peap: EAPTLS_OK
>   rlm_eap_peap: Session established.  Decoding tunneled attributes.
>   rlm_eap_peap: EAP type mschapv2
>   rlm_eap_peap: Tunneled data is valid.
>   PEAP: Setting User-Name to anolson
>   PEAP: Adding old state with dc 84
>   Processing the authorize section of radiusd.conf
> modcall: entering group authorize for request 7
>   modcall[authorize]: module "preprocess" returns ok for request 7
>   modcall[authorize]: module "chap" returns noop for request 7
>   modcall[authorize]: module "mschap" returns noop for request 7
>     rlm_realm: No '@' in User-Name = "anolson", looking up realm NULL
>     rlm_realm: No such realm "NULL"
>   modcall[authorize]: module "suffix" returns noop for request 7
>   rlm_eap: EAP packet type response id 7 length 9
>   rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
>   modcall[authorize]: module "eap" returns updated for request 7
>     users: Matched entry DEFAULT at line 57
>   modcall[authorize]: module "files" returns ok for request 7
> modcall: leaving group authorize (returns updated) for request 7
>   PEAP: Calling authenticate in order to initiate tunneled EAP session.
>   Processing the authenticate section of radiusd.conf
> modcall: entering group authenticate for request 7
>   rlm_eap: Request not found in the list
> rlm_eap: Either EAP-request timed out OR EAP-response to an unknown 
> EAP-request
>   rlm_eap: Failed in handler
>   modcall[authenticate]: module "eap" returns invalid for request 7
> modcall: leaving group authenticate (returns invalid) for request 7
>   PEAP: Can't handle the return code 4
>  rlm_eap: Handler failed in EAP/peap
>   rlm_eap: Failed in EAP select
>   modcall[authenticate]: module "eap" returns invalid for request 7
> modcall: leaving group authenticate (returns invalid) for request 7
> auth: Failed to validate the user.
> Delaying request 7 for 1 seconds
> Finished request 7
> Going to the next request
> Waking up in 6 seconds...
> --- Walking the entire request list ---
> Cleaning up request 0 ID 10 with timestamp 47a8d136
> Cleaning up request 1 ID 11 with timestamp 47a8d136
> Cleaning up request 2 ID 12 with timestamp 47a8d136
> Cleaning up request 3 ID 13 with timestamp 47a8d136
> Cleaning up request 4 ID 14 with timestamp 47a8d136
> Cleaning up request 5 ID 15 with timestamp 47a8d136
> Cleaning up request 6 ID 16 with timestamp 47a8d136
> Sending Access-Reject of id 17 to 128.173.10.131 port 56945
>         EAP-Message = 0x04070004
>         Message-Authenticator = 0x00000000000000000000000000000000
> Cleaning up request 7 ID 17 with timestamp 47a8d136
> Nothing to do.  Sleeping until we see a request.
> 
> 
> 
> The complete non-proxied debug starting with the final Access-Challenge 
> is as follows:
> 
> Sending Access-Challenge of id 18 to 128.173.10.131 port 56939
>         EAP-Message = 
> 0x0108002b190017030100206ae9bd54b7c0124979401818f662bec45aea2853b277e8dda897e8a645571887 
> 
>         Message-Authenticator = 0x00000000000000000000000000000000
>         State = 0x00e512dd6dbcc968bffd9f8b8dc13bc4
> Finished request 40
> Going to the next request
> Waking up in 6 seconds...
> rad_recv: Access-Request packet from host 128.173.10.131:56939, id=19, 
> length=166
>         User-Name = "andrew"
>         State = 0x00e512dd6dbcc968bffd9f8b8dc13bc4
>         EAP-Message = 
> 0x0208006419800000005e1703010020a0257f0df72e93adb495d9ab98f8e65ee4b526e563dd80bcdd464a3735f1d83417030100304c5de1fa016827d3181b8a26a7a31091f8f4474167c5424e0b51913e0ede50c14e04ec233670bd9888b1ea89ed510131 
> 
>         Message-Authenticator = 0xf3079323771a635bac1bdaa00b2e850f
>   Processing the authorize section of radiusd.conf
> modcall: entering group authorize for request 41
>   modcall[authorize]: module "preprocess" returns ok for request 41
>   modcall[authorize]: module "chap" returns noop for request 41
>   modcall[authorize]: module "mschap" returns noop for request 41
>     rlm_realm: No '@' in User-Name = "andrew", looking up realm NULL
>     rlm_realm: No such realm "NULL"
>   modcall[authorize]: module "suffix" returns noop for request 41
>   rlm_eap: EAP packet type response id 8 length 100
>   rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
>   modcall[authorize]: module "eap" returns updated for request 41
>     users: Matched entry andrew at line 53
>   modcall[authorize]: module "files" returns ok for request 41
> modcall: leaving group authorize (returns updated) for request 41
>   rad_check_password:  Found Auth-Type EAP
> auth: type "EAP"
>   Processing the authenticate section of radiusd.conf
> modcall: entering group authenticate for request 41
>   rlm_eap: Request found, released from the list
>   rlm_eap: EAP/peap
>   rlm_eap: processing type peap
>   rlm_eap_peap: Authenticate
>   rlm_eap_tls: processing TLS
> rlm_eap_tls:  Length Included
>   eaptls_verify returned 11
>   eaptls_process returned 7
>   rlm_eap_peap: EAPTLS_OK
>   rlm_eap_peap: Session established.  Decoding tunneled attributes.
>   rlm_eap_peap: Received EAP-TLV response.
>   rlm_eap_peap: Tunneled data is valid.
>   rlm_eap_peap: Success
>   rlm_eap: Freeing handler
>   modcall[authenticate]: module "eap" returns ok for request 41
> modcall: leaving group authenticate (returns ok) for request 41
> Sending Access-Accept of id 19 to 128.173.10.131 port 56939
>         MS-MPPE-Recv-Key = 
> 0x1aa22f77848e2c89b4a6681bd67b45483d25b05232dd9e37748bba578fff2700
>         MS-MPPE-Send-Key = 
> 0x62d67197e6bfbce385f1b6e2ccd03c183281bca70e810a79cd85e7d2a38d654d
>         EAP-Message = 0x03080004
>         Message-Authenticator = 0x00000000000000000000000000000000
>         User-Name = "andrew"
> Finished request 41
> Going to the next request
> Waking up in 6 seconds...
> 
> -
> List info/subscribe/unsubscribe? See 
> http://www.freeradius.org/list/users.html

-- 
Best wishes,
Dmitry Sergienko (SDA104-RIPE)
Trifle Co., Ltd.




More information about the Freeradius-Users mailing list