bad radtest results with eap/peap mschap
Michel Villeneuve
Michel.Villeneuve at univ-brest.fr
Thu May 4 16:29:43 CEST 2017
Thanks Alan
Yes I did that
in the defaut server I put in the post-auth, a condition depending of my
realm like
if ( &reply:Realm != "mydomain.ex" ) {
update {
&reply:Tunnel-Private-Group-Id := 143
}
}
elsif ( ....
and It works, in the inner-tunnerl I put condition to specifiy a VLAN
according to LDAP-attribute ( only for internal users ) like :
if (&outer.session-state:LDAP-Desc == "employee") {
update outer.session-state {
&Tunnel-Private-Group-Id :=
142
}
}
elsif (......
and It works too.
If I try with eapol_test : eapol_test -c eapol_student -p1812
-smysecret -r1
with eapol_stutdent =
network={ eap=PEAP
eapol_flags=0
key_mgmt=IEEE8021X
identity="teststudent at univ-brest.fr"
password="a1z2e3r4*"
phase2="auth=MSCHAPV2"
}
It works
I joined the first debug (radius -X ) of this command and the results for
eapol_test is :........
EAPOL: SUPP_BE entering state IDLE
eapol_sm_cb: success=1
EAPOL: Successfully fetched key (len=32)
PMK from EAPOL - hexdump(len=32): a4 c1 e3 f6 68 80 9a 8e c5 65 69 44 dd 1a
70 10 b6 f6 69 53 53 17 b4 a2 14 8d f1 66 2d aa 72 fa
EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit
ENGINE: engine deinit
MPPE keys OK: 2 mismatch: 0
SUCCESS
But If I try
[root at freeradius-3-a test]# radtest -t mschap teststudent 'a1z2e3r4*'
127.0.0.1:18120 0 mysecret
Sent Access-Request Id 176 from 0.0.0.0:40417 to 127.0.0.1:18120 length 137
User-Name = "teststudent"
MS-CHAP-Password = "a1z2e3r4*"
NAS-IP-Address = 195.83.247.135
NAS-Port = 0
Message-Authenticator = 0x00
Cleartext-Password = "a1z2e3r4*"
MS-CHAP-Challenge = 0xb835226cb6ade5e0
MS-CHAP-Response =
0x00010000000000000000000000000000000000000000000000008062fbf5061e27dcc5038f6ad7105d9486d9df3efc9813c5
Received Access-Reject Id 176 from 127.0.0.1:18120 to 0.0.0.0:0 length 20
(0) -: Expected Access-Accept got Access-Reject
I joined the second debug file too. It's the same result for internal or
external users, it failed.
I would like to understand why I got this error with radtest even if it
works well with wifi device or eapol_test.
I noticed that when I configured steps by steps my radius, at the
beginning , I didn't affected a VLAN in the default and inner-tunnel. I
didn't configure the post_auth section and so I didn't use update
outer.session-state and update block.
At this time, my tests with a device, eapol_test and radtest with the same
command line worked, when I added the
option to update block in the inner-tunnel
update {
&outer.session-state: += &reply:
}
+
update outer.session-state {
MS-MPPE-Encryption-Policy......
my tests failed with the radtest command and still worked withe the device
and eapo_test.
So I have a doubt with my configuration any advice will be appreciate.
I would like to be sure of my configuration before using it in production
or can I used it like that.
Michel
Quoting Alan Buxey <alan.buxey at gmail.com>:
> PEAP etc use inner-tunnel, radtest is just a PAP or MSCHAP method,
> without any EAP so it doesnt use inner-tunnel....and therefore will
> use whatever auth methods you only have in the outer phase (in
> 'default' server with a default install) - you could try using eg
> eapol_test (part of wpa_supplicant) - or, use radtest against the
> direct
> inner-tunnel listener - read the inner-tunnel config..it has a listen
> on localhost 18121 or 18120 or such.... direct your radtest to that.
>
> note that this config wont work if you have real external users (ie
> users that you proxy off to a remote RADIUS server - eg in eduroam -
> for that you need to also look at setting VLANs in the post-auth outer
> phase (or dont assign a VLAN and hope your kit drops people correctly
> onto a predefined default vlan.
>
> alan
>
> On 28 April 2017 at 22:06, Michel Villeneuve
> <Michel.Villeneuve at univ-brest.fr> wrote:
>> Hi,
>>
>> I use freeradius-3.0.12 on centos 7.3 with an openldap 2.4 and a samba
>> attribute EAP / PEAP authentication MSCHAPV2.
>>
>> I want to authentificate and authorize users according to their
>> attribute on the LDAP.
>> I created an attribute LDAP-Desc mapped with the field
>> eduPersonPrimaryAffilation on my LDAP.
>> I want to put user on specific VLAN if they are students, employee ....
>> or
>> outer people.
>>
>> For that I use in the inner-tunnel the capabilities to return AVP like
>> Tunnel-Private-Group-Id with the good value .
>>
>> It's work very well, for internal and also for external people. I tested
>> also the realm
>> value in the default server and I put also the good
>> Tunnel-Private-Group-Id
>> depending
>> the value of realm. It's work with device like smartphone, pc ... and
>> also with the command.
>>
>> eapol_test -c afile -p1812 -smysecret -r1
>>
>> Everything seems good but not when I use radtest command
>>
>> I can't authentificate internal or external people with the test command
>> radtest
>>
>> [root at freeradius-3-a test]# radtest 'teststudent' 'a1z2e3r4*'
localhost
>> 1812 mysecret
>>
>> Sent Access-Request Id 154 from 0.0.0.0:54585 to 127.0.0.1:1812 length
81
>> User-Name = "teststudent"
>> User-Password = "a1z2e3r4*"
>> NAS-IP-Address = 195.83.247.135
>> NAS-Port = 1812
>> Message-Authenticator = 0x00
>> Cleartext-Password = "a1z2e3r4*"
>> Received Access-Reject Id 154 from 127.0.0.1:1812 to 0.0.0.0:0 length 20
>> (0) -: Expected Access-Accept got Access-Reject
>>
>> nor
>>
>> radtest -t mschap 'teststudent' 'a1z2e3r4*' 127.0.0.1:18120 1 mysecret
>>
>> I got
>> ot at freeradius-3-a test]# radtest -t mschap 'teststudent' 'secret'
>> 127.0.0.1:18120 1 mysecret
>> Sent Access-Request Id 129 from 0.0.0.0:34088 to 127.0.0.1:18120 length
>> 137
>> User-Name = "teststudent"
>> MS-CHAP-Password = "a1z2e3r4*"
>> NAS-IP-Address = 195.83.247.135
>> NAS-Port = 1
>> Message-Authenticator = 0x00
>> Cleartext-Password = "secret"
>> MS-CHAP-Challenge = 0x3a7dd0c59a922170
>> MS-CHAP-Response =
>>
0x0001000000000000000000000000000000000000000000000000ae872e407e206d5579b1515fbf4e92f594e5c5e66739c6e7
>> Received Access-Reject Id 129 from 127.0.0.1:18120 to 0.0.0.0:0 length
20
>> (0) -: Expected Access-Accept got Access-Reject
>>
>> Perhaps the problem comes from /etc/raddb/mods-enabled/mschap files
>> and I tried differents values with no good results.
>>
>> mschap {
>> with_ntdomain_hack = no
>> #authtype = MS-CHAP
>> allow_retry = yes
>> use_mppe=yes
>> require_encryption = yes
>> require_strong = yes
>> .....
>> I am not sure about the good values needing for this section.
>> I would like to have an advice before using this configuration in
>> production environment.
>>
>> here a debug with a Successful results
>>
>> Thanks in advance for you help
>>
>> PS:
>> sorry for my english I hope it's comprehensible.
>> --
>> Michel Villeneuve
>> Tel 02 98 01 71 61
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>
> -List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
--
Michel Villeneuve
Tel 02 98 01 71 61
More information about the Freeradius-Users
mailing list