(RADIATOR) PEAP and Filter-ID

Berndt Sevcik berndt.sevcik at tgm.ac.at
Wed Jan 19 08:44:28 CST 2005


A small addendum to my last mail:

I tried tt with two different authentication mechanism:
  PEAP - is working
  TTLS - is not working

Sorry for the error.

Has sonemone an idea for TTLS?

Regards
Berndt

Am Mit, den 19.01.2005 schrieb Hugh Irvine um 8:48:
> Hello Berndt -
> 
> Have you installed all the latest patches?
> 
> regards
> 
> Hugh
> 
> 
> On 19 Jan 2005, at 18:15, Berndt Sevcik wrote:
> 
> > I am using already the latest version of Radiator (3.11).
> >
> > Berndt
> >
> > Am 19.01.2005 um 00:51 schrieb Hugh Irvine:
> >
> >>
> >> Hello Berndt -
> >>
> >> There is only one Access-Accept returned to the access point.
> >>
> >> The first Access-Accept is dealt with inside Radiator and causes an  
> >> Access-Challenge to be sent to the NAS to complete the MS-CHAP  
> >> authentication.
> >>
> >> Can you please tell me what version of Radiator you are using? The  
> >> latest version is Radiator 3.11 plus patches.
> >>
> >> Please try the latest version and let me know how you get on.
> >>
> >> regards
> >>
> >> Hugh
> >>
> >>
> >> On 19 Jan 2005, at 05:16, Berndt Sevcik wrote:
> >>
> >>> I configured 802.1x authentication with PEAP. Why do I get two Access
> >>> Accept messages?
> >>>
> >>> I also added with AddToReply an attribute to the answer message
> >>> (Filter-Id = "Enterasys:version=1:policy=ITS") which is included in  
> >>> the
> >>> first access accept message. Why message is investigated by the  
> >>> access
> >>> point? When the last one is interpreted by the access point how can I
> >>> assign the Filter-ID Attribut also to this one?
> >>>
> >>> I also attached my config at the end.
> >>>
> >>> Thanks
> >>> Berndt
> >>>
> >>> Tue Jan 18 18:59:57 2005: DEBUG: Handling request with Handler
> >>> 'Client-Identifier = IntegerVLANTag'
> >>> Tue Jan 18 18:59:57 2005: DEBUG:  Deleting session for berndt.sevcik,
> >>> 10.3.4.5,
> >>> Tue Jan 18 18:59:57 2005: DEBUG: Handling with Radius::AuthLDAP2:
> >>> Tue Jan 18 18:59:57 2005: INFO: Connecting to 10.2.4.22, port 389
> >>> Tue Jan 18 18:59:57 2005: INFO: Attempting to bind to LDAP server
> >>> 10.2.4.22:389)
> >>> Tue Jan 18 18:59:57 2005: DEBUG: LDAP got result for
> >>> uid=berndt.sevcik,ou=People,ou=admin,dc=tgm,dc=ac,dc=at
> >>> Tue Jan 18 18:59:57 2005: DEBUG: LDAP got rcryptPassword:  
> >>> {rcrypt}xxxx
> >>> Tue Jan 18 18:59:57 2005: DEBUG: Radius::AuthLDAP2 looks for match  
> >>> with
> >>> berndt.sevcik
> >>> Tue Jan 18 18:59:57 2005: DEBUG: Radius::AuthLDAP2 ACCEPT:
> >>> Tue Jan 18 18:59:58 2005: DEBUG: Access accepted for berndt.sevcik
> >>> Tue Jan 18 18:59:58 2005: DEBUG: Returned TTLS tunnelled Diameter  
> >>> Packet
> >>> dump:
> >>> Code:       Access-Accept
> >>> Identifier: UNDEF
> >>> Authentic:   
> >>> <235>#<139><214><6><177>7<0><148>5<202><226>2<151><239><29>
> >>> Attributes:
> >>>         MS-CHAP2-Success =
> >>> "<147>S=2BD0EAE2485256CD3D22D5184043F195A0B072EE"
> >>>         MS-MPPE-Send-Key =
> >>> "<176><253>$~<171><231><251>x<188>#<167><182><208>H<174><136>Rp<136>< 
> >>> 166>q<253>hS}<155>B<234><243><147><210><147>&<128>"
> >>>         MS-MPPE-Recv-Key =
> >>> "<215><22>Qh<194><128><7><129><2><130><201><202><167><196>7<234><197> 
> >>> <222><180><1>m$<188><161><184><22><176>or<238><6><176>>T"
> >>>         Filter-Id = "Enterasys:version=1:policy=ITS"
> >>>
> >>> Tue Jan 18 18:59:58 2005: DEBUG: EAP result: 3, EAP TTLS Inner
> >>> authentication challenged
> >>> Tue Jan 18 18:59:58 2005: DEBUG: Access challenged for berndt.sevcik:
> >>> EAP TTLS Inner authentication challenged
> >>> Tue Jan 18 18:59:58 2005: DEBUG: Packet dump:
> >>> *** Sending to 10.3.4.5 port 1046 ....
> >>> Code:       Access-Challenge
> >>> Identifier: 112
> >>> Authentic:  p:<0><0>/0<0><0><236>0<0><0><4>q<0><0>
> >>> Attributes:
> >>>         EAP-Message =
> >>> <1><7><0><227><21><128><0><0><0><217><23><3><1><0><212><168><192><137 
> >>> >Z<250>_x"<15><252>Is<178>C<198><234><221>''<246><16><131>s<190><241> 
> >>> ; 
> >>> <192><11>F<204><187><194>btGH<183><219>M<252><7><145><227><19>OW<161> 
> >>> <230><175><240><205><196><229><11><166><225><13><201><215>3<155>Q<141 
> >>> >: 
> >>> <129><246>o<222><218><28>P<155><193>_<134>[<131><13><129>l<173>Q<240> 
> >>> "Q<200><149><137><181><204><19><13><225><200><254>r<17><11>7<231><219 
> >>> >+g]<25>  
> >>> <14>)<140>u<21><5><13><135><9><253><127><148>x<209>.,b<5>c<174><246>< 
> >>> 147>A]<209>v<1><222><13><8><17>g<169><143>(X! 
> >>> <15>H<169>9<248>*<141>z? 
> >>> <219>.<201><168><238><147><235><172><211>b<227><213><237><159><222><1 
> >>> 63><134><186>A<11><243><238>A')<18><177>k_<9>Kr<15><2>l<138>cW<128>La 
> >>> <237>j<179><136><29><212><26>d<189><192><169>(<161><206>.<11>?<229>b
> >>>         Message-Authenticator =
> >>> <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
> >>>
> >>> Tue Jan 18 18:59:58 2005: DEBUG: Packet dump:
> >>> *** Received from 10.3.4.5 port 1046 ....
> >>> Code:       Access-Request
> >>> Identifier: 113
> >>> Authentic:  <137>e<0><0><183><0><0><0>0<15><0><0><176>q<0><0>
> >>> Attributes:
> >>>         Message-Authenticator = &{<137>o<187>Dl <197><235>o7<25>G<8>#
> >>>         User-Name = "berndt.sevcik"
> >>>         State = ""
> >>>         NAS-IP-Address = 10.3.4.5
> >>>         NAS-Port = 2
> >>>         NAS-Port-Type = Wireless-IEEE-802-11
> >>>         Calling-Station-Id = "00-0d-93-89-cc-6f"
> >>>         Framed-MTU = 1000
> >>>         EAP-Message = <2><7><0><6><21><0>
> >>>
> >>> Tue Jan 18 18:59:58 2005: DEBUG: Handling request with Handler
> >>> 'Client-Identifier = IntegerVLANTag'
> >>> Tue Jan 18 18:59:58 2005: DEBUG:  Deleting session for berndt.sevcik,
> >>> 10.3.4.5, 2
> >>> Tue Jan 18 18:59:58 2005: DEBUG: Handling with Radius::AuthLDAP2:
> >>> Tue Jan 18 18:59:58 2005: DEBUG: Handling with EAP: code 2, 7, 6
> >>> Tue Jan 18 18:59:58 2005: DEBUG: Response type 21
> >>> Tue Jan 18 18:59:58 2005: DEBUG: EAP result: 0,
> >>> Tue Jan 18 18:59:58 2005: DEBUG: Access accepted for berndt.sevcik
> >>> Tue Jan 18 18:59:58 2005: DEBUG: Packet dump:
> >>> *** Sending to 10.3.4.5 port 1046 ....
> >>> Code:       Access-Accept
> >>> Identifier: 113
> >>> Authentic:  <137>e<0><0><183><0><0><0>0<15><0><0><176>q<0><0>
> >>> Attributes:
> >>>         MS-MPPE-Send-Key =
> >>> "<147><164>q<158><167>bS<239><191><152><155><225>kB<170><192>8X<200>< 
> >>> 220>$<195><203><210>I(Z]<5><159>f<253><217><184><138><207><148><210>I 
> >>> s<169><150><175>Kp#<201><236><151>W"
> >>>         MS-MPPE-Recv-Key =
> >>> "<167><246>R<181>v<157><22><14><132>pDQ<219><186>k~<175><255>>q<151>Q 
> >>> H<237><133>8<14>%),<217>{<209><157><202><129>.<245><138>- 
> >>> <190><7><222><19><31>k<<223>&<199>"
> >>>         EAP-Message = <3><7><0><4>
> >>>         Message-Authenticator =
> >>> <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
> >>>
> >>> My config:
> >>>
> >>> # Foreground
> >>> LogStdout
> >>> LogDir          /var/log/radiator
> >>> LogFile         %L/radiator.log
> >>>
> >>> DbDir           /etc/radiator
> >>> PidFile         /var/run/radiusd.pid
> >>> Trace           4
> >>>
> >>> AuthPort 1645
> >>> AcctPort 1646
> >>>
> >>> <Client 10.3.4.5>
> >>>         Secret  secret
> >>>         Identifier IntegerVLANTag
> >>> </Client>
> >>>
> >>> <Handler Client-Identifier = IntegerVLANTag>
> >>> <AuthBy LDAP2>
> >>>     EAPType PEAP,TTLS
> >>>     EAPTLS_CAFile %D/certificates/cacert.pem
> >>>     EAPTLS_CertificateFile %D/certificates/edu-pdc02.pem
> >>>     EAPTLS_CertificateType PEM
> >>>     EAPTLS_PrivateKeyFile %D/certificates/edu-pdc02.pem
> >>>     EAPTLS_PrivateKeyPassword whatever
> >>>     EAPTLS_MaxFragmentSize 1000
> >>>     AutoMPPEKeys
> >>>     #RewriteUsername s/(.*)\\(.*)/$2/
> >>>     RcryptKey   whatever
> >>>     Host                10.2.4.22
> >>>     AuthDN              cn=admin,dc=tgm,dc=ac,dc=at
> >>>     AuthPassword        whatever
> >>>     BaseDN              dc=tgm,dc=ac,dc=at
> >>>     UsernameAttr        uid
> >>>     PasswordAttr        rcryptPassword
> >>>     AuthAttrDef         radiusAuthType,GENERIC,check
> >>>     #ReplyAttr       radiusReplyItem
> >>>     Debug 255
> >>>     AddToReply Filter-Id = Enterasys:version=1:policy=ITS
> >>> </AuthBy>
> >>>   #  PostAuthHook file:"%D/hooks/vlan-ascii-to-binary-postauth"
> >>> </Handler>
> >>>
> >>>
> >>>
> >>> --
> >>> Archive at http://www.open.com.au/archives/radiator/
> >>> Announcements on radiator-announce at open.com.au
> >>> To unsubscribe, email 'majordomo at open.com.au' with
> >>> 'unsubscribe radiator' in the body of the message.
> >>>
> >>>
> >>
> >> NB:
> >>
> >> Have you read the reference manual ("doc/ref.html")?
> >> Have you searched the mailing list archive  
> >> (www.open.com.au/archives/radiator)?
> >> Have you had a quick look on Google (www.google.com)?
> >> Have you included a copy of your configuration file (no secrets),
> >> together with a trace 4 debug showing what is happening?
> >>
> >> -- 
> >> Radiator: the most portable, flexible and configurable RADIUS server
> >> anywhere. Available on *NIX, *BSD, Windows, MacOS X.
> >> -
> >> Nets: internetwork inventory and management - graphical, extensible,
> >> flexible with hardware, software, platform and database independence.
> >> -
> >> CATool: Private Certificate Authority for Unix and Unix-like systems.
> >>
> >>
> >  -----------------------------------------
> >  TGM - Die Schule der Technik
> >  IT-Service
> >  A-1200 Wien, Wexstr. 19-23
> >  Tel. +43(1)33126/316 Fax: +43(1)33126/154
> >  E-Mail: berndt.sevcik at tgm.ac.at
> >  -----------------------------------------
> >
> > --
> > Archive at http://www.open.com.au/archives/radiator/
> > Announcements on radiator-announce at open.com.au
> > To unsubscribe, email 'majordomo at open.com.au' with
> > 'unsubscribe radiator' in the body of the message.
> >
> >
> 
> NB:
> 
> Have you read the reference manual ("doc/ref.html")?
> Have you searched the mailing list archive  
> (www.open.com.au/archives/radiator)?
> Have you had a quick look on Google (www.google.com)?
> Have you included a copy of your configuration file (no secrets),
> together with a trace 4 debug showing what is happening?

--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.


More information about the radiator mailing list