Re: WinXP/Cisco/Freeradius - Configuring 802.1X Port-Based Authentication

2002-03-07 Thread Raghu

Hi Hajo,

Try running radiusd from src/main and check with gdb.

A second look at the logs posted, shows a weird thing like,
 EAP packet length is 0 (EAP-Message = "\001$\000\000\004\020 )
 but there are a bunch of EAP-Messages created.
 This should never happen.

So I would like to find out the root cause of this problem.
If possible try to send all the info like logs, configurations,
OS etc


-Raghu

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html



Re: WinXP/Cisco/Freeradius - Configuring 802.1X Port-Based Authentication

2002-03-07 Thread Hajo Kessener

Hi Raghu,

thanks for your answer. Let gdb check the core but the results were not very
meaningful. I read about possible misconfigurations of gdb that may result
in this kind of useless output, but I mounted the whole GNU-Package from a
colleague and can't recompile it right now. Nevertheless:

 snip 
(gdb) core core
Core was generated by `./radiusd -X'.
Program terminated with signal 9, Killed.
#0  0xff0706bc in ?? ()
(gdb)
 snip 

So I ran 'radiusd -X' from gdb with the following output (sorry, hope it
isn't too much but it also includes the relevant radiusd.conf information
you asked for):

 snip 

# gdb radiusd
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "sparc-sun-solaris2.6"...
(gdb) run -X
Starting program: /usr/local/sbin/radiusd -X
[New LWP 1]
[New LWP 2]
[New LWP 3]
Starting - reading configuration files ...
reread_config:  reading radiusd.conf
Config:   including file: /usr/local/etc/raddb/proxy.conf
Config:   including file: /usr/local/etc/raddb/clients.conf
Config:   including file: /usr/local/etc/raddb/snmp.conf
Config:   including file: /usr/local/etc/raddb/sql.conf
 main: prefix = "/usr/local"
 main: localstatedir = "/usr/local/var"
 main: logdir = "/usr/local/var/log/radius"
 main: libdir = "/usr/local/lib"
 main: radacctdir = "/usr/local/var/log/radius/radacct"
 main: hostname_lookups = no
read_config_files:  reading dictionary
read_config_files:  reading clients
read_config_files:  reading realms
read_config_files:  reading naslist
 main: max_request_time = 30
 main: cleanup_delay = 5
 main: max_requests = 1024
 main: delete_blocked_requests = 0
 main: port = 1812
 main: allow_core_dumps = no
 main: log_stripped_names = yes
 main: log_auth = yes
 main: log_auth_badpass = yes
 main: log_auth_goodpass = yes
 main: pidfile = "/usr/local/var/run/radiusd.pid"
 main: user = "root"
 main: group = "root"
 main: usercollide = no
 main: lower_user = "no"
 main: lower_pass = "no"
 main: nospace_user = "no"
 main: nospace_pass = "no"
 main: proxy_requests = yes
 proxy: retry_delay = 5
 proxy: retry_count = 3
 proxy: synchronous = no
 proxy: default_fallback = yes
 proxy: dead_time = 120
 security: max_attributes = 200
 security: reject_delay = 1
 main: debug_level = 0
read_config_files:  entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded System
 unix: cache = yes
 unix: passwd = "/etc/passwd"
 unix: shadow = "/etc/shadow"
 unix: group = "/etc/group"
 unix: radwtmp = "/usr/local/var/log/radius/radwtmp"
 unix: usegroup = no
 unix: cache_reload = 600
HASH:  Reinitializing hash structures and lists for caching...
  HASH:  user root found in hashtable bucket 11726
  HASH:  user daemon found in hashtable bucket 11668
  ...
  HASH:  user ks found in hashtable bucket 46164
HASH:  Stored 14 entries from /etc/passwd
HASH:  Stored 17 entries from /etc/group
Module: Instantiated unix (unix)
Module: Loaded eap
 eap: default_eap_type = "md5"
 eap: timer_expire = 60
rlm_eap: Loaded and initialized the type md5
Module: Instantiated eap (eap)
Module: Loaded preprocess
 preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"
 preprocess: hints = "/usr/local/etc/raddb/hints"
 preprocess: with_ascend_hack = no
 preprocess: ascend_channels_per_line = 23
 preprocess: with_ntdomain_hack = no
 preprocess: with_specialix_jetstream_hack = no
 preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
 realm: format = "suffix"
 realm: delimiter = "@"
Module: Instantiated realm (suffix)
Module: Loaded files
 files: usersfile = "/usr/local/etc/raddb/users"
 files: acctusersfile = "/usr/local/etc/raddb/acct_users"
 files: compat = "no"
Module: Instantiated files (files)
Module: Loaded detail
 detail: detailfile =
"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail"
 detail: detailperm = 384
 detail: dirperm = 493
Module: Instantiated detail (detail)
Module: Loaded radutmp
 radutmp: filename = "/usr/local/var/log/radius/radutmp"
 radutmp: username = "%{User-Name}"
 radutmp: perm = 384
 radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on
1814/udp.
Ready to process requests.
[New LWP 4]
rad_recv: Access-Request packet from host 130.75.xx.xx:2343, id=36,
length=63
User-Name = "ks"
NAS-IP-Address = 130.75.xx.xx
Framed-MTU = 1000
EAP-Message = "\002\001\000\007\001ks"
Message-Authenticator = 0xd61f273476c1d685ab6a352c8ef53957
modcall: entering group authorize
  modcall[authorize]: module "preprocess" returns ok
  modcall[authorize]: module "eap" returns updated
  modcall[authorize]: module "s

Re: WinXP/Cisco/Freeradius - Configuring 802.1X Port-Based Authentication

2002-03-06 Thread Raghu

>does anybody have "dot1x port-based authentication" up and running for
>WinXP/Cisco Catalyst/Freeradius ? (see
>http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/1216ea2/scg/swg8
>021x.htm#10608). I have a LAN-connection in WinXP configured with 802.1x
>enabled using EAP-MD5. Set up the radius-settings on a Catalyst 6009 and
>enabled dot1x ("port-control auto"). The Freeradius (latest
>nightly-snapshot) is running with the new EAP-MD5 module (thanks a lot for
>this work). After startup WinXP prompts for Username/Password to
>authenticate for the LAN-connection. The Freeradius debug-ouput is the
>following:

Looks like a configuration problem.
Can you send the radiusd.conf.


>Freeradius sends about 40 EAP-Messages until it fails with a core dump.
Can you use GDB on the core and send the output.

-Raghu

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html



WinXP/Cisco/Freeradius - Configuring 802.1X Port-Based Authentication

2002-03-06 Thread Hajo Kessener

Hi,

does anybody have "dot1x port-based authentication" up and running for
WinXP/Cisco Catalyst/Freeradius ? (see
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/1216ea2/scg/swg8
021x.htm#10608). I have a LAN-connection in WinXP configured with 802.1x
enabled using EAP-MD5. Set up the radius-settings on a Catalyst 6009 and
enabled dot1x ("port-control auto"). The Freeradius (latest
nightly-snapshot) is running with the new EAP-MD5 module (thanks a lot for
this work). After startup WinXP prompts for Username/Password to
authenticate for the LAN-connection. The Freeradius debug-ouput is the
following:

-- snip --
Ready to process requests.
rad_recv: Access-Request packet from host 130.75.xx.xx:2343, id=34,
length=63
User-Name = "ks"
NAS-IP-Address = 130.75.xx.xx
Framed-MTU = 1000
EAP-Message = "\002\001\000\007\001ks"
Message-Authenticator = 0x5d2caed87f294fb5bf14f316c92956e0
modcall: entering group authorize
  modcall[authorize]: module "preprocess" returns ok
  modcall[authorize]: module "eap" returns updated
  modcall[authorize]: module "suffix" returns ok
  modcall[authorize]: module "files" returns notfound
modcall: group authorize returns updated
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
modcall: entering group authenticate
rlm_eap: processing type md5
  modcall[authenticate]: module "eap" returns ok
modcall: group authenticate returns ok
Login OK: [ks/] (from nas UNKNOWN-NAS port 0)
Sending Access-Challenge of id 34 to 130.75.xx.xx:2343
EAP-Message = "\001"\000\000\004\020\250l\211\245\032\245\250k ...
EAP-Message = "back\000\004@\350inistrative\t11\n\n#\tFr\000 ...
EAP-Message = "\000\000\000\030ynch\000\004A\350us\t6\n\n#\t ...
EAP-Message = "ALUE\000\000\000\030amed\000\004B\350pression\t ...
...
Segmentation Fault - core dumped
-- snip --

Freeradius sends about 40 EAP-Messages until it fails with a core dump.

Thanks a lot for your help.

Regards,
Hajo


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html