Hi there!
I've got a big prob. Thanks to the excellent howto of Adam Sulmicki, I finally
managed to move back from my Win2k RADIUS towards freeRADIUS. I'm using
freeRADIUS with eap tls enabled (cvs snaptshot 2002-04-08), a 3Com 8000 WLAN
AP and xsupplicant under Linux to auth via 802.1x/EAP-TLS.
The messages look quite ok, but as soon as the secand request is handeled EAP
is complainig about "rlm_eap: State verification failed.". As I looked out
for the State Attribute of the last message, I found it some chars shorter
than it was in the message before. I tried to adjust the fragment size, but
could'nt solve the problem. The packet has a length of 144 bytes, so it
should not be a big deal with (standard) 1024 byte fragments.
Thank's a lot for your help!
Here's what I get:
Ready to process requests.
rad_recv: Access-Request packet from host 134.76.4.7:1812, id=11, length=67
EAP-Message = "\002\010\000\t\001flex"
Message-Authenticator = 0x783038983e2b972451718f233530d296
NAS-IP-Address = 134.76.4.7
User-Name = "flex"
Framed-MTU = 1400
modcall: entering group authorize
modcall[authorize]: module "preprocess" returns ok
modcall[authorize]: module "eap" returns updated
modcall[authorize]: module "suffix" returns ok
users: Matched flex at 54
modcall[authorize]: module "files" returns ok
modcall: group authorize returns updated
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
modcall: entering group authenticate
rlm_eap: processing type tls
modcall[authenticate]: module "eap" returns ok
modcall: group authenticate returns ok
Sending Access-Challenge of id 11 to 134.76.4.7:1812
EAP-Message = "\001\t\000\006\r "
Message-Authenticator = 0x00000000000000000000000000000000
State =
0x3df30ad930886ee1c76b2ec405f54c47455db43c219ab001a93e6b8dfbf601baf54db839
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 134.76.4.7:1812, id=12, length=144
EAP-Message =
"\002\t\000>\r\200\000\000\0004\026\003\001\000/\001\000\000+\003\001<\264]ENJ\247\210_l/\227\347\256$O\211\255\031X\231\256\363\206\031\347mPSM\257\000\000\004\000\004\000\005\001"
Message-Authenticator = 0xcd0dfea408b14674f367809b305f7c5c
NAS-IP-Address = 134.76.4.7
User-Name = "flex"
State = 0x3df30ad930886ee1c76b2ec405f54c47455db43c219a
Framed-MTU = 1400
modcall: entering group authorize
modcall[authorize]: module "preprocess" returns ok
modcall[authorize]: module "eap" returns updated
modcall[authorize]: module "suffix" returns ok
users: Matched flex at 54
modcall[authorize]: module "files" returns ok
modcall: group authorize returns updated
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
modcall: entering group authenticate
rlm_eap: State verification failed.
modcall[authenticate]: module "eap" returns invalid
modcall: group authenticate returns invalid
auth: Failed to validate the user.
Delaying request 1 for 1 seconds
Finished request 1
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 134.76.4.7:1812, id=12, length=144
Sending duplicate authentication reply to client 134.76.4.7:1812 - ID: 12
Sending Access-Reject of id 12 to 134.76.4.7:1812
--- Walking the entire request list ---
Sending Access-Reject of id 12 to 134.76.4.7
Waking up in 1 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 11 with timestamp 3cb45d45
Cleaning up request 1 ID 12 with timestamp 3cb45d45
Nothing to do. Sleeping until we see a request.
--------------------------------------------
before all this - the server start's up with:
[root@caladan flex]# /usr/local/sbin/rc.radiusd -A -X
+ LD_LIBRARY_PATH=/usr/local/ssleap/lib
+ LD_PRELOAD=/usr/local/ssleap/lib/libcrypto.so
+ export LD_LIBRARY_PATH LD_PRELOAD
+ /usr/local/radiuseap/sbin/radiusd -A -X
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /usr/local/radiuseap/etc/raddb/proxy.conf
Config: including file: /usr/local/radiuseap/etc/raddb/clients.conf
Config: including file: /usr/local/radiuseap/etc/raddb/snmp.conf
Config: including file: /usr/local/radiuseap/etc/raddb/sql.conf
main: prefix = "/usr/local/radiuseap"
main: localstatedir = "/usr/local/radiuseap/var"
main: logdir = "/usr/local/radiuseap/var/log/radius"
main: libdir = "/usr/local/radiuseap/lib"
main: radacctdir = "/usr/local/radiuseap/var/log/radius/radacct"
main: hostname_lookups = no
read_config_files: reading dictionary
read_config_files: reading clients
read_config_files: reading realms
read_config_files: reading naslist
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_auth = no
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile = "/usr/local/radiuseap/var/run/radiusd.pid"
main: user = "root"
main: group = "root"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
security: max_attributes = 200
security: reject_delay = 1
main: debug_level = 0
read_config_files: entering modules setup
Module: Library search path is /usr/local/radiuseap/lib
Module: Loaded System
unix: cache = yes
unix: passwd = "/etc/passwd"
unix: shadow = "/etc/shadow"
unix: group = "/etc/group"
unix: radwtmp = "/usr/local/radiuseap/var/log/radius/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
HASH: Reinitializing hash structures and lists for caching...
HASH: user root found in hashtable bucket 11726
HASH: user bin found in hashtable bucket 86651
HASH: user daemon found in hashtable bucket 11668
HASH: user adm found in hashtable bucket 26466
HASH: user lp found in hashtable bucket 54068
HASH: user sync found in hashtable bucket 42895
HASH: user shutdown found in hashtable bucket 71746
HASH: user halt found in hashtable bucket 7481
HASH: user mail found in hashtable bucket 79471
HASH: user news found in hashtable bucket 5375
HASH: user uucp found in hashtable bucket 38541
HASH: user operator found in hashtable bucket 21748
HASH: user games found in hashtable bucket 47657
HASH: user gopher found in hashtable bucket 47357
HASH: user postgres found in hashtable bucket 19301
HASH: user ftp found in hashtable bucket 56226
HASH: user squid found in hashtable bucket 62826
HASH: user gdm found in hashtable bucket 50360
HASH: user htdig found in hashtable bucket 6378
HASH: user dhcpd found in hashtable bucket 6699
HASH: user named found in hashtable bucket 7729
HASH: user nscd found in hashtable bucket 36306
HASH: user rpm found in hashtable bucket 72383
HASH: user apache found in hashtable bucket 26582
HASH: user rpcuser found in hashtable bucket 552
HASH: user rpc found in hashtable bucket 72373
HASH: user sympa found in hashtable bucket 13804
HASH: user ldap found in hashtable bucket 45563
HASH: user nobody found in hashtable bucket 99723
HASH: user alias found in hashtable bucket 92764
HASH: user qmaild found in hashtable bucket 58676
HASH: user qmaill found in hashtable bucket 58684
HASH: user qmailp found in hashtable bucket 58688
HASH: user qmailq found in hashtable bucket 58689
HASH: user qmailr found in hashtable bucket 58690
HASH: user qmails found in hashtable bucket 58691
HASH: user dnscache found in hashtable bucket 17753
HASH: user dnslog found in hashtable bucket 4955
HASH: user tinydns found in hashtable bucket 15953
HASH: user axfrdns found in hashtable bucket 61774
HASH: user xfs found in hashtable bucket 17213
HASH: user postfix found in hashtable bucket 23093
HASH: user mysql found in hashtable bucket 46314
HASH: user flex found in hashtable bucket 14069
HASH: user helen found in hashtable bucket 18200
HASH: user exolon found in hashtable bucket 8883
HASH: user mike found in hashtable bucket 60470
HASH: user snort found in hashtable bucket 79598
HASH: user gica found in hashtable bucket 68888
HASH: user vpopmail found in hashtable bucket 51678
HASH: Stored 50 entries from /etc/passwd
HASH: Stored 66 entries from /etc/group
Module: Instantiated unix (unix)
Module: Loaded eap
eap: default_eap_type = "tls"
eap: timer_expire = 60
rlm_eap: Loaded and initialized the type md5
tls: private_key_file = "/etc/1x/keys/cert/cert-srv.pem"
tls: certificate_file = "/etc/1x/keys/cert/cert-srv.pem"
tls: CA_file = "/etc/1x/keys/cert/demoCA/cacert.pem"
tls: private_key_password = "whatever"
tls: dh_file = "/etc/1x/keys/cert/dh"
tls: random_file = "/etc/1x/keys/cert/random"
tls: fragment_size = 80
tls: include_length = yes
rlm_eap_tls: conf N ctx stored
rlm_eap: Loaded and initialized the type tls
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = "/usr/local/radiuseap/etc/raddb/huntgroups"
preprocess: hints = "/usr/local/radiuseap/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = "/usr/local/radiuseap/etc/raddb/users"
files: acctusersfile = "/usr/local/radiuseap/etc/raddb/acct_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded detail
detail: detailfile =
"/usr/local/radiuseap/var/log/radius/radacct/%{Client-IP-Address}/detail"
detail: detailperm = 384
detail: dirperm = 493
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/usr/local/radiuseap/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on
1814/udp.
CU
Sebastian Rieger
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
