problem with PEAP/MSCHAPv2
hello, I have found some errors in my freeradius server logs. It seems that some clients are having problems to authenticate againts them. I'm using PEAP/MSCHAPv2 with the latest freeradius version and SUSE OS. Mon Mar 29 14:20:56 2010 : Error: TLS Alert write:fatal:protocol version Mon Mar 29 14:20:56 2010 : Error: rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Mon Mar 29 14:20:56 2010 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. I have debuged the servers and when this error appears there are differences in the TLS negotiation of PEAP: example of succesful negotiation: [peap] processing EAP-TLS TLS Length 102 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] TLS 1.0 Handshake [length 0061], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] TLS 1.0 Handshake [length 05aa], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED example of unsuccesful negotiation: [peap] processing EAP-TLS TLS Length 109 [peap] Length Included [peap] eaptls_verify returned 11 [peap] TLS 1.0 Handshake [length 0061], ClientHello [peap] TLS_accept: SSLv3 read client hello C [peap] TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] TLS 1.0 Handshake [length 05aa], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] Unknown TLS version [length 0002] TLS Alert write:fatal:protocol version [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version num ber SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS I will look if something is bad configured in the user's wifi profile, but does anybody have this problem previously? Thanks, -- Christian Pinedo Zamalloa (zako) PGP keyID: 0x828D0C80 Fingerprint: 7BFF 4105 F46B 7977 BD96 348C 1007 4FF8 828D 0C80 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: problem with PEAP/MSCHAPv2
Hi, What OS is the client machine running? It would seem like an issue with the client to me. Regards, Matt Harlum On 31/03/2010, at 8:31 PM, Christian Pinedo Zamalloa wrote: wrong version num ber - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: problem with PEAP/MSCHAPv2
Christian Pinedo Zamalloa wrote: hello, I have found some errors in my freeradius server logs. It seems that some clients are having problems to authenticate againts them. I'm using PEAP/MSCHAPv2 with the latest freeradius version and SUSE OS. Mon Mar 29 14:20:56 2010 : Error: TLS Alert write:fatal:protocol version Mon Mar 29 14:20:56 2010 : Error: rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Mon Mar 29 14:20:56 2010 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. The client is likely doing TLS v1.1, and the OpenSSL libraries don't support it. i.e. the client is *ignoring* TLS negotiation. They're broken. Tell the vendor to fix them. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Big Problem with peap-mschapv2+freeradius 1.1.7
Hi, I have a big problem with my radius setup. I want to authenticate my users with peap+mschapv2. The radius backend is an ldap server. I have this setup working with Freeradius 1.0.1 on Redhat 4 ES. But after upgrading to 1.1.7 this setup does not work anymore. I configured my radius/eap/client config file the same way like the old file was. I additionally tried to start the new radius with the old config files with the same effect, it does not work. Here is my setup: Freeradius 1.1.7 OPenldap (newest version) Clients: Windows Xp Sp 2 WPA Supplicant, Juniper Odyysee Client, Cisco Secure Services Client In my ldap i have following attributes: cn,uid, description, UserPassword, If i look at the logfiles, i can see that the ldap authorization seems to work. It seems that something goes wrong with the authentication. But i cant find the reason :-( ... Here is the logfile output of radiusd -X: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/freeradius/etc/raddb/proxy.conf Config: including file: /usr/local/freeradius/etc/raddb/clients.conf Config: including file: /usr/local/freeradius/etc/raddb/snmp.conf Config: including file: /usr/local/freeradius/etc/raddb/eap.conf Config: including file: /usr/local/freeradius/etc/raddb/sql.conf main: prefix = /usr/local/freeradius main: localstatedir = /usr/local/freeradius/var main: logdir = /usr/local/freeradius/var/log/radius main: libdir = /usr/local/freeradius/lib main: radacctdir = /usr/local/freeradius/var/log/radius/radacct main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = /usr/local/freeradius/var/log/radius/radius.log main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = /usr/local/freeradius/var/run/radiusd/radiusd.pid main: user = radiusd main: group = radiusd main: usercollide = no main: lower_user = no main: lower_pass = no main: nospace_user = no main: nospace_pass = no main: checkrad = /usr/local/freeradius/sbin/checkrad main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/freeradius/lib Module: Loaded exec exec: wait = yes exec: program = (null) exec: input_pairs = request exec: output_pairs = (null) exec: packet_type = (null) rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = crypt pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = (null) mschap: ntlm_auth = (null) Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = (null) unix: shadow = (null) unix: group = (null) unix: radwtmp = /usr/local/freeradius/var/log/radius/radwtmp unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = peap eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = Password: gtc: auth_type = PAP rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = (null) tls: pem_file_type = yes tls: private_key_file = /usr/local/certs/wcsserver.key tls: certificate_file = /usr/local/certs/wcsserver.pem tls: CA_file = /usr/local/certs/root.pem tls: private_key_password = wcs tls: dh_file = /usr/local/freeradius/etc/raddb/certs/dh tls: random_file = /usr/local/freeradius/etc/raddb/certs/random tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = (null) tls: cipher_list = (null) tls: check_cert_issuer = (null) rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap:
Re: Big Problem with peap-mschapv2+freeradius 1.1.7
Christian Frank wrote: I have a big problem with my radius setup. I want to authenticate my users with peap+mschapv2. The radius backend is an ldap server. Does the LDAP server contain a clear-text or NT hashed password for the user? I have this setup working with Freeradius 1.0.1 on Redhat 4 ES. But after upgrading to 1.1.7 this setup does not work anymore. I configured my radius/eap/client config file the same way like the old file was. Are you sure? The configurations are similar, but not identical. rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) rlm_ldap: checking if remote access for cfra is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cfra authorized to use remote access BUT there was no known good password for the user found in LDAP. That's why authentication is failing. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Problem with PEAP-MSCHAPV2
Hi all,I try to authenticate Windows XP SP2 client using PEAP-MSCHAPv2 through a D-Link DWL 900AP+ with freeradius-1.0.0 in a Linux RedHat 9 machine. I install the openssl-0.9.7e as below./config shared --prefix=/usr/local/opensslmakemake install For freeradius./configure --with-openssl-includes=/usr/local/openssl/include \--with-openssl-libraries=/usr/local/openssl/lib \--disable-sharedmakemake install For cerificatesCN for CA = KKKCN for client = kschiamCN for server = localhost.localdomain Wrapper Script#!/bin/sh/ -xLD_LIBRARY_PATH=/usr/local/openssl/libLD_PRELOAD=//usr/local/openssl/lib/libcrypto.soexport LD_LIBRARY_PATH LD_PRELOAD/usr/local/sbin/radiusd $@ For Windows XPI had install the root.pem and cert-clt.pl2. I disable the "Authenticate as computer when computerinformation is available" and "Automatically use my windows logon name and passwords" In user file"kschiam" User-Password =="100083" For D-Link AP802.1X is enabled Authentication = WPAEncryption Key Length = 64 bit The server able to start in debug mode, but no furtherresponse after sending access challenge. What i had missed out? I been stuck here quite a long time. Why there is "No EAP Start, assuming it's an on-going EAP conversationin debugging snippets?[EMAIL PROTECTED] root]# run-radius -X -A + LD_LIBRARY_PATH=/usr/local/openssl/lib + LD_PRELOAD=/usr/local/openssl/lib/libcrypto.so + export LD_LIBRARY_PATH LD_PRELOAD + /usr/local/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/1x/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/1x/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/1x/root.pem" tls: private_key_password = "whatever" tls: dh_file =
Problem - proxy peap + mschapv2
Hi, i need help. I configured freeradius to authenticate users in Openldap using samba password, it's working 100%. Now a configured other freeradius server to route the information of users conform Windows Domain Name, then a configured proxy.conf for this. When I do a test, occurr ther error bellow: rlm_eap: Request is supposed to be proxied to Realm TESTE. Not doing EAP. rad_recv: Access-Request packet from host 172.22.2.32:1520, id=218, length=98 User-Name = [EMAIL PROTECTED] EAP-Message = 0x020100110154455354455c69737261656c NAS-IP-Address = 172.22.2.32 Service-Type = Login-User Calling-Station-Id = 0.0.0.0 NAS-Port-Type = Ethernet Message-Authenticator = 0x3bd8b99f86bf11e0fd40509088fac01a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module preprocess returns ok for request 4 modcall[authorize]: module chap returns noop for request 4 modcall[authorize]: module mschap returns noop for request 4 rlm_realm: Looking up realm TESTE for User-Name = [EMAIL PROTECTED] rlm_realm: Found realm TESTE rlm_realm: Adding Stripped-User-Name = israel rlm_realm: Proxying request from user israel to realm TESTE rlm_realm: Adding Realm = TESTE rlm_realm: Preparing to proxy authentication request to realm TESTE modcall[authorize]: module suffix returns updated for request 4 rlm_eap: Request is supposed to be proxied to Realm TESTE. Not doing EAP. modcall[authorize]: module eap returns noop for request 4 modcall[authorize]: module files returns notfound for request 4 modcall: group authorize returns updated for request 4 Sending Access-Request of id 4 to 172.22.3.69:1812 User-Name = israel EAP-Message = 0x020100110154455354455c69737261656c NAS-IP-Address = 172.22.2.32 Service-Type = Login-User Calling-Station-Id = 0.0.0.0 NAS-Port-Type = Ethernet Message-Authenticator = 0x Proxy-State = 0x323138 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Reject packet from host 172.22.3.69:1812, id=4, length=25 Proxy-State = 0x323138 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 4 modcall[post-proxy]: module eap returns noop for request 4 modcall: group post-proxy returns noop for request 4 Delaying request 4 for 1 seconds Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 172.22.2.32:1520, id=218, length=98 Sending Access-Reject of id 218 to 172.22.2.32:1520 --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 218 with timestamp 41f12c0d Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.22.0.47:1814, id=4, length=97 User-Name = israel EAP-Message = 0x020100110154455354455c69737261656c NAS-IP-Address = 172.22.2.32 Service-Type = Login-User Calling-Station-Id = 0.0.0.0 NAS-Port-Type = Ethernet Message-Authenticator = 0xf46be4650830b6c5e442cc2756cf7411 Proxy-State = 0x323138 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module preprocess returns ok for request 8 modcall[authorize]: module mschap returns noop for request 8 rlm_eap: EAP packet type response id 1 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module eap returns updated for request 8 rlm_ldap: - authorize rlm_ldap: performing user authorization for israel radius_xlat: '(uid=israel)' radius_xlat: 'dc=testdomain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testdomain,dc=com, with filter (uid=israel) rlm_ldap: looking for check items in directory... rlm_ldap: Adding ntPassword as NT-Password, value E16089130E8B7BEE87E6FF312E5B8312 op=21 rlm_ldap: Adding lmPassword as LM-Password, value E42C92D3C5AE8D6AE68AA26A841A86FA op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User op=11 rlm_ldap: user israel authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module ldap returns ok for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type EAP Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module eap returns invalid for request 8 modcall: group authenticate
