Вводные такие:
OpenSUSE 11.1 2.6.27.45-0.1-default x86_64.
freeradius 2.1.8-1.1
openssl 0.9.8h-28.15.1.
клиенты ХР sp3 и 7
Основным руководством было вот это http://www.ixbt.com/comm/prac-wpa-eap_3.shtml
с поправками на время написания сего руководства.
Сертификаты создавал с помощью инструментов freeradius из папки /etc/raddb/certs.
На клиентскую машину установлены CA и клиентский сертификат.
При попытке авторизации freeradius выдаёт вот такой вывод:
Код:
rad_recv: Access-Request packet from host 192.168.10.110 port 1128, id=64, length=154
User-Name = "rum-test-user"
NAS-IP-Address = 192.168.10.110
NAS-Identifier = "P2302HWUDLP1"
Framed-MTU = 1496
Called-Station-Id = "00-19-cb-6f-97-6c:marafon_co"
Calling-Station-Id = "00-21-91-1d-f2-a3"
NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020100120172756d2d746573742d75736572
Message-Authenticator = 0x266862e846693f09ac29bebfcf7b4ae6
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "rum-test-user", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 1 length 18
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[unix] returns notfound
++[files] returns noop
[sql] expand: %{User-Name} -> rum-test-user
[sql] sql_set_user escaped user --> 'rum-test-user'
rlm_sql (sql): Reserving sql socket id: 3
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'rum-test-user' ORDER BY id
[sql] User found in radcheck table
[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'rum-test-user' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'rum-test-user' ORDER BY priority
rlm_sql (sql): Released sql socket id: 3
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Found existing Auth-Type, not changing it.
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type md5
rlm_eap_md5: Issuing Challenge
++[eap] returns handled
Sending Access-Challenge of id 64 to 192.168.10.110 port 1128
EAP-Message = 0x0102001604101e41320351a20b5cce33b95a9dad1463
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8e62bf098e60bb934eac56150a84d601
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.10.110 port 1128, id=65, length=160
User-Name = "rum-test-user"
NAS-IP-Address = 192.168.10.110
NAS-Identifier = "P2302HWUDLP1"
Framed-MTU = 1496
Called-Station-Id = "00-19-cb-6f-97-6c:marafon_co"
Calling-Station-Id = "00-21-91-1d-f2-a3"
NAS-Port-Type = Wireless-802.11
EAP-Message = 0x02020006030d
State = 0x8e62bf098e60bb934eac56150a84d601
Message-Authenticator = 0x117f221a5c5ad4d0d7983016340106c2
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "rum-test-user", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 2 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[unix] returns notfound
++[files] returns noop
[sql] expand: %{User-Name} -> rum-test-user
[sql] sql_set_user escaped user --> 'rum-test-user'
rlm_sql (sql): Reserving sql socket id: 2
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'rum-test-user' ORDER BY id
[sql] User found in radcheck table
[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'rum-test-user' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'rum-test-user' ORDER BY priority
rlm_sql (sql): Released sql socket id: 2
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Found existing Auth-Type, not changing it.
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP NAK
[eap] EAP-NAK asked for EAP-Type/tls
[eap] processing type tls
[tls] Requiring client certificate
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 65 to 192.168.10.110 port 1128
EAP-Message = 0x010300060d20
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8e62bf098f61b2934eac56150a84d601
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.10.110 port 1128, id=66, length=234
User-Name = "rum-test-user"
NAS-IP-Address = 192.168.10.110
NAS-Identifier = "P2302HWUDLP1"
Framed-MTU = 1496
Called-Station-Id = "00-19-cb-6f-97-6c:marafon_co"
Calling-Station-Id = "00-21-91-1d-f2-a3"
NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020300500d800000004616030100410100003d03014bd179fe2c573cfe2aa4db977f1e9843febb
8372f8ccfa4631ebadf647c50fac00001600040005000a0009006400620003000600130012006301
0
0
State = 0x8e62bf098f61b2934eac56150a84d601
Message-Authenticator = 0xf520ea07dac4248fe22be095285f2a64
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "rum-test-user", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 3 length 80
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[unix] returns notfound
++[files] returns noop
[sql] expand: %{User-Name} -> rum-test-user
[sql] sql_set_user escaped user --> 'rum-test-user'
rlm_sql (sql): Reserving sql socket id: 1
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'rum-test-user' ORDER BY id
[sql] User found in radcheck table
[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'rum-test-user' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'rum-test-user' ORDER BY priority
rlm_sql (sql): Released sql socket id: 1
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Found existing Auth-Type, not changing it.
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
TLS Length 70
[tls] Length Included
[tls] eaptls_verify returned 11
[tls] (other): before/accept initialization
[tls] TLS_accept: before/accept initialization
[tls] <<< TLS 1.0 Handshake [length 0041], ClientHello
[tls] TLS_accept: SSLv3 read client hello A
[tls] >>> TLS 1.0 Handshake [length 002a], ServerHello
[tls] TLS_accept: SSLv3 write server hello A
[tls] >>> TLS 1.0 Handshake [length 083d], Certificate
[tls] TLS_accept: SSLv3 write certificate A
[tls] >>> TLS 1.0 Handshake [length 009d], CertificateRequest
[tls] TLS_accept: SSLv3 write certificate request A
[tls] TLS_accept: SSLv3 flush data
[tls] TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
[tls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 66 to 192.168.10.110 port 1128
EAP-Message = 0x010404000dc000000913160301002a0200002603014bd17a01b8119691985b53f5073c4df2062d
9e74a095ec13a106a18ebc5f856a00000400160301083d0b0008390008360003a03082039c308202
8
4a003020102020101300d06092a864886f70d010104050030818a310b30090603550406130252553
1
0f300d060355040813064d6f73636f77310f300d060355040713064d6f73636f7731153013060355
0
40a130c4d617261666f6e20496e632e3122302006092a864886f70d010901161361646d696e406c6
5
676769726f6e692e636f6d311e301c06035504031315436572746966696361746520417574686f72
6
97479301e170d3130303432
EAP-Message = 0x333039333332305a170d3131303432333039333332305a307f310b300906035504061302525531
0f300d060355040813064d6f73636f7731153013060355040a130c4d617261666f6e20496e632e31
2
430220603550403131b4b61736869726b61205365727665722043657274696669636174653122302
0
06092a864886f70d010901161361646d696e406c65676765726f6e692e636f6d30820122300d0609
2
a864886f70d01010105000382010f003082010a0282010100bae009fb4d4e81300376c6671e53951
8
674205563e482eb3d776275122067945eb5cf3fa40e3eaa9bdba5f717f9c252a095f743155febbff
7
fe5e36ee42a039165016e81
EAP-Message = 0xdbffb9f60220d1b41ec6a63685e2d7ab45878a487df65635507c7d7c8411237f1f1a3addc7fe37
a0cde3df53c304d62fc7ebecc5a1ebef30dcd8c77d572ca31b4c5a7a9d27097ba858a1f4c35ebdb4
f
b314391ec1ec259eb3f2edf368cb32b4871a82572bd7098fdbc5a846f52a60240efbb68c73f9a695
2
e0910e5960dff21ff36a5963f6fd19bb0aee93e4d710c0fc4e2ac2208128dc6cc0c28782c38b32a5
d
6afa49ef7a1357926f310db9a76f623f9cf7d903098b8311dc9fe2d0203010001a31730153013060
3
551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100642fa4
3
8cb633d47dade4ccc6a655c
EAP-Message = 0x970aa13c81f7b3e2186d9c73858321a6a5314b8e96923f6cb03d6b549ef93379d8e72f77e8da47
3550bf40b3872e86da50ae721d74acc94e2894f9654a63a20160bc3422562fcfabfa0bfc0dc4d9bc
b
951135db368f91480272fe3db1a7f6ffcd42ee75ad4dffc8312e5c644b3382026b8fe3ec11f37c0c
a
398b6170bf8ebff86e7f034cfe3fb2c4010495bc144c8e998e4d21396a5c434b6cb23bbc71808cd0
4
9a1d86234053665108329c792f0db4377ff748d94d2308bc171ea21d3d4a888a41d8d1a041520e8c
a
f1019601cc8fad7a305e1ea95d9918f2fb58f7ca6615d13443c1605376d0e2bf5b9857598d1314df
0
004903082048c30820374a0
EAP-Message = 0x03020102020900c4e98ac486
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8e62bf098c66b2934eac56150a84d601
Finished request 2.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 192.168.10.110 port 1128, id=67, length=160
User-Name = "rum-test-user"
NAS-IP-Address = 192.168.10.110
NAS-Identifier = "P2302HWUDLP1"
Framed-MTU = 1496
Called-Station-Id = "00-19-cb-6f-97-6c:marafon_co"
Calling-Station-Id = "00-21-91-1d-f2-a3"
NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020400060d00
State = 0x8e62bf098c66b2934eac56150a84d601
Message-Authenticator = 0x39c93643f903a38601593cccec7c1e3b
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "rum-test-user", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 4 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[unix] returns notfound
++[files] returns noop
[sql] expand: %{User-Name} -> rum-test-user
[sql] sql_set_user escaped user --> 'rum-test-user'
rlm_sql (sql): Reserving sql socket id: 0
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'rum-test-user' ORDER BY id
[sql] User found in radcheck table
[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'rum-test-user' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'rum-test-user' ORDER BY priority
rlm_sql (sql): Released sql socket id: 0
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Found existing Auth-Type, not changing it.
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
[tls] Received TLS ACK
[tls] ACK handshake fragment handler
[tls] eaptls_verify returned 1
[tls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 67 to 192.168.10.110 port 1128
EAP-Message = 0x010504000dc000000913cc4f79300d06092a864886f70d010105050030818a310b300906035504
0613025255310f300d060355040813064d6f73636f77310f300d060355040713064d6f73636f7731
1
53013060355040a130c4d617261666f6e20496e632e3122302006092a864886f70d0109011613616
4
6d696e406c65676769726f6e692e636f6d311e301c06035504031315436572746966696361746520
4
17574686f72697479301e170d3130303432333039323833345a170d3131303432333039323833345
a
30818a310b3009060355040613025255310f300d060355040813064d6f73636f77310f300d060355
0
40713064d6f73636f773115
EAP-Message = 0x3013060355040a130c4d617261666f6e20496e632e3122302006092a864886f70d010901161361
646d696e406c65676769726f6e692e636f6d311e301c060355040313154365727469666963617465
2
0417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a02820
1
0100d9beb0b07948dfe0cacb1bdbe863153e0a4b69aaf2046df6ce1dcc7c9736941bfa07c27c40d7
3
52df4be185ada85fca46d3ac7f3abe6a23d203a76cf681df2b7999c29c7a563ce028832861a49b61
c
63164997cf432daa4ea04731e4afbbca44c428c454ffd784c787be84ddd1d0a6f9021250b803c9ca
3
83490eb60e6ec1beec6bb11
EAP-Message = 0xbff5d115f6c94d0be3db6d01a5da64e9cac2bcefc6a09416b60ef1702bccef54e114f02cb5a94f
944dac762de28a9bab415262d1db5454233a1b1a51e3b2662321a3775937ad084738207726d4a47c
a
17661472737ad0ef6a449269fa75db8b980aea272b6aebd5828d7d2397c857a22c507d57bc480cdf
c
08721087110203010001a381f23081ef301d0603551d0e041604140fa9348074160e93bb27a9e116
3
d64291b1a70ff3081bf0603551d230481b73081b480140fa9348074160e93bb27a9e1163d64291b1
a
70ffa18190a4818d30818a310b3009060355040613025255310f300d060355040813064d6f73636f
7
7310f300d06035504071306
EAP-Message = 0x4d6f73636f7731153013060355040a130c4d617261666f6e20496e632e3122302006092a864886
f70d010901161361646d696e406c65676769726f6e692e636f6d311e301c06035504031315436572
7
46966696361746520417574686f72697479820900c4e98ac486cc4f79300c0603551d13040530030
1
01ff300d06092a864886f70d0101050500038201010041d56a5b67424e690c4a2c58deddabd94c33
a
00e3f283d8c4db26de1791d20d1f68b6c40a30bb818a15dea10358082ec3ceca5073c9b7dbe842d6
6
0f9d5a44e5dba5002805586438860fdfaa1964a8ac22f4ff3b267ff81db83bb4f42749bcfcacf058
0
f74e213033b0687af2dd6d1
EAP-Message = 0xce5e079c318187ec490e8ef5
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8e62bf098d67b2934eac56150a84d601
Finished request 3.
Going to the next request
Waking up in 4.7 seconds.
rad_recv: Access-Request packet from host 192.168.10.110 port 1128, id=68, length=160
User-Name = "rum-test-user"
NAS-IP-Address = 192.168.10.110
NAS-Identifier = "P2302HWUDLP1"
Framed-MTU = 1496
Called-Station-Id = "00-19-cb-6f-97-6c:marafon_co"
Calling-Station-Id = "00-21-91-1d-f2-a3"
NAS-Port-Type = Wireless-802.11
EAP-Message = 0x020500060d00
State = 0x8e62bf098d67b2934eac56150a84d601
Message-Authenticator = 0x7e2f29a029e94c088bd274a032f44eca
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "rum-test-user", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 5 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[unix] returns notfound
++[files] returns noop
[sql] expand: %{User-Name} -> rum-test-user
[sql] sql_set_user escaped user --> 'rum-test-user'
rlm_sql (sql): Reserving sql socket id: 4
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'rum-test-user' ORDER BY id
[sql] User found in radcheck table
[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'rum-test-user' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'rum-test-user' ORDER BY priority
rlm_sql (sql): Released sql socket id: 4
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Found existing Auth-Type, not changing it.
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
[tls] Received TLS ACK
[tls] ACK handshake fragment handler
[tls] eaptls_verify returned 1
[tls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 68 to 192.168.10.110 port 1128
EAP-Message = 0x010601310d8000000913df1953b20a7da13eeff93761256c9dc853d071eae09d95f9c807b388a3
b84e3b4f4e7b08148ed417ee807eddfab480117e4cc68d80b9180e3db4dd195cb8f1d27478c7b4c4
9
9ddb08e63ea6a47bcea5b3b0d422249bf4112df85cead93656bd843566ff4ca347a795f735348410
0
0a1f63ab0ac500c3e94eb40eb24c567ce7d242b4bd0d2c160301009d0d00009503010240008f008d
3
0818a310b3009060355040613025255310f300d060355040813064d6f73636f77310f300d0603550
4
0713064d6f73636f7731153013060355040a130c4d617261666f6e20496e632e3122302006092a86
4
886f70d010901161361646d
EAP-Message = 0x696e406c65676769726f6e692e636f6d311e301c06035504031315436572746966696361746520
417574686f726974790e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8e62bf098a64b2934eac56150a84d601
Finished request 4.
Going to the next request
Waking up in 4.7 seconds.
Cleaning up request 0 ID 64 with timestamp +20
Cleaning up request 1 ID 65 with timestamp +20
Waking up in 0.1 seconds.
Cleaning up request 2 ID 66 with timestamp +20
Cleaning up request 3 ID 67 with timestamp +20
Cleaning up request 4 ID 68 with timestamp +20
Из этого всего я понимаю что есть проблемы с чтением сертификатов. в часности вот это:
Код: Выделить всё
[tls] TLS_accept: Need to read more data: SSLv3 read client certificate AМысли такие:
Похоже на то что сертификат не правильный или супликант неверно работает с freeradius.
Вся информация в инете по этому поводу сильно устарела... и ничего внятного по этой проблеме я не нашёл.
Вопрос такой:
Кому удалось поднять всё это? Какими руководствами пользовались? Какие версии пакетов были установлены? Как генерировали сертификаты...
Бьюсь с этой проблемой уже неделю, но света в конце тонеля не видно. Где то есть принципиальная ошибка... или несовместимость.
Если нужны дополнительные сведения пишите что надо... - незамедлительно выложу.
