- Freeradius-Devel - lists.freeradius.org

GPL license versions between dependencies
by Weber, Matthew L Collins 30 Jul '21

30 Jul '21

Hi, While adding Freeradius to the Buildroot build system, we noticed that between the libtalloc library (GPL3) which Freeradius uses, and Freeradius (GPL2) there is a mismatch of GPL versions. What do others think? https://softwareengineering.stackexchange.com/questions/238748/can-gpl-v2-c… Regards, Matt Weber

2 7

(4) eap_tls: ERROR: TLS Alert write:fatal:unexpected_message
by Michel Verhagen 21 Jun '21

21 Jun '21

Hi, I'm integrating hostap's EAP library and its EAP supplicant state machine on an embedded device and am testing against the FreeRADIUS server. I've got MD5 authentication going (yes, I know this is open to attacks) and I have EAP-TTLS going as well. However, with EAP-TLS I'm getting the error as per subject of this email. I'm getting the same error if I set the EAP-TTLS config option "require_client_cert = yes". It definitely is a problem with the certificate, but I don't know what (or how to get more information about this). I created the test certificates and copied the ca.pem file to the device with my hostap EAP library and EAP supplicant state machine. The FreeRadius log: (4) Found Auth-Type = eap (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0x05594454060d4948 (4) eap: Finished EAP session with state 0x05594454060d4948 (4) eap: Previous EAP request found for state 0x05594454060d4948, released from the list (4) eap: Peer sent packet with method EAP TLS (13) (4) eap: Calling submodule eap_tls to process data (4) eap_tls: Continuing EAP-TLS (4) eap_tls: [eaptls verify] = ok (4) eap_tls: Done initial handshake (4) eap_tls: TLS_accept: SSLv3/TLS write server done (4) eap_tls: >>> send TLS 1.2 [length 0002] (4) eap_tls: ERROR: TLS Alert write:fatal:unexpected_message tls: TLS_accept: Error in error (4) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:141A20F4:SSL routines:ossl_statem_server_read_transition:unexpected message (4) eap_tls: ERROR: System call (I/O) error (-1) (4) eap_tls: ERROR: TLS receive handshake failed during operation (4) eap_tls: ERROR: [eaptls process] = fail (4) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (4) eap: Sending EAP Failure (code 4) ID 84 length 4 (4) eap: Failed in EAP select (4) [eap] = invalid (4) } # authenticate = invalid (4) Failed to authenticate the user (4) Using Post-Auth-Type Reject The wireshark log (for EAP-TLS) looks like this: No. Time Source Destination Protocol Length Info 16 2.721206 00:11:22:33:44:55 00:00:00:00:00:00 EAPOL 60 Start 17 2.722845 cc:37:ab:cb:f6:98 01:80:c2:00:00:03 EAP 60 Request, Identity 18 2.741815 00:11:22:33:44:55 cc:37:ab:cb:f6:98 EAP 60 Response, Identity 19 2.746876 192.168.1.2 192.168.1.4 RADIUS 144 Access-Request id=166 42 2.752227 192.168.1.4 192.168.1.2 RADIUS 106 Access-Challenge id=166 46 2.756640 cc:37:ab:cb:f6:98 01:80:c2:00:00:03 EAP 60 Request, TLS EAP (EAP-TLS) 69 6.971847 00:11:22:33:44:55 cc:37:ab:cb:f6:98 TLSv1.2 226 Client Hello 70 7.084757 192.168.1.2 192.168.1.4 RADIUS 359 Access-Request id=65 112 7.149186 192.168.1.4 192.168.1.2 RADIUS 1110 Access-Challenge id=65 118 7.156721 cc:37:ab:cb:f6:98 01:80:c2:00:00:03 EAP 1022 Request, TLS EAP (EAP-TLS) 119 7.162062 00:11:22:33:44:55 cc:37:ab:cb:f6:98 EAP 60 Response, TLS EAP (EAP-TLS) 120 7.166973 192.168.1.2 192.168.1.4 RADIUS 157 Access-Request id=136 141 7.170477 192.168.1.4 192.168.1.2 RADIUS 1110 Access-Challenge id=136 145 7.176735 cc:37:ab:cb:f6:98 01:80:c2:00:00:03 EAP 1022 Request, TLS EAP (EAP-TLS) 146 7.182956 00:11:22:33:44:55 cc:37:ab:cb:f6:98 EAP 60 Response, TLS EAP (EAP-TLS) 147 7.188318 192.168.1.2 192.168.1.4 RADIUS 157 Access-Request id=166 166 7.191746 192.168.1.4 192.168.1.2 RADIUS 1063 Access-Challenge id=166 170 7.196867 cc:37:ab:cb:f6:98 01:80:c2:00:00:03 TLSv1.2 975 Server Hello, Certificate, Server Key Exchange, Certificate Request, Server Hello Done 257 16.852519 00:11:22:33:44:55 cc:37:ab:cb:f6:98 TLSv1.2 150 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message 258 16.882712 192.168.1.2 192.168.1.4 RADIUS 283 Access-Request id=56 290 17.929500 192.168.1.4 192.168.1.2 RADIUS 86 Access-Reject id=56 296 18.007949 cc:37:ab:cb:f6:98 01:80:c2:00:00:03 EAP 60 Failure Any ideas? Thanks in advance, Mike.

3 18

EAP_PEAP authentication failing if set to higher rate if greater than 600 TPS.
by saurabha badhai 15 Jun '21

15 Jun '21

Hi, Using freeradius server set EAP_PEAP method for authentication. When try to do more authentication per second may be 600 or higher, seeing errors at radius server. I am using freeradius version 3.0.13 to test, OS - centos verion -7 I can't set to debug mode as into running loads. Can any one let me know what might be the issue here ? Thanks in advance ! Below are the errors: Tue Jun 15 16:37:23 2021 : ERROR: (296599) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x6e130c1e6e1215a6 Tue Jun 15 16:37:23 2021 : ERROR: (296600) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x39368ccf3c309553 Tue Jun 15 16:37:23 2021 : ERROR: (296600) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x39368ccf3c309553 Tue Jun 15 16:37:23 2021 : ERROR: (296601) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xb07065a5b0717c6a Tue Jun 15 16:37:23 2021 : ERROR: (296601) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xb07065a5b0717c6a Tue Jun 15 16:37:23 2021 : ERROR: (296602) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296602) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296602) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296605) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xf406e507f100fc80 Tue Jun 15 16:37:23 2021 : ERROR: (296605) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xf406e507f100fc80 Tue Jun 15 16:37:23 2021 : ERROR: (296606) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xd1541a96d4520336 0x849715d586940cd3 Tue Jun 15 16:37:23 2021 : ERROR: (296613) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x5cc33f9a5ec026d7 Tue Jun 15 16:37:23 2021 : ERROR: (296614) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x35abced034a9d723 Tue Jun 15 16:37:23 2021 : ERROR: (296614) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x35abced034a9d723 Tue Jun 15 16:37:23 2021 : ERROR: (296616) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xb8e4370bbbe02e94 Tue Jun 15 16:37:23 2021 : ERROR: (296616) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xb8e4370bbbe02e94 Tue Jun 15 16:37:23 2021 : ERROR: (296617) eap_peap: ERROR: TLS Alert write:fatal:unexpected_message Tue Jun 15 16:37:23 2021 : Error: tls: TLS_accept: Error in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296619) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x38356d7939377498 Tue Jun 15 16:37:23 2021 : ERROR: (296619) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x38356d7939377498 Tue Jun 15 16:37:23 2021 : ERROR: (296621) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x5484342e56872dc4 Tue Jun 15 16:37:23 2021 : ERROR: (296621) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x5484342e56872dc4 Tue Jun 15 16:37:23 2021 : ERROR: (296622) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x1533ca021035d355 Tue Jun 15 16:37:23 2021 : ERROR: (296622) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x1533ca021035d355 Tue Jun 15 16:37:23 2021 : ERROR: (296623) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x88ad5f4888ac460e Tue Jun 15 16:37:23 2021 : ERROR: (296624) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xa729e227a728fb5d Tue Jun 15 16:37:23 2021 : ERROR: (296623) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x88ad5f4888ac460e Tue Jun 15 16:37:23 2021 : ERROR: (296624) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xa729e227a728fb5d Tue Jun 15 16:37:23 2021 : ERROR: (296625) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x42305de7403344ee Tue Jun 15 16:37:23 2021 : ERROR: (296627) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x69ce22216aca3b53 Tue Jun 15 16:37:23 2021 : ERROR: (296627) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x69ce22216aca3b53 Tue Jun 15 16:37:23 2021 : ERROR: (296626) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:23 2021 : ERROR: (296625) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x42305de7403344ee Tue Jun 15 16:37:23 2021 : ERROR: (296628) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:23 2021 : ERROR: (296629) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:23 2021 : ERROR: (296630) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296630) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296630) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296632) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x2aa7bc792aa6a558 Tue Jun 15 16:37:23 2021 : ERROR: (296631) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296632) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x2aa7bc792aa6a558 Tue Jun 15 16:37:23 2021 : ERROR: (296631) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296631) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296634) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296634) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296634) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296636) eap_peap: ERROR: TLS Alert write:fatal:unexpected_message Tue Jun 15 16:37:23 2021 : Error: tls: TLS_accept: Error in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296639) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xe0ae4c1fe0af556f Tue Jun 15 16:37:23 2021 : ERROR: (296640) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xd8fd6f6fddfb76cb Tue Jun 15 16:37:23 2021 : ERROR: (296639) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xe0ae4c1fe0af556f Tue Jun 15 16:37:23 2021 : ERROR: (296640) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xd8fd6f6fddfb76cb Tue Jun 15 16:37:23 2021 : ERROR: (296643) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x4e1bf2584e1aeb75 Tue Jun 15 16:37:23 2021 : ERROR: (296643) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x4e1bf2584e1aeb75 Tue Jun 15 16:37:23 2021 : ERROR: (296644) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xa32342f6a3225bb8 Tue Jun 15 16:37:23 2021 : ERROR: (296645) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x0998f5ae0b9bec49 Tue Jun 15 16:37:23 2021 : ERROR: (296644) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xa32342f6a3225bb8 Tue Jun 15 16:37:23 2021 : ERROR: (296646) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x5725d2735724cbad Tue Jun 15 16:37:23 2021 : ERROR: (296647) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x77270d17772614ae Tue Jun 15 16:37:23 2021 : ERROR: (296645) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x0998f5ae0b9bec49 Tue Jun 15 16:37:23 2021 : ERROR: (296646) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x5725d2735724cbad Tue Jun 15 16:37:23 2021 : ERROR: (296647) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x77270d17772614ae Tue Jun 15 16:37:23 2021 : ERROR: (296649) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296649) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296649) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296650) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x72529d907a5b8467 Tue Jun 15 16:37:23 2021 : ERROR: (296650) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x72529d907a5b8467 Tue Jun 15 16:37:23 2021 : ERROR: (296651) eap_peap: ERROR: TLS Alert write:fatal:unexpected_message Tue Jun 15 16:37:23 2021 : Error: tls: TLS_accept: Error in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296652) eap_peap: ERROR: TLS Alert write:fatal:unexpected_message Tue Jun 15 16:37:23 2021 : Error: tls: TLS_accept: Error in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296654) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296655) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296654) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296655) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296654) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296655) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296656) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296656) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296656) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296657) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296659) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x3753af853752b60b Tue Jun 15 16:37:23 2021 : ERROR: (296657) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296659) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x3753af853752b60b Tue Jun 15 16:37:23 2021 : ERROR: (296660) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xc7a105e6c7a01c7e Tue Jun 15 16:37:23 2021 : ERROR: (296657) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296660) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xc7a105e6c7a01c7e Tue Jun 15 16:37:23 2021 : ERROR: (296661) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296662) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:23 2021 : ERROR: (296661) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296661) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296663) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296663) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296663) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296665) eap_peap: ERROR: TLS Alert write:fatal:unexpected_message Tue Jun 15 16:37:23 2021 : Error: tls: TLS_accept: Error in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296666) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x48f0d46948f1cd45 Tue Jun 15 16:37:23 2021 : ERROR: (296666) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x48f0d46948f1cd45 Tue Jun 15 16:37:23 2021 : ERROR: (296667) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296668) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:23 2021 : ERROR: (296667) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296667) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296671) eap_peap: ERROR: TLS Alert write:fatal:unexpected_message Tue Jun 15 16:37:23 2021 : ERROR: (296672) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x34895c09368a4509 Tue Jun 15 16:37:23 2021 : Error: tls: TLS_accept: Error in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296672) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x34895c09368a4509 Tue Jun 15 16:37:23 2021 : ERROR: (296673) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x2e1a29b52c193026 Tue Jun 15 16:37:23 2021 : ERROR: (296673) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x2e1a29b52c193026 Tue Jun 15 16:37:23 2021 : ERROR: (296674) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x8d6c197c8d6d00b6 Tue Jun 15 16:37:23 2021 : ERROR: (296674) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x8d6c197c8d6d00b6 Tue Jun 15 16:37:23 2021 : ERROR: (296675) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xcc0acc28ce09d5c6 Tue Jun 15 16:37:23 2021 : ERROR: (296675) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xcc0acc28ce09d5c6 Tue Jun 15 16:37:23 2021 : ERROR: (296676) eap_peap: ERROR: TLS Alert write:fatal:unexpected_message Tue Jun 15 16:37:23 2021 : Error: tls: TLS_accept: Error in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296677) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x95ae3f4d97ad2612 Tue Jun 15 16:37:23 2021 : ERROR: (296677) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x95ae3f4d97ad2612 Tue Jun 15 16:37:23 2021 : ERROR: (296678) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x94bdc97291bbd0df Tue Jun 15 16:37:23 2021 : ERROR: (296678) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x94bdc97291bbd0df Tue Jun 15 16:37:23 2021 : ERROR: (296680) eap_peap: ERROR: TLS Alert write:fatal:unexpected_message Tue Jun 15 16:37:23 2021 : Error: tls: TLS_accept: Error in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296681) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xdfb8d3c7ddbbcaa2 Tue Jun 15 16:37:23 2021 : ERROR: (296681) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xdfb8d3c7ddbbcaa2 Tue Jun 15 16:37:23 2021 : ERROR: (296683) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296683) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296683) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296684) eap_peap: ERROR: TLS Alert read:fatal:decode error Tue Jun 15 16:37:23 2021 : ERROR: (296684) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296684) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Tue Jun 15 16:37:23 2021 : ERROR: (296685) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x7917f6d97b14eff9 Tue Jun 15 16:37:23 2021 : ERROR: (296685) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x7917f6d97b14eff9 Tue Jun 15 16:37:23 2021 : ERROR: (296687) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:23 2021 : ERROR: (296689) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xe5726319e5737aca Tue Jun 15 16:37:23 2021 : ERROR: (296689) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xe5726319e5737aca Tue Jun 15 16:37:23 2021 : ERROR: (296690) eap_peap: ERROR: TLS Alert write:fatal:unexpected_message Tue Jun 15 16:37:23 2021 : Error: tls: TLS_accept: Error in SSLv3 read client key exchange A Tue Jun 15 16:37:23 2021 : ERROR: (296691) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x49c6154349c70c6e Tue Jun 15 16:37:23 2021 : ERROR: (296691) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x49c6154349c70c6e Tue Jun 15 16:37:23 2021 : ERROR: (296696) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x1b6564041b647d6d Tue Jun 15 16:37:23 2021 : ERROR: (296697) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xc28e23d2c28f3a3e Tue Jun 15 16:37:23 2021 : ERROR: (296696) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x1b6564041b647d6d Tue Jun 15 16:37:23 2021 : ERROR: (296697) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xc28e23d2c28f3a3e Tue Jun 15 16:37:23 2021 : ERROR: (296701) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:23 2021 : ERROR: (296705) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:23 2021 : ERROR: (296711) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:23 2021 : ERROR: (296717) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xb56b43d0b56a5a66 Tue Jun 15 16:37:23 2021 : ERROR: (296717) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xb56b43d0b56a5a66 Tue Jun 15 16:37:23 2021 : ERROR: (296718) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:23 2021 : ERROR: (296719) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xf4555b41f4544249 Tue Jun 15 16:37:23 2021 : ERROR: (296719) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xf4555b41f4544249 Tue Jun 15 16:37:24 2021 : ERROR: (296721) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296723) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296725) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296726) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x78cba76d78cabeb9 Tue Jun 15 16:37:24 2021 : ERROR: (296726) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x78cba76d78cabeb9 Tue Jun 15 16:37:24 2021 : ERROR: (296727) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296730) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296733) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x4212d0334213c99b Tue Jun 15 16:37:24 2021 : ERROR: (296733) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x4212d0334213c99b Tue Jun 15 16:37:24 2021 : ERROR: (296741) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296746) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296748) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xa1a961c6a1a878d1 Tue Jun 15 16:37:24 2021 : ERROR: (296748) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xa1a961c6a1a878d1 Tue Jun 15 16:37:24 2021 : ERROR: (296749) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296750) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296751) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296752) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296753) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296757) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xee309520ef328cb1 Tue Jun 15 16:37:24 2021 : ERROR: (296757) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xee309520ef328cb1 Tue Jun 15 16:37:24 2021 : ERROR: (296758) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x501102e151131be7 Tue Jun 15 16:37:24 2021 : ERROR: (296759) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xaf2689c1af279014 Tue Jun 15 16:37:24 2021 : ERROR: (296759) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xaf2689c1af279014 Tue Jun 15 16:37:24 2021 : ERROR: (296758) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x501102e151131be7 Tue Jun 15 16:37:24 2021 : ERROR: (296760) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x788ea929788fb0c6 Tue Jun 15 16:37:24 2021 : ERROR: (296760) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x788ea929788fb0c6 Tue Jun 15 16:37:24 2021 : ERROR: (296761) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296762) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296763) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xb8369947b8378066 Tue Jun 15 16:37:24 2021 : ERROR: (296763) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xb8369947b8378066 Tue Jun 15 16:37:24 2021 : ERROR: (296765) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x70e734b070e62da6 Tue Jun 15 16:37:24 2021 : ERROR: (296765) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x70e734b070e62da6 Tue Jun 15 16:37:24 2021 : ERROR: (296768) eap_peap: ERROR: TLS Alert write:fatal:bad record mac Tue Jun 15 16:37:24 2021 : ERROR: (296769) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xed4e5709ed4f4ebc Tue Jun 15 16:37:24 2021 : ERROR: (296770) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x0552d5a90553cccd Tue Jun 15 16:37:24 2021 : ERROR: (296769) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xed4e5709ed4f4ebc Tue Jun 15 16:37:24 2021 : ERROR: (296770) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x0552d5a90553ccc Thanks, Saurabha <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#m_-1132320085862151243_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

2 1

Trouble (rlm_python) with grpcio.
by s malinskiy 27 Apr '21

27 Apr '21

Good day Team. Several days ago I tried to use grpc for authentication in the python3 module, but my request to the backend service failed. That was pretty strange and I spent some time troubleshooting the problem. First, all works well if I call script from *instantiate* section, but for case if i try use call for example in *authentication,* nothing happens (grpc constantly tries to reach backend service) and radiusd stops proceeding new authentication requests. I think there is some kind of threading issue of python. Currently I don't have a solution to this issue but maybe you can help with this. ps. Centos8.x , freerad 3.20, python 3.6 and grpcio 1.37 if i dont mind.

3 2

[PATCH] modules/rlm_sql: remove mysql_version.h
by Matt Weber 12 Apr '21

12 Apr '21

From: Jared Bents <jared.bents(a)rockwellcollins.com> remove mysql_version.h as mysql.h is included and mysql_version.h should not be included by per the header file warning Signed-off-by: Jared Bents <jared.bents(a)rockwellcollins.com> Signed-off-by: Matt Weber <matthew.weber(a)rockwellcollins.com> --- Patch applied and tested on 3.0.21 with GCC 9.3 --- src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c b/src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c index a7992647cd..ea44d0cc7a 100644 --- a/src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c +++ b/src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c @@ -34,12 +34,10 @@ RCSID("$Id$") #include "config.h" #ifdef HAVE_MYSQL_MYSQL_H -# include <mysql/mysql_version.h> # include <mysql/errmsg.h> # include <mysql/mysql.h> # include <mysql/mysqld_error.h> #elif defined(HAVE_MYSQL_H) -# include <mysql_version.h> # include <errmsg.h> # include <mysql.h> # include <mysqld_error.h> -- 2.17.1

1 0

No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
by Sazzad Hossain 08 Apr '21

08 Apr '21

Hello to all, In our VPN server(Radius) I see some of the users can't login and it shows the following message. *(No Auth-Type found: rejecting the user via Post-Auth-Type = Reject)* Where is the problem,can anyone help me please? Thanks in advance & have a nice day! Regards Sazzad

2 1

Updating Mysql version in a FreeRadius Server
by wifi.italia-delivery 16 Feb '21

16 Feb '21

Hi, In my system I implemented a FreeRadius instance (Versione 3.0.4) that retrieves data from a dB on Cloud AWS. Due to schedule maintenance of AWS, I have to update the instance Amazon RDS MySQL 5.6 to the newer version MySQL 5.7. The update can impact the system? * Is there a way/path where I can check if there are some funcionalities/drivers that could be impacted? * The updating could cause some disruption of the service? Thank you in advance.

2 1

[master] Unintended renaming of DHCP-Requested-IP-Address ?
by Chaigneau, Nicolas 03 Dec '20

03 Dec '20

Hello, One minor issue that I noticed. I think the following commit had an unintended renaming of DHCP attribute « DHCP-Requested-IP-Address » : https://github.com/FreeRADIUS/freeradius-server/commit/155fe50caa079def1bd9… It is now : ATTRIBUTE Requested-IP-Address 50 ipaddr I assume a global sed on « DHCP-Request » caused this change. Regards, Nicolas. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

3 5

[ANN] Multi-Level namespaces
by Arran Cudbard-Bell 30 Nov '20

30 Nov '20

Multi-level namespaces were just merged into the master branch. If you're building from master and using nested attributes, structures, or vendor specific attributes, this will effect the way you reference those attributes. This work removes the dictionary specific namespace attributes were inserted into and uses attribute specific namespaces. These attribute specific namespaces contain the direct decedents of a given VSA, TLV, or Vendor attribute. Example: # Previous referencing scheme if (&Cisco-AvPair) # New referencing scheme if (&Vendor-Specific.Cisco.AvPair) - Vendor-Specific (Attribute 26, VSA) is located in the top level namespace for the RADIUS dictionary. - Cisco (PEN 9, Vendor) is located in the Vendor-Specific namespace. - AvPair (Attribute 1, string) is located in the Cisco namespace. We will likely be adding aliases for the vendors so that they're accessible from the root, and for some common nested attributes to make the new syntax less unwieldily, but in all cases the way vendor attributes and TLVs are referenced will change. The primary reason for the new name-spacing scheme was that grouped attributes require both the group attribute and its child attribute to be specified. In many cases the parent and child had a lengthy prefix to uniquely identify them in the global namespace, combining these attributes in a reference string lead to obscenely large references which were very hard to follow. DHCPv4 is the next protocol to be reworked for these changes. Expect to see the "DHCP-" prefix removed from the DHCPv4 dictionaries in the next couple of weeks. If you want to add your own aliases before the official ones are added, the syntax is: ALIAS <name> <OID> It will need to be used inside a BEGIN-PROTOCOL block if you're making the changes in raddb/dictionary. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 4

Proxy to realm after eap-ttls authantication
by Mesut Ozturk 23 Nov '20

23 Nov '20

Hello, I desperately need your help. I am noob with FreeRadius so please guide me what i am doing wrong. My point is using freeradius as a Proxy. Because we already have a PAP supported Radius, so i want to do eap auth part on freeradius and then Proxy the Access-request to our own Radius. We are trying 802.1x authantication. According to my readings i did below steps : 1 . Edit clients.conf for my mobile devices to Access freeradius client nevotek { ipaddr = 213.74.143.140 secret = testing1234 } 2. add home_server in proxy.conf home_server IAS { ipaddr = 192.168.0.252 port = 1812 type = "auth" secret = "secret" response_window = 20 max_outstanding = 65536 } home_server_pool jack_pool { type = fail-over home_server = IAS } realm nevotek { auth_pool = jack_pool nostirp } 3. edit eap.cof default_eap_type = ttls and in ttls function : ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "proxy-inner-tunnel" } 4. prepare Proxy.config soft link for sites-enabled, added nevotek in proxy-inner-tunnel: server proxy-inner-tunnel { authorize { update control { Proxy-To-Realm := "nevotek" } } authenticate { eap } post-proxy { eap } } 5. disabled "suffix" part in sites-enabled/default But no chance. Also android and IOS devices has different behaviors. Here is the output of IOS device : (2) Received Access-Request Id 216 from 213.74.143.148:19733 to 10.0.0.4:1812 length 311 (2) User-Name = "iosuser2(a)nevotek.com<mailto:iosuser2@nevotek.com>" (2) Chargeable-User-Identity = 0x00 (2) Operator-Name = "1nevotek.com" (2) Location-Capable = Civic-Location (2) Calling-Station-Id = "74-8d-08-b1-f2-17" (2) Called-Station-Id = "58-f3-9c-43-52-a0:Nevotek" (2) NAS-Port = 4 (2) Cisco-AVPair = "audit-session-id=0a0102e1000001205fbba08c" (2) Acct-Session-Id = "5fbba08c/74:8d:08:b1:f2:17/352" (2) NAS-IP-Address = 10.1.2.225 (2) NAS-Identifier = "aa5a6c45-b2c2-436b-90da-0ed2031" (2) Airespace-Wlan-Id = 7 (2) Service-Type = Framed-User (2) Framed-MTU = 1300 (2) NAS-Port-Type = Wireless-802.11 (2) EAP-Message = 0x020300061500 (2) State = 0xca8e79cacb8d6ce3fd1d37ee8f32d170 (2) Message-Authenticator = 0xc7b01c5b471b2eb70578f1dc7ed6e7ea (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)<mailto:/@(.+)\.(.+)$/)>) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)<mailto:/@(.+)\.(.+)$/)>) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./<mailto:/@\./>) { (2) if (&User-Name =~ /(a)\./<mailto:/@\./>) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) eap: Peer sent EAP Response (code 2) ID 3 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0xca8e79cacb8d6ce3 (2) eap: Finished EAP session with state 0xca8e79cacb8d6ce3 (2) eap: Previous EAP request found for state 0xca8e79cacb8d6ce3, released from the list (2) eap: Peer sent packet with method EAP TTLS (21) (2) eap: Calling submodule eap_ttls to process data (2) eap_ttls: Authenticate (2) eap_ttls: Continuing EAP-TLS (2) eap_ttls: Peer ACKed our handshake fragment (2) eap_ttls: [eaptls verify] = request (2) eap_ttls: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 4 length 336 (2) eap: EAP session adding &reply:State = 0xca8e79cac88a6ce3 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 216 from 10.0.0.4:1812 to 213.74.143.148:19733 length 0 (2) EAP-Message = 0x01040150158000000528d123b84f84592a0a7ccb12b23ec09a0c025464d3f258d5090bffa282b17870910449329f906380b0b4340ef2b6a1dc73e72d35763148b65bfc0401010038af8b17d95590598994e5ec35c96642e3e8fce291173f61b7e1ca06aa4b749dd3f2bbe12175a964524311069490e0f6 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xca8e79cac88a6ce3fd1d37ee8f32d170 (2) Finished request And here is the output of Android device : (2) Received Access-Request Id 59 from 213.74.143.148:38031 to 10.0.0.4:1812 length 312 (2) User-Name = "anonymous(a)nevotek.com<mailto:anonymous@nevotek.com>" (2) Chargeable-User-Identity = 0x00 (2) Operator-Name = "1nevotek.com" (2) Location-Capable = Civic-Location (2) Calling-Station-Id = "04-b1-a1-53-4d-1e" (2) Called-Station-Id = "58-f3-9c-43-52-a0:Nevotek" (2) NAS-Port = 4 (2) Cisco-AVPair = "audit-session-id=0a0102e1000001275fbbbb17" (2) Acct-Session-Id = "5fbbbb17/04:b1:a1:53:4d:1e/359" (2) NAS-IP-Address = 10.1.2.225 (2) NAS-Identifier = "aa5a6c45-b2c2-436b-90da-0ed2031" (2) Airespace-Wlan-Id = 7 (2) Service-Type = Framed-User (2) Framed-MTU = 1300 (2) NAS-Port-Type = Wireless-802.11 (2) EAP-Message = 0x020300061500 (2) State = 0xd875f9c9d976ec270910ae6415adb475 (2) Message-Authenticator = 0xe92ebb9e5e7641c5515a25ae2ee50929 (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)<mailto:/@(.+)\.(.+)$/)>) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)<mailto:/@(.+)\.(.+)$/)>) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./<mailto:/@\./>) { (2) if (&User-Name =~ /(a)\./<mailto:/@\./>) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) eap: Peer sent EAP Response (code 2) ID 3 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0xd875f9c9d976ec27 (2) eap: Finished EAP session with state 0xd875f9c9d976ec27 (2) eap: Previous EAP request found for state 0xd875f9c9d976ec27, released from the list (2) eap: Peer sent packet with method EAP TTLS (21) (2) eap: Calling submodule eap_ttls to process data (2) eap_ttls: Authenticate (2) eap_ttls: Continuing EAP-TLS (2) eap_ttls: Peer ACKed our handshake fragment (2) eap_ttls: [eaptls verify] = request (2) eap_ttls: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 4 length 336 (2) eap: EAP session adding &reply:State = 0xd875f9c9da71ec27 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 59 from 10.0.0.4:1812 to 213.74.143.148:38031 length 0 (2) EAP-Message = 0x01040150158000000528a2e03207e6a1163699a1cff7af74692beaafff15b2a3033c4d0238dd7014db04f7f40d669da91832dd39bbdbfca1bdb456f26f4a981b5a820108040100b7a20cf24aad9d35b94575b849f9e8ef528d1b13e7caea59f3cc578845763a601b7fceb8ffda9d989423730b5ea4c0f3 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xd875f9c9da71ec270910ae6415adb475 (2) Finished request Waking up in 4.3 seconds. (3) Received Access-Request Id 60 from 213.74.143.148:38031 to 10.0.0.4:1812 length 319 (3) User-Name = "anonymous(a)nevotek.com<mailto:anonymous@nevotek.com>" (3) Chargeable-User-Identity = 0x00 (3) Operator-Name = "1nevotek.com" (3) Location-Capable = Civic-Location (3) Calling-Station-Id = "04-b1-a1-53-4d-1e" (3) Called-Station-Id = "58-f3-9c-43-52-a0:Nevotek" (3) NAS-Port = 4 (3) Cisco-AVPair = "audit-session-id=0a0102e1000001275fbbbb17" (3) Acct-Session-Id = "5fbbbb17/04:b1:a1:53:4d:1e/359" (3) NAS-IP-Address = 10.1.2.225 (3) NAS-Identifier = "aa5a6c45-b2c2-436b-90da-0ed2031" (3) Airespace-Wlan-Id = 7 (3) Service-Type = Framed-User (3) Framed-MTU = 1300 (3) NAS-Port-Type = Wireless-802.11 (3) EAP-Message = 0x0204000d150015030300020230 (3) State = 0xd875f9c9da71ec270910ae6415adb475 (3) Message-Authenticator = 0xbd27e9cbdb496b0f8072580915cabc5d (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)<mailto:/@(.+)\.(.+)$/)>) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)<mailto:/@(.+)\.(.+)$/)>) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./<mailto:/@\./>) { (3) if (&User-Name =~ /(a)\./<mailto:/@\./>) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) eap: Peer sent EAP Response (code 2) ID 4 length 13 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0xd875f9c9da71ec27 (3) eap: Finished EAP session with state 0xd875f9c9da71ec27 (3) eap: Previous EAP request found for state 0xd875f9c9da71ec27, released from the list (3) eap: Peer sent packet with method EAP TTLS (21) (3) eap: Calling submodule eap_ttls to process data (3) eap_ttls: Authenticate (3) eap_ttls: Continuing EAP-TLS (3) eap_ttls: [eaptls verify] = ok (3) eap_ttls: Done initial handshake (3) eap_ttls: <<< recv TLS 1.2 [length 0002] (3) eap_ttls: ERROR: TLS Alert read:fatal:unknown CA (3) eap_ttls: TLS_accept: Need to read more data: error (3) eap_ttls: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca (3) eap_ttls: In SSL Handshake Phase (3) eap_ttls: In SSL Accept mode (3) eap_ttls: SSL Application Data (3) eap_ttls: ERROR: TLS failed during operation (3) eap_ttls: ERROR: [eaptls process] = fail (3) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (3) eap: Sending EAP Failure (code 4) ID 4 length 4 (3) eap: Failed in EAP select (3) [eap] = invalid (3) } # authenticate = invalid (3) Failed to authenticate the user (3) Using Post-Auth-Type Reject (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Post-Auth-Type REJECT { (3) attr_filter.access_reject: EXPAND %{User-Name} (3) attr_filter.access_reject: --> anonymous(a)nevotek.com<mailto:anonymous@nevotek.com> (3) attr_filter.access_reject: Matched entry DEFAULT at line 11 (3) [attr_filter.access_reject] = updated (3) [eap] = noop (3) policy remove_reply_message_if_eap { (3) if (&reply:EAP-Message && &reply:Reply-Message) { (3) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (3) else { (3) [noop] = noop (3) } # else = noop (3) } # policy remove_reply_message_if_eap = noop (3) } # Post-Auth-Type REJECT = updated (3) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (3) Sending delayed response (3) Sent Access-Reject Id 60 from 10.0.0.4:1812 to 213.74.143.148:38031 length 44 (3) EAP-Message = 0x04040004 (3) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.1 seconds. (0) Cleaning up request packet ID 57 with timestamp +25 Waking up in 0.2 seconds. (1) Cleaning up request packet ID 58 with timestamp +26 Waking up in 0.3 seconds. (2) Cleaning up request packet ID 59 with timestamp +26 Waking up in 0.2 seconds. (3) Cleaning up request packet ID 60 with timestamp +26 Regards. [http://www.nevotek.com/nevotekmail/logo.png] Mesut Ozturk R&D Senior Developer P: +902122867576 E: mesut(a)nevotek.com F: +902122867476 W: www.nevotek.com [http://www.nevotek.com/nevotekmail/maps-icon.png] Santa Clara-CA, USA<https://www.google.com/maps/place/5201+Great+America+Pkwy+%23320,+Santa+Cla…> [http://www.nevotek.com/nevotekmail/maps-icon.png] Istanbul, TURKEY<https://www.google.com/maps/search/teknokent,+Istanbul,+Turkey/@41.106333,2…> [http://www.nevotek.com/nevotekmail/maps-icon.png] Dubai, UAE<https://www.google.com/maps/place/Internet+City,+Building+%2314+-+Dubai+-+U…> [www.nevotek.com]<www.nevotek.com>

1 0