Hi !<br><br>I am trying to replace freeradius with hostapd for an EAP-SIM session (and later EAP-AKA). The authentication is OK when using freeradius, but I don't get it to work with hostapd.<br><br>client: wpa_supplicant v0.4.9 and a SIM-card reader (pcscd) . <br>AP: cisco 1240AG<br>auth server: hostapd-0.5.8 as eap/radius-server on a Fedora Core 6 machine<br><br>With hostapd I see that the first Access-Challenge message is dropped by the AP. I see that there are some differences when I compare with the Access-Challenge which was sent when i used freeradius.<br><br>1) hostapd don't send reply-message within the Access-challenge even if I have "eap_message=hello" in hostapd.conf<br><br>2) freeradius uses "AT_AULLAUTH_ID_REQ" while hostapd uses "AT_PERMANENT_ID_REQ" (which should be OK I guess).<br><br>3) Message-Authenticator. -Can I verify that is is correct in any way ?<br><br><br>## Log and configuration<br><br>[root@longrow hostapd-0.5.8]#
/usr/local/src/hostapd-0.5.8/hostapd -ddt /usr/loc<br>al/src/hostapd-0.5.8/hostapd.conf<br>Configuration file: /usr/local/src/hostapd-0.5.8/hostapd.conf<br>BSS count 1, BSSID mask ff:ff:ff:ff:ff:ff (0 bits)<br>RATE[0] rate=10 flags=0x152<br>Could not set passive scanning: Unknown error 4294967295<br>1191309066.866152: Flushing old station entries<br>1191309066.866175: Deauthenticate all stations<br>1191309066.866186: test_driver_set_privacy(ifname= enabled=0)<br>1191309066.866199: test_driver_set_encryption(iface= alg=none idx=0 txkey=1)<br>1191309066.866213: test_driver_set_encryption(iface= alg=none idx=1 txkey=0)<br>1191309066.866225: test_driver_set_encryption(iface= alg=none idx=2 txkey=0)<br>1191309066.866237: test_driver_set_encryption(iface= alg=none idx=3 txkey=0)<br>Using interface with hwaddr 02:13:85:56:01:90 and ssid 'test'<br>1191309066.866279: test_driver_set_ssid(ifname=)<br>1191309066.866290: test_driver_set_ssid: SSID -
hexdump_ascii(len=4):<br> 74 65 73 74 test<br>1191309066.866355: : Setup of interface done.<br>1191309102.867683: RADIUS SRV: Received 146 bytes from 192.168.100.21:1645<br>1191309102.867727: RADIUS SRV: Received data - hexdump(len=146): 01 b7 00 92 0f<br>eb 79 90 8e ac f7 d0 69 be 7d 5b 5d cf e3 04 01 11 32 34 30 39 38 31 31 31 30 30<br> 31 35 32 32 30 0c 06 00 00 05 78 1e 10 30 30 31 39 2e 61 39 66 64 2e 34 39 64 3<br>0 1f 10 30 30 31 37 2e 39 61 62 61 2e 36 32 33 34 06 06 00 00 00 01 50 12 c5 21<br>af cb ae 53 b5 ff eb d6 27 1a ed 28 ca 1f 4f 16 02 02 00 14 01 32 34 30 39 38 31<br> 31 31 30 30 31 35 32 32 30 3d 06 00 00 00 13 05 06 00 00 2e a4 57 07 31 31 39 3<br>4 30 04 06 c0 a8 64 15<br>RADIUS message: code=1
(Access-Request) identifier=183 length=146<br> Attribute 1 (User-Name) length=17<br> Value: '240981110015220'<br> Attribute 12 (Framed-MTU) length=6<br> Value: 1400<br> Attribute 30 (Called-Station-Id) length=16<br> Value: '0019.a9fd.49d0'<br> Attribute 31 (Calling-Station-Id) length=16<br> Value: '0017.9aba.6234'<br> Attribute 6 (?Unknown?) length=6<br> Attribute 80 (Message-Authenticator) length=18<br> Value: c5 21 af cb ae 53 b5 ff eb d6 27 1a ed 28 ca 1f<br> Attribute 79 (EAP-Message) length=22<br> Value: 02 02 00 14 01 32 34 30 39 38 31 31 31 30 30 31 35 32 32 30<br> Attribute 61 (NAS-Port-Type) length=6<br> Value: 19<br> Attribute 5 (NAS-Port)
length=6<br> Value: 11940<br> Attribute 87 (?Unknown?) length=7<br> Attribute 4 (NAS-IP-Address) length=6<br> Value: 192.168.100.21<br>1191309102.868080: RADIUS SRV: Creating a new session<br>1191309102.868099: RADIUS SRV: User-Name - hexdump_ascii(len=15):<br> 32 34 30 39 38 31 31 31 30 30 31 35 32 32 30 240981110015220<br>1191309102.868136: RADIUS SRV: Matching user entry found<br>1191309102.868156: EAP: State machine created<br>1191309102.868169: RADIUS SRV: New session 0x0 initialized<br>1191309102.868184: RADIUS SRV: Received EAP data - hexdump(len=20): 02 02 00 14<br>01 32 34 30 39 38 31 31 31 30 30 31 35 32 32 30<br>1191309102.868211: EAP: EAP-Response received - hexdump(len=20): 02 02 00 14 01<br>32 34 30 39 38 31 31 31 30 30 31 35 32 32 30<br>1191309102.868241: EAP: EAP entering state INITIALIZE<br>1191309102.868255: EAP:
parseEapResp: rxResp=1 respId=2 respMethod=1 respVendor=<br>0 respVendorMethod=0<br>1191309102.868270: EAP: EAP entering state PICK_UP_METHOD<br>1191309102.868284: EAP: EAP entering state METHOD_RESPONSE<br>1191309102.868298: EAP-Identity: Peer identity - hexdump_ascii(len=15):<br> 32 34 30 39 38 31 31 31 30 30 31 35 32 32 30 240981110015220<br>1191309102.868330: EAP: EAP entering state SELECT_ACTION<br>1191309102.868344: EAP: getDecision: another method available -> CONTINUE<br>1191309102.868358: EAP: EAP entering state PROPOSE_METHOD<br>1191309102.868370: EAP: getNextMethod: vendor 0 type 18<br>1191309102.868385: EAP: EAP entering state METHOD_REQUEST<br>1191309102.868396: EAP: building EAP-Request: Identifier 3<br>1191309102.868409: EAP-SIM: Generating Start<br>1191309102.868427: AT_PERMANENT_ID_REQ<br>1191309102.868440: AT_VERSION_LIST<br>1191309102.868458: EAP: EAP entering
state SEND_REQUEST<br>1191309102.868470: EAP: eapReqData -> EAPOL - hexdump(len=20): 01 03 00 14 12 0a<br> 00 00 0a 01 00 00 0f 02 00 02 00 01 00 00<br>1191309102.868497: EAP: EAP entering state IDLE<br>1191309102.868509: RADIUS SRV: EAP data from the state machine - hexdump(len=20)<br>: 01 03 00 14 12 0a 00 00 0a 01 00 00 0f 02 00 02 00 01 00 00<br>1191309102.868553: RADIUS SRV: Reply to 192.168.100.21:1645<br>RADIUS message: code=11 (Access-Challenge) identifier=183 length=66<br> Attribute 24 (State) length=6<br> Value: 00 00 00 00<br> Attribute 79 (EAP-Message) length=22<br> Value: 01 03 00 14 12 0a 00 00 0a 01 00 00 0f 02 00 02 00 01 00 00<br> Attribute 80 (Message-Authenticator) length=18<br> Value: d9 b2 4b 55 13 14 79 e0 6a 13 b8 f7 07 c3 24 f8<br>1191309108.338010: RADIUS SRV: Received 146 bytes from
192.168.100.21:1645<br>1191309108.338355: RADIUS SRV: Received data - hexdump(len=146): 01 b7 00 92 0f<br>eb 79 90 8e ac f7 d0 69 be 7d 5b 5d cf e3 04 01 11 32 34 30 39 38 31 31 31 30 30<br> 31 35 32 32 30 0c 06 00 00 05 78 1e 10 30 30 31 39 2e 61 39 66 64 2e 34 39 64 3<br>0 1f 10 30 30 31 37 2e 39 61 62 61 2e 36 32 33 34 06 06 00 00 00 01 50 12 c5 21<br>af cb ae 53 b5 ff eb d6 27 1a ed 28 ca 1f 4f 16 02 02 00 14 01 32 34 30 39 38 31<br> 31 31 30 30 31 35 32 32 30 3d 06 00 00 00 13 05 06 00 00 2e a4 57 07 31 31 39 3<br>4 30 04 06 c0 a8 64 15<br>RADIUS message: code=1 (Access-Request) identifier=183 length=146<br> Attribute 1 (User-Name) length=17<br> Value: '240981110015220'<br> Attribute 12 (Framed-MTU) length=6<br> Value: 1400<br> Attribute 30 (Called-Station-Id) length=16<br> Value: '0019.a9fd.49d0'<br> Attribute 31
(Calling-Station-Id) length=16<br> Value: '0017.9aba.6234'<br> Attribute 6 (?Unknown?) length=6<br> Attribute 80 (Message-Authenticator) length=18<br> Value: c5 21 af cb ae 53 b5 ff eb d6 27 1a ed 28 ca 1f<br> Attribute 79 (EAP-Message) length=22<br> Value: 02 02 00 14 01 32 34 30 39 38 31 31 31 30 30 31 35 32 32 30<br> Attribute 61 (NAS-Port-Type) length=6<br> Value: 19<br> Attribute 5 (NAS-Port) length=6<br> Value: 11940<br> Attribute 87 (?Unknown?) length=7<br> Attribute 4 (NAS-IP-Address) length=6<br> Value: 192.168.100.21<br>1191309108.339027: RADIUS SRV: Creating a new session<br>1191309108.339038: RADIUS SRV: User-Name - hexdump_ascii(len=15):<br> 32 34 30 39 38 31 31 31 30 30 31 35
32 32 30 240981110015220<br>1191309108.339067: RADIUS SRV: Matching user entry found<br>1191309108.339082: EAP: State machine created<br>1191309108.339092: RADIUS SRV: New session 0x1 initialized<br>1191309108.339104: RADIUS SRV: Received EAP data - hexdump(len=20): 02 02 00 14<br>01 32 34 30 39 38 31 31 31 30 30 31 35 32 32 30<br>1191309108.339127: EAP: EAP-Response received - hexdump(len=20): 02 02 00 14 01<br>32 34 30 39 38 31 31 31 30 30 31 35 32 32 30<br>1191309108.339150: EAP: EAP entering state INITIALIZE<br>1191309108.339161: EAP: parseEapResp: rxResp=1 respId=2 respMethod=1 respVendor=<br>0 respVendorMethod=0<br>1191309108.339174: EAP: EAP entering state PICK_UP_METHOD<br>1191309108.339187: EAP: EAP entering state METHOD_RESPONSE<br>1191309108.339199: EAP-Identity: Peer identity - hexdump_ascii(len=15):<br> 32 34 30 39 38 31 31 31 30 30 31 35 32 32 30
240981110015220<br>1191309108.339227: EAP: EAP entering state SELECT_ACTION<br>1191309108.339239: EAP: getDecision: another method available -> CONTINUE<br>1191309108.339251: EAP: EAP entering state PROPOSE_METHOD<br>1191309108.339261: EAP: getNextMethod: vendor 0 type 18<br>1191309108.339273: EAP: EAP entering state METHOD_REQUEST<br>1191309108.339283: EAP: building EAP-Request: Identifier 3<br>1191309108.339293: EAP-SIM: Generating Start<br>1191309108.339306: AT_PERMANENT_ID_REQ<br>1191309108.339317: AT_VERSION_LIST<br>1191309108.339328: EAP: EAP entering state SEND_REQUEST<br>1191309108.339337: EAP: eapReqData -> EAPOL - hexdump(len=20): 01 03 00 14 12 0a<br> 00 00 0a 01 00 00 0f 02 00 02 00 01 00 00<br>1191309108.339365: EAP: EAP entering state IDLE<br>1191309108.339375: RADIUS SRV: EAP data from the state machine - hexdump(len=20)<br>: 01 03 00 14 12 0a 00 00 0a 01 00 00 0f 02 00 02 00 01 00 00<br>1191309108.339407:
RADIUS SRV: Reply to 192.168.100.21:1645<br>RADIUS message: code=11 (Access-Challenge) identifier=183 length=66<br> Attribute 24 (State) length=6<br> Value: 00 00 00 01<br> Attribute 79 (EAP-Message) length=22<br> Value: 01 03 00 14 12 0a 00 00 0a 01 00 00 0f 02 00 02 00 01 00 00<br> Attribute 80 (Message-Authenticator) length=18<br> Value: 70 a2 dd ca e0 93 24 e4 3a e6 5a 54 e5 7a 4a cf<br>1191309113.576982: RADIUS SRV: Received 146 bytes from 192.168.100.21:1645<br>1191309113.577016: RADIUS SRV: Received data - hexdump(len=146): 01 b7 00 92 0f<br>eb 79 90 8e ac f7 d0 69 be 7d 5b 5d cf e3 04 01 11 32 34 30 39 38 31 31 31 30 30<br> 31 35 32 32 30 0c 06 00 00 05 78 1e 10 30 30 31 39 2e 61 39 66 64 2e 34 39 64 3<br>0 1f 10 30 30 31 37 2e 39 61 62 61 2e 36 32 33 34 06 06 00 00 00 01 50 12 c5 21<br>af cb ae 53 b5 ff eb d6 27 1a ed 28 ca 1f 4f 16 02
02 00 14 01 32 34 30 39 38 31<br> 31 31 30 30 31 35 32 32 30 3d 06 00 00 00 13 05 06 00 00 2e a4 57 07 31 31 39 3<br>4 30 04 06 c0 a8 64 15<br><br><br>[root@longrow hostapd-0.5.8]# cat .config | grep -v "^#" | uniq<br>CONFIG_DRIVER_TEST=y<br>CONFIG_IAPP=y<br>CONFIG_RSN_PREAUTH=y<br>CONFIG_PEERKEY=y<br>CONFIG_EAP=y<br>CONFIG_EAP_MD5=y<br>CONFIG_EAP_TLS=y<br>CONFIG_EAP_MSCHAPV2=y<br>CONFIG_EAP_PEAP=y<br>CONFIG_EAP_GTC=y<br>CONFIG_EAP_TTLS=y<br>CONFIG_EAP_SIM=y<br>CONFIG_EAP_AKA=y<br>CONFIG_PKCS12=y<br>CONFIG_RADIUS_SERVER=y<br>CONFIG_IPV6=y<br><br><br>[root@longrow hostapd-0.5.8]# cat hostapd.conf | grep -v "^#" |
uniq<br>driver=test<br>logger_syslog=-1<br>logger_syslog_level=2<br>logger_stdout=-1<br>logger_stdout_level=2<br>debug=4<br>dump_file=/tmp/hostapd.dump<br>ssid=test<br>auth_algs=1<br>ignore_broadcast_ssid=0<br>ieee8021x=1<br>eap_message=hello<br>eapol_key_index_workaround=0<br>eap_reauth_period=3600<br>eap_server=1<br>eap_user_file=/usr/local/src/hostapd-0.5.8/hostapd.eap_user<br>eap_sim_db=/usr/local/src/hostapd-0.5.8/hostapd.sim_db<br>own_ip_addr=127.0.0.1<br>radius_server_clients=/usr/local/src/hostapd-0.5.8/hostapd.radius_clients<br>radius_server_auth_port=1812<br><br><br>[root@longrow hostapd-0.5.8]# cat hostapd.sim_db | grep -v "^#" | uniq<br>240993000003063:1D4DD94A14441487:0EC3CAC3:34000003287584378734296795826790<br>240993000003063:FFFB3415E0539600:30253A92:34000000723497894276897234672469<br>240993000003063:8BE76C91E94598A5:A591F351:34000000000000009809826509987134<br><br><br>[root@longrow hostapd-0.5.8]# cat hostapd.radius_clients | grep -v "^#" |
uniq<br>0.0.0.0/0 SysVer<br><br><br><br><p> 
<hr size=1><br><table><tr><td>Alt i én. Få <a href=http://no.mail.yahoo.com>Yahoo! Mail</a> med adressekartotek, kalender og notisblokk.</td></tr></table>