August 2014 - Freeradius-Devel - lists.freeradius.org

Commit report for master branch
by announce＠freeradius.org 08 Aug '14

08 Aug '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Add 'Warning:' prefix Arran Cudbard-Bell@2014-08-08T18:24:39Z Files modified: * src/main/log.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3819b535f9b8a66eca6e… ====== Number of active connections should not be signed Arran Cudbard-Bell@2014-08-08T17:17:35Z Files modified: * src/main/connection.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9a810bdefdc0883dbba9… ====== Formatting in threads.c Arran Cudbard-Bell@2014-08-08T16:32:00Z Files modified: * src/main/threads.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1fe349aa4db7db38cec2… ====== assert(pool->active == pool->num) if we can't find any free connections Arran Cudbard-Bell@2014-08-07T00:14:21Z Files modified: * src/main/connection.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/17e3704a42dc40fa8b9e… ====== Fix weird loop in connection.c Arran Cudbard-Bell@2014-08-07T00:07:25Z Files modified: * src/main/connection.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0cb642660059cb2f1bc8… ====== -- This commit summary was generated @2014-08-09T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Re: Freeradius-Devel Digest, Vol 112, Issue 6
by Ammu Argh 08 Aug '14

08 Aug '14

Hi Stefan, Thank you for reply. But By default FR takes MS-CHAPv2. How to configure to GTC/PAP? However i will try FR connects to samba or active directory. Regards Ammu On Fri, Aug 8, 2014 at 3:30 PM, < freeradius-devel-request(a)lists.freeradius.org> wrote: > Send Freeradius-Devel mailing list submissions to > freeradius-devel(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-devel > or, via email, send a message with subject or body 'help' to > freeradius-devel-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-devel-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Devel digest..." > > > Today's Topics: > > 1. RE: EAP-FAST phase2 failed (Stefan Paetow) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 7 Aug 2014 21:25:46 +0000 > From: Stefan Paetow <Stefan.Paetow(a)ja.net> > To: FreeRadius developers mailing list > <freeradius-devel(a)lists.freeradius.org> > Subject: RE: EAP-FAST phase2 failed > Message-ID: <C072996E0B81144DBB9426B44462540C0D6935BF@EXC001> > Content-Type: text/plain; charset="iso-8859-1" > > The log says this: > > EAP-MSCHAPV2: eap_server Password not configured > EAP-FAST: Phase2 method failed > EAP-FAST: PHASE2_METHOD -> FAILURE > > Leads me to believe you either need to configure EAP-FAST to use EAP-GTC > or PAP as the second phase, or connect FR to SAMBA or Active Directory > (which both speak MSCHAPv2). > > Stefan > > ________________________________ > From: freeradius-devel-bounces+stefan.paetow=ja.net(a)lists.freeradius.org > [freeradius-devel-bounces+stefan.paetow=ja.net(a)lists.freeradius.org] on > behalf of Ammu Argh [ammu3634(a)gmail.com] > Sent: 07 August 2014 17:16 > To: freeradius-devel(a)lists.freeradius.org > Subject: EAP-FAST phase2 failed > > Hi, > > I was trying to connect to AP using EAP-FAST authentication. > But Freeradius EAP-FAST failed with below error: > > State = 0x97d5bb340dc1cb0c525e6b44738f3553 > Message-Authenticator = 0xdce2fb540845c5ee76a5f48b505bb4eb > # Executing section authorize from file > /usr/local/etc/raddb/sites-enabled/default > +group authorize { > ++[preprocess] = ok > ++[chap] = noop > ++[mschap] = noop > ++[digest] = noop > [suffix] No '@' in User-Name = "anonymous", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] = noop > [eap] EAP packet type response id 4 length 107 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] = updated > [files] users: Matched entry DEFAULT at line 202 > ++[files] = ok > ++[expiration] = noop > ++[logintime] = noop > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this. > ++[pap] = noop > +} # group authorize = updated > Found Auth-Type = EAP > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > +group EAP { > [eap2] Request found, released from the list > EAP: EAP entering state RECEIVED > EAP: parseEapResp: rxResp=1 respId=4 respMethod=43 respVendor=0 > respVendorMethod=0 > EAP: EAP entering state INTEGRITY_CHECK > EAP: EAP entering state METHOD_RESPONSE > SSL: Received packet(len=107) - Flags 0x01 > SSL: Received packet: Flags 0x1 Message Length 0 > EAP-FAST: Received 101 bytes encrypted data for Phase 2 > EAP-FAST: Decrypted Phase 2 TLVs - hexdump(len=67): [REMOVED] > EAP-FAST: Received Phase 2: TLV type 9 length 63 (mandatory) > EAP-FAST: EAP-Payload TLV - hexdump(len=63): 02 04 00 3f 1a 02 04 00 3a 31 > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 > 67 a5 fd 37 80 a6 91 10 ed 46 97 b2 70 75 aa cc 57 27 17 4e dc 0c 6c 00 77 > 69 66 69 > EAP-FAST: Received Phase 2: code=2 identifier=4 length=63 > EAP-MSCHAPV2: eap_server Password not configured > EAP-FAST: Phase2 method failed > EAP-FAST: PHASE2_METHOD -> FAILURE > EAP: EAP entering state SELECT_ACTION > EAP: getDecision: method failed -> FAILURE > EAP: EAP entering state FAILURE > EAP: Building EAP-Failure (id=4) > ==> Fail > [eap2] Freeing handler > EAP: Server state machine removed > ++[eap2] = reject > +} # group EAP = reject > Failed to authenticate the user. > Using Post-Auth-Type REJECT > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > +group REJECT { > [attr_filter.access_reject] expand: %{User-Name} -> anonymous > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] = updated > +} # group REJECT = updated > Delaying reject of request 4 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 4 > Sending Access-Reject of id 117 to 10.10.2.2 port 46531 > EAP-Message = 0x04040004 > Message-Authenticator = 0x00000000000000000000000000000000 > Waking up in 3.9 seconds. > > > Other details are as below" > > Users file" > wifi Auth-Type := EAP, Cleartext-Password := "welcome123" > > eap.conf > eap2 { > fast { > pac_opaque_encr_key = > 000102030405060708090a0b0c0d0e0f > eap_fast_a_id = tjsys > eap_fast_a_id_info = my_server > eap_fast_prov = 3 > pac_key_lifetime = 604800 # 7 days > pac_key_refresh_tim = 86400 > } > > tls { > ca_cert = /usr/local/etc/raddb/certs/ca.pem > server_cert = /usr/local/etc/raddb/certs/server.pem > private_key_file = > /usr/local/etc/raddb/certs/server.key > private_key_password = whatever > dh_file = /usr/local/etc/raddb/certs/dh > random_file = /usr/local/etc/raddb/certs/random > } > } > > > Sites-enabled/default: > Added in authenticate block > Auth-Type EAP { > eap2 > } > > > > wpa_supplicant.conf > update_config=1 > ap_scan=1 > fast_reauth=1 > > network={ > ssid="WiFi-11g" > key_mgmt=WPA-EAP > proto=WPA > pairwise=TKIP > group=TKIP > eap=FAST > anonymous_identity="fast" > identity="fast" > password="koro" > phase1="fast_provisioning=3" > pac_file="/data/misc/wifi/eap_fast.pac" > } > > > > FreeRADIUS Version 2.2.5, > OpenSSL 1.0.1e 11 > Ubuntu 14.04.1 > > Please help me to get it work. > > Regards > Ammu > > Janet(UK) is a trading name of Jisc Collections and Janet Limited, a > not-for-profit company which is registered in England under No. 2881024 > and whose Registered Office is at Lumen House, Library Avenue, > Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238 > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html > > > End of Freeradius-Devel Digest, Vol 112, Issue 6 > ************************************************ >

2 1

EAP-FAST phase2 failed
by Ammu Argh 07 Aug '14

07 Aug '14

Hi, I was trying to connect to AP using EAP-FAST authentication. But Freeradius EAP-FAST failed with below error: State = 0x97d5bb340dc1cb0c525e6b44738f3553 Message-Authenticator = 0xdce2fb540845c5ee76a5f48b505bb4eb # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 107 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry DEFAULT at line 202 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group EAP { [eap2] Request found, released from the list EAP: EAP entering state RECEIVED EAP: parseEapResp: rxResp=1 respId=4 respMethod=43 respVendor=0 respVendorMethod=0 EAP: EAP entering state INTEGRITY_CHECK EAP: EAP entering state METHOD_RESPONSE SSL: Received packet(len=107) - Flags 0x01 SSL: Received packet: Flags 0x1 Message Length 0 EAP-FAST: Received 101 bytes encrypted data for Phase 2 EAP-FAST: Decrypted Phase 2 TLVs - hexdump(len=67): [REMOVED] EAP-FAST: Received Phase 2: TLV type 9 length 63 (mandatory) EAP-FAST: EAP-Payload TLV - hexdump(len=63): 02 04 00 3f 1a 02 04 00 3a 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 67 a5 fd 37 80 a6 91 10 ed 46 97 b2 70 75 aa cc 57 27 17 4e dc 0c 6c 00 77 69 66 69 EAP-FAST: Received Phase 2: code=2 identifier=4 length=63 EAP-MSCHAPV2: eap_server Password not configured EAP-FAST: Phase2 method failed EAP-FAST: PHASE2_METHOD -> FAILURE EAP: EAP entering state SELECT_ACTION EAP: getDecision: method failed -> FAILURE EAP: EAP entering state FAILURE EAP: Building EAP-Failure (id=4) ==> Fail [eap2] Freeing handler EAP: Server state machine removed ++[eap2] = reject +} # group EAP = reject Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 117 to 10.10.2.2 port 46531 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Other details are as below" Users file" wifi Auth-Type := EAP, Cleartext-Password := "welcome123" eap.conf eap2 { fast { pac_opaque_encr_key = 000102030405060708090a0b0c0d0e0f eap_fast_a_id = tjsys eap_fast_a_id_info = my_server eap_fast_prov = 3 pac_key_lifetime = 604800 # 7 days pac_key_refresh_tim = 86400 } tls { ca_cert = /usr/local/etc/raddb/certs/ca.pem server_cert = /usr/local/etc/raddb/certs/server.pem private_key_file = /usr/local/etc/raddb/certs/server.key private_key_password = whatever dh_file = /usr/local/etc/raddb/certs/dh random_file = /usr/local/etc/raddb/certs/random } } Sites-enabled/default: Added in authenticate block Auth-Type EAP { eap2 } wpa_supplicant.conf update_config=1 ap_scan=1 fast_reauth=1 network={ ssid="WiFi-11g" key_mgmt=WPA-EAP proto=WPA pairwise=TKIP group=TKIP eap=FAST anonymous_identity="fast" identity="fast" password="koro" phase1="fast_provisioning=3" pac_file="/data/misc/wifi/eap_fast.pac" } FreeRADIUS Version 2.2.5, OpenSSL 1.0.1e 11 Ubuntu 14.04.1 Please help me to get it work. Regards Ammu

2 1

Suggested improvement to connection spawning info
by Chaigneau, Nicolas 07 Aug '14

07 Aug '14

In function fr_connection_spawn (src\main\connection.c), the following INFO message is logged: INFO("%s: Opening additional connection (%" PRIu64 ")", pool->log_prefix, pool->count); The value logged is the number of times a new connection has been spawned on that pool. What could be interesting (at least to me) would be to also show the current number of connections, and the number of busy connections. So, what do you think of something like : INFO("%s: Opening additional connection (spawned: %" PRIu64 ", num: %d, active: %d) ", pool->log_prefix, pool->count, pool->num, pool->active); Regards, Nicolas. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 2

Commit report for v3.0.x branch
by announce＠freeradius.org 06 Aug '14

06 Aug '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Add more verbose logging for the connection pool Arran Cudbard-Bell@2014-08-06T19:08:34Z Files modified: * src/main/connection.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/35bb6674b3691615e551… ====== Doxygen Arran Cudbard-Bell@2014-08-06T17:07:49Z Files modified: * src/main/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2a8a4efc441875c73fb8… ====== Distinguish between single VP inserts, and list merges Arran Cudbard-Bell@2014-08-06T16:49:30Z Files modified: * src/include/libradius.h * src/lib/cursor.c * src/lib/valuepair.c * src/main/detail.c * src/main/process.c * src/main/valuepair.c * src/modules/proto_dhcp/dhcp.c * src/modules/rlm_cache/rlm_cache.c * src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c * src/modules/rlm_ldap/attrmap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e322a2008160b2471501… ====== Force should be a bool Arran Cudbard-Bell@2014-08-06T16:49:26Z Files modified: * src/modules/rlm_ldap/ldap.c * src/modules/rlm_ldap/ldap.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0962072d46cae3ec69e0… ====== -- This commit summary was generated @2014-08-07T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 06 Aug '14

06 Aug '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Add more verbose logging for the connection pool Arran Cudbard-Bell@2014-08-06T19:08:49Z Files modified: * src/main/connection.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/bf6d471be31986b888c4… ====== Doxygen Arran Cudbard-Bell@2014-08-06T17:07:55Z Files modified: * src/main/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1ebd757089d89b994b11… ====== Distinguish between single VP inserts, and list merges Arran Cudbard-Bell@2014-08-06T16:49:03Z Files modified: * src/include/libradius.h * src/lib/cursor.c * src/lib/valuepair.c * src/main/detail.c * src/main/process.c * src/main/valuepair.c * src/modules/proto_dhcp/dhcp.c * src/modules/rlm_cache/rlm_cache.c * src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c * src/modules/rlm_ldap/attrmap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/130a232295fdd9c0addc… ====== Force should be a bool Arran Cudbard-Bell@2014-08-06T16:49:03Z Files modified: * src/modules/rlm_ldap/ldap.c * src/modules/rlm_ldap/ldap.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0ac3549734f771dd075d… ====== -- This commit summary was generated @2014-08-07T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 05 Aug '14

05 Aug '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Refactor radius_map2vp and add support for returning multiple attributes from RHS attr references Arran Cudbard-Bell@2014-08-05T05:17:27Z Files modified: * src/main/valuepair.c * src/tests/keywords/update-add-ref-index * src/tests/keywords/update-add-ref-tag Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e94616e915de74f2841b… ====== Make it clearer how the switch-attr-cmp test failed Arran Cudbard-Bell@2014-08-05T05:17:27Z Files modified: * src/tests/keywords/switch-attr-cmp Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a25621bb83e241a626ee… ====== Allow Attr[*] in radius_parse_attr Arran Cudbard-Bell@2014-08-05T05:17:27Z Files modified: * src/main/map.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f1700b11a5a3407ef1f1… ====== radius_parse_attr writes nice descriptive errors to the error buffer, so use them... Arran Cudbard-Bell@2014-08-05T05:17:27Z Files modified: * src/main/map.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/16bd1d26749dd51fa03a… ====== make radius_tmply_copy_vp respect instance numbers and NUM_ALL (*) Arran Cudbard-Bell@2014-08-05T05:17:27Z Files modified: * src/include/radiusd.h * src/main/valuepair.c * src/modules/proto_dhcp/rlm_dhcp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/4503bb166da0549c392c… ====== Rename 'paircopy2' to 'paircopy_by_num' Arran Cudbard-Bell@2014-08-05T05:17:26Z Files modified: * src/include/libradius.h * src/lib/valuepair.c * src/main/listen.c * src/main/process.c * src/main/tls.c * src/main/valuepair.c * src/main/xlat.c * src/modules/rlm_eap/radeapclient.c * src/modules/rlm_eap/types/rlm_eap_peap/peap.c * src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0082c70b0721f338a75c… ====== -- This commit summary was generated @2014-08-06T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 05 Aug '14

05 Aug '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Refactor radius_map2vp and add support for returning multiple attributes from RHS attr references Arran Cudbard-Bell@2014-08-05T05:19:22Z Files modified: * src/main/valuepair.c * src/tests/keywords/update-add-ref-index * src/tests/keywords/update-add-ref-tag Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1411859e3819e37ed3fa… ====== Make it clearer how the switch-attr-cmp test failed Arran Cudbard-Bell@2014-08-05T05:19:18Z Files modified: * src/tests/keywords/switch-attr-cmp Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5f63a120ba2f82ca85bc… ====== Allow Attr[*] in radius_parse_attr Arran Cudbard-Bell@2014-08-05T05:19:14Z Files modified: * src/main/map.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/dc9ae1f8c9ab188c4206… ====== radius_parse_attr writes nice descriptive errors to the error buffer, so use them... Arran Cudbard-Bell@2014-08-05T05:19:10Z Files modified: * src/main/map.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1ab49780010223531b19… ====== make radius_tmply_copy_vp respect instance numbers and NUM_ALL (*) Arran Cudbard-Bell@2014-08-05T05:19:06Z Files modified: * src/include/radiusd.h * src/main/valuepair.c * src/modules/proto_dhcp/rlm_dhcp.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5586bed1e64578411648… ====== Rename 'paircopy2' to 'paircopy_by_num' Arran Cudbard-Bell@2014-08-05T05:19:02Z Files modified: * src/include/libradius.h * src/lib/valuepair.c * src/main/listen.c * src/main/process.c * src/main/tls.c * src/main/valuepair.c * src/main/xlat.c * src/modules/rlm_eap/radeapclient.c * src/modules/rlm_eap/types/rlm_eap_peap/peap.c * src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/db8a24e1fb04dd9ea3d4… ====== -- This commit summary was generated @2014-08-06T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 03 Aug '14

03 Aug '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Nested extern Conflicts: src/main/listen.c Alan T. DeKok@2014-08-03T08:42:52Z Files modified: * src/main/listen.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/440099fa0f9a5dcb555c… ====== -- This commit summary was generated @2014-08-04T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 03 Aug '14

03 Aug '14

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Nested extern Alan T. DeKok@2014-08-03T08:41:36Z Files modified: * src/main/listen.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/72b80272eeb2a5a40e99… ====== -- This commit summary was generated @2014-08-04T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0