[prev in list] [next in list] [prev in thread] [next in thread]
List: freeradius-users
Subject: freeradius against AD authentication not working
From: "Karthik R" <kartthikr () gmail ! com>
Date: 2006-10-31 23:32:24
Message-ID: 1ecd0e750610311532n1a80ee2eq868b540f37a7f97d () mail ! gmail ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
Running Freeradius v1.1.1 on a RHEL 4 box and trying to authenticate the
WiFi users against windows 2003 active directory using EAP-MSCHAPv2. I was
able to join the linux box to windows domain successfully and able to read
the users and groups from AD. I have configured the windows XP supplicant
with root.der certificate and EAP-MSCHAPv2. When i try to connect to access
point, it takes the local machine name default instead of asking for
username and password.
Does i missed anything ? Here is my radius log file.
bash3.0#radiusd -X -A
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /usr/local/etc/raddb/proxy.conf
Config: including file: /usr/local/etc/raddb/clients.conf
Config: including file: /usr/local/etc/raddb/snmp.conf
Config: including file: /usr/local/etc/raddb/eap.conf
Config: including file: /usr/local/etc/raddb/sql.conf
main: prefix = "/usr/local"
main: localstatedir = "/usr/local/var"
main: logdir = "/usr/local/var/log/radius"
main: libdir = "/usr/local/lib"
main: radacctdir = "/usr/local/var/log/radius/radacct"
main: hostname_lookups = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file = "/usr/local/var/log/radius/radius.log"
main: log_auth = no
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid"
main: user = "(null)"
main: group = "(null)"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: checkrad = "/usr/local/sbin/checkrad"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
proxy: post_proxy_authorize = no
proxy: wake_all_if_all_dead = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
Using deprecated naslist file. Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded exec
exec: wait = yes
exec: program = "(null)"
exec: input_pairs = "request"
exec: output_pairs = "(null)"
exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = yes
mschap: require_strong = yes
mschap: with_ntdomain_hack = yes
mschap: passwd = "(null)"
mschap: authtype = "MS-CHAP"
mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{mschap:User-Name} --domain=%{mschap:NT-Domain}
--challenge=%{mschap:Challenge} --nt-re
sponse=%{mschap:NT-Response}"
Module: Instantiated mschap (mschap)
Module: Loaded PAP
pap: encryption_scheme = "crypt"
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded System
unix: cache = no
unix: passwd = "(null)"
unix: shadow = "(null)"
unix: group = "(null)"
unix: radwtmp = "/usr/local/var/log/radius/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
eap: default_eap_type = "peap"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
gtc: challenge = "Password: "
gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
tls: rsa_key_exchange = no
tls: dh_key_exchange = yes
tls: rsa_key_length = 512
tls: dh_key_length = 512
tls: verify_depth = 0
tls: CA_path = "(null)"
tls: pem_file_type = yes
tls: private_key_file = "/usr/local/etc/raddb/secert/cert-srv.pem"
tls: certificate_file = "/usr/local/etc/raddb/secert/cert-srv.pem"
tls: CA_file = "/usr/local/etc/raddb/secert/root.pem"
tls: private_key_password = "<removed>"
tls: dh_file = "/usr/local/etc/raddb/secert/dh"
tls: random_file = "/usr/local/etc/raddb/secert/random"
tls: fragment_size = 1024
tls: include_length = yes
tls: check_crl = no
tls: check_cert_cn = "(null)"
rlm_eap_tls: Loading the certificate file as a chain
rlm_eap: Loaded and initialized type tls
peap: default_eap_type = "mschapv2"
peap: copy_request_to_tunnel = no
peap: use_tunneled_reply = no
peap: proxy_tunneled_request_as_eap = yes
rlm_eap: Loaded and initialized type peap
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"
preprocess: hints = "/usr/local/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = "/usr/local/etc/raddb/users"
files: acctusersfile = "/usr/local/etc/raddb/acct_users"
files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address,
Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile =
"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/usr/local/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 10.20.3.246:3072, id=0, length=152
User-Name = "host/your-a9279112e3"
NAS-IP-Address = 10.20.3.246
Called-Station-Id = "00183910020e"
Calling-Station-Id = "00166f6c282f"
NAS-Identifier = "00183910020e"
NAS-Port = 43
Framed-MTU = 1400
State = 0x8df956d66a233b914490c5a4e103fd9e
NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020400061900
Message-Authenticator = 0xe7b8b93d9d67cf0e45588430640cb980
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 5
modcall[authorize]: module "preprocess" returns ok for request 5
rlm_realm: No '@' in User-Name = "host/your-a9279112e3", looking up
realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 5
rlm_eap: EAP packet type response id 4 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 5
modcall[authorize]: module "files" returns notfound for request 5
modcall: leaving group authorize (returns updated) for request 5
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 5
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake fragment handler
eaptls_verify returned 1
eaptls_process returned 13
rlm_eap_peap: EAPTLS_HANDLED
modcall[authenticate]: module "eap" returns handled for request 5
modcall: leaving group authenticate (returns handled) for request 5
Sending Access-Challenge of id 0 to 10.20.3.246 port 3072
EAP-Message = 0x010500061900
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x6ea42dd7cde1d2a43ddc2b06a110d694
Finished request 5
Going to the next request
Waking up in 6 seconds...
Kartthik
[Attachment #5 (text/html)]
<div>Running Freeradius v1.1.1 on a RHEL 4 box and trying to authenticate the WiFi \
users against windows 2003 active directory using EAP-MSCHAPv2. I was able to \
join the linux box to windows domain successfully and able to read the users and \
groups from AD. I have configured the windows XP supplicant with root.der \
certificate and EAP-MSCHAPv2. When i try to connect to access point, it takes the \
local machine name default instead of asking for username and password.</div> \
<div> </div> <div>Does i missed anything ? Here is my radius log file.</div>
<div> </div>
<div>bash3.0#radiusd -X -A</div>
<div>Starting - reading configuration files ...<br>reread_config: reading \
radiusd.conf<br>Config: including file: \
/usr/local/etc/raddb/proxy.conf<br>Config: including file: \
/usr/local/etc/raddb/clients.conf<br>Config: including file: \
/usr/local/etc/raddb/snmp.conf <br>Config: including file: \
/usr/local/etc/raddb/eap.conf<br>Config: including file: \
/usr/local/etc/raddb/sql.conf<br> main: prefix = \
"/usr/local"<br> main: localstatedir = \
"/usr/local/var"<br> main: logdir = \
"/usr/local/var/log/radius" <br> main: libdir = \
"/usr/local/lib"<br> main: radacctdir = \
"/usr/local/var/log/radius/radacct"<br> main: hostname_lookups = \
no<br> main: max_request_time = 30<br> main: cleanup_delay = \
5<br> main: max_requests = 1024 <br> main: delete_blocked_requests = \
0<br> main: port = 0<br> main: allow_core_dumps = no<br> main: \
log_stripped_names = no<br> main: log_file = \
"/usr/local/var/log/radius/radius.log"<br> main: log_auth = no<br> \
main: log_auth_badpass = no<br> main: log_auth_goodpass = \
no<br> main: pidfile = \
"/usr/local/var/run/radiusd/radiusd.pid"<br> main: user = \
"(null)"<br> main: group = "(null)"<br> main: \
usercollide = no <br> main: lower_user = "no"<br> main: \
lower_pass = "no"<br> main: nospace_user = \
"no"<br> main: nospace_pass = "no"<br> main: checkrad = \
"/usr/local/sbin/checkrad"<br> main: proxy_requests = yes \
<br> proxy: retry_delay = 5<br> proxy: retry_count = 3<br> proxy: \
synchronous = no<br> proxy: default_fallback = yes<br> proxy: dead_time = \
120<br>proxy: post_proxy_authorize = no<br> proxy: wake_all_if_all_dead = \
no<br> security: max_attributes = 200 <br> security: reject_delay = \
1<br> security: status_server = no<br> main: debug_level = \
0<br>read_config_files: reading dictionary<br>read_config_files: reading \
naslist<br>Using deprecated naslist file. Support for this will go away soon. \
<br>read_config_files: reading clients<br>read_config_files: reading \
realms<br>radiusd: entering modules setup<br>Module: Library search path is \
/usr/local/lib<br>Module: Loaded exec<br> exec: wait = yes<br> exec: \
program = "(null)" <br> exec: input_pairs = \
"request"<br> exec: output_pairs = "(null)"<br> exec: \
packet_type = "(null)"<br>rlm_exec: Wait=yes but no output defined. Did you \
mean output=none?<br>Module: Instantiated exec (exec) <br>Module: Loaded \
expr<br>Module: Instantiated expr (expr)<br>Module: Loaded MS-CHAP<br> mschap: \
use_mppe = yes<br> mschap: require_encryption = yes<br> mschap: \
require_strong = yes<br> mschap: with_ntdomain_hack = yes<br> mschap: \
passwd = "(null)"<br> mschap: authtype = \
"MS-CHAP"<br> mschap: ntlm_auth = "/usr/bin/ntlm_auth \
--request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} \
--challenge=%{mschap:Challenge} --nt-re \
<br>sponse=%{mschap:NT-Response}"<br>Module: Instantiated mschap \
(mschap)<br>Module: Loaded PAP<br> pap: encryption_scheme = \
"crypt"<br>Module: Instantiated pap (pap)<br>Module: Loaded CHAP<br>Module: \
Instantiated chap (chap) <br>Module: Loaded System<br> unix: cache = \
no<br> unix: passwd = "(null)"<br> unix: shadow = \
"(null)"<br> unix: group = "(null)"<br> unix: radwtmp = \
"/usr/local/var/log/radius/radwtmp" <br> unix: usegroup = \
no<br> unix: cache_reload = 600<br>Module: Instantiated unix (unix)<br>Module: \
Loaded eap<br> eap: default_eap_type = "peap"<br> eap: \
timer_expire = 60<br> eap: ignore_unknown_eap_types = no <br> eap: \
cisco_accounting_username_bug = no<br>rlm_eap: Loaded and initialized type \
md5<br>rlm_eap: Loaded and initialized type leap<br> gtc: challenge = \
"Password: "<br> gtc: auth_type = "PAP"<br>rlm_eap: Loaded \
and initialized type gtc <br> tls: rsa_key_exchange = no<br> tls: \
dh_key_exchange = yes<br> tls: rsa_key_length = 512<br> tls: dh_key_length \
= 512<br> tls: verify_depth = 0<br> tls: CA_path = \
"(null)"<br> tls: pem_file_type = yes<br> tls: private_key_file = \
"/usr/local/etc/raddb/secert/cert- srv.pem"<br> tls: certificate_file \
= "/usr/local/etc/raddb/secert/cert-srv.pem"<br> tls: CA_file = \
"/usr/local/etc/raddb/secert/root.pem"<br> tls: private_key_password = \
"<removed>" <br> tls: dh_file = \
"/usr/local/etc/raddb/secert/dh"<br> tls: random_file = \
"/usr/local/etc/raddb/secert/random"<br> tls: fragment_size = \
1024<br> tls: include_length = yes<br> tls: check_crl = no<br> tls: \
check_cert_cn = "(null)" <br>rlm_eap_tls: Loading the certificate file as a \
chain<br>rlm_eap: Loaded and initialized type tls<br> peap: default_eap_type = \
"mschapv2"<br> peap: copy_request_to_tunnel = no<br>peap: \
use_tunneled_reply = no <br> peap: proxy_tunneled_request_as_eap = \
yes<br>rlm_eap: Loaded and initialized type peap<br> mschapv2: \
with_ntdomain_hack = no<br>rlm_eap: Loaded and initialized type mschapv2<br>Module: \
Instantiated eap (eap)<br>Module: Loaded preprocess <br> preprocess: huntgroups \
= "/usr/local/etc/raddb/huntgroups"<br> preprocess: hints = \
"/usr/local/etc/raddb/hints"<br> preprocess: with_ascend_hack = \
no<br> preprocess: ascend_channels_per_line = 23<br> preprocess: \
with_ntdomain_hack = no<br> preprocess: with_specialix_jetstream_hack = \
no<br> preprocess: with_cisco_vsa_hack = no<br>Module: Instantiated preprocess \
(preprocess)<br>Module: Loaded realm<br> realm: format = "suffix" \
<br> realm: delimiter = "@"<br> realm: ignore_default = \
no<br> realm: ignore_null = no<br>Module: Instantiated realm (suffix)<br>Module: \
Loaded files<br> files: usersfile = "/usr/local/etc/raddb/users" \
<br> files: acctusersfile = \
"/usr/local/etc/raddb/acct_users"<br> files: preproxy_usersfile = \
"/usr/local/etc/raddb/preproxy_users"<br> files: compat = \
"no"<br>Module: Instantiated files (files) <br>Module: Loaded \
Acct-Unique-Session-Id<br> acct_unique: key = "User-Name, Acct-Session-Id, \
NAS-IP-Address, Client-IP-Address, NAS-Port"<br>Module: Instantiated acct_unique \
(acct_unique)<br>Module: Loaded detail <br> detail: detailfile = \
"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"<br> detail: \
detailperm = 384<br> detail: dirperm = 493<br> detail: locking = \
no<br>Module: Instantiated detail (detail) <br>Module: Loaded \
radutmp<br> radutmp: filename = \
"/usr/local/var/log/radius/radutmp"<br> radutmp: username = \
"%{User-Name}"<br>radutmp: case_sensitive = yes<br> radutmp: \
check_with_nas = yes<br> radutmp: perm = 384 <br> radutmp: callerid = \
yes<br>Module: Instantiated radutmp (radutmp)<br>Listening on authentication \
*:1812<br>Listening on accounting *:1813<br>Ready to process requests.<br>rad_recv: \
Access-Request packet from host <a href="http://10.20.3.246:3072"> \
10.20.3.246:3072</a>, id=0, length=152<br> \
User-Name = "host/your-a9279112e3"<br> \
NAS-IP-Address = <a href="http://10.20.3.246">10.20.3.246</a><br> \
Called-Station-Id = "00183910020e" \
<br> Calling-Station-Id = \
"00166f6c282f"<br> NAS-Identifier \
= "00183910020e"<br> NAS-Port = \
43<br> Framed-MTU = \
1400<br> State = \
0x8df956d66a233b914490c5a4e103fd9e<br> \
NAS-Port-Type = Wireless-802.11<br> \
EAP-Message = 0x020400061900<br> \
Message-Authenticator = 0xe7b8b93d9d67cf0e45588430640cb980<br> Processing the \
authorize section of radiusd.conf<br>modcall: entering group authorize for request 5 \
<br> modcall[authorize]: module "preprocess" returns ok for request \
5<br> rlm_realm: No <a href="mailto:'@'">'@'</a> in User-Name = \
"host/your-a9279112e3", looking up realm NULL<br> \
rlm_realm: No such realm "NULL" <br> modcall[authorize]: module \
"suffix" returns noop for request 5<br> rlm_eap: EAP packet type \
response id 4 length 6<br> rlm_eap: No EAP Start, assuming it's an on-going EAP \
conversation<br> modcall[authorize]: module "eap" returns updated for \
request 5 <br> modcall[authorize]: module "files" returns notfound \
for request 5<br>modcall: leaving group authorize (returns updated) for request \
5<br> rad_check_password: Found Auth-Type EAP<br>auth: type \
"EAP" <br> Processing the authenticate section of \
radiusd.conf<br>modcall: entering group authenticate for request 5<br> rlm_eap: \
Request found, released from the list<br> rlm_eap: EAP/peap<br> rlm_eap: \
processing type peap <br> rlm_eap_peap: Authenticate<br> rlm_eap_tls: \
processing TLS<br>rlm_eap_tls: Received EAP-TLS ACK message<br> rlm_eap_tls: \
ack handshake fragment handler<br> eaptls_verify returned 1<br> \
eaptls_process returned 13 <br> rlm_eap_peap: EAPTLS_HANDLED<br> \
modcall[authenticate]: module "eap" returns handled for request \
5<br>modcall: leaving group authenticate (returns handled) for request 5<br>Sending \
Access-Challenge of id 0 to <a href="http://10.20.3.246">10.20.3.246</a> port \
3072<br> EAP-Message = \
0x010500061900<br> Message-Authenticator = \
0x00000000000000000000000000000000<br> \
State = 0x6ea42dd7cde1d2a43ddc2b06a110d694<br> Finished request 5<br>Going to the \
next request<br>Waking up in 6 seconds...</div> <div> </div>
<div>Kartthik<br> </div>
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic