teratail
回答率
85.30%
質問するログイン新規登録
トップに関する質問FreeRADIUSでEAP-TLS認証がしたい

編集履歴

質問編集履歴

4

説明追加

2018/03/29 01:15

投稿

ma-yu
ma-yu

スコア57

title CHANGED
File without changes
body CHANGED
@@ -45,7 +45,7 @@
45
45
 
46
46
  FreeRADIUS -Xから"Reply-Message = "20180328Hello, user"が出たのでRADIUS側は成功しているのではと思ってしまいました。
47
47
 
48
- <wpa_supplicant　ログ>
48
+ <wpa_supplicant　ログ>（一部省略あり）
49
49
  ```
50
50
  ~# wpa_supplicant -i eth3 -c /etc/wpa_supplicant.conf -D wired -dd
51
51
  wpa_supplicant v2.6
@@ -54,7 +54,7 @@
54
54
  Initializing interface 'eth3' conf '/etc/wpa_supplicant.conf' driver 'wired' ctrl_interface 'N/A' bridge 'N/A'
55
55
  ＊文字数制限のため省略します。
56
56
  ＊
57
- ＊
57
+ ＊省略終わり
58
58
  EAPOL: Received EAP-Packet frame
59
59
  EAPOL: SUPP_PAE entering state RESTART
60
60
  EAP: EAP entering state INITIALIZE
@@ -130,7 +130,7 @@
130
130
 
131
131
  ```
132
132
 
133
- <freeradius -X　ログ>
133
+ <freeradius -X　ログ>（省略なし）
134
134
 
135
135
  ```
136
136
 

3

誤字修正

2018/03/29 01:15

投稿

ma-yu
ma-yu

スコア57

title CHANGED
File without changes
body CHANGED
@@ -129,7 +129,7 @@
129
129
 
130
130
 
131
131
  ```
132
- ### 2018/03/29 9:45 追記２
132
+
133
133
  <freeradius -X　ログ>
134
134
 
135
135
  ```

2

不足情報の追加

2018/03/29 01:14

投稿

ma-yu
ma-yu

スコア57

title CHANGED
File without changes
body CHANGED
@@ -29,75 +29,225 @@
29
29
  }
30
30
  ```
31
31
 
32
+ ### 試したこと
33
+ クライアントPCよりeapol_testを行いました。
32
- ### 発生している問題・エラーメッセージ
34
+ PEAPは成功したのに、TLSがうまくいきません。
33
35
 
34
- 認証失敗時のログです。
36
+ ### 補足情報
35
37
 
36
- <freeradius -X>
37
- ```
38
- Delaying reject of request 1 for 1 seconds
39
- Going to the next request
40
- Waking up in 0.9 seconds.
41
- Sending delayed reject for request 1
42
- Sending Access-Reject of id 1 to 192.168.0.34 port 43842
43
- Reply-Message = "20180327Hello, user"
38
+ 使用している証明書はプライベートCAを構築し、サーバー証明書とクライアント証明書を作成しました。
44
- EAP-Message = 0x04010004
45
- Message-Authenticator = 0x00000000000000000000000000000000
46
- Waking up in 3.9 seconds.
47
- Cleaning up request 0 ID 0 with timestamp +6
39
+ サーバー証明書とクライアント証明書の認証局は同じプライベートCAになります。
48
- Waking up in 1.0 seconds.
49
- Cleaning up request 1 ID 1 with timestamp +6
50
- Ready to process requests.
51
- ```
52
40
 
41
+ ### 2018/03/29 9:45 追記
53
42
 
43
+ 認証失敗時のログをできる限り省略せずに示します。
44
+ 10000字制限により全ては書き込めませんでした。
45
+
46
+ FreeRADIUS -Xから"Reply-Message = "20180328Hello, user"が出たのでRADIUS側は成功しているのではと思ってしまいました。
47
+
54
- <eapol_test>
48
+ <wpa_supplicant　ログ>
55
49
  ```
50
+ ~# wpa_supplicant -i eth3 -c /etc/wpa_supplicant.conf -D wired -dd
51
+ wpa_supplicant v2.6
52
+ random: Trying to read entropy from /dev/random
53
+ Successfully initialized wpa_supplicant
54
+ Initializing interface 'eth3' conf '/etc/wpa_supplicant.conf' driver 'wired' ctrl_interface 'N/A' bridge 'N/A'
55
+ ＊文字数制限のため省略します。
56
+ ＊
57
+ ＊
58
+ EAPOL: Received EAP-Packet frame
59
+ EAPOL: SUPP_PAE entering state RESTART
60
+ EAP: EAP entering state INITIALIZE
61
+ EAP: EAP entering state IDLE
62
+ EAPOL: SUPP_PAE entering state AUTHENTICATING
63
+ EAPOL: SUPP_BE entering state REQUEST
64
+ EAPOL: getSuppRsp
65
+ EAP: EAP entering state RECEIVED
66
+ EAP: Received EAP-Request id=1 method=1 vendor=0 vendorMethod=0
67
+ EAP: EAP entering state IDENTITY
68
+ eth3: CTRL-EVENT-EAP-STARTED EAP authentication started
69
+ EAP: Status notification: started (param=)
70
+ EAP: EAP-Request Identity data - hexdump_ascii(len=0):
71
+ EAP: using real identity - hexdump_ascii(len=4):
72
+ 75 73 65 72 user
73
+ EAP: EAP entering state SEND_RESPONSE
74
+ EAP: EAP entering state IDLE
75
+ EAPOL: SUPP_BE entering state RESPONSE
76
+ EAPOL: txSuppRsp
77
+ TX EAPOL: dst=01:80:c2:xx:xx:xx
78
+ TX EAPOL - hexdump(len=13): 01 00 00 09 02 01 00 09 01 75 73 65 72
56
79
  EAPOL: SUPP_BE entering state RECEIVE
80
+ l2_packet_receive: src=34:76:c5:xx:xx:xx len=46
57
- Received 65 bytes from RADIUS server
81
+ eth3: RX EAPOL from 34:76:c5:xx:xx:xx
58
- Received RADIUS message
59
- RADIUS message: code=3 (Access-Reject) identifier=1 length=65
60
- Attribute 18 (Reply-Message) length=21
61
- Value: '20180327Hello, user'
62
- Attribute 79 (EAP-Message) length=6
63
- Value: 04 01 00 04
64
- Attribute 80 (Message-Authenticator) length=18
65
- Value: bd d5 54 1d ef af 23 1a f8 a7 ca e7 69 a1 6a d7
66
- STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 1.00 sec
82
+ RX EAPOL - hexdump(len=46): 02 00 00 06 01 02 00 06 0d 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
67
-
68
- RADIUS packet matching with station
69
- decapsulated EAP packet (code=4 id=1 len=4) from RADIUS server: EAP Failure
70
83
  EAPOL: Received EAP-Packet frame
71
84
  EAPOL: SUPP_BE entering state REQUEST
72
85
  EAPOL: getSuppRsp
73
86
  EAP: EAP entering state RECEIVED
87
+ EAP: Received EAP-Request id=2 method=13 vendor=0 vendorMethod=0
88
+ EAP: EAP entering state GET_METHOD
89
+ eth3: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=13
90
+ EAP: Status notification: accept proposed method (param=TLS)
91
+ EAP: Initialize selected EAP method: vendor 0 method 13 (TLS)
92
+ TLS: using phase1 config options
93
+ OpenSSL: tls_connection_ca_cert - Failed to load root certificates error:02001002:system library:fopen:No such file or directory
94
+ OpenSSL: pending error: error:2006D080:BIO routines:BIO_new_file:no such file
95
+ OpenSSL: pending error: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib
96
+ OpenSSL: tls_load_ca_der - Failed load CA in DER format error:02001002:system library:fopen:No such file or directory
97
+ OpenSSL: pending error: error:20074002:BIO routines:FILE_CTRL:system lib
98
+ OpenSSL: pending error: error:0B06F002:x509 certificate routines:X509_load_cert_file:system lib
99
+ TLS: Failed to set TLS connection parameters
100
+ ENGINE: engine deinit
101
+ EAP-TLS: Failed to initialize SSL.
102
+ eth3: EAP: Failed to initialize EAP method: vendor 0 method 13 (TLS)
103
+ EAP: Building EAP-Nak (requested type 13 vendor=0 method=0 not allowed)
104
+ EAP: allowed methods - hexdump(len=0):
105
+ EAP: EAP entering state SEND_RESPONSE
106
+ EAP: EAP entering state IDLE
107
+ EAPOL: SUPP_BE entering state RESPONSE
108
+ EAPOL: txSuppRsp
109
+ TX EAPOL: dst=01:80:c2:xx:xx:xx
110
+ TX EAPOL - hexdump(len=10): 01 00 00 06 02 02 00 06 03 00
111
+ EAPOL: SUPP_BE entering state RECEIVE
112
+ l2_packet_receive: src=34:76:c5:xx:xx:xx len=46
113
+ eth3: RX EAPOL from 34:76:c5:xx:xx:xx
114
+ RX EAPOL - hexdump(len=46): 02 00 00 04 04 02 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
115
+ EAPOL: Received EAP-Packet frame
116
+ EAPOL: SUPP_BE entering state REQUEST
117
+ EAPOL: getSuppRsp
118
+ EAP: EAP entering state RECEIVED
74
119
  EAP: Received EAP-Failure
120
+ EAP: Status notification: completion (param=failure)
75
121
  EAP: EAP entering state FAILURE
76
- CTRL-EVENT-EAP-FAILURE EAP authentication failed
122
+ eth3: CTRL-EVENT-EAP-FAILURE EAP authentication failed
77
123
  EAPOL: SUPP_PAE entering state HELD
124
+ EAPOL: Supplicant port status: Unauthorized
78
125
  EAPOL: SUPP_BE entering state RECEIVE
79
126
  EAPOL: SUPP_BE entering state FAIL
80
127
  EAPOL: SUPP_BE entering state IDLE
81
- eapol_sm_cb: success=0
82
- EAPOL: EAP key not available
83
- Control interface directory not empty - leaving it behind
128
+ EAPOL authentication completed - result=FAILURE
84
- MPPE keys OK: 0 mismatch: 1
85
- FAILURE
86
129
 
87
130
 
88
131
  ```
132
+ ### 2018/03/29 9:45 追記２
133
+ <freeradius -X　ログ>
89
134
 
135
+ ```
90
136
 
137
+ Ready to process requests.
138
+ rad_recv: Access-Request packet from host 192.168.1.253 port 19181, id=136, length=123
139
+ NAS-IP-Address = 192.168.1.253
140
+ NAS-Port = 5
141
+ User-Name = "user"
142
+ Called-Station-Id = "34-76-C5-70-F4-14"
143
+ Calling-Station-Id = "00-22-CF-F9-2E-04"
144
+ Service-Type = Framed-User
145
+ Framed-MTU = 1300
146
+ NAS-Port-Type = Ethernet
147
+ Message-Authenticator = 0x1d0cf8f2a5cdb24657f4d76dfb804dc2
148
+ EAP-Message = 0x020100090175736572
149
+ # Executing section authorize from file /etc/freeradius/sites-enabled/default
150
+ +group authorize {
151
+ ++[preprocess] = ok
152
+ ++[chap] = noop
153
+ ++[mschap] = noop
154
+ ++[digest] = noop
155
+ [suffix] No '@' in User-Name = "user", looking up realm NULL
156
+ [suffix] No such realm "NULL"
157
+ ++[suffix] = noop
158
+ [eap] EAP packet type response id 1 length 9
159
+ [eap] No EAP Start, assuming it's an on-going EAP conversation
160
+ ++[eap] = updated
161
+ [files] users: Matched entry user at line 94
162
+ [files] expand: 20180328Hello, %{User-Name} -> 20180328Hello, user
163
+ ++[files] = ok
164
+ ++[expiration] = noop
165
+ ++[logintime] = noop
166
+ [pap] WARNING: Auth-Type already set. Not setting to PAP
167
+ ++[pap] = noop
168
+ +} # group authorize = updated
169
+ Found Auth-Type = EAP
170
+ # Executing group from file /etc/freeradius/sites-enabled/default
171
+ +group authenticate {
172
+ [eap] EAP Identity
173
+ [eap] processing type tls
174
+ [tls] Requiring client certificate
175
+ [tls] Initiate
176
+ [tls] Start returned 1
177
+ ++[eap] = handled
178
+ +} # group authenticate = handled
179
+ Sending Access-Challenge of id 136 to 192.168.1.253 port 19181
180
+ Reply-Message = "20180328Hello, user"
181
+ EAP-Message = 0x010200060d20
182
+ Message-Authenticator = 0x00000000000000000000000000000000
183
+ State = 0x67ee941c67ec99990c723ec61783218e
184
+ Finished request 0.
185
+ Going to the next request
186
+ Waking up in 4.9 seconds.
187
+ rad_recv: Access-Request packet from host 192.168.1.253 port 50587, id=136, length=138
188
+ NAS-IP-Address = 192.168.1.253
189
+ NAS-Port = 5
190
+ User-Name = "user"
191
+ Called-Station-Id = "34-76-C5-70-F4-14"
192
+ Calling-Station-Id = "00-22-CF-F9-2E-04"
193
+ Service-Type = Framed-User
194
+ Framed-MTU = 1300
195
+ NAS-Port-Type = Ethernet
196
+ Message-Authenticator = 0xc32aa9880c71f8baab1c716b57118412
197
+ EAP-Message = 0x020200060300
198
+ State = 0x67ee941c67ec99990c723ec61783218e
199
+ # Executing section authorize from file /etc/freeradius/sites-enabled/default
200
+ +group authorize {
201
+ ++[preprocess] = ok
202
+ ++[chap] = noop
203
+ ++[mschap] = noop
204
+ ++[digest] = noop
205
+ [suffix] No '@' in User-Name = "user", looking up realm NULL
206
+ [suffix] No such realm "NULL"
207
+ ++[suffix] = noop
208
+ [eap] EAP packet type response id 2 length 6
209
+ [eap] No EAP Start, assuming it's an on-going EAP conversation
210
+ ++[eap] = updated
211
+ [files] users: Matched entry user at line 94
212
+ [files] expand: 20180328Hello, %{User-Name} -> 20180328Hello, user
213
+ ++[files] = ok
214
+ ++[expiration] = noop
215
+ ++[logintime] = noop
216
+ [pap] WARNING: Auth-Type already set. Not setting to PAP
217
+ ++[pap] = noop
218
+ +} # group authorize = updated
219
+ Found Auth-Type = EAP
220
+ # Executing group from file /etc/freeradius/sites-enabled/default
221
+ +group authenticate {
222
+ [eap] Request found, released from the list
223
+ [eap] EAP NAK
224
+ [eap] NAK asked for bad type 0
225
+ [eap] Failed in EAP select
226
+ ++[eap] = invalid
227
+ +} # group authenticate = invalid
228
+ Failed to authenticate the user.
229
+ Login incorrect: [user/<via Auth-Type = EAP>] (from client private-network-1 port 5 cli 00-22-CF-F9-2E-04)
230
+ Using Post-Auth-Type Reject
231
+ # Executing group from file /etc/freeradius/sites-enabled/default
232
+ +group REJECT {
233
+ [eap] Reply already contained an EAP-Message, not inserting EAP-Failure
234
+ ++[eap] = noop
235
+ [attr_filter.access_reject] expand: %{User-Name} -> user
236
+ attr_filter: Matched entry DEFAULT at line 11
237
+ ++[attr_filter.access_reject] = updated
238
+ +} # group REJECT = updated
239
+ Delaying reject of request 1 for 1 seconds
240
+ Going to the next request
241
+ Waking up in 0.9 seconds.
242
+ Sending delayed reject for request 1
243
+ Sending Access-Reject of id 136 to 192.168.1.253 port 50587
244
+ Reply-Message = "20180328Hello, user"
245
+ EAP-Message = 0x04020004
246
+ Message-Authenticator = 0x00000000000000000000000000000000
247
+ Waking up in 3.9 seconds.
248
+ Cleaning up request 0 ID 136 with timestamp +6
249
+ Waking up in 1.0 seconds.
250
+ Cleaning up request 1 ID 136 with timestamp +6
251
+ Ready to process requests.
91
252
 
92
- ### 試したこと
253
+ ```
93
- クライアントPCよりeapol_testを行いました。
94
- PEAPは成功したのに、TLSがうまくいきません。
95
-
96
- ### 補足情報（FW/ツールのバージョンなど）
97
-
98
- 使用している証明書はプライベートCAを構築し、サーバー証明書とクライアント証明書を作成しました。
99
- サーバー証明書とクライアント証明書の認証局は同じプライベートCAになります。
100
-
101
-
102
- FreeRADIUS側はSuccessのようなログがでますが、クライアントPC側はfailedが出ています。
103
- クライアント証明書が悪いのでしょうか？

1

タグ追加

2018/03/29 01:13

投稿

ma-yu
ma-yu

スコア57

title CHANGED
@@ -1,1 +1,1 @@
1
- FREERADIUSのEAP-TLSについて
1
+ FreeRADIUSでEAP-TLS認証がしたい
body CHANGED
File without changes