Re: WinXP/Cisco/Freeradius - Configuring 802.1X Port-Based Authentication

2002-03-07 Thread Hajo Kessener

Hi Raghu,

thanks for your answer. Let gdb check the core but the results were not very
meaningful. I read about possible misconfigurations of gdb that may result
in this kind of useless output, but I mounted the whole GNU-Package from a
colleague and can't recompile it right now. Nevertheless:

 snip 
(gdb) core core
Core was generated by `./radiusd -X'.
Program terminated with signal 9, Killed.
#0  0xff0706bc in ?? ()
(gdb)
 snip 

So I ran 'radiusd -X' from gdb with the following output (sorry, hope it
isn't too much but it also includes the relevant radiusd.conf information
you asked for):

 snip 

# gdb radiusd
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type show copying to see the conditions.
There is absolutely no warranty for GDB.  Type show warranty for details.
This GDB was configured as sparc-sun-solaris2.6...
(gdb) run -X
Starting program: /usr/local/sbin/radiusd -X
[New LWP 1]
[New LWP 2]
[New LWP 3]
Starting - reading configuration files ...
reread_config:  reading radiusd.conf
Config:   including file: /usr/local/etc/raddb/proxy.conf
Config:   including file: /usr/local/etc/raddb/clients.conf
Config:   including file: /usr/local/etc/raddb/snmp.conf
Config:   including file: /usr/local/etc/raddb/sql.conf
 main: prefix = /usr/local
 main: localstatedir = /usr/local/var
 main: logdir = /usr/local/var/log/radius
 main: libdir = /usr/local/lib
 main: radacctdir = /usr/local/var/log/radius/radacct
 main: hostname_lookups = no
read_config_files:  reading dictionary
read_config_files:  reading clients
read_config_files:  reading realms
read_config_files:  reading naslist
 main: max_request_time = 30
 main: cleanup_delay = 5
 main: max_requests = 1024
 main: delete_blocked_requests = 0
 main: port = 1812
 main: allow_core_dumps = no
 main: log_stripped_names = yes
 main: log_auth = yes
 main: log_auth_badpass = yes
 main: log_auth_goodpass = yes
 main: pidfile = /usr/local/var/run/radiusd.pid
 main: user = root
 main: group = root
 main: usercollide = no
 main: lower_user = no
 main: lower_pass = no
 main: nospace_user = no
 main: nospace_pass = no
 main: proxy_requests = yes
 proxy: retry_delay = 5
 proxy: retry_count = 3
 proxy: synchronous = no
 proxy: default_fallback = yes
 proxy: dead_time = 120
 security: max_attributes = 200
 security: reject_delay = 1
 main: debug_level = 0
read_config_files:  entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded System
 unix: cache = yes
 unix: passwd = /etc/passwd
 unix: shadow = /etc/shadow
 unix: group = /etc/group
 unix: radwtmp = /usr/local/var/log/radius/radwtmp
 unix: usegroup = no
 unix: cache_reload = 600
HASH:  Reinitializing hash structures and lists for caching...
  HASH:  user root found in hashtable bucket 11726
  HASH:  user daemon found in hashtable bucket 11668
  ...
  HASH:  user ks found in hashtable bucket 46164
HASH:  Stored 14 entries from /etc/passwd
HASH:  Stored 17 entries from /etc/group
Module: Instantiated unix (unix)
Module: Loaded eap
 eap: default_eap_type = md5
 eap: timer_expire = 60
rlm_eap: Loaded and initialized the type md5
Module: Instantiated eap (eap)
Module: Loaded preprocess
 preprocess: huntgroups = /usr/local/etc/raddb/huntgroups
 preprocess: hints = /usr/local/etc/raddb/hints
 preprocess: with_ascend_hack = no
 preprocess: ascend_channels_per_line = 23
 preprocess: with_ntdomain_hack = no
 preprocess: with_specialix_jetstream_hack = no
 preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
 realm: format = suffix
 realm: delimiter = 
Module: Instantiated realm (suffix)
Module: Loaded files
 files: usersfile = /usr/local/etc/raddb/users
 files: acctusersfile = /usr/local/etc/raddb/acct_users
 files: compat = no
Module: Instantiated files (files)
Module: Loaded detail
 detail: detailfile =
/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail
 detail: detailperm = 384
 detail: dirperm = 493
Module: Instantiated detail (detail)
Module: Loaded radutmp
 radutmp: filename = /usr/local/var/log/radius/radutmp
 radutmp: username = %{User-Name}
 radutmp: perm = 384
 radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on
1814/udp.
Ready to process requests.
[New LWP 4]
rad_recv: Access-Request packet from host 130.75.xx.xx:2343, id=36,
length=63
User-Name = ks
NAS-IP-Address = 130.75.xx.xx
Framed-MTU = 1000
EAP-Message = \002\001\000\007\001ks
Message-Authenticator = 0xd61f273476c1d685ab6a352c8ef53957
modcall: entering group authorize
  modcall[authorize]: module preprocess returns ok
  modcall[authorize]: module eap returns updated
  modcall[authorize]: module suffix returns ok
  modcall[authorize]: module files returns notfound

Re: WinXP/Cisco/Freeradius - Configuring 802.1X Port-Based Authentication

2002-03-07 Thread Raghu

Hi Hajo,

Try running radiusd from src/main and check with gdb.

A second look at the logs posted, shows a weird thing like,
 EAP packet length is 0 (EAP-Message = \001$\000\000\004\020 )
 but there are a bunch of EAP-Messages created.
 This should never happen.

So I would like to find out the root cause of this problem.
If possible try to send all the info like logs, configurations,
OS etc


-Raghu

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html



WinXP/Cisco/Freeradius - Configuring 802.1X Port-Based Authentication

2002-03-06 Thread Hajo Kessener

Hi,

does anybody have dot1x port-based authentication up and running for
WinXP/Cisco Catalyst/Freeradius ? (see
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/1216ea2/scg/swg8
021x.htm#10608). I have a LAN-connection in WinXP configured with 802.1x
enabled using EAP-MD5. Set up the radius-settings on a Catalyst 6009 and
enabled dot1x (port-control auto). The Freeradius (latest
nightly-snapshot) is running with the new EAP-MD5 module (thanks a lot for
this work). After startup WinXP prompts for Username/Password to
authenticate for the LAN-connection. The Freeradius debug-ouput is the
following:

-- snip --
Ready to process requests.
rad_recv: Access-Request packet from host 130.75.xx.xx:2343, id=34,
length=63
User-Name = ks
NAS-IP-Address = 130.75.xx.xx
Framed-MTU = 1000
EAP-Message = \002\001\000\007\001ks
Message-Authenticator = 0x5d2caed87f294fb5bf14f316c92956e0
modcall: entering group authorize
  modcall[authorize]: module preprocess returns ok
  modcall[authorize]: module eap returns updated
  modcall[authorize]: module suffix returns ok
  modcall[authorize]: module files returns notfound
modcall: group authorize returns updated
  rad_check_password:  Found Auth-Type EAP
auth: type EAP
modcall: entering group authenticate
rlm_eap: processing type md5
  modcall[authenticate]: module eap returns ok
modcall: group authenticate returns ok
Login OK: [ks/no User-Password attribute] (from nas UNKNOWN-NAS port 0)
Sending Access-Challenge of id 34 to 130.75.xx.xx:2343
EAP-Message = \001\000\000\004\020\250l\211\245\032\245\250k ...
EAP-Message = back\000\004@\350inistrative\t11\n\n#\tFr\000 ...
EAP-Message = \000\000\000\030ynch\000\004A\350us\t6\n\n#\t ...
EAP-Message = ALUE\000\000\000\030amed\000\004B\350pression\t ...
...
Segmentation Fault - core dumped
-- snip --

Freeradius sends about 40 EAP-Messages until it fails with a core dump.

Thanks a lot for your help.

Regards,
Hajo


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html



Re: WinXP/Cisco/Freeradius - Configuring 802.1X Port-Based Authentication

2002-03-06 Thread Raghu

does anybody have dot1x port-based authentication up and running for
WinXP/Cisco Catalyst/Freeradius ? (see
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/1216ea2/scg/swg8
021x.htm#10608). I have a LAN-connection in WinXP configured with 802.1x
enabled using EAP-MD5. Set up the radius-settings on a Catalyst 6009 and
enabled dot1x (port-control auto). The Freeradius (latest
nightly-snapshot) is running with the new EAP-MD5 module (thanks a lot for
this work). After startup WinXP prompts for Username/Password to
authenticate for the LAN-connection. The Freeradius debug-ouput is the
following:

Looks like a configuration problem.
Can you send the radiusd.conf.


Freeradius sends about 40 EAP-Messages until it fails with a core dump.
Can you use GDB on the core and send the output.

-Raghu

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html