suddenly problem with certificates / error in SSLv3 read client certificate B

Stephan Manske gmane-reply at stephan.manske-net.de
Tue Jan 22 20:50:26 CET 2013


Hello!

I have a huge problem with freeradius 2.2.0  on my eisfair server  
(www.eisfair.org) and users using certificates to authenticate.

first of all: this should not be a "how must I config my freeradius to  
work?" problem. These installation with these certificates and these  
config worked for over 8 month very well. And suddenly I got the problem.

Every client with user/pass works still fine.

The problem is about the users with certificates (windows xp and android).

the certificates are not outdated:

list of active certificates:
V 13-01-28 13:16:17 Z           01      unknown
   /C=DE/ST=Somewhere/O=Manske EIS/OU=Radius_Managment/CN=Manske  
Radius/emailAddress=xxx
(the server certificate)

V 14-02-17 13:16:54 Z           02      unknown
   /C=DE/ST=Somewhere/O=Manske EIS/OU=Radius_Managment/CN=User  
Name/emailAddress=xxx
(one of the problematic user certificates)


I tried it with check_crl = yes and no



changes before the problem occurs: I updated openssl-packages from

Internal Program Version: OpenSSL  1.0.0j
also included the old version 0.9.7m
also included the old version 0.9.8x

to

Internal Program Version: OpenSSL  1.0.1c

also included the old version 0.9.8x



But I did this over three days before the errors occured. In the meantime  
freeradius worked well.


So, here is a shorten output of radiusd -X (I hope I do not shorten  
important things - btw, are there parts of such an debug output I should  
keep secret?)


Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.x.x port 2049, id=2,  
length=141
         User-Name = "User Name"
         NAS-IP-Address = 192.168.x.x

# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "User Name", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 0 length 19
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry User Name at line 8
[files]         expand: Hello, %{User-Name} -> Hello, User Name
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.   
Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type md5
rlm_eap_md5: Issuing Challenge
++[eap] returns handled

[eap] Request found, released from the list
[eap] EAP NAK
[eap] EAP-NAK asked for EAP-Type/tls
[eap] processing type tls
[tls] Requiring client certificate
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 2 to 192.168.x.x port 2049
         Reply-Message = "Hello, User Name"
         EAP-Message = 0x010200060d20
         Message-Authenticator = 0x00000000000000000000000000xx
         State = 0x7d1f9f227c1d92c8e39xxxxxxxxx
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.x.x port 2049, id=2,  
length=227


[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry User Name at line 8
[files]         expand: Hello, %{User-Name} -> Hello, User Name
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
   TLS Length 77
[tls] Length Included
[tls] eaptls_verify returned 11
[tls]     (other): before/accept initialization
[tls]     TLS_accept: before/accept initialization
[tls] <<< TLS 1.0 Handshake [length 0048], ClientHello
[tls]     TLS_accept: SSLv3 read client hello A
[tls] >>> TLS 1.0 Handshake [length 0031], ServerHello
[tls]     TLS_accept: SSLv3 write server hello A
[tls] >>> TLS 1.0 Handshake [length 08bb], Certificate
[tls]     TLS_accept: SSLv3 write certificate A
[tls] >>> TLS 1.0 Handshake [length 00b8], CertificateRequest
[tls]     TLS_accept: SSLv3 write certificate request A
[tls]     TLS_accept: SSLv3 flush data
[tls]     TLS_accept: Need to read more data: SSLv3 read client  
certificate A
In SSL Handshake Phase
In SSL Accept mode
[tls] eaptls_process returned 13
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
   TLS Length 77
[tls] Length Included
[tls] eaptls_verify returned 11
[tls]     (other): before/accept initialization
[tls]     TLS_accept: before/accept initialization
[tls] <<< TLS 1.0 Handshake [length 0048], ClientHello
[tls]     TLS_accept: SSLv3 read client hello A
[tls] >>> TLS 1.0 Handshake [length 0031], ServerHello
[tls]     TLS_accept: SSLv3 write server hello A
[tls] >>> TLS 1.0 Handshake [length 08bb], Certificate
[tls]     TLS_accept: SSLv3 write certificate A
[tls] >>> TLS 1.0 Handshake [length 00b8], CertificateRequest
[tls]     TLS_accept: SSLv3 write certificate request A
[tls]     TLS_accept: SSLv3 flush data
[tls]     TLS_accept: Need to read more data: SSLv3 read client  
certificate A
In SSL Handshake Phase
In SSL Accept mode
[tls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 2 to 192.168.x.x port 2049
         Reply-Message = "Hello, User Name"
         EAP-Message =  
0x010304000dc0000009b316030100310200002d030150e4ae0ed21d8
         EAP-Message =  
0x3017060355040313104d616e736b6520526164697573204341301e1
         EAP-Message =  
0xce7ab5f8c7edc84656371d677436108b21313e1ea308f55566b8684
         EAP-Message =  
0x25040c300a06082b06010505070301300d06092a864886f70d01010
         EAP-Message = 0xb12f24c809d9d
         Message-Authenticator = 0x00000000000000000000000000000000
         State = 0x7d1f9f227f1c92c8e3xxxxxx
Finished request 2.
Going to the next request

[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated

Sending Access-Challenge of id 2 to 192.168.x.x port 2049
         Reply-Message = "Hello, User Name"
         EAP-Message = 0x010404000dc0000009b3301
         EAP-Message = 0x3130323136313231325a17:
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
[tls] Received TLS ACK
[tls] ACK handshake fragment handler
[tls] eaptls_verify returned 1
[tls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 2 to 192.168.x.x port 2049
         Reply-Message = "Hello, User Name"
         EAP-Message = 0x010404000dc0000009bxxxxxx
         EAP-Message = 0xfdf4cec951566e50d17
         EAP-Message = 0xca21c0f495c75a3a13d
         EAP-Message = 0x01ff300d06092a86488
         Message-Authenticator = 0x00000000000000000000000000000000
         State = 0x7d1f9f227e1b92c8e39
Finished request 3.
Going to the next request

and so on ...

but here it might be important:

# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
[tls] eaptls_verify returned 7
[tls] Done initial handshake
[tls] <<< TLS 1.0 Handshake [length 03de], Certificate
[tls] chain-depth=1,
[tls] error=0
[tls] --> User-Name = User Name
[tls] --> BUF-Name = Radius CA
[tls] --> subject = /C=DE/ST=Somewhere/L=Somewhere/O=Manske  
EIS/OU=Radius_Managment/emailAddress=radius at xxxx
[tls] --> issuer  = /C=DE/ST=Somewhere/L=Somewhere/O=Manske  
EIS/OU=Radius_Managment/emailAddress=radius at xxxx
[tls] --> verify return:1
--> verify error:num=7:certificate signature failure
[tls] >>> TLS 1.0 Alert [length 0002], fatal decrypt_error
TLS Alert write:fatal:decrypt error
     TLS_accept: error in SSLv3 read client certificate B
rlm_eap: SSL error error:04067084:rsa routines:RSA_EAY_PUBLIC_DECRYPT:data  
too large for modulus
SSL: SSL_read failed inside of TLS (-1), TLS session fails.
TLS receive handshake failed during operation
[tls] eaptls_process returned 4
[eap] Handler failed in EAP/tls
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Login incorrect (certificate signature failure): [User Name/<via Auth-Type  
= EAP>] (from client xxxx
Using Post-Auth-Type REJECT
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject]     expand: %{User-Name} -> User Name
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 6 for 2 seconds
Going to the next request
Waking up in 0.9 seconds.
Waking up in 0.9 seconds.
Sending delayed reject for request 6
Sending Access-Reject of id 2 to 192.168.x.x port 2049



TIIA,

Stephan



More information about the Freeradius-Users mailing list