March 2009 - Freeradius-Users - lists.freeradius.org

Duplicate Acct-Status packets
by Bogomolov Andrei 01 Apr '09

01 Apr '09

I'm running freeradius-1.1.7: NAS server sends Acct-Status-Start packet, then freeradius processes it, and confirms with Acct-Status-Reply. But if the reply packet is lost due UDP-nature, NAS sends second Acct-Status-Start. In this situation I have two duplicate records in radacct table. How can I avoid this? Unique db-indexes, or better something else?

3 4

SQL xlat not working
by Eric Geier 01 Apr '09

01 Apr '09

I can't get SQL xlat to work in the Clients file. I'm trying to do a DB query for the Shared Secret. I'm getting invalid Message-Authenticator (Shared secret is incorrect) errors. The select statement works fine when ran on my DB server. Have any suggestions? Thanks, Eric

2 1

RE: MAC auth won't work with SQL
by Eric Geier 01 Apr '09

01 Apr '09

Great, works now. Thanks! Is there a way to load the Database Value field with multiple MAC addresses, and freeradius check against them....so I can specify multiple devices the user can use? - Eric > -----Original Message----- > From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On > Behalf Of tnt(a)kalik.net > Sent: Tuesday, March 31, 2009 5:11 PM > To: FreeRadius users mailing list > Subject: Re: MAC auth won't work with SQL > > >Hi, I've setup two different Linux machines with FR and still can't > get MAC > >authentication working with Calling-Station-Id in the radchk table. > I've > >checked FAQ and have googled for hours. I've tried a hosted and local > mySQL > >server. > > > > If you only bothered looking at debug and configuration files for the > authentication method you are using. Outer request: > > >rad_recv: Access-Request packet from host 192.168.0.1 port 41576, > id=191, > >length=230 > .. > > Calling-Station-Id = "00-1C-B3-B1-3E-07" > .. > > has that attribute in it, and inner request (user is authenticated in > inner tunnel): > > >Sending tunneled request > > > > EAP-Message = > >0x026c00491a026c00443177f318d460fc36f9cc77a41c0a4b36560000000000000000 > 10538d > >55c2badfcc4a85b41f875a5521f978d255be29a7d20065676569657240736b796e6574 > 73 > > > > FreeRADIUS-Proxied-To = 127.0.0.1 > > > > User-Name = "egeier@skynets" > > > > State = 0x8433f2b7845fe8463016d60fe5b8c67e > > .. doesn't! You have a setting copy_request_to_tunnel in peap section > of eap.conf. Enable it. > > Ivan Kalik > Kalik Informatika ISP > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

autostart script for FreeRADIUS
by Tseveendorj 01 Apr '09

01 Apr '09

Hello, I was installed FreeRADIUS 2.1.3 on FreeBSD 6.4 . I want FreeRADIUS comes up when the system is rebooting. Thank you. Sincerely, Tseveen

10 17

User Authorization question
by Larry Ross 31 Mar '09

31 Mar '09

Good Afternoon; I am looking at different ways to authorize users using local resources. I would like to create various Text files (like foundry.acl, juniper.acl etc etc) with a list of kerberos principles contained within (each principle separated by new line). When a user attempts to authenticate from a given IP range the radius engine will authorize the user against the appropriate acl file, if the user is contained within the acl file then they are allowed and certain vendor specific attrs are sent back with the acess accept. Basically I would like to create "groups" to authorize access to different devices accross the network, LDAP is not an option and moving forward with a SQL db seems a bit over kill. Larry

2 6

MAC auth won't work with SQL
by Eric Geier 31 Mar '09

31 Mar '09

Hi, I've setup two different Linux machines with FR and still can't get MAC authentication working with Calling-Station-Id in the radchk table. I've checked FAQ and have googled for hours. I've tried a hosted and local mySQL server. Right now I'm using FR 2.1.1 on openSUSE. I didn't install freeradius-mysql on this new Linux machine, because I can't find it. However, I can still do 802.1X/PEAP authentication against my MySQL DB if I don't have the Calling-Station-Id entry in the radchk table. I can't get SQL xlat to work in the Clients file either. I appreciate your help! Thanks! Associated entries in the radchk table: DEFAULT Fall-Through = yes egeier@skynets Cleartext-Password := XXXX egeier@skynets Calling-Station-Id == 00-1C-B3-B1-3E-07 (if I remove this entry, I can get authenticated) Here's most of the debug: [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> egeier@skynets [sql] sql_set_user escaped user --> 'egeier@skynets' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'egeier@skynets' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'egeier@skynets' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'egeier@skynets' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 190 to 192.168.0.1 port 41576 EAP-Message = 0x016600061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x887600b0881019123d77eed9ad3cef65 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 41576, id=191, length=230 User-Name = "egeier@skynets" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x887600b0881019123d77eed9ad3cef65 EAP-Message = 0x0266007d198000000073160301006e0100006a030149d245f8cc2cbd4fe33cdb07dc35b6c8 7acfcc21da980a70fa466c6e819bf491000018002f00350005000ac009c00ac013c014003200 38001300040100002900000013001101000e65676569657240736b796e657473000a00080006 001700180019000b00020100 Message-Authenticator = 0x15b99d469f497dd1de41e19b04d463d9 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "skynets" for User-Name = "egeier@skynets" [suffix] No such realm "skynets" ++[suffix] returns noop [eap] EAP packet type response id 102 length 125 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 115 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 006e], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 191 to 192.168.0.1 port 41576 EAP-Message = 0x0167040019c00000089b160301002a02000026030149d245fcb6267b990aa260afc7ea5b36 69e5ee697512f85665761dad0e9b077600002f00160301085e0b00085a0008570003a6308203 a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355 040613024652310f300d060355040813065261646975733112301006035504071309536f6d65 776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886 f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d457861 6d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303332393034333235325a170d3130303332393034333235325a307c310b30 09060355040613024652310f300d0603550408130652616469757331153013060355040a130c 4578616d706c6520496e632e312330210603550403131a4578616d706c652053657276657220 43657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d 706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a028201 0100afd25d67da8ccffe4763fb564786b51a38065630484af7bdfabce1d2c494a9178693a0d3 7c5d8bb0f184839f8700e87e464a3fd3664d6c82da999d3a6fd4 EAP-Message = 0x03feced789fe0bc58ac735ea394fff75c1e3723d9badf8045fea760ba15017ca23cd28c633 e2ff2c55f19fe853ccee89390c60abe5c8b5be7cce9fd2e1efe34086fc578e9cd3dca650e261 2444f21a4f7c80eb794132fad70261a3da7c63ccf56dcd931ffc1e0912c82313121e4197edad 3ed70eef62995f2b051615c0a6de7e1168c58814bdff90876a6bbe2f55a41646fed7b11f207f ee2afc6978da691d65c8b11a4cfef4d7e0e095aba4a8a1262c4021bc738930d2fae12d48353e f49abbe6a30203010001a317301530130603551d25040c300a06082b06010505070301300d06 092a864886f70d010104050003820101006f3167466476eee8e8 EAP-Message = 0x1d9bc9ff6179df282ac7c7ae44de229478cd5ff080afc57bae410b221f2f63cb5d55a2132e 76ba5e5ec0e020a0cb789746cf6af20a26bfca7f4c46dfeedb0db3800fdf3daae1ac08590294 64cb8bea159c1a7803a6a1f048eb694a038d7185a020b995a4c41034221925550e1b59ab8426 4f300de6287dabe959c111739cb6c0857b9229a2556880b70ff453d6eb68e17fdee42c7daa43 d531d49796ee7c824bad36e71a56a23e697f734db8f5196d53cade8e8c58f086e37c343efa9f 544bd5182c285c2eb1f14316c3a0c7ecce1440131b7345dbb21c5b50fbdf1f7fbb919a8c5ebb c7b8306ed89ddf179b89734df0983f59ab3078370004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x887600b0891119123d77eed9ad3cef65 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 41576, id=192, length=111 User-Name = "egeier@skynets" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x887600b0891119123d77eed9ad3cef65 EAP-Message = 0x026700061900 Message-Authenticator = 0x8eba19bccc5e69b9f216eb1aa5d622ec +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "skynets" for User-Name = "egeier@skynets" [suffix] No such realm "skynets" ++[suffix] returns noop [eap] EAP packet type response id 103 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 192 to 192.168.0.1 port 41576 EAP-Message = 0x016803fc194000a663d4bcfa59435a300d06092a864886f70d0101050500308193310b3009 060355040613024652310f300d06035504081306526164697573311230100603550407130953 6f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a 864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d 4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303332 393034333235325a170d3039303432383034333235325a308193310b30090603550406130246 52310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120 301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603 550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122 300d06092a864886f70d01010105000382010f003082010a0282010100a07b3f7d03db9d9063 8bb2fe00a7bee1499ce3357164fcca2ae55636c68b591031c54a32b71db07a0fc4648f64ac0f 3e42fb6e1eb213d1a857ecc05855716d79e27df2253e3200d2edae7859d688ed4ee1bf9b187f 0eafa0f9f938caea97793b222d0f48fb61d261bc7c0d951d958b EAP-Message = 0x919afcca2e94aa848668316e70519c9a02150d8108761a132572fb411b6a9ee027b60f528e 8225c76eb4a961a27207042995695d6fe7c4f46357ca7157ca753aa662a643fc56bb211be0c5 913cdc4db159a4ed1cde0c57bbdbf36a6fe4c41cf2049e652697dc5e7c25cbee83191c8498fd bdc7c920750dff86943ffbaa91391b3aa2cf4a7d9b47bcd5a3d66f64f26c02bf0203010001a3 81fb3081f8301d0603551d0e04160414190087aa851c8abf07d58793670b07dc0f281afb3081 c80603551d230481c03081bd8014190087aa851c8abf07d58793670b07dc0f281afba18199a4 8196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d6577686572653115301306035504 0a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e40 6578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963 61746520417574686f72697479820900a663d4bcfa59435a300c0603551d13040530030101ff 300d06092a864886f70d01010505000382010100873e551255bc752b4c131e4a95863d8b6a80 cb2d7586d71fb4e2e6c5495e054570666e6ac56c1c696bd6b836fc9f091472be94cc2eb4d0f7 e5361541d47e0f6cef294c6c371b3cba08216b3b23d4eecd1a43 EAP-Message = 0xbf0e3675fb3f585c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x887600b08a1e19123d77eed9ad3cef65 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 41576, id=193, length=111 User-Name = "egeier@skynets" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x887600b08a1e19123d77eed9ad3cef65 EAP-Message = 0x026800061900 Message-Authenticator = 0x4a18ffde3fd54458709082acc41f3d7f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "skynets" for User-Name = "egeier@skynets" [suffix] No such realm "skynets" ++[suffix] returns noop [eap] EAP packet type response id 104 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 193 to 192.168.0.1 port 41576 EAP-Message = 0x016900b519000ac1781ba6b83678764615af96a16b9e8de4d9b113c26bb2c31ade4edb2b68 22bbb18d7f91bc56bb4488583f3d505689b6679adc328619eb21a7daf1af07872aac89e203b2 7a66d85397274bc951dc0046c7fb8c7c295405b50ddf9a215e56983d429c6b3880a926b90bd7 068106ee1acc4bb6338265a98d87358fe9150ee5c23194a513e978793898b6e635d3fd5e055d 7af2cde4f8e0eedf75aa077bcb6f304894f85b4c2f16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x887600b08b1f19123d77eed9ad3cef65 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 41576, id=194, length=443 User-Name = "egeier@skynets" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x887600b08b1f19123d77eed9ad3cef65 EAP-Message = 0x02690150198000000146160301010610000102010023b2893885fd70080592f9f1436edd78 1ef99c8de7e15d281fc9e0cb48e5bc031012f493c8c0ec5db3f86b6d30af49d9802cabd8b2c6 bfc33aacf0bdbc772d6ec72fa854774550353bd846ffb9c343e6cabb3ddb76f9ee01b9a7521c 860bef148d1d4eb1b8b899333c0969bdda4a9696b3ba755e681a8605ece35cb2f45c79206a48 10c1e9ace4a13174888ead4afc6072c4bb7dc181b8901660fe2b7a1efe22976f5002e38c86a8 add81006330cfd3f2cbdd5c2e76bb81c4846ea52f4aef3af45cce2a86b849237500eb9d1c6d6 7bdbfc9836e26fbda7ae864fde76b74984d59aedb730cba46565 EAP-Message = 0xa20dc51aeb625c90ed25b9e40eba2e117eb2997a2d04bbec1403010001011603010030b651 eef1062359b260318bb1dd249762365351efbf979e7ef0c70337855c0be3525be8a1d9f2de75 96e29aeb12db9ea0 Message-Authenticator = 0x23d1e19846a4ea99d34d9f1a1bf02ad3 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "skynets" for User-Name = "egeier@skynets" [suffix] No such realm "skynets" ++[suffix] returns noop [eap] EAP packet type response id 105 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 194 to 192.168.0.1 port 41576 EAP-Message = 0x016a004119001403010001011603010030265d5beb57a7f13839215fa229455a84bed0bfc5 f273c5c0535713ccf5aa89e1df349a61abbbfe8f1b76f83d2644755d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x887600b08c1c19123d77eed9ad3cef65 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 41576, id=195, length=111 User-Name = "egeier@skynets" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x887600b08c1c19123d77eed9ad3cef65 EAP-Message = 0x026a00061900 Message-Authenticator = 0xf532a3f5a4dcdd4ed4cd71b5cce532e4 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "skynets" for User-Name = "egeier@skynets" [suffix] No such realm "skynets" ++[suffix] returns noop [eap] EAP packet type response id 106 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 195 to 192.168.0.1 port 41576 EAP-Message = 0x016b002b19001703010020b112cf49ce3a72e40dc7e9d2e94fef07b74cfac248dd3f4e6e30 9db3b1b05606 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x887600b08d1d19123d77eed9ad3cef65 Finished request 5. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 41576, id=196, length=164 User-Name = "egeier@skynets" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x887600b08d1d19123d77eed9ad3cef65 EAP-Message = 0x026b003b19001703010030aee967824d4e7846b6a3c5c2c6b17ab847f7b1fbcdb0fef31637 10a16b7bc351909a7bfbce7b8d60894766b4b01ab6d2 Message-Authenticator = 0xfa8e5924d5d9b80b3b1eb528d3513560 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "skynets" for User-Name = "egeier@skynets" [suffix] No such realm "skynets" ++[suffix] returns noop [eap] EAP packet type response id 107 length 59 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - egeier@skynets [peap] Got tunnled request EAP-Message = 0x026b00130165676569657240736b796e657473 server (null) { PEAP: Got tunneled identity of egeier@skynets PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to egeier@skynets Sending tunneled request EAP-Message = 0x026b00130165676569657240736b796e657473 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "egeier@skynets" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] Looking up realm "skynets" for User-Name = "egeier@skynets" [suffix] No such realm "skynets" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 107 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> egeier@skynets [sql] sql_set_user escaped user --> 'egeier@skynets' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'egeier@skynets' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'egeier@skynets' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User egeier@skynets not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x016c00281a016c0023106185c5d30b26df47aaac5835af87854b65676569657240736b796e 657473 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8433f2b7845fe8463016d60fe5b8c67e [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x016c00281a016c0023106185c5d30b26df47aaac5835af87854b65676569657240736b796e 657473 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8433f2b7845fe8463016d60fe5b8c67e [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 196 to 192.168.0.1 port 41576 EAP-Message = 0x016c004b1900170301004067569516e09b50992249a0bac4306d551611bcdb09de427286d5 1a142ec500855f624a955aca6ce7ae6c5a4c306e7b00579d350b7066fc9b799899f54327558c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x887600b08e1a19123d77eed9ad3cef65 Finished request 6. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 41576, id=197, length=212 User-Name = "egeier@skynets" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x887600b08e1a19123d77eed9ad3cef65 EAP-Message = 0x026c006b19001703010060d41722535ff45cf717b4f40c141ecfcdad9962074ea118036098 59c2ea68c930bce1856c23eb1bc5c0625068f4ebcaba06ff1b3558ec28f435bcec2cdb75d736 3a9a77334da514d01e43e12bf757ff038bb0f37084a82213a93a6303c2ac4539 Message-Authenticator = 0x620d57d70597d1e4d0364a17ab00182f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "skynets" for User-Name = "egeier@skynets" [suffix] No such realm "skynets" ++[suffix] returns noop [eap] EAP packet type response id 108 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunnled request EAP-Message = 0x026c00491a026c00443177f318d460fc36f9cc77a41c0a4b3656000000000000000010538d 55c2badfcc4a85b41f875a5521f978d255be29a7d20065676569657240736b796e657473 server (null) { PEAP: Setting User-Name to egeier@skynets Sending tunneled request EAP-Message = 0x026c00491a026c00443177f318d460fc36f9cc77a41c0a4b3656000000000000000010538d 55c2badfcc4a85b41f875a5521f978d255be29a7d20065676569657240736b796e657473 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "egeier@skynets" State = 0x8433f2b7845fe8463016d60fe5b8c67e server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] Looking up realm "skynets" for User-Name = "egeier@skynets" [suffix] No such realm "skynets" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 108 length 73 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> egeier@skynets [sql] sql_set_user escaped user --> 'egeier@skynets' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'egeier@skynets' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'egeier@skynets' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User egeier@skynets not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for egeier@skynets with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "lE=691 R=1" EAP-Message = 0x046c0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "lE=691 R=1" EAP-Message = 0x046c0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 197 to 192.168.0.1 port 41576 EAP-Message = 0x016d002b1900170301002050851be7730cf2433442d5288ae299103964d96aca2e00a9a20a 8172328618ee Message-Authenticator = 0x00000000000000000000000000000000 State = 0x887600b08f1b19123d77eed9ad3cef65 Finished request 7. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 41576, id=198, length=148 User-Name = "egeier@skynets" NAS-IP-Address = 192.168.0.1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1C-B3-B1-3E-07" State = 0x887600b08f1b19123d77eed9ad3cef65 EAP-Message = 0x026d002b190017030100202fe95f0a379156a0d8b5c8e2ce3aac1e190037397df3a685ea59 cb4fd6e0e6f2 Message-Authenticator = 0xf374de61a4af8301e8ca7954dd356a7f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "skynets" for User-Name = "egeier@skynets" [suffix] No such realm "skynets" ++[suffix] returns noop [eap] EAP packet type response id 109 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> egeier@skynets attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 198 to 192.168.0.1 port 41576 EAP-Message = 0x046d0004 Message-Authenticator = 0x00000000000000000000000000000000

2 1

Need help to identify source of problem
by Doe Hoe 31 Mar '09

31 Mar '09

Hi. I managed to get FreeRADIUS to work with PEAP and WPA2 authentication using a Linksys WRT54GL wireless router. The weird problem I'm now having is a follows: If the client logging onto the Wi-Fi network tries to login with incorrect credentials (incorrect user or pass) then he gets an access-reject as expected. However, any subsequent login requests from the same client machine (even with correct credentials) seem to be ignored completely. Other client machines CAN login however. Restarting FreeRADIUS or the wi-fi network interface card of the client does not help at all. The only way I can get the client machine to login again is by rebooting the wireless router. Now when I say ignored completely, I mean having FreeRADIUS running in debug mode (freeradius -X) shows absolutely nothing for any of failed logins. The output just stays on "Ready to process requests". However, logins from other client machines that have not been access-rejected yet cause outptut on the freeradius debug. So I am trying to identify the source of the problem. My question is, are there any cases where freeradius will silently (without debug output) reject login requests? If not, then I guess the problem lies with the router itself. And if it is the router causing the problem, can you please help me with what I should search for on message boards and forums to fix the problem as I have limited experience with RADIUS. Kind Regards, Doron

2 1

rlm_perl and tagged attributes problem
by Alexandr Kovalenko 31 Mar '09

31 Mar '09

Hello I'm trying to set up FreeRADIUS with rlm_perl module to have ability to interoperate with our billing/provisioning system. FreeRADIUS version: # radiusd -v radiusd: FreeRADIUS Version 1.1.7, for host amd64-portbld-freebsd6.3, built on Jan 15 2009 at 18:36:52 Perl version: # perl -V Summary of my perl5 (revision 5 version 8 subversion 8) configuration: Platform: osname=freebsd, osvers=6.3-rc2, archname=amd64-freebsd We are using Juniper ERX-310 BRAS to terminate our customers and to configure policies and so on, he need few attributes to be tagged. Here is what normal session should be like to: [never@nemo ~]$ radtest admin test 127.0.0.1 2 testing123 Sending Access-Request of id 229 to 127.0.0.1 port 1812 User-Name = "admin" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=229, length=126 ERX-Qos-Profile-Name = "SP_Tele_Internet" ERX-Qos-Parameters = "internet_tr_value 2097152" Framed-IP-Address = 10.0.112.2 Framed-IP-Netmask = 255.255.255.255 ERX-Service-Statistics:1 = time-volume ERX-Service-Activate:1 = "telesys(1048576)" Please note ERX-Service-Statistics:1 and ERX-Service-Activate:1 attributes. I have minimized code in Perl module to achieve this, to exclude any possibility of our system influence: sub authorize { if (($RAD_REQUEST{'User-Name'} eq 'admin') and ($RAD_REQUEST{'User-Password'} eq 'test')) { $RAD_REPLY{'ERX-Service-Activate:1'} = 'telesys(1048576)'; $RAD_REPLY{'ERX-Service-Statistics:1'} = 'time-volume'; $RAD_REPLY{'ERX-Qos-Parameters'} = "internet_tr_value 2097152"; $RAD_REPLY{'ERX-Qos-Profile-Name'} = "SP_Tele_Internet"; $RAD_REPLY{'Framed-IP-Address'} = '10.0.112.2'; $RAD_REPLY{'Framed-IP-Netmask'}= "255.255.255.255"; return RLM_MODULE_OK; }; } Now let me to describe what happens. When I restart radiusd and issue 1st radius Access-Request packet, it returns attributes as expected. But the next one returns this: $ radtest admin test 127.0.0.1 2 testing123 Sending Access-Request of id 32 to 127.0.0.1 port 1812 User-Name = "admin" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=32, length=125 ERX-Qos-Profile-Name = "SP_Tele_Internet" ERX-Qos-Parameters = "internet_tr_value 2097152" Framed-IP-Address = 10.0.112.2 Framed-IP-Netmask = 255.255.255.255 ERX-Service-Statistics:0 = time-volume ERX-Service-Activate:0 = "telesys(1048576)" Please note ":0" after 2 last ERX-* attributes, which is a) incorrect, b) in perl code it is clearly written as ":1". Please help me to resolve this issue. Thanks in advance. Here is log of correct behavior: ------------------------------------ rad_recv: Access-Request packet from host 127.0.0.1:64032, id=42, length=57 User-Name = "admin" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "admin", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 0 Using perl at 0x592370 rlm_perl: $VAR1 = {}; rlm_perl: defined rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value 2097152 rlm_perl: Added pair ERX-Service-Activate = telesys (1048576) rlm_perl: Added pair ERX-Qos-Profile-Name = SP_Tele_Internet rlm_perl: Added pair ERX-Service-Statistics = time-volume rlm_perl: Added pair Framed-IP-Address = 10.0.112.2 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = Perl modcall[authorize]: module "perl" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Perl auth: type "Perl" Processing the authenticate section of radiusd.conf modcall: entering group Perl for request 0 Using perl at 0x592370 rlm_perl: Added pair ERX-Qos-Profile-Name = SP_Tele_Internet rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value 2097152 rlm_perl: Added pair Framed-IP-Address = 10.0.112.2 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = Perl modcall[authenticate]: module "perl" returns ok for request 0 modcall: leaving group Perl (returns ok) for request 0 Sending Access-Accept of id 42 to 127.0.0.1 port 64032 ERX-Qos-Parameters = "internet_tr_value 2097152" ERX-Service-Activate:1 = "telesys (1048576)" ERX-Qos-Profile-Name = "SP_Tele_Internet" ERX-Service-Statistics:1 = time-volume Framed-IP-Address = 10.0.112.2 Framed-IP-Netmask = 255.255.255.255 Finished request 0 -------------------------------------------- Here is log of next try: -------------------------------------------- rad_recv: Access-Request packet from host 127.0.0.1:49908, id=68, length=57 User-Name = "admin" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "admin", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 1 Using perl at 0x592370 rlm_perl: $VAR1 = {}; rlm_perl: defined rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value 2097152 rlm_perl: Added pair ERX-Service-Activate = telesys (1048576) rlm_perl: Added pair ERX-Qos-Profile-Name = SP_Tele_Internet rlm_perl: Added pair ERX-Service-Statistics = time-volume rlm_perl: ERROR: Failed to create pair Primary-DNS = 77.91.190.21 rlm_perl: Added pair Framed-IP-Address = 10.0.112.2 rlm_perl: ERROR: Failed to create pair Secondary-DNS = 77.91.190.24 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = Perl modcall[authorize]: module "perl" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Perl auth: type "Perl" Processing the authenticate section of radiusd.conf modcall: entering group Perl for request 1 Using perl at 0x592370 rlm_perl: Added pair ERX-Qos-Profile-Name = SP_Tele_Internet rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value 2097152 rlm_perl: Added pair Framed-IP-Address = 10.0.112.2 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = Perl modcall[authenticate]: module "perl" returns ok for request 1 modcall: leaving group Perl (returns ok) for request 1 Sending Access-Accept of id 68 to 127.0.0.1 port 49908 ERX-Qos-Parameters = "internet_tr_value 2097152" ERX-Service-Activate:0 = "telesys (1048576)" ERX-Qos-Profile-Name = "SP_Tele_Internet" ERX-Service-Statistics:0 = time-volume Framed-IP-Address = 10.0.112.2 Framed-IP-Netmask = 255.255.255.255 Finished request 1 -- Alexandr Kovalenko http://uafug.org.ua/

2 5

How to use Autz-Type?
by Fajar A. Nugraha 31 Mar '09

31 Mar '09

Hi, I'm using freeradius 2.1.3 (self-compiled as RPM), and trying to use Autz-Type. I see example from /usr/share/doc/freeradius-2.1.3/Autz-Type: #================== authorize{ preprocess suffix Autz-Type customer1{ ldap1 } Autz-Type customer2{ ldap2 } files } users file------------------- DEFAULT Realm == "customer1", Autz-Type := customer1, Auth-Type := customer1 DEFAULT Realm == "customer2", Autz-Type := customer2, Auth-Type := customer2 ---------------------------- #================== So in /etc/raddb/sites-available/default I have this (only authorize section shown): #================== authorize { preprocess suffix Autz-Type DOM1 { sql1 } Autz-Type DOM2 { sql2 } files } #================== and on /etc/raddb/users I have this: #================== DEFAULT Realm == "domain1.com", Autz-Type := DOM1, Auth-Type := DOM1 DEFAULT Realm == "domain2.com", Autz-Type := DOM2, Auth-Type := DOM2 #================== but on starting freeradius I got this (full output on http://pastebin.com/f7ab657ef) Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" compat = "no" } /etc/raddb/users[2]: Parse error (check) for entry DEFAULT: Unknown value DOM1 for attribute Autz-Type Errors reading /etc/raddb/users /etc/raddb/modules/files[7]: Instantiation failed for module "files" Did I miss something? Regards, Fajar

3 4

PEAP test fails using eapol_test
by Bo Nygaard Bai 31 Mar '09

31 Mar '09

I have spend more than a week, trying every hint i could extract from google. But I am still unable to get a working PEAP setup. Could someone please point out my glaringly obvious mistake. Versions: freeradius built from 2.1.4 source (but it reports 2.1.5 on start!) eapol_test from wpa_supplicant-0.6.9 I am trying to perform PEAP with MSCHAPV2. eapol_test (wpa_supplicant-0.6.9) configuration: network={ eap=PEAP eapol_flags=0 key_mgmt=IEEE8021X identity="testuser" password="password" ca_cert="ca.pem" phase2="auth=MSCHAPV2" anonymous_identity="anonymous" } ./eapol_test -c eapol_test.conf.peap -a130.225.51.102 -p1812 -stesting123 -r1 eapol_test.log <http://kom.aau.dk/%7Ebai/wpa/eapol_test.log> radiusd -X radiusd.log <http://kom.aau.dk/%7Ebai/wpa/radiusd.log> Troubled spost seem to be: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Do i have to create an entry in users for the anonymous user? [peap] FAIL: Forcibly stopping session resumption as it is not allowed. This seems to happen after successful mschapv2 trough the tunnel. Any help will be appreciated! /Bo Bai

2 1