Bonjour,
Je souhaite mettre en place une architecture Wifi à l'aide de freeradius. Je veux utiliser EAP-TTLS avec mschapv2. J'ai des messages d'erreurs.
Voici mes fichiers de conf :
clients.conf :
Code:
client 127.0.0.1 {
secret = testing123
shortname = localhost
nastype = other # localhost isn't usually a NAS...
}
client 192.168.1.1 {
secret = secret
shortname = APPROJET
nastype = other
}
eap.conf :
Code:
eap {
default_eap_type = ttls
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
tls {
private_key_password = whatever
private_key_file = ${raddbdir}/certs/srv-linux.wifi.local.pem
certificate_file = ${raddbdir}/certs/srv-linux.wifi.local.pem
CA_file = ${raddbdir}/certs/root.pem
dh_file = ${raddbdir}/certs/dh
random_file = ${raddbdir}/certs/random
fragment_size = 1024
include_length = yes
}
ttls {
default_eap_type = mschapv2
copy_request_to_tunnel = yes
use_tunneled_reply = yes
}
mschapv2 {
}
}
users :
Code:
"test" Auth-Type := Local, User-Password =="test"
"nico" Auth-Type := EAP, User-Password =="nico"
radiusd.conf :
Code:
prefix = /usr/local
exec_prefix = ${prefix}
sysconfdir = /etc
localstatedir = ${prefix}/var
sbindir = ${exec_prefix}/sbin
logdir = /var/log
raddbdir = ${sysconfdir}/raddb
radacctdir = ${logdir}/radacct
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/radiusd
log_file = ${logdir}/radius.log
libdir = ${exec_prefix}/lib
pidfile = ${run_dir}/radiusd.pid
max_request_time = 30
delete_blocked_requests = no
cleanup_delay = 5
max_requests = 1024
bind_address = *
port = 0
hostname_lookups = no
allow_core_dumps = no
regular_expressions = yes
extended_expressions = yes
log_stripped_names = no
log_auth = no
log_auth_badpass = no
log_auth_goodpass = no
usercollide = no
lower_user = no
lower_pass = no
nospace_user = no
nospace_pass = no
checkrad = ${sbindir}/checkrad
security {
max_attributes = 200
reject_delay = 1
status_server = no
}
proxy_requests = no
$INCLUDE ${confdir}/proxy.conf
$INCLUDE ${confdir}/clients.conf
snmp = no
$INCLUDE ${confdir}/snmp.conf
thread pool {
start_servers = 5
max_servers = 32
min_spare_servers = 3
max_spare_servers = 10
max_requests_per_server = 0
}
modules {
$INCLUDE ${confdir}/eap.conf
mschap {
authtype = MS-CHAPv2
}
preprocess {
huntgroups = ${confdir}/huntgroups
hints = ${confdir}/hints
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
}
files {
usersfile = ${confdir}/users
acctusersfile = ${confdir}/acct_users
preproxy_usersfile = ${confdir}/preproxy_users
compat = no
}
detail {
detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
detailperm = 0600
}
acct_unique {
key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
}
radutmp {
filename = ${logdir}/radutmp
username = %{User-Name}
case_sensitive = yes
check_with_nas = yes
callerid = "yes"
perm = 0600
}
radutmp sradutmp {
filename = ${logdir}/sradutmp
perm = 0644
callerid = "no"
}
attr_filter {
attrsfile = ${confdir}/attrs
}
counter daily {
filename = ${raddbdir}/db.daily
key = User-Name
count-attribute = Acct-Session-Time
reset = daily
counter-name = Daily-Session-Time
check-name = Max-Daily-Session
allowed-servicetype = Framed-User
cache-size = 5000
}
always fail {
rcode = fail
}
always reject {
rcode = reject
}
always ok {
rcode = ok
simulcount = 0
mpp = no
}
expr {
}
exec {
wait = yes
input_pairs = request
}
exec echo {
wait = yes
program = "/bin/echo %{User-Name}"
input_pairs = request
output_pairs = reply
}
instantiate {
exec
expr
}
authorize {
preprocess
mschap
eap
files
}
authenticate {
Auth-Type MS-CHAP {
mschap
}
eap
}
preacct {
preprocess
acct_unique
files
}
accounting {
detail
radutmp
}
session {
radutmp
}
post-auth {
}
pre-proxy {
}
post-proxy {
eap
}
Voici le message du mode debug (radius -X -A) :
Code:
rad_recv: Access-Request packet from host 192.168.1.1:32913, id=5, length=170
User-Name = "anonyme@monentreprise.fr"
NAS-IP-Address = 192.168.1.1
Called-Station-Id = "00-0D-54-FB-61-72:ttls"
Calling-Station-Id = "00-0E-35-94-07-7B"
NAS-Identifier = ""
NAS-Port = 29
Service-Type = Framed-User
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
EAP-Message = 0x0205001d01616e6f6e796d65406d6f6e656e74726570726973652e6672
Message-Authenticator = 0x666aab110a7c501e49b549313b3b4e1b
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
rlm_eap: EAP packet type response id 5 length 29
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 0
users: Matched entry DEFAULT at line 156
users: Matched entry DEFAULT at line 175
modcall[authorize]: module "files" returns ok for request 0
modcall: leaving group authorize (returns updated) for request 0
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: EAP Identity
rlm_eap: processing type tls
rlm_eap_tls: Initiate
rlm_eap_tls: Start returned 1
modcall[authenticate]: module "eap" returns handled for request 0
modcall: leaving group authenticate (returns handled) for request 0
Sending Access-Challenge of id 5 to 192.168.1.1 port 32913
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x010600061520
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xd9db4cca54dd0b13a7c7fa510bd9e0ff
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.1.1:32914, id=6, length=261
User-Name = "anonyme@monentreprise.fr"
NAS-IP-Address = 192.168.1.1
Called-Station-Id = "00-0D-54-FB-61-72:ttls"
Calling-Station-Id = "00-0E-35-94-07-7B"
NAS-Identifier = ""
NAS-Port = 29
Service-Type = Framed-User
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
State = 0xd9db4cca54dd0b13a7c7fa510bd9e0ff
EAP-Message = 0x020600661500160301005b010000570301461e17b0860f09a447f4bb2bed3404b9137974e95339a16802e31318eea237dc00003000390038003500160013000a00330032002f0066000500040065006400630062006000150012000900140011000800030100
Message-Authenticator = 0x4050c580de8aa3f3e9092010ba9a12de
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
rlm_eap: EAP packet type response id 6 length 102
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 1
users: Matched entry DEFAULT at line 156
users: Matched entry DEFAULT at line 175
modcall[authorize]: module "files" returns ok for request 1
modcall: leaving group authorize (returns updated) for request 1
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 1
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
(other): before/accept initialization
TLS_accept: before/accept initialization
rlm_eap_tls: <<<TLS>>> TLS 1.0 Handshake [length 004a], ServerHello
TLS_accept: SSLv3 write server hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0652], Certificate
TLS_accept: SSLv3 write certificate A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
TLS_accept: SSLv3 write server done A
TLS_accept: SSLv3 flush data
TLS_accept:error in SSLv3 read client certificate A
rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0)
In SSL Handshake Phase
In SSL Accept mode
eaptls_process returned 13
modcall[authenticate]: module "eap" returns handled for request 1
modcall: leaving group authenticate (returns handled) for request 1
Sending Access-Challenge of id 6 to 192.168.1.1 port 32914
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x0107040a15c0000006af160301004a020000460301461e185e2edb0d40717ad98dae29ac4dd387faa2a733ec3b80b1f5d14f22c0682024fd008921aac82c588875912b645c386dabb403828434eda81a1d240d36200200350016030106520b00064e00064b0002b1308202ad30820216a003020102020101300d06092a864886f70d010104050030818d310b3009060355040613024652310c300a06035504081303494446310e300c060355040713054365726779310d300b060355040a13044954494e31143012060355040b130b70726f6a6574207769666931193017060355040313104954494e20576972656c6573732043413120301e06092a86
EAP-Message = 0x4886f70d01090116116b61626f756e733231406d736e2e636f6d301e170d3037303430333134303930375a170d3038303430323134303930375a308191310b3009060355040613024652310c300a06035504081303494446310e300c060355040713054365726779310d300b060355040a13044954494e31143012060355040b130b70726f6a65742077696669311d301b060355040313147372762d6c696e75782e776966692e6c6f63616c3120301e06092a864886f70d01090116116b61626f756e733231406d736e2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d1b510926706128c8067125c73b6a20f4174
EAP-Message = 0x2945ef6be6863c51783f6271bc19948eb92bd875acdb905b5ec96cd0e98ab97ad018f88191174b80a0457d9a93f85dcbd0fbce44f12e3368dab89b92f135d5383fcee686ed91d740ab84ab0348917a5e6ab07f9a2ff5c3b0cd0d1b1887996e240fcd244643d2dfcf1a043f64d7a10203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181009240590b0cfdd796feba0d9ba1d8773de354420836048972c3e1c8226adc706eb27048a71aad969bfb6c4509694e42a12303f5e734ba807be2fd8408800f7e7bc25c2dc64f686bfd3e2777e030025b19f959496d4521ada6eaf8d8fdbf4d
EAP-Message = 0x1b98ddaa456f8bd0bff203a143704b41a8ad66665f16478408211905eca00f87e11c00039430820390308202f9a003020102020900b8b0a09b1aae01d3300d06092a864886f70d010105050030818d310b3009060355040613024652310c300a06035504081303494446310e300c060355040713054365726779310d300b060355040a13044954494e31143012060355040b130b70726f6a6574207769666931193017060355040313104954494e20576972656c6573732043413120301e06092a864886f70d01090116116b61626f756e733231406d736e2e636f6d301e170d3037303430333134303531365a170d3038303430323134303531365a30
EAP-Message = 0x818d310b3009060355040613024652310c300a060355
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xa7e3d8a6b5fa1238dff6378c16da9c5b
Finished request 1
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.1.1:32915, id=7, length=165
User-Name = "anonyme@monentreprise.fr"
NAS-IP-Address = 192.168.1.1
Called-Station-Id = "00-0D-54-FB-61-72:ttls"
Calling-Station-Id = "00-0E-35-94-07-7B"
NAS-Identifier = ""
NAS-Port = 29
Service-Type = Framed-User
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
State = 0xa7e3d8a6b5fa1238dff6378c16da9c5b
EAP-Message = 0x020700061500
Message-Authenticator = 0x85e033e552410493c017878f97832c58
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
rlm_eap: EAP packet type response id 7 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 2
users: Matched entry DEFAULT at line 156
users: Matched entry DEFAULT at line 175
modcall[authorize]: module "files" returns ok for request 2
modcall: leaving group authorize (returns updated) for request 2
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 2
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake fragment handler
eaptls_verify returned 1
eaptls_process returned 13
modcall[authenticate]: module "eap" returns handled for request 2
modcall: leaving group authenticate (returns handled) for request 2
Sending Access-Challenge of id 7 to 192.168.1.1 port 32915
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x010802b91580000006af04081303494446310e300c060355040713054365726779310d300b060355040a13044954494e31143012060355040b130b70726f6a6574207769666931193017060355040313104954494e20576972656c6573732043413120301e06092a864886f70d01090116116b61626f756e733231406d736e2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100b1c460fa5ccc002ae623a334b7a930caad26140ed69a51c283965c4465c44587bef3a1298875750497c9641a5e464b14d21d27dfa03c5322a627570db44778c6d201ed7ed0c4f76877e80ad73d9a908643bce0fcd03127d83b39541914
EAP-Message = 0x06cfd96469de5aca582b500395f9c2f02effd9bd1691ab105abd12b6d4b0cbbb32fbb30203010001a381f53081f2301d0603551d0e04160414d1f50866e2308f76cb9ee73142c2caf5081203813081c20603551d230481ba3081b78014d1f50866e2308f76cb9ee73142c2caf508120381a18193a4819030818d310b3009060355040613024652310c300a06035504081303494446310e300c060355040713054365726779310d300b060355040a13044954494e31143012060355040b130b70726f6a6574207769666931193017060355040313104954494e20576972656c6573732043413120301e06092a864886f70d01090116116b61626f756e73
EAP-Message = 0x3231406d736e2e636f6d820900b8b0a09b1aae01d3300c0603551d13040530030101ff300d06092a864886f70d01010505000381810072149ae8736f0f19aee0a152f9f088cf7f871465187fcfaea8ee80273d7e9286ed67986e4bf3fbeb9decf113cb1975041c3dd7627df2bd8e2e73a65158b5e7f62b1cac2879fe8033992728677080f38fb621502974c9a599f813a1fb0d4c556bfbef3ccbbdbaeeef2d9e194b38cc4fdb8462ef5ce216a25c24e720e1fb78ba6016030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xc22c197ed0c4de73d2ca61134e8e5449
Finished request 2
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.1.1:32916, id=8, length=363
User-Name = "anonyme@monentreprise.fr"
NAS-IP-Address = 192.168.1.1
Called-Station-Id = "00-0D-54-FB-61-72:ttls"
Calling-Station-Id = "00-0E-35-94-07-7B"
NAS-Identifier = ""
NAS-Port = 29
Service-Type = Framed-User
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
State = 0xc22c197ed0c4de73d2ca61134e8e5449
EAP-Message = 0x020800cc1500160301008610000082008096e2e3a993f2b919ca3eb62f694e7e752cca96d34f34551fc442698c927a7efb696712859c72e1dea2817f003d7b98d26c03a7974c3f92e1ef9a8032f805ad19bc267280d4d03b39425463458c334912779ecc1d1c8ad4bc5c06566a72e7b8b09c6ce0ec2e97564067db60c2613e9b75ea353964cfdf98677d988e51b418f1ad140301000101160301003074348e8f0c082ef691585e0c32a19aad61f649b7a589c4415087f93e4e7437e8004e9bf854b70b8b4c653d0175935e5f
Message-Authenticator = 0x74ba8ce2fa087d8d15b97e1f8486373f
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
rlm_eap: EAP packet type response id 8 length 204
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 3
users: Matched entry DEFAULT at line 156
users: Matched entry DEFAULT at line 175
modcall[authorize]: module "files" returns ok for request 3
modcall: leaving group authorize (returns updated) for request 3
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 3
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange
TLS_accept: SSLv3 read client key exchange A
rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001]
rlm_eap_tls: <<<TLS>>> TLS 1.0 ChangeCipherSpec [length 0001]
TLS_accept: SSLv3 write change cipher spec A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished
TLS_accept: SSLv3 write finished A
TLS_accept: SSLv3 flush data
(other): SSL negotiation finished successfully
rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0)
SSL Connection Established
eaptls_process returned 13
modcall[authenticate]: module "eap" returns handled for request 3
modcall: leaving group authenticate (returns handled) for request 3
Sending Access-Challenge of id 8 to 192.168.1.1 port 32916
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x0109004515800000003b1403010001011603010030743c5d3fe343697a29b0bbdcca319d01e493693d331d696ffad03dbb9c45699890a3bc83d7b62f6debe20ebcd037c093
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x90fbaf8d42552395fc4d98c8f730a2b2
Finished request 3
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.1.1:32917, id=9, length=335
User-Name = "anonyme@monentreprise.fr"
NAS-IP-Address = 192.168.1.1
Called-Station-Id = "00-0D-54-FB-61-72:ttls"
Calling-Station-Id = "00-0E-35-94-07-7B"
NAS-Identifier = ""
NAS-Port = 29
Service-Type = Framed-User
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
State = 0x90fbaf8d42552395fc4d98c8f730a2b2
EAP-Message = 0x020900b0150017030100208a8684fc9f210a1fa5b1c3ec51048469d6fe3a0a33239eb95e528db991379a781703010080130d3503d09e40709aa6f4865bb98ad8ced00d86919d22924280584cc3f4841fb678152fb366adb4538ace53a963d4b19e6dfc12086b98741f8f4989ed4975d738d967a224f190c5bfd827d9fa4ee8d7c4718f44af706ca23ab66e67f879f18c8fbe9828be897f2356cdf0482b8dd90152cf1611ec386d7d0858f21b07374278
Message-Authenticator = 0x9405349379b1bd2e9a4e5f699ac4ac7e
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
rlm_eap: EAP packet type response id 9 length 176
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 4
users: Matched entry DEFAULT at line 156
users: Matched entry DEFAULT at line 175
modcall[authorize]: module "files" returns ok for request 4
modcall: leaving group authorize (returns updated) for request 4
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 4
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes.
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
rlm_eap: No EAP-Message, not doing EAP
modcall[authorize]: module "eap" returns noop for request 4
users: Matched entry nico at line 90
modcall[authorize]: module "files" returns ok for request 4
modcall: leaving group authorize (returns ok) for request 4
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 4
rlm_eap: EAP-Message not found
rlm_eap: Malformed EAP Message
modcall[authenticate]: module "eap" returns fail for request 4
modcall: leaving group authenticate (returns fail) for request 4
auth: Failed to validate the user.
TTLS: Got tunneled Access-Reject
rlm_eap: Handler failed in EAP/ttls
rlm_eap: Failed in EAP select
modcall[authenticate]: module "eap" returns invalid for request 4
modcall: leaving group authenticate (returns invalid) for request 4
auth: Failed to validate the user.
Merci beaucoup de votre aide
Kab
