October 2011 - Freeradius-Users - lists.freeradius.org

Quota based on time with squid
by senthil kumar 31 Oct '11

31 Oct '11

Hello Team, I am a newbie to radius server. I have installed free-radius in linux machine with accounting support and was able to authenticate using radtest client.and also I was also successfully authenticate with squid proxy server. I need to assign quota to squid users based on the weekly/hourly basis. I need users radius server to return packet reject when time is expired. is it possible in radius? I am using only linux machine with proxy server. whether NAS is needed? If so, can anyone help me in framing the rules for quota . eg 2 hours a day. I have basic configuration and now when a user authenticates login time is updated in the radpostauth. Thanks, Senthil

4 6

Custom MySQL Queries
by JennyBlunt 29 Oct '11

29 Oct '11

Hello What's the best approach regarding custom mysql queries? I'd like to check if a user is blocked whilst authorising.. Have tried to add something like this to my dictionary file: ATTRIBUTE User-Disabled-Attr 3002 integer And then putting a 1 / 0 in to radcheck against the user. What's the best way to do this kind of request? Is it better to write a lookup somewhere else? Thanks J -- View this message in context: http://freeradius.1045715.n5.nabble.com/Custom-MySQL-Queries-tp4943692p4943… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

RADIUS certificate compatibility warning
by Martin Ubank 29 Oct '11

29 Oct '11

I've upgraded FreeRadius to 2.1.10 and Samba to 3.5.6. I've got right through (again) to the final "Configuring FreeRADIUS to use ntlm_auth for MS-CHAP" stage but the command 'eapol_test -c peap-mschapv2-cert-ntlm_auth.conf -s testing123' fails. The 'radiusd -X' output finishes with : WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x89fe3c9f81f72525 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! http://wiki.freeradius.org/Certificate_Compatibility refers to a problem when the client is a Windows machine, but I'm running the 'eapol_test' command on the FreeRadius server which is Linux (CentOS). The following lines from the output of the 'eapol_test' command seem to indicate a problem with the root certificate.: OpenSSL: tls_connection_ca_cert - Failed to load root certificates error:00000000:lib(0):func(0):reason(0) OpenSSL: tls_connection_ca_cert - loaded DER format CA certificate I created the certificates using the method decsribed in http://deployingradius.com/documents/configuration/certificates.html I can supply the full output from the 'eapol_test' command and from 'radiusd -X' but they're too big to include in this email. Can anyone tell me what I'm doing wrong? Thanks Martin. ================================================================ Here are the errors/warnings section from the output of the 'eapol_test' command and from 'radiusd -X', and the full contents of peap-mschapv2-cert-ntlm_auth.conf, the ca.cnf, server.cnf & client.cnf files & eap.conf: 'eapol_test' errors/warnings ============================ : RADIUS packet matching with station decapsulated EAP packet (code=1 id=2 len=6) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=2 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state GET_METHOD CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25 EAP: Initialize selected EAP method: vendor 0 method 25 (PEAP) TLS: Phase2 EAP types - hexdump(len=40): 00 00 00 00 04 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 11 00 00 00 TLS: using phase1 config options OpenSSL: tls_connection_ca_cert - Failed to load root certificates error:00000000:lib(0):func(0):reason(0) OpenSSL: tls_connection_ca_cert - loaded DER format CA certificate CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected EAP: EAP entering state METHOD SSL: Received packet(len=6) - Flags 0x20 EAP-PEAP: Start (server ver=0, own ver=1) EAP-PEAP: Using PEAP version 0 SSL: (where=0x10 ret=0x1) SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:before/connect initialization SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 write client hello A SSL: (where=0x1002 ret=0xffffffff) SSL: SSL_connect:error in SSLv3 read server hello A SSL: SSL_connect - want more data SSL: 112 bytes pending from ssl_out SSL: 112 bytes left to be sent out (of total 112 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=122) : 'radiusd -X' errors/warnings ============================ : # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: USERNAME [mschap] Told to do MS-CHAPv2 for USERNAME with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=USERNAME [mschap] No NT-Domain was found in the User-Name. [mschap] expand: %{mschap:NT-Domain} -> [mschap] ... expanding second conditional [mschap] expand: --domain=%{%{mschap:NT-Domain}:-CAMPUS} -> --domain=CAMPUS [mschap] mschap2: 8a [mschap] Creating challenge hash with username: USERNAME [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=ee9182b1015b8ded [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=69c37f86d6f44237a66d979b71072d9b874e0fd822ad f858 Exec-Program output: NT_KEY: 4600A59AAB67436A4D937233DEED28B7 Exec-Program-Wait: plaintext: NT_KEY: 4600A59AAB67436A4D937233DEED28B7 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010900331a0308002e533d4343373038393531333746344638333338433834463437303836313636424637413735344643333 0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9197308e909e2a67190d1c1ddd88b035 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010900331a0308002e533d4343373038393531333746344638333338433834463437303836313636424637413735344643333 0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9197308e909e2a67190d1c1ddd88b035 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 8 to 127.0.0.1 port 50462 EAP-Message = 0x0109005b19001703010050ad7b5774ef100e1dd3a5c7a83b174202511c51378dc9f1932cf39dc92db9b588fa9f336d1aeb825 807e62e2cc34dd162d02aa28c9104381f52a86933e2b9e0f65927f00c2fb64b78a078cc5e8e79457b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x20754327287c5ad31b57225dabc8b87e Finished request 8. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +76 Cleaning up request 1 ID 1 with timestamp +76 Cleaning up request 2 ID 2 with timestamp +76 Cleaning up request 3 ID 3 with timestamp +76 Cleaning up request 4 ID 4 with timestamp +76 Cleaning up request 5 ID 5 with timestamp +76 Cleaning up request 6 ID 6 with timestamp +76 Cleaning up request 7 ID 7 with timestamp +76 Cleaning up request 8 ID 8 with timestamp +76 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x20754327287c5ad3 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. peap-mschapv2-cert-ntlm_auth.conf ================================= # # eapol_test -c peap-mschapv2-cert-ntlm_auth.conf -s testing123 # # eapol_version=1 # fast_reauth=0 network={ key_mgmt=WPA-EAP eap=PEAP identity="USERNAME" password="PASSWORD" phase2="autheap=MSCHAPV2" # priority=10 ca_cert="/etc/raddb/certs/ca.der" } ca.cnf ====== [ ca ] default_ca = CA_default [ CA_default ] dir = ./ certs = $dir crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir certificate = $dir/ca.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/ca.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default default_days = 3650 default_crl_days = 30 default_md = sha1 preserve = no policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] prompt = no distinguished_name = certificate_authority default_bits = 2048 input_password = inpass output_password = outpass x509_extensions = v3_ca [certificate_authority] countryName = UK stateOrProvinceName = United Kingdom localityName = Bristol organizationName = UWE emailAddress = email(a)uwe.ac.uk commonName = "UWE Certificate Authority" [v3_ca] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer:always basicConstraints = CA:true ================================================================ server.cnf ========== [ ca ] default_ca = CA_default [ CA_default ] dir = ./ certs = $dir crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir certificate = $dir/server.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/server.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default default_days = 730 default_crl_days = 30 default_md = sha1 preserve = no policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] prompt = no distinguished_name = server default_bits = 2048 input_password = inpass output_password = outpass [server] countryName = UK stateOrProvinceName = United Kingdom localityName = Bristol organizationName = UWE emailAddress = email(a)uwe.ac.uk commonName = "UWE Server Certificate" ================================================================ client.cnf ========== [ ca ] default_ca = CA_default [ CA_default ] dir = ./ certs = $dir crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir certificate = $dir/server.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/server.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default default_days = 730 default_crl_days = 30 default_md = sha1 preserve = no policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] prompt = no distinguished_name = client default_bits = 2048 input_password = inpass output_password = outpass [client] countryName = UK stateOrProvinceName = United Kingdom localityName = Bristol organizationName = UWE emailAddress = email(a)uwe.ac.uk commonName = "UWE Client Certificate" eap.conf ======== eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = outpass private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random cipher_list = "DEFAULT" cache { enable = no max_entries = 255 } } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } }

7 13

CUI in TLS
by Panagiotis Georgopoulos 28 Oct '11

28 Oct '11

Hello all, I am trying to implement CUI in EAP-TLS and I would like to get a handle on the CN of the client's certificate in my default. Basically I need to use the CN of the certificate, since there is no User-Name attribute in EAP-TLS. What module handles the TLS certificates' authentication? How can I get the CN in my post_auth and accounting stanzas in my default? On a similar note, why do we set the lastaccounting='0000-00-00 00:00:00',in the post_authquery in the cui.conf? Incidentally, if we need full IPv6 support the clientipaddress field in the cui table and the equivalent fields in radacct should be of length 39 and not 15. Cheers, Panos

2 3

Access-Reject (code 3) on an otherwise valid Accept packet / delayed reject when SQL module fails in post-auth
by Jason Antman 28 Oct '11

28 Oct '11

Hello, I'm have a FreeRADIUS 2.1.10 server on CentOS... with a backend MySQL database (logging) which is, as Alan would say, Broken - at peak usage times it's horribly overloaded. Up until yesterday, our post-auth section had a "sql" call not wrapped in a "redundant { sql / ok }". It seems that when the MySQL server gets overloaded, and the sql module fails/times out (can't find a configuration value for timeout, or a note on what the timeout actually is), the post-auth section stops and returns a Reject packet. Since it stops before attr_filter, it's returning a non-RFC-compliant REJECT... i.e. an otherwise valid and correct Access-Accept packet, but with a Code of 3 (Access-Reject) since the sql module failed. For the short-term, I wrapped the sql calls in post-auth and post-auth-type reject in redundant, followed by "ok", so that users will not get rejected because of failed logging (administrative/managerial decision, not mine) and gave up SQL post-auth logging in favor of not locking out users when the DB is struggling. Using the test described below, this appears to solve the problem of the improperly formed REJECT packets, but it still ends up with lots of "There are no DB handles to use! skipped 0, tried to connect 0" and then lots of "Info: WARNING Child is hung for request XXXX in component post-auth module sql." lines... I can only assume that these are a non-critical issue (i.e. the child is hung but will recover), but 1) I would like to set a much lower database timeout, i.e. have the sql module fail sooner and move on, and 2) as the "Login (OK|incorrect)" messages don't have the request number, it's difficult to associate these with a given client. An acceptable way to reproduce this is to start radiusd, and then issue a LOCK TABLES radpostauth WRITE; followed by bombarding the radius server with access-requests. In my case, after the DB handles fill up, I will start getting these invalid Reject packets out (a valid accept with a code of 3), along with the above log messages - and "Login OK" messages even for the clients who are rejected due to the sql failure. So a few questions: 1) The logging for this is flat-out wrong. When the SQL module fails in this way in post-auth (because of timeout), I'm still seeing "Auth: Login OK" in radius.log. I guess this could be "a matter of opinion", but the fact that I'm seeing a log message for OK but getting a reject out on the wire, seems like a bug. IMHO, the logging of ok/incorrect should either a) be delayed until JUST before the packet goes out, beyond where an Accept could turn into a Reject, or b) if/when an Accept packet is turned into a Reject and sent out on the wire, there should be an explicit log message stating such (as opposed to just the current "Sending delayed reject" which appears only in debug logs). 2) Is it the expected behavior that if a module in post-auth fails, the packet will be changed to a reject without passing through Post-Auth-Type REJECT, therefore without passing through attr_filter, therefore sending out a non-RFC-compliant Access-Reject packet? 3) As far as I can tell, this entire issue does *not* happen when running "radiusd -fXx"... in that case, radiusd will simply hang indefinitely until the DB recovers (or the table is unlocked, in testing). Does this sound right? Does anyone know if rlm_sql_mysql will behave differently in this way in debug mode as opposed to normal daemon mode? And does it seem correct that in debug mode, there doesn't seem to be a timeout for mysql? I was, however, able to replicate the issue when running "radiusd -fxx", i.e. no single threaded mode. 4) As an example of log output, see the lines below. I know that the 15:19:30 "Login OK" for client mc4k-121 port 8195 actually left as an Access-Reject packet (code 3), which still had User-Name, Callback-Id, Session-Timeout, Termination-Action, and two VSAs set, as the proper Accept for that user should. In certain instances with this problem, the SQL logging was queued somewhere (presumably on the MySQL side, waiting for the unlock) and actually made it to the DB, listed as an Accept packet and all, after radiusd sent out the incompliant Reject. However, of concern in the logs below is the fact that 3 of those Login OK lines (outer tunnel) were actually the invalid Access-Reject packets on the wire, but there's no indication of that here. While there is a vague "There are no DB handles to use" message, that doesn't specify which request it relates to (hence no way to tell which Login OK was actually rejected), nor does it explicitly say that the request will be rejected. ### BEGIN LOG SNIP Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-125 port 8255 cli 00:22:FB:8B:58:04 via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-125 port 8255 cli 00:22:FB:8B:58:04) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-125 port 10287 cli 58:B0:35:41:46:A1 via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-125 port 10287 cli 58:B0:35:41:46:A1) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8203 cli 1C:65:9D:16:2D:EB via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8203 cli 1C:65:9D:16:2D:EB) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8289 cli 70:F1:A1:8B:F2:F8 via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8289 cli 70:F1:A1:8B:F2:F8) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-126 port 6243 cli 88:53:2E:0D:F2:D7 via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-126 port 6243 cli 88:53:2E:0D:F2:D7) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8288 cli 88:9F:FA:77:F7:EE via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8288 cli 88:9F:FA:77:F7:EE) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8209 cli 8C:58:77:4C:78:CE via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8209 cli 8C:58:77:4C:78:CE) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8202 cli F0:B4:79:45:14:DD via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8202 cli F0:B4:79:45:14:DD) Thu Oct 27 15:19:29 2011 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-126 port 6278 cli 18:E7:F4:F6:C8:E6 via TLS tunnel) Thu Oct 27 15:19:29 2011 : Auth: Login OK: [usernameRedacted] (from client mc5k-126 port 6278 cli 18:E7:F4:F6:C8:E6) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8273 cli 00:26:C6:83:50:82 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8273 cli 00:26:C6:83:50:82) Thu Oct 27 15:19:30 2011 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8295 cli CC:08:E0:EA:1A:23 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8295 cli CC:08:E0:EA:1A:23) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8195 cli 00:1E:C2:AB:03:07 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8195 cli 00:1E:C2:AB:03:07) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8219 cli 00:21:E9:DE:F2:3A via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8219 cli 00:21:E9:DE:F2:3A) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8272 cli 00:25:56:51:82:C8 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8272 cli 00:25:56:51:82:C8) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8280 cli E4:CE:8F:41:DD:82 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8280 cli E4:CE:8F:41:DD:82) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8300 cli 58:1F:AA:69:48:49 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8300 cli 58:1F:AA:69:48:49) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 10241 cli 04:0C:CE:D7:B3:28 via TLS tunnel) Thu Oct 27 15:19:30 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 10241 cli 04:0C:CE:D7:B3:28) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8301 cli 8C:58:77:66:0C:AE via TLS tunnel) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8301 cli 8C:58:77:66:0C:AE) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8202 cli F0:B4:79:45:14:DD via TLS tunnel) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8202 cli F0:B4:79:45:14:DD) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8284 cli 34:51:C9:2E:05:DD via TLS tunnel) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8284 cli 34:51:C9:2E:05:DD) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8271 cli 00:22:69:68:87:B4 via TLS tunnel) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8271 cli 00:22:69:68:87:B4) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8303 cli 00:21:5C:0C:9C:61 via TLS tunnel) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8303 cli 00:21:5C:0C:9C:61) Thu Oct 27 15:19:31 2011 : Auth: Login OK: [usernameRedacted] (from client mc4k-121 port 8213 cli 00:25:00:4D:5D:EA via TLS tunnel) ### END LOG SNIP So to summarize what I'm asking for/about: 1) In instances of a "delayed reject" caused by a failure in post-auth, would it be possible to have this clearly logged to radius.log, either instead of "Login OK", or something along the lines of "WARNING - delayed reject of previous request (request id, username, Calling Station Id, client, port)"? 2) Is there any way to maintain attr_filter.access_reject even with a delayed reject because of module failure in post-auth, so that these packets are still RFC-compliant? 3) Is there any way to configure the rlm_sql_mysql timeout, or whatever is causing this module to fail when the table is locked? 4) Can I get some clarification on the "There are no DB handles to use! skipped 0, tried to connect 0" and "Info: WARNING Child is hung for request XXXX in component post-auth module sql" radius.log messages, and the severity of these (i.e. does either of them definitively mean that a request was rejected?) Thank you for any advice/insight/comments/suggestions, Jason Antman Rutgers University, NJ, USA

2 1

ntlm_auth reconnection without login data?
by Andreas Rudat 28 Oct '11

28 Oct '11

Hi, if I connect to my radius server, I don't need my password anymore, also if I restart radius or my workstation. But why? Thanks

3 7

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 28 Oct '11

28 Oct '11

right now, the user that i am testing with has a password that is CRYPT. I am fairly certain that my user that i am binding with has the perms to read the userPassword attribute, but i will verify that this morning. On 10/28/2011 4:37 AM, freeradius-users-request(a)lists.freeradius.org wrote: > By default, userPassword is mapped to the FreeRADIUS attribute > Password-With-Header which assumes {label} prefixes, as this is most common. > > Also - are you*sure* the credentials you're using in the "ldap" module > to query the directory have permissions to read the userPassword attribute? -- Matthew Arguin Currensee, Inc. 54 Canal St, 4th Floor Boston, MA 02114 (617) 986-4758 (Office) _________________________________________________________________________ This email and any files transmitted with it are confidential and intended solely for the addressee. If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system. © 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions. Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824

2 1

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 28 Oct '11

28 Oct '11

Thanks Phil. question on that. in the deployment of ldap that we have in place the users password attribute is 'userPassword'. looking at the ldap attribute file and various online results, is the authentication looking for ntPassword for that ldap attribute as opposed to the userPassword one that i have? i know that the user i am testing with has the password that is showing up, i am guessing that maybe i have it assigned in the wrong attribute or i need to change the ldap mapping file to use the attribute i have? -m On 10/27/2011 5:14 PM, freeradius-users-request(a)lists.freeradius.org wrote: > Re: cisco WAP/FreeRadius/OpenLDAP -- Matthew Arguin Currensee, Inc. 54 Canal St, 4th Floor Boston, MA 02114 (617) 986-4758 (Office) _________________________________________________________________________ This email and any files transmitted with it are confidential and intended solely for the addressee. If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system. © 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions. Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824

3 2

cisco WAP/FreeRadius/OpenLDAP
by Matt Arguin 27 Oct '11

27 Oct '11

Hi All, having trouble setting up my RADIUS(FreeRADIUS Version 2.1.7) to auth to my openldap server (openldap-2.3.43-12.el5_6.7) on CentOS 5.5. i am trying to configure EAP-TLS and think i am pretty close. I am currently wondering if possibly i have an incorrect mapping in the ldap.attrs file (it is completely default right now). running 'radiusd -X' i do see some errors such as: rlm_ldap: performing search in dc=currensee,dc=com, with filter (uid=anonymous) rlm_ldap: object not found [ldap] search failed but later down the path of the session it looks like things are going ok , seeing a bunch of EAP challeges and it expanding the username and stuff being put in to the inner-tunnel. However, in the end: rlm_ldap: performing search in dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by uid [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? my ldap attribute for password is userPassword and i have tried changing the values in the ldap.attrs to match this but that did not help. Here is the full output of the run of radiusd in debug mode. Any insight is appreciated: Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=181, length=132 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x247be03937ef0698a7ad23d2f86aa54b EAP-Message = 0x0202000e01616e6f6e796d6f7573 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] performing user authorization for anonymous [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> anonymous [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=anonymous) [ldap] expand: dc=currensee,dc=com -> dc=currensee,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.local.currensee.com:389, authentication 0 rlm_ldap: bind as cn=radius,ou=Services,dc=currensee,dc=com/c17ad5805204465ab39d11e0381272c5 to ldap.local.currensee.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=currensee,dc=com, with filter (uid=anonymous) rlm_ldap: object not found [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop [eap] EAP packet type response id 2 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Found Auth-Type = EAP Found Auth-Type = EAP Warning: Found 2 auth-types on request for user 'anonymous' +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 181 to 192.168.10.31 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382012d02152159f345e3e0c333a Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=182, length=228 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x07f8f2c72439114d5efd54762efa740b EAP-Message = 0x0203005c190016030100510100004d03014ea9917e4e0fee76b71533a74710796e73ac02e494439b92a5338ee6d1f1bcd900002600390038003500160013000a00330032002f00050004001500120009001400110008000600030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382012d02152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 92 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0051], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 06cd], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 182 to 192.168.10.31 port 1645 EAP-Message = 0x0104040019c00000089c160301002a0200002603014ea9916c2187b4df7edfdaf6bcadb4e396d5e7fe95aa4b84bdb2342f281e64d00000390016030106cd0b0006c90006c60002a6308202a23082020b0203100028300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f EAP-Message = 0x63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3131313032313135313134335a170d3231313032303135313134335a3077310b3009060355040613025553311630140603550408130d4d61737361636875736574747331183016060355040a130f43757272656e7365652c20496e632e31133011060355040b130a4f7065726174696f6e733121301f060355040313186f7073322e6c6f63616c2e63757272656e7365652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100dbd67230f6e9b1f8d37cd689371e4965f6760ef34369b95ea48e1ef153be887b5dd5ef31 EAP-Message = 0x7a47e5d66048731d7458d9ae1ebe0508aa349d4fa74dd0c077cdca1fb2af2868d309e938cd6222f3c6737116ff656e10bbb175b76e2aa83c35efc2b0655f3bf669cabbad375d98d89c84f9d30b5887ac5225685c5bee55176ce2fe890203010001300d06092a864886f70d01010405000381810023558f75bca5500a1b7ca225f46cd98622ef05c01cc43e000dcae1cd19b8d8fcf7c53d2dff7c6403781839d0dd4a0bffb4eec337967c32665ee5f11720e09760c222e2fc6a029b0d4eb33c45614d21a6fb55cb6f01df47958d97578160057f0d23aa685539931ad0229522218b7d7c31f9fb1b8e94a9b88d6e8bc4f410a9701400041a308204163082 EAP-Message = 0x037fa003020102020900d869d83ec24831ce300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3130303432363138323634325a170d3230303432353138323634325a EAP-Message = 0x3081b931183016060355040a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382013d72152159f345e3e0c333a Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=183, length=142 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xfb2f68eee2f87814bcac62b0feb517d1 EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382013d72152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 183 to 192.168.10.31 port 1645 EAP-Message = 0x010503fc1940130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100d6e8fe8f9e3905fcd63f0c9f3b9eded323e8b7a1e47ef23d8d53a29572e41656e189ccd616664ad52ea7 EAP-Message = 0x36ee86a2e1fe0696e1fe24e0345cd5b3167530ef0d6b7a58f9f55774d7a403b9a03e5d9374118a1dbb30fcab8c8bc499ef62b3aac1aec00134b635416c73e2f555b24e08933cefe2fb2a47024ee61ab51490f1cae3070203010001a38201223082011e300c0603551d13040530030101ff301d0603551d0e04160414706ed0933d93523470a6e9bc979d124333df14b03081ee0603551d230481e63081e38014706ed0933d93523470a6e9bc979d124333df14b0a181bfa481bc3081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d01090116 EAP-Message = 0x12726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479820900d869d83ec24831ce300d06092a864886f70d010104050003818100d435d275a02b5e04e17e75b6046bbd1ab3ca33299cee907f2bd9c7603b3da4a23ee97e677e97e442bd855e8c2dffc351e134e03fbec16ad71eb7608c62c29bd2a2aaa2660013bc8d76520a5a9f3b516dcbddf6a773564e57c29e20d0a614a6116a36aef3cdfb EAP-Message = 0xdc510f1058d291e6310d9b53c8b17e521038a866f3510355ef29160301018d0c0001890080ff76d1db8e9c6aa6bbe3d1bcc691f539a047acfa556255866a6d802ab6698cb71cf82f2fb16dfe236b5855ea6c50768f5725618bf523493f97785eda71b4aab842513a83fdb1b2466f94df90ec6c771bc6c8004fe3695f678f44ed4618b609c0e8eaf250ea9aef1bfc6213d2e48bd75258d4b20fcb2ea89eb6f562a93619ebeb0001020080b5a0d1fe1783f77da04814409d4381253b3ffbf42bcb99c317280d8c75540d6fb116b748951b5f932db160803689d6f8ed466d8486abae167f27da11a06607c72df17a54d517f21ac5d620663643f8f855e518 EAP-Message = 0x9a37bae7ab57131e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382010d62152159f345e3e0c333a Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=184, length=142 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x1fd77cc584bc1051b7d9fe58107c4c3a EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382010d62152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 184 to 192.168.10.31 port 1645 EAP-Message = 0x010600b6190020da5b4f45515a10838c069b4f306c799dcae80fde0c7eecec68db12a3eaa188db7dcbf50200806bb73ce9d989ce3e074cef9ed67d06dfb226f888a3f8799c5df1c4bf4f652a966eac1ea47e789967cf2657c8a245141794ee18ee29c0ff4f3b3634573b90285e23472af4b29d2e75cac5db910ddac31d258f7f5e3bf8bafe20fe7c46c70bda90a2f67eef82eeff0e907606354f10dff1e2b6ce1cac104de8a8ec6c73cdec574616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382011d52152159f345e3e0c333a Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=185, length=340 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x60c232952342a311ee2bc93a26e4ce71 EAP-Message = 0x020600cc19001603010086100000820080a52906e4cab72051f10862c9b4e9db68968fa1c00ebc4f8c074fa28048ae720918e3e6dde2c7aecddddd342e1f5c6649fa27b48b6960a42370a44bb8ed450c95c35db9878c8e37bf4766de7da741e152ac923353122eba5812448d68414c59de2b16bb02ff0251b80feabf15ef38a54bfd78cda06c8ccee4cfa6088c8803d7361403010001011603010030c557f553edafc375c220d8b101de0f084b5177c27a77c54fb0d465a68e47620529713ff626312a53bf1e06d3ac1ca073 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382011d52152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 185 to 192.168.10.31 port 1645 EAP-Message = 0x0107004119001403010001011603010030ffe92683dad17988140bd1cded5144fa14720bb91cb28e33292d07a24deb1ef51839a5b0531e269e6f31be133887341b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382016d42152159f345e3e0c333a Finished request 4. Going to the next request Waking up in 1.2 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=186, length=142 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xef4b9bafcba2b7293142633bf00f1a52 EAP-Message = 0x020700061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382016d42152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 186 to 192.168.10.31 port 1645 EAP-Message = 0x0108002b190017030100203572669053841178aa51d4dea859b4aa66a10fe9dcce996c6d9e0bf40953d2a4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382017db2152159f345e3e0c333a Finished request 5. Going to the next request Waking up in 1.2 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=187, length=216 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x82af7372ebc34d1c5a983c695666352f EAP-Message = 0x0208005019001703010020381428016e79c1a921ad7bdf022e84bc4a9c4d00aef5e18e9da6abc10d096e501703010020fcac01f3ed169b5b12acb63a0c071b20a1dd48091f06a95457a478078cacbc42 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382017db2152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - marguin2 [peap] Got tunneled request EAP-Message = 0x0208000d016d61726775696e32 server { PEAP: Got tunneled identity of marguin2 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to marguin2 Sending tunneled request EAP-Message = 0x0208000d016d61726775696e32 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "marguin2" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: dc=currensee,dc=com -> dc=currensee,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by uid [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user marguin2 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010900221a0109001d105c038f58bcb3c4fc977d39febd11f16c6d61726775696e32 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2676f99a26e75640cc52013c4080612 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010900221a0109001d105c038f58bcb3c4fc977d39febd11f16c6d61726775696e32 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2676f99a26e75640cc52013c4080612 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 187 to 192.168.10.31 port 1645 EAP-Message = 0x0109004b190017030100407c0dcc2b6be749d2d560495f41a01c6ba27e65a9f3e1facf816a8486e3ebc9be251742e5134b24c41a4e3a1727748ce3ddec39e39c97c21d4de46155f44fe292 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382014da2152159f345e3e0c333a Finished request 6. Going to the next request Waking up in 0.2 seconds. Cleaning up request 0 ID 181 with timestamp +1285 Cleaning up request 1 ID 182 with timestamp +1285 Cleaning up request 2 ID 183 with timestamp +1285 Cleaning up request 3 ID 184 with timestamp +1285 Waking up in 3.6 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=188, length=216 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xba68c91d8ff9a8fc3d4b81978503d6a8 EAP-Message = 0x020900501900170301002038ddef970c4b5de2408e15dcf170380e2dae20f5b4906ca0b83ab09955f3adb31703010020c662bb01f949917629bbf706a765e7289242c9ac1bf7977e086d474a0c535275 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382014da2152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type nak [peap] Got tunneled request EAP-Message = 0x020900060306 server { PEAP: Setting User-Name to marguin2 Sending tunneled request EAP-Message = 0x020900060306 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "marguin2" State = 0xa2676f99a26e75640cc52013c4080612 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: dc=currensee,dc=com -> dc=currensee,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by uid [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user marguin2 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/gtc [eap] processing type gtc ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a000f0650617373776f72643a20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2676f99a36d69640cc52013c4080612 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a000f0650617373776f72643a20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2676f99a36d69640cc52013c4080612 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 188 to 192.168.10.31 port 1645 EAP-Message = 0x010a002b19001703010020ba7c2227f17381def4ec6006850ae086b0697cdfc41e97ee94d231ccdd551274 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d3382015d92152159f345e3e0c333a Finished request 7. Going to the next request Waking up in 2.4 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=189, length=216 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x4f5e68f91a36294046965c597972916c EAP-Message = 0x020a005019001703010020a4743668f0e6f04dc75a186b4547d127fe87d9ac737598ed00d339bd31eef34a1703010020c4266d8d1399b82aaf4d2dc72f527108219aa6f977d6481102df32ac0c4d6eff NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d3382015d92152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type gtc [peap] Got tunneled request EAP-Message = 0x020a000d06723061646b696c6c server { PEAP: Setting User-Name to marguin2 Sending tunneled request EAP-Message = 0x020a000d06723061646b696c6c FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "marguin2" State = 0xa2676f99a36d69640cc52013c4080612 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 10 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: dc=currensee,dc=com -> dc=currensee,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by uid [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user marguin2 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/gtc [eap] processing type gtc [gtc] +- entering group PAP {...} [pap] login attempt with password "r0adkill" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject [eap] Handler failed in EAP/gtc [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 189 to 192.168.10.31 port 1645 EAP-Message = 0x010b002b19001703010020bc3ae32e4fe71200cc035272d73d69789a34f8e7c790f035bee17b0980cdf04b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12d338201ad82152159f345e3e0c333a Finished request 8. Going to the next request Waking up in 0.8 seconds. Cleaning up request 4 ID 185 with timestamp +1288 Cleaning up request 5 ID 186 with timestamp +1288 Waking up in 1.0 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=190, length=216 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x1688d578dda01e85e46ea3f9a3f33deb EAP-Message = 0x020b00501900170301002018a1fc697e05b342b2d81cc8e159577636727020200da90ecd9fc5a854639bd6170301002077d6f24b102100d28f33456f2390219e2ea88229cff0fe978b9df68ac5c60918 NAS-Port-Type = Wireless-802.11 NAS-Port = 799 NAS-Port-Id = "799" State = 0x12d338201ad82152159f345e3e0c333a NAS-IP-Address = 192.168.10.31 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.2 seconds. Cleaning up request 6 ID 187 with timestamp +1289 Waking up in 0.7 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 190 to 192.168.10.31 port 1645 EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.8 seconds. Cleaning up request 7 ID 188 with timestamp +1291 Waking up in 1.5 seconds. Cleaning up request 8 ID 189 with timestamp +1293 Waking up in 2.6 seconds. Cleaning up request 9 ID 190 with timestamp +1294 Ready to process requests. -- Matthew Arguin

3 2

Re: cisco WAP/FreeRadius/OpenLDAP
by Matt Arguin 27 Oct '11

27 Oct '11

\hrm..i guess maybe i am getting my info crossed. I am basically trying to get secure wireless set up for my office. we currently utilize and openldap server and are trying to put cisco 1142's in place. my understanding, and if you tell me i took a wrong turn, i will believe you.... is that the EAP-TLS secures the network and then the RADIUS component authorizes and authenticates the user . Again, I would believe you completely if you told me that I was mashing different sets of info together and coming up with my own incorrect set. -m On Thu, Oct 27, 2011 at 3:01 PM, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Custom MySQL Queries (JennyBlunt) > 2. RES: FreeRadius + MySQL | radacct: Errors and Warnings > (Daniel Menezes) > 3. Failed to load module "jradius" (Travis Dimmig) > 4. Re: Failed to load module "jradius" (Alan DeKok) > 5. RE: Failed to load module "jradius" (Travis Dimmig) > 6. Re: cisco WAP/FreeRadius/OpenLDAP (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 27 Oct 2011 10:37:28 -0700 (PDT) > From: JennyBlunt <jennyshoehorn(a)me.com> > Subject: Custom MySQL Queries > To: freeradius-users(a)lists.freeradius.org > Message-ID: <1319737048193-4943692.post(a)n5.nabble.com> > Content-Type: text/plain; charset=us-ascii > > Hello > > What's the best approach regarding custom mysql queries? I'd like to check > if a user is blocked whilst authorising.. > > Have tried to add something like this to my dictionary file: > > ATTRIBUTE User-Disabled-Attr 3002 integer > > And then putting a 1 / 0 in to radcheck against the user. > > What's the best way to do this kind of request? Is it better to write a > lookup somewhere else? > > Thanks > > J > > -- > View this message in context: http://freeradius.1045715.n5.nabble.com/Custom-MySQL-Queries-tp4943692p4943… > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > > ------------------------------ > > Message: 2 > Date: Thu, 27 Oct 2011 15:55:18 -0200 > From: "Daniel Menezes" <listas(a)dmnzs.com.br> > Subject: RES: FreeRadius + MySQL | radacct: Errors and Warnings > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <02ce01cc94d1$96c37790$c44a66b0$(a)com.br> > Content-Type: text/plain; charset="us-ascii" > > Fajar, > >> So you mean radutmp was the root cause of your problem? > > I don't know, but it's better now. =) > >> What does FR log says? Does it say it recives duplicate or conflicting > packets? >> If yes, then the db is still slow. You still need to fix it. If not, >> then the problem might be somewhere else (e.g. congested network >> causing dropped packets) > > This is strange! > When starting radius in debug mode I don't see any error, in normal mode > duplicate or conflicting packages have disappeared. > Always the statistics in MikroTik shows 2, 4 resends and timeouts .. a few. > > I'll try other ways, first, change the DB engine. > Tomorrow i'll write about. > > Thanks. > > > Sds, > > --- > Daniel Menezes > > > > > > ------------------------------ > > Message: 3 > Date: Thu, 27 Oct 2011 18:28:36 +0000 > From: Travis Dimmig <tdimmig(a)impulse.com> > Subject: Failed to load module "jradius" > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <2ECC69012853FB42A8ADABA5EB3B4B800C9D15CD(a)DSM-Mail01.dsm.net> > Content-Type: text/plain; charset="us-ascii" > > I don't seem to be able to get freeRadius to load the "jradius" module. My steps are as follows: > > wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.12.tar.gz > tar -xzvf freeradius-server-2.1.12.tar.gz > cd freeradius-server-2.1.12 > echo "rlm_jradius" >> src/modules/stable > ./configure && make && make install > cp src/modules/rlm_jradius/jradius./conf /usr/local/etc/raddb > > I configure jradius.conf to point to my JRadius server, and add jradius to the accounting section of sites-enabled. > "radiusd -X" gives: > /usr/local/etc/raddb/sites-enabled/default[443]: Failed to load module "jradius". > /usr/local/etc/raddb/sites-enabled/default[378]: Errors parsing accounting section. > > I have verified that the jradius libraries have been compiled and installed /usr/local/lib. > > I've managed to comile freeRadius with the jradius module before just fine.....not sure what the problem is now. Any help would be greatly appreciated. > > Travis Dimmig > Software Development Specialist > Impulse Point > www.impulse.com<http://www.impulse.com> > >

1 0