[RADIATOR] (RADIATOR) AuthBy LSA Error when using groups

Hugh Irvine hugh at open.com.au
Thu Jun 26 20:12:02 CDT 2008


Hello Kristof -

Thanks for your mail.

The debug you sent shows an error in the AuthBy FILE clause in the  
default Handler:

......

Thu Jun 26 09:54:26 2008: DEBUG: Packet dump:
*** Received from 10.223.143.54 port 32769 ....
Code:       Access-Request
Identifier: 105
Authentic:   
<173><181><173>qD<186><243>1<151><13><200>s<248><209><165><171>
Attributes:
	User-Name = "XPP243"
	Calling-Station-Id = "00-13-E8-58-43-A9"
	Called-Station-Id = "00-19-07-8C-8E-C0:tcm-work"
	NAS-Port = 1
	NAS-IP-Address = 10.223.143.54
	NAS-Identifier = "wlan1"
	Airespace-WLAN-Id = 2
	Service-Type = Framed-User
	Framed-MTU = 1300
	NAS-Port-Type = Wireless-IEEE-802-11
	Tunnel-Type = 0:VLAN
	Tunnel-Medium-Type = 0:802
	Tunnel-Private-Group-ID = 10
	EAP-Message = <2><7><0><144><25><0><23><3><1><0> <151><21>~<176>,| 
Zy<231><180><163>=7<14>A<130>L<219><188><178>]<160><23><166><235>1 
[<189>Mtq<155><23><3><1><0>`k 
{<215><200><163><25><247><235>S<189>o<13><164>S%0<2>]<188><216>} 
<160><227>E<0><192><197><201>!W<214><224><<28><151>N<238>v 
$g0<205><225>U<143>R<253>Vl<160>t^K<15>u<26>&<148>f<4>.<143><230><244>)< 
9><225>2jt<27><160><182><195><31>/<190><242>9gJ  
s^<23><193><178>7<3><170><189><29><4>=R<217>
	Message-Authenticator =  
<15><212><183><131><14>v<238><254><215><15><<227>&g<170><162>

Thu Jun 26 09:54:26 2008: DEBUG: Handling request with Handler ''
Thu Jun 26 09:54:26 2008: DEBUG:  Deleting session for XPP243,  
10.223.143.54, 1
Thu Jun 26 09:54:26 2008: DEBUG: Handling with Radius::AuthFILE:
Thu Jun 26 09:54:26 2008: DEBUG: Handling with EAP: code 2, 7, 144, 25
Thu Jun 26 09:54:26 2008: DEBUG: Response type 25
Thu Jun 26 09:54:26 2008: ERR: EAP PEAP TLS read failed:  2480: 1 -  
error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad  
record mac

Thu Jun 26 09:54:26 2008: DEBUG: EAP result: 1, EAP PEAP TLS read failed
Thu Jun 26 09:54:26 2008: DEBUG: AuthBy FILE result: REJECT, EAP PEAP  
TLS read failed
Thu Jun 26 09:54:26 2008: INFO: Access rejected for XPP243: EAP PEAP  
TLS read failed
Thu Jun 26 09:54:26 2008: DEBUG: Packet dump:
*** Sending to 10.223.143.54 port 32769 ....
Code:       Access-Reject
Identifier: 105
Authentic:   
<173><181><173>qD<186><243>1<151><13><200>s<248><209><165><171>
Attributes:
	Reply-Message = "Request Denied"


This doesn't have anything to do with a Group specification in the  
AuthBy LSA clause.

Can you please send a more complete debug showing both success  
without Group's and failure with Group's?

regards

Hugh


On 26 Jun 2008, at 19:58, <kristof.vandenouweland at thomsonreuters.com>  
<kristof.vandenouweland at thomsonreuters.com> wrote:

> Hi All,
>
> We've successfully set up a configuration for Radiator using
> PEAP/MSCHAPV2 and then LSA
>
> Now the strange thing is, from the moment we add the Group property to
> the LSA authentication to check wether the user is in a group and  
> so may
> connect, the repsonse givin back seems to be wrong and causes a TLS  
> READ
> error (see log) which results in a REJECTED message
>
> I've tried non-existing groups to see wether he can dedect them which
> than add the following line :
>
>   Thu Jun 26 09:45:47 2008: DEBUG: Radius::AuthLSA looks for match  
> with
> TLR\u0093289 [TLR\u0093289]
>   Thu Jun 26 09:45:52 2008: DEBUG: Radius::AuthLSA REJECT: AuthBy LSA
> User is not a member of any Group: TLR\u0093289 [TLR\u0093289]
>   Thu Jun 26 09:45:52 2008: DEBUG: AuthBy LSA result: REJECT,  
> AuthBy LSA
> User is not a member of any Group
>   Thu Jun 26 09:45:52 2008: INFO: Access rejected for TLR\u0093289:
> AuthBy LSA User is not a member of any Group
>
>    :  and then result in an REJECTED, which is off course normal.  
> (Just
> to point that he can dedect groups)
>
> Rejection message encoutering:
>
>   Thu Jun 26 09:45:52 2008: DEBUG: EAP TLS SSL_accept result: -1, 1,
> 8465
>   Thu Jun 26 09:45:53 2008: ERR: EAP TLS error: -1, 1, 8465,  2832:  
> 1 -
> error:140940F5:SSL routines:SSL3_READ_BYTES:unexpected record
>
>   Thu Jun 26 09:45:53 2008: DEBUG: EAP result: 1, EAP PEAP TLS error
>   Thu Jun 26 09:45:53 2008: DEBUG: AuthBy FILE result: REJECT, EAP  
> PEAP
> TLS error
>   Thu Jun 26 09:45:53 2008: INFO: Access rejected for XPP243: EAP PEAP
> TLS error
>
>
> If we remove the groups, everything is back to normal and functions
> fine.
>
>
> Did someone encounter this problem and found a solution?
>
> Much appreciated
>
> See config below and log in attachment
>
> Kind regards,
> Met vriendelijke groet,
>
> Kristof Van Den Ouweland
> ---------------------------------------------------------------------- 
> --
> -------------------
>
> DbDir %D
> Trace 4
> LogStdout
> AuthPort 1812
> AcctPort 1813
> LogFile c:\Radiator\logs\%Y-%m-logfile.log
> PidFile %D/radiusd.pid
> DictionaryFile c:\Radiator\dictionary
>
> <Client 10.223.143.54>
>         Secret  somehting
>         DupInterval 0
> 		
> </Client>
>
>
> <Client LOCALHOST>
> 	Secret somethingelse
> 	DupInterval 0	
> 	Identifier LOCALHOST
> 	
> </Client>
>
> <AuthLog FILE>
> 	Identifier logger1
> 	Filename c:\Radiator\authenticationlogs\%Y-%m-authlog.log
> 	LogSuccess 1
> 	LogFailure 1
> </AuthLog>
>
> <Handler Client-Identifier=LOCALHOST>
>
>                 # Connection to LDAP Thomson TLR AD
>                 <AuthBy LSA>
> 				  #EAPType MSCHAP-v2
>
> 					#Only users in these groups are
> allowed to have access to the WLAN
> 					#Group CME-grpDomainAdmins
> 					#Group CME-grpWLANAccess
> 					
> 				
>                 </AuthBy>
> </Handler>
>
> <Handler ConvertedFromEAPMSCHAPV2=1>
>
> 	        <AuthBy RADIUS>
> 			Host localhost
>        		        Secret somethingelse
>                 	AuthPort 1812
>                 	AcctPort 1813
>                 	StripFromRequest ConvertedFromEAPMSCHAPV2
> 					
>         	</AuthBy>
> 			
> </Handler>
>
> <Handler TunnelledByPEAP=1>
>         <AuthBy FILE>
>             EAPType MSCHAP-V2
>             EAP_PEAP_MSCHAP_Convert 1	
>         </AuthBy>
> </Handler>
>
> <Handler>
>         <AuthBy FILE>
> 			Filename c:/Radiator/users
>             EAPType PEAP, TTLS
>             EAPTLS_CAFile c:/Radiator/certificates/demoCA/cacert.pem
>             EAPTLS_CertificateFile
> c:/Radiator/certificates/signed-newcert.pem
>             EAPTLS_CertificateType PEM
>             EAPTLS_PrivateKeyFile c:/Radiator/certificates/newkey.pem
>             EAPTLS_PrivateKeyPassword somethingdifferent
>             EAPTLS_MaxFragmentSize 2048
>             EAPAnonymous anonymous
>             EAPTLS_PEAPVersion 0
> 	RejectEmptyPassword
> 	EAPTLS_PEAPBrokenV1Label
> 			
>         </AuthBy>
> 		
> 		AuthLog logger1
>
> </Handler><log_radius_exmaple.txt>



NB:

Have you read the reference manual ("doc/ref.html")?
Have you searched the mailing list archive (www.open.com.au/archives/ 
radiator)?
Have you had a quick look on Google (www.google.com)?
Have you included a copy of your configuration file (no secrets),
together with a trace 4 debug showing what is happening?
Have you checked the RadiusExpert wiki:
http://www.open.com.au/wiki/index.php/Main_Page

-- 
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. Available on *NIX, *BSD, Windows, MacOS X.
Includes support for reliable RADIUS transport (RadSec),
and DIAMETER translation agent.
-
Nets: internetwork inventory and management - graphical, extensible,
flexible with hardware, software, platform and database independence.
-
CATool: Private Certificate Authority for Unix and Unix-like systems.




More information about the radiator mailing list