Re: problem with PEAP/MSCHAPv2
Christian Pinedo Zamalloa wrote: > hello, > > I have found some errors in my freeradius server logs. It seems that > some clients are having problems to authenticate againts them. I'm using > PEAP/MSCHAPv2 with the latest freeradius version and SUSE OS. > > Mon Mar 29 14:20:56 2010 : Error: TLS Alert write:fatal:protocol version > Mon Mar 29 14:20:56 2010 : Error: rlm_eap: SSL error error:1408F10B:SSL > routines:SSL3_GET_RECORD:wrong version number > Mon Mar 29 14:20:56 2010 : Error: SSL: SSL_read failed in a system call > (-1), TLS session fails. The client is likely doing TLS v1.1, and the OpenSSL libraries don't support it. i.e. the client is *ignoring* TLS negotiation. They're broken. Tell the vendor to fix them. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: problem with PEAP/MSCHAPv2
Hi, What OS is the client machine running? It would seem like an issue with the client to me. Regards, Matt Harlum On 31/03/2010, at 8:31 PM, Christian Pinedo Zamalloa wrote: > wrong version num > ber - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
problem with PEAP/MSCHAPv2
hello, I have found some errors in my freeradius server logs. It seems that some clients are having problems to authenticate againts them. I'm using PEAP/MSCHAPv2 with the latest freeradius version and SUSE OS. Mon Mar 29 14:20:56 2010 : Error: TLS Alert write:fatal:protocol version Mon Mar 29 14:20:56 2010 : Error: rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Mon Mar 29 14:20:56 2010 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. I have debuged the servers and when this error appears there are differences in the TLS negotiation of PEAP: example of succesful negotiation: [peap] processing EAP-TLS TLS Length 102 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0061], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 05aa], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED example of unsuccesful negotiation: [peap] processing EAP-TLS TLS Length 109 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0061], ClientHello [peap] TLS_accept: SSLv3 read client hello C [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 05aa], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] >>> Unknown TLS version [length 0002] TLS Alert write:fatal:protocol version [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version num ber SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS I will look if something is bad configured in the user's wifi profile, but does anybody have this problem previously? Thanks, -- Christian Pinedo Zamalloa (zako) PGP keyID: 0x828D0C80 Fingerprint: 7BFF 4105 F46B 7977 BD96 348C 1007 4FF8 828D 0C80 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Big Problem with peap-mschapv2+freeradius 1.1.7
Alan DeKok schrieb:
> Christian Frank wrote:
>> I have a big problem with my radius setup. I want to authenticate
>> my users with peap+mschapv2. The radius backend is an ldap server.
>
> Does the LDAP server contain a clear-text or NT hashed password for
> the user?
The ldap server contains a clear text password. I added it using jxplorer.
>
>> I have this setup working with Freeradius 1.0.1 on Redhat 4 ES.
>>
>> But after upgrading to 1.1.7 this setup does not work anymore.
>> I configured my radius/eap/client config file the same way like the old file
>> was.
>
> Are you sure? The configurations are similar, but not identical.
I will doublecheck this tomorrow morning. Maybe i haved missed something...
>
>> rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra)
>> rlm_ldap: checking if remote access for cfra is allowed by uid
>> rlm_ldap: looking for check items in directory...
>> rlm_ldap: looking for reply items in directory...
>> rlm_ldap: user cfra authorized to use remote access
>
> BUT there was no "known good" password for the user found in LDAP.
> That's why authentication is failing.
M. Here is my ldap config from radiusd.conf
ldap {
#server = "ldap.your.domain"
server = "150.150.40.241"
# identity = "cn=admin,o=My Org,c=UA"
identity = "cn=Manager,dc=rsel,dc=com"
# password = mypass
password = secret
#basedn = "o=My Org,c=UA"
basedn = "dc=rsel,dc=com"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
# base_filter = "(objectclass=radiusprofile)"
# set this to 'yes' to use TLS encrypted connections
# to the LDAP database by using the StartTLS extended
# operation.
# The StartTLS operation is supposed to be used with normal
# ldap connections instead of using ldaps (port 689) connections
start_tls = no
# tls_cacertfile= /path/to/cacert.pem
# tls_cacertdir= /path/to/ca/dir/
# tls_certfile= /path/to/radius.crt
# tls_keyfile= /path/to/radius.key
# tls_randfile= /path/to/rnd
# tls_require_cert= "demand"
# default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
# profile_attribute = "radiusProfileDn"
access_attr = "uid"
# Mapping of RADIUS dictionary attributes to LDAP
# directory attributes.
dictionary_mapping = ${raddbdir}/ldap.attrmap
ldap_connections_number = 5
#
# NOTICE: The password_header directive is NOT case insensitive
#
# password_header = "{clear}"
#
# Set:
#password_attribute = nspmPassword
#
# to get the user's password from a Novell eDirectory
# backend. This will work *only if* freeRADIUS is
# configured to build with --with-edir option.
#
#
# The server can usually figure this out on its own, and pull
# the correct User-Password or NT-Password from the database.
#
# Note that NT-Passwords MUST be stored as a 32-digit hex
# string, and MUST start off with "0x", such as:
#
#0x000102030405060708090a0b0c0d0e0f
#
# Without the leading "0x", NT-Passwords will not work.
# This goes for NT-Passwords stored in SQL, too.
#
# password_attribute = userPassword
#
# Un-comment the following to disable Novell eDirectory account
# policy check and intruder detection. This will work *only if*
# FreeRADIUS is configured to build with --with-edir option.
#
edir_account_policy_check=no
#
# groupname_attribute = cn
# groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
# groupmembership_attribute = radiusGroupName
timeout = 4
timelimit = 3
net_timeout = 1
# compare_check_items = yes
# do_xlat = yes
# access_attr_used_for_allow = yes
#
# By default, if the packet contains a User-Password,
# and no other module is configured to handle the
# authentication, the LDAP module sets itself to do
# LDAP bind for authentication.
#
# You can disable this behavior by setting the following
# configuration entry to "no".
#
# allowed values: {no, yes}
# set_auth_type = yes
}
The only thing i do not understand in this case is the password_header =
"{clear}" directive.
What is its prupose ? Maybe that is the problem ?
Today i tried 2.0 pre 1 and it is working with this version (And the
password_header thing seems to be changed in this version).
I get a big warning about that "something with my
Re: Big Problem with peap-mschapv2+freeradius 1.1.7
Christian Frank wrote: > I have a big problem with my radius setup. I want to authenticate > my users with peap+mschapv2. The radius backend is an ldap server. Does the LDAP server contain a clear-text or NT hashed password for the user? > I have this setup working with Freeradius 1.0.1 on Redhat 4 ES. > > But after upgrading to 1.1.7 this setup does not work anymore. > I configured my radius/eap/client config file the same way like the old file > was. Are you sure? The configurations are similar, but not identical. > rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra) > rlm_ldap: checking if remote access for cfra is allowed by uid > rlm_ldap: looking for check items in directory... > rlm_ldap: looking for reply items in directory... > rlm_ldap: user cfra authorized to use remote access BUT there was no "known good" password for the user found in LDAP. That's why authentication is failing. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Big Problem with peap-mschapv2+freeradius 1.1.7
Hi, I have a big problem with my radius setup. I want to authenticate my users with peap+mschapv2. The radius backend is an ldap server. I have this setup working with Freeradius 1.0.1 on Redhat 4 ES. But after upgrading to 1.1.7 this setup does not work anymore. I configured my radius/eap/client config file the same way like the old file was. I additionally tried to start the new radius with the old config files with the same effect, it does not work. Here is my setup: Freeradius 1.1.7 OPenldap (newest version) Clients: Windows Xp Sp 2 WPA Supplicant, Juniper Odyysee Client, Cisco Secure Services Client In my ldap i have following attributes: cn,uid, description, UserPassword, If i look at the logfiles, i can see that the ldap authorization seems to work. It seems that something goes wrong with the authentication. But i cant find the reason :-( ... Here is the logfile output of radiusd -X: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/freeradius/etc/raddb/proxy.conf Config: including file: /usr/local/freeradius/etc/raddb/clients.conf Config: including file: /usr/local/freeradius/etc/raddb/snmp.conf Config: including file: /usr/local/freeradius/etc/raddb/eap.conf Config: including file: /usr/local/freeradius/etc/raddb/sql.conf main: prefix = "/usr/local/freeradius" main: localstatedir = "/usr/local/freeradius/var" main: logdir = "/usr/local/freeradius/var/log/radius" main: libdir = "/usr/local/freeradius/lib" main: radacctdir = "/usr/local/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/freeradius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/freeradius/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/freeradius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/freeradius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/certs/wcsserver.key" tls: certificate_file = "/usr/local/certs/wcsserver.pem" tls: CA_file = "/usr/local/certs/root.pem" tls: private_key_password = "wcs" tls: dh_file = "/usr/local/freeradius/etc/raddb/certs/dh" tls: random_file = "/usr/local/freeradius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certifica
Problem with PEAP-MSCHAPV2
Hi all,I try to authenticate Windows XP SP2 client using PEAP-MSCHAPv2 through a D-Link DWL 900AP+ with freeradius-1.0.0 in a Linux RedHat 9 machine. I install the openssl-0.9.7e as below./config shared --prefix=/usr/local/opensslmakemake install For freeradius./configure --with-openssl-includes=/usr/local/openssl/include \--with-openssl-libraries=/usr/local/openssl/lib \--disable-sharedmakemake install For cerificatesCN for CA = KKKCN for client = kschiamCN for server = localhost.localdomain Wrapper Script#!/bin/sh/ -xLD_LIBRARY_PATH=/usr/local/openssl/libLD_PRELOAD=//usr/local/openssl/lib/libcrypto.soexport LD_LIBRARY_PATH LD_PRELOAD/usr/local/sbin/radiusd $@ For Windows XPI had install the root.pem and cert-clt.pl2. I disable the "Authenticate as computer when computerinformation is available" and "Automatically use my windows logon name and passwords" In user file"kschiam" User-Password =="100083" For D-Link AP802.1X is enabled Authentication = WPAEncryption Key Length = 64 bit The server able to start in debug mode, but no furtherresponse after sending access challenge. What i had missed out? I been stuck here quite a long time. Why there is "No EAP Start, assuming it's an on-going EAP conversationin debugging snippets?[EMAIL PROTECTED] root]# run-radius -X -A + LD_LIBRARY_PATH=/usr/local/openssl/lib + LD_PRELOAD=/usr/local/openssl/lib/libcrypto.so + export LD_LIBRARY_PATH LD_PRELOAD + /usr/local/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/1x/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/1x/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/1x/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/
