Hi all I am trying to do eap-tls authentication with 1.1.6.My xp client is saying attempting to authenticate. So in the output i got when i tried to connect in debug mode is
Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = \\\"/usr/local\\\" main: localstatedir = \\\"/usr/local/var\\\" main: logdir = \\\"/usr/local/var/log/radius\\\" main: libdir = \\\"/usr/local/lib\\\" main: radacctdir = \\\"/usr/local/var/log/radius/radacct\\\" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = \\\"/usr/local/var/log/radius/radius.log\\\" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = \\\"/usr/local/var/run/radiusd/radiusd.pid\\\" main: user = \\\"(null)\\\" main: group = \\\"(null)\\\" main: usercollide = no main: lower_user = \\\"no\\\" main: lower_pass = \\\"no\\\" main: nospace_user = \\\"no\\\" main: nospace_pass = \\\"no\\\" main: checkrad = \\\"/usr/local/sbin/checkrad\\\" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = \\\"(null)\\\" exec: input_pairs = \\\"request\\\" exec: output_pairs = \\\"(null)\\\" exec: packet_type = \\\"(null)\\\" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = \\\"(null)\\\" unix: shadow = \\\"(null)\\\" unix: group = \\\"(null)\\\" unix: radwtmp = \\\"/usr/local/var/log/radius/radwtmp\\\" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = \\\"tls\\\" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = \\\"(null)\\\" tls: pem_file_type = yes tls: private_key_file = \\\"/etc/1x/07xwifi.pem\\\" tls: certificate_file = \\\"/etc/1x/07xwifi.pem\\\" tls: CA_file = \\\"/etc/1x/root.pem\\\" tls: private_key_password = \\\"password\\\" tls: dh_file = \\\"/etc/1x/DH\\\" tls: random_file = \\\"/etc/1x/random\\\" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = \\\"(null)\\\" tls: cipher_list = \\\"(null)\\\" tls: check_cert_issuer = \\\"(null)\\\" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = \\\"/etc/raddb/huntgroups\\\" preprocess: hints = \\\"/etc/raddb/hints\\\" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = \\\"suffix\\\" realm: delimiter = \\\"@\\\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = \\\"/etc/raddb/users\\\" files: acctusersfile = \\\"/etc/raddb/acct_users\\\" files: preproxy_usersfile = \\\"/etc/raddb/preproxy_users\\\" files: compat = \\\"no\\\" Module: Instantiated files (files) Module: Loaded PAP pap: encryption_scheme = \\\"crypt\\\" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = \\\"User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addre ss, NAS-Port\\\" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = \\\"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/de tail-%Y%m%d\\\" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = \\\"/usr/local/var/log/radius/radutmp\\\" radutmp: username = \\\"%{User-Name}\\\" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.50:1026, id=0, length=197 Message-Authenticator = 0x58682b62b2334fb6e661df414bc30e61 Service-Type = Framed-User User-Name = \\\"anoop07\\\" Framed-MTU = 1488 Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\" Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\" NAS-Identifier = \\\"D-Link Access Point\\\" NAS-Port-Type = Wireless-802.11 Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\" EAP-Message = 0x0200000c01616e6f6f703037 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \\\"STA port # 1\\\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module \\\"preprocess\\\" returns ok for request 0 rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm NULL rlm_realm: No such realm \\\"NULL\\\" modcall[authorize]: module \\\"suffix\\\" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation modcall[authorize]: module \\\"eap\\\" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \\\"files\\\" returns ok for request 0 rlm_pap: WARNING! No \\\"known good\\\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \\\"pap\\\" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type \\\"EAP\\\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module \\\"eap\\\" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.0.50 port 1026 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf149907fc590a6e39f01cbbd9619107b Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1026, id=1, length=299 Message-Authenticator = 0x4fd5a9fe11d848f8f7a1324997be4a8e Service-Type = Framed-User User-Name = \\\"anoop07\\\" Framed-MTU = 1488 State = 0xf149907fc590a6e39f01cbbd9619107b Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\" Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\" NAS-Identifier = \\\"D-Link Access Point\\\" NAS-Port-Type = Wireless-802.11 Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\" EAP-Message = 0x020100600d800000005616030100510100004d03014642cb0590f008 20866efd284d568c69cde48b6530bced71bd7a674a2a46e36e103102d6b9e079cbcf0242e2192803 fe40001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \\\"STA port # 1\\\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module \\\"preprocess\\\" returns ok for request 1 rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm NULL rlm_realm: No such realm \\\"NULL\\\" modcall[authorize]: module \\\"suffix\\\" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 96 rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation modcall[authorize]: module \\\"eap\\\" returns updated for request 1 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \\\"files\\\" returns ok for request 1 rlm_pap: WARNING! No \\\"known good\\\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \\\"pap\\\" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type \\\"EAP\\\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0051], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04bf], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004c], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module \\\"eap\\\" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 192.168.0.50 port 1026 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0102040a0dc000000564160301004a0200004603014642cb066051eb 4f14285a58bcd1249829d97ad27f846524d57f7a25b0a3981720143a0cfecdd12ac8ec78c09d87f3 05ba498dcfe95c07b2b76e9b8510cfc644fd00040016030104bf0b0004bb0004b800022c30820228 30820191a003020102020101300d06092a864886f70d0101040500303b310b300906035504061302 494e310b300906035504081302544e310d300b060355040a1304536966793110300e060355040313 0730377877696669301e170d3037303131323135333533305a170d3038303131323135333533305a 3060310b300906035504061302494e310b3009060355040813 EAP-Message = 0x02544e310d300b060355040a1304536966793110300e060355040313 07303778776966693123302106092a864886f70d0109011614616e6f6f705f634073696679636f72 702e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d2bbbe35bc8a 47709632284aff484695385e69c3522f63da46834f9586a420bda380889693fa77fedd9ed4290e6f 9ff4436721775294fc65a38fea098f18975b34b5063de27220e18a07d433cbb6e19aeb3f84b012f7 c20071dd280457a932634bbe50f438cc2ee6f4d65fa395a10bdecc4bf9087979ec45af000940e186 ed290203010001a317301530130603551d25040c300a06082b EAP-Message = 0x06010505070301300d06092a864886f70d0101040500038181000afe a7f2a8a9cffe60baa8f779353c523457f8237faeff81ba5f2c22664c70b6b2fb58c8967ca4a4c847 b80e1d5a6cc4558ffa1d161614f374d8b5efd565aa66045b192b3ac3da82c81c4a99fc10cfe473f9 ac258ef99b16cbd335004677694a05addae48c6a9dcdb26b86ddb56c635266c33c7de75865435326 92e5220d30b100028630820282308201eba003020102020100300d06092a864886f70d0101040500 303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453 6966793110300e0603550403130730377877696669301e170d EAP-Message = 0x3037303131323135333435305a170d3038303131323135333435305a 303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453 6966793110300e060355040313073037787769666930819f300d06092a864886f70d010101050003 818d0030818902818100ba8b07a479bb6ce9adf2d8bc6ac9cf214506dfc039cb10c3b4d27d1bbc08 2caff0bb77424819728977f04b32e231a3c4755a65823b366f1a604f15ce6c499883ab7d2757a5a2 c07a11e75b7a00d6c55a8fb7443b202a25a3cdaad39579b2d8f4c09c974056f0c8666fff754d5748 36fcaf105200fcd5df5158e2b387310c4ed90203010001a381 EAP-Message = 0x95308192301d0603551d0e041604149eda6f69065423 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2fdcf333629491d0e1c1ee647458de64 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1026, id=2, length=209 Message-Authenticator = 0x4ad9312009d92ce8a0efb591a5179928 Service-Type = Framed-User User-Name = \\\"anoop07\\\" Framed-MTU = 1488 State = 0x2fdcf333629491d0e1c1ee647458de64 Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\" Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\" NAS-Identifier = \\\"D-Link Access Point\\\" NAS-Port-Type = Wireless-802.11 Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\" EAP-Message = 0x020200060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \\\"STA port # 1\\\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module \\\"preprocess\\\" returns ok for request 2 rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm NULL rlm_realm: No such realm \\\"NULL\\\" modcall[authorize]: module \\\"suffix\\\" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation modcall[authorize]: module \\\"eap\\\" returns updated for request 2 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \\\"files\\\" returns ok for request 2 rlm_pap: WARNING! No \\\"known good\\\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \\\"pap\\\" returns noop for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type \\\"EAP\\\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \\\"eap\\\" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 2 to 192.168.0.50 port 1026 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103016e0d80000005647ec1c9e4d07a608e0e6dcd730f3063060355 1d23045c305a80149eda6f690654237ec1c9e4d07a608e0e6dcd730fa13fa43d303b310b30090603 5504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e06 03550403130730377877696669820100300c0603551d13040530030101ff300d06092a864886f70d 0101040500038181006b514f008b6a77757fc73ddbe9d54e4ea925a1ab9ce80ad7895d6d19661d8b 8558d0e359876aac023aa52d4273e00407b9b588b30dbc35c5911bc89d2d99677e0ec8dea17fece3 5d0b4dfab8775ba73eaeb0a0998bcdf1437cff0a1031f6a5b1 EAP-Message = 0x7e8bcdc01e2e964cb256f49d947eea2cfd42989aef397fa438be294f a3dc7a3d160301004c0d000044020102003f003d303b310b300906035504061302494e310b300906 035504081302544e310d300b060355040a1304536966793110300e06035504031307303778776966 690e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8312be86097e0bba014e67facd670e26 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1026, id=3, length=209 Message-Authenticator = 0xd1d028ef0c35ada1104dae076b233114 Service-Type = Framed-User User-Name = \\\"anoop07\\\" Framed-MTU = 1488 State = 0x8312be86097e0bba014e67facd670e26 Called-Station-Id = \\\"00-0F-3D-AF-DD-C2:default\\\" Calling-Station-Id = \\\"00-0E-35-F3-A1-67\\\" NAS-Identifier = \\\"D-Link Access Point\\\" NAS-Port-Type = Wireless-802.11 Connect-Info = \\\"CONNECT 54Mbps 802.11g\\\" EAP-Message = 0x020300060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \\\"STA port # 1\\\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module \\\"preprocess\\\" returns ok for request 3 rlm_realm: No \\\'@\\\' in User-Name = \\\"anoop07\\\", looking up realm NULL rlm_realm: No such realm \\\"NULL\\\" modcall[authorize]: module \\\"suffix\\\" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it\\\'s an on-going EAP conversation modcall[authorize]: module \\\"eap\\\" returns updated for request 3 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \\\"files\\\" returns ok for request 3 rlm_pap: WARNING! No \\\"known good\\\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \\\"pap\\\" returns noop for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type \\\"EAP\\\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \\\"eap\\\" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 3 to 192.168.0.50 port 1026 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0104000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc08d54ac02795c8e31c2f7865a609bd5 Finished request 3 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 4642cb06 Cleaning up request 1 ID 1 with timestamp 4642cb06 Cleaning up request 2 ID 2 with timestamp 4642cb06 Cleaning up request 3 ID 3 with timestamp 4642cb06 Nothing to do. Sleeping until we see a request. [EMAIL PROTECTED] raddb]# Regards Anoop essage: 3 Date: Thu, 10 May 2007 11:45:42 +0200 From: inverse <[EMAIL PROTECTED]> Subject: Re: eap-tls authentication with free radius 1.1.5 To: \"FreeRadius users mailing list\" <freeradius-users@lists.freeradius.org> Message-ID: <[EMAIL PROTECTED]> Content-Type: text/plain; charset=ISO-8859-1; format=flowed On 5/10/07, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: anoop, please fix your quoting. Configurations are not interchangeable between the snapshot tree, 1.1.5 and 1.1.6 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html