August 2011 - Freeradius-Users - lists.freeradius.org

PEAP Authentication Problems with Windows Users
by Jacob Dawson 06 Sep '11

06 Sep '11

We're having an odd problem here, and I just can't pin down quite where to look to fix it. We use PEAP-MSCHAPv2 for authentication of our windows domain users on wireless. This is accomplished by terminating the TLS conversation at FreeRADIUS and sending along the MSCHAP conversation to an IAS server. We've tested this in the past, and it's worked fine, and we're doing a modified form of this in production, and it's working fine, but I've lately been unable to get it to work in our pre-production 2.1.11 environment. What's particularly odd is that it's only affecting the Windows clients. My OS X client doing PEAP with the same credentials is happy. What we're doing in production, which continues to work, is this: We terminate TLS at FreeRADIUS. This allows us to manage the wireless service certificate there, keeps the IAS operators from having to keep up with it. We proxy the MSCHAP conversation to our OpenRADIUS server (which is also running and interacting with TACACS). OpenRADIUS proxies the CHAP stuff to IAS. It may be tinkering with the MSCHAP fields from IAS to make them more compatible (basically changing out the secrets because it's standing in the middle). Successful authentication then percolates back through the chain and the user is happy. In pre-production, it looks like this: Request comes in from Windows client, is recognized to be a Domain authentication request, gets proxied to an FR virtual server. Said virtual server gets it, processes the TLS and terminates it, and proxies the MSCHAP conversation to IAS. IAS does its MSCHAP thing, accepts the user. Access-Accept percolates back up through the chain. We send an access challenge, the user sends an Access request, and FR says the user said something weird, so it's rejecting them. Request comes in from non-windows client, is recognized to be Domain authentication request, gets proxied to an FR virtual server Said virtual server gets it, processes the TLS and terminates it, and proxies the MSCHAP conversation to IAS. IAS does its MSCHAP thing, accepts the user. Access-Accept percolates back up through the chain. We send an access challenge, the user sends an Access request, and FR says everything's fine, user gets Access-Accept. Thoughts on where I need to look? I can't parse out what's happening to cause a response to be invalid for Windows users but not for, say, Mac users. Our initial guess here is that the Windows clients are looking at the MPPE keys, and are unhappy about them, whereas the Mac clients are not, though we suspect neither set of clients requires them. Posting relevant bits of debug output below. Thanks much, Jacob M. Dawson --------- Pre-production failure: rad_recv: Access-Request packet from host 198.82.171.153 port 32768, id=138, length=293 User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020b005f19001703010054bdd79574acfa8744908880dfa66a9e861f5fff5d2b3b7e387679b867704afa60476df6cc1ac0f30d92a4dc753cebb4bc4e71f4e0bc4db75534ab2403ec993619f05ad02497597deaa193debe78641e14b4718e84 State = 0x5b4a8e485341972bae816e794759d3ea Message-Authenticator = 0xc234d7f3f04c9d023687fd78e4d5c9da (75) # Executing section authorize from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (75) group authorize { (75) - entering group authorize {...} (75) policy split_username_prefix { (75) - entering policy split_username_prefix {...} (75) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) (75) ? Evaluating (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE (75) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE (75) if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) { (75) - entering if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) {...} (75) update request { (75) expand: %{2} -> dawson (75) expand: %{1} -> HOKIES (75) } # update request = notfound (75) [updated] = updated (75) - if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) returns updated (75) ... skipping else for request 75: Preceding "if" was taken (75) - policy split_username_prefix returns updated (75) policy split_username_suffix { (75) - entering policy split_username_suffix {...} (75) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) (75) ? Evaluating (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE (75) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE (75) else else { (75) - entering else else {...} (75) [noop] = noop (75) - else else returns noop (75) - policy split_username_suffix returns noop (75) [preprocess] = ok (75) auth_log : expand: /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823 (75) auth_log : /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823 (75) auth_log : expand: %t -> Tue Aug 23 10:40:16 2011 (75) [auth_log] = ok rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair State = 0x5b4a8e485341972bae816e794759d3ea rlm_perl: Added pair Called-Station-Id = 00-21-55-4d-c4-40:CNS-Test rlm_perl: Added pair Message-Authenticator = 0xc234d7f3f04c9d023687fd78e4d5c9da rlm_perl: Added pair Airespace-Wlan-Id = 17 rlm_perl: Added pair Stripped-User-Domain = HOKIES rlm_perl: Added pair NAS-IP-Address = 198.82.171.153 rlm_perl: Added pair Tunnel-Private-Group-Id = 1381 rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Calling-Station-Id = 00-1d-e0-90-5f-db rlm_perl: Added pair User-Name = HOKIES\\dawson rlm_perl: Added pair NAS-Identifier = cas-6509-3.wsm8b rlm_perl: Added pair EAP-Message = 0x020b005f19001703010054bdd79574acfa8744908880dfa66a9e861f5fff5d2b3b7e387679b867704afa60476df6cc1ac0f30d92a4dc753cebb4bc4e71f4e0bc4db75534ab2403ec993619f05ad02497597deaa193debe78641e14b4718e84 rlm_perl: Added pair Stripped-User-Name = dawson rlm_perl: Added pair NAS-Port = 29 rlm_perl: Added pair Framed-MTU = 1300 (75) [perl] = noop (75) ? if ("%{Stripped-User-Domain}" != "HOKIES") (75) expand: %{Stripped-User-Domain} -> HOKIES (75) ? Evaluating ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE (75) ? if ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE (75) eap : EAP packet type response id 11 length 95 (75) eap : Continuing tunnel setup. (75) [eap] = ok (75) Found Auth-Type = ? (75) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (75) group authenticate { (75) - entering group authenticate {...} (75) eap : Request found, released from the list (75) eap : EAP/peap (75) eap : processing type peap (75) peap : processing EAP-TLS (75) peap : eaptls_verify returned 7 (75) peap : Done initial handshake (75) peap : eaptls_process returned 7 (75) peap : FR_TLS_OK (75) peap : Session established. Decoding tunneled attributes. (75) peap : Peap state phase2 (75) peap : EAP type mschapv2 (75) peap : Got tunneled request EAP-Message = 0x020b00481a020b004331bf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d06600484f4b4945535c646177736f6e server { (75) peap : Setting User-Name to HOKIES\dawson Sending tunneled request EAP-Message = 0x020b00481a020b004331bf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d06600484f4b4945535c646177736f6e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "HOKIES\\dawson" State = 0x21ebcfee21e0d5ab22fbf5cfb29bfd25 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Tunnel-Type:0 = VLAN Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-IP-Address = 198.82.171.153 Tunnel-Private-Group-Id:0 = "1381" Tunnel-Medium-Type:0 = IEEE-802 Calling-Station-Id = "00-1d-e0-90-5f-db" NAS-Identifier = "cas-6509-3.wsm8b" NAS-Port = 29 Framed-MTU = 1300 server proxy-inner-tunnel { (75) # Executing section authorize from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/proxy-inner-tunnel (75) group authorize { (75) - entering group authorize {...} (75) ? if ("%{User-Name}" =~ /^(host\/.*)$/) (75) expand: %{User-Name} -> HOKIES\dawson (75) ? Evaluating ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE (75) ? if ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE (75) else else { (75) - entering else else {...} (75) update control { (75) } # update control = notfound (75) - else else returns notfound } # server proxy-inner-tunnel (75) peap : Got tunneled reply code 0 PEAP: Calling authenticate in order to initiate tunneled EAP session. (75) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/proxy-inner-tunnel (75) group authenticate { (75) - entering group authenticate {...} (75) eap : Request found, released from the list (75) eap : EAP/mschapv2 (75) eap : processing type mschapv2 rlm_eap_mschapv2: cancelling authentication and letting it be proxied (75) eap : Not-EAP proxy set. Not composing EAP (75) [eap] = handled PEAP: Tunneled authentication will be proxied to DomainUser PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. (75) eap : Tunneled session will be proxied. Not doing EAP. (75) [eap] = handled (75) WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 161 to 198.82.160.219 port 1812 User-Name = "HOKIES\\dawson" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Tunnel-Type:0 = VLAN Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-IP-Address = 198.82.171.153 Tunnel-Private-Group-Id:0 = "1381" Tunnel-Medium-Type:0 = IEEE-802 Calling-Station-Id = "00-1d-e0-90-5f-db" NAS-Identifier = "cas-6509-3.wsm8b" NAS-Port = 29 Framed-MTU = 1300 MS-CHAP-Challenge = 0xd3827513a357a99d4eb9a5c87a716418 MS-CHAP2-Response = 0x0b4fbf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d066 Proxy-State = 0x313338 (75) Proxying request to home server 198.82.160.219 port 1812 Sending Access-Request of id 161 to 198.82.160.219 port 1812 User-Name = "HOKIES\\dawson" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Tunnel-Type:0 = VLAN Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-IP-Address = 198.82.171.153 Tunnel-Private-Group-Id:0 = "1381" Tunnel-Medium-Type:0 = IEEE-802 Calling-Station-Id = "00-1d-e0-90-5f-db" NAS-Identifier = "cas-6509-3.wsm8b" NAS-Port = 29 Framed-MTU = 1300 MS-CHAP-Challenge = 0xd3827513a357a99d4eb9a5c87a716418 MS-CHAP2-Response = 0x0b4fbf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d066 Proxy-State = 0x313338 Waking up in 0.2 seconds. rad_recv: Access-Accept packet from host 198.82.160.219 port 1812, id=161, length=219 DEBUG: Compare b472204 to calculated digest f796ca40, secret temporaryS3CR3T Proxy-State = 0x313338 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6538078a000001370001c652a0db01cc5476fe414ece0000000000004586 MS-MPPE-Recv-Key = 0x7208bb9a9555b125d123303ac3db12a1 MS-MPPE-Send-Key = 0x0cd6218a695a558ade111bcd7b05cfc2 MS-CHAP2-Success = 0x0b533d32434230433038364541464632333233453842414534314643443231333130453939354641454134 MS-CHAP-Domain = "\013HOKIES" (75) # Executing section post-proxy from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (75) group post-proxy { (75) - entering group post-proxy {...} (75) eap : Doing post-proxy callback (75) eap : Passing reply from proxy back into the tunnel. server proxy-inner-tunnel { (75) eap : Passing reply back for EAP-MS-CHAP-V2 (75) # Executing section post-proxy from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/proxy-inner-tunnel (75) group post-proxy { (75) - entering group post-proxy {...} (75) [eap] = noop (75) WARNING: Empty post-auth section. Using default return values. } # server proxy-inner-tunnel (75) eap : Final reply from tunneled session code 2 Proxy-State = 0x313338 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6538078a000001370001c652a0db01cc5476fe414ece0000000000004586 MS-MPPE-Recv-Key = 0x7208bb9a9555b125d123303ac3db12a1 MS-MPPE-Send-Key = 0x0cd6218a695a558ade111bcd7b05cfc2 MS-CHAP2-Success = 0x0b533d32434230433038364541464632333233453842414534314643443231333130453939354641454134 MS-CHAP-Domain = "\013HOKIES" (75) eap : Got reply 2 (75) eap : Got tunneled reply RADIUS code 2 Proxy-State = 0x313338 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6538078a000001370001c652a0db01cc5476fe414ece0000000000004586 MS-MPPE-Recv-Key = 0x7208bb9a9555b125d123303ac3db12a1 MS-MPPE-Send-Key = 0x0cd6218a695a558ade111bcd7b05cfc2 MS-CHAP2-Success = 0x0b533d32434230433038364541464632333233453842414534314643443231333130453939354641454134 MS-CHAP-Domain = "\013HOKIES" (75) eap : Tunneled authentication was successful. (75) eap : SUCCESS (75) eap : Reply was handled (75) [eap] = ok (75) Found Auth-Type = ? (75) Found Auth-Type = ? (75) Warning: Found 2 auth-types on request for user 'HOKIES\dawson' (75) Auth-Type = Accept, accepting the user (75) Login OK: [HOKIES\\dawson] (from client 198.82.171.153 port 29 cli 00-1d-e0-90-5f-db) (75) # Executing section post-auth from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (75) group post-auth { (75) - entering group post-auth {...} (75) [exec] = noop Sending Access-Challenge of id 138 to 198.82.171.153 port 32768 EAP-Message = 0x010c00261900170301001b0167b434a0313cb3f29b20e1f731efe3d173083c964cda1451135a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5b4a8e485246972bae816e794759d3ea (75) Finished request 75. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 198.82.171.153 port 32768, id=139, length=236 User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020c00261900170301001b00dae368dd150e9d42e0c8888cb128e6ecc520b887a849a8a1d743 State = 0x5b4a8e485246972bae816e794759d3ea Message-Authenticator = 0x26b42d72271f1819599977a28920622f (76) # Executing section authorize from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (76) group authorize { (76) - entering group authorize {...} (76) policy split_username_prefix { (76) - entering policy split_username_prefix {...} (76) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) (76) ? Evaluating (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE (76) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE (76) if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) { (76) - entering if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) {...} (76) update request { (76) expand: %{2} -> dawson (76) expand: %{1} -> HOKIES (76) } # update request = notfound (76) [updated] = updated (76) - if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) returns updated (76) ... skipping else for request 76: Preceding "if" was taken (76) - policy split_username_prefix returns updated (76) policy split_username_suffix { (76) - entering policy split_username_suffix {...} (76) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) (76) ? Evaluating (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE (76) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE (76) else else { (76) - entering else else {...} (76) [noop] = noop (76) - else else returns noop (76) - policy split_username_suffix returns noop (76) [preprocess] = ok (76) auth_log : expand: /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823 (76) auth_log : /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823 (76) auth_log : expand: %t -> Tue Aug 23 10:40:16 2011 (76) [auth_log] = ok rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair State = 0x5b4a8e485246972bae816e794759d3ea rlm_perl: Added pair Called-Station-Id = 00-21-55-4d-c4-40:CNS-Test rlm_perl: Added pair Message-Authenticator = 0x26b42d72271f1819599977a28920622f rlm_perl: Added pair Airespace-Wlan-Id = 17 rlm_perl: Added pair Stripped-User-Domain = HOKIES rlm_perl: Added pair NAS-IP-Address = 198.82.171.153 rlm_perl: Added pair Tunnel-Private-Group-Id = 1381 rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Calling-Station-Id = 00-1d-e0-90-5f-db rlm_perl: Added pair User-Name = HOKIES\\dawson rlm_perl: Added pair NAS-Identifier = cas-6509-3.wsm8b rlm_perl: Added pair EAP-Message = 0x020c00261900170301001b00dae368dd150e9d42e0c8888cb128e6ecc520b887a849a8a1d743 rlm_perl: Added pair Stripped-User-Name = dawson rlm_perl: Added pair NAS-Port = 29 rlm_perl: Added pair Framed-MTU = 1300 (76) [perl] = noop (76) ? if ("%{Stripped-User-Domain}" != "HOKIES") (76) expand: %{Stripped-User-Domain} -> HOKIES (76) ? Evaluating ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE (76) ? if ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE (76) eap : EAP packet type response id 12 length 38 (76) eap : Continuing tunnel setup. (76) [eap] = ok (76) Found Auth-Type = ? (76) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (76) group authenticate { (76) - entering group authenticate {...} (76) eap : Request found, released from the list (76) eap : EAP/peap (76) eap : processing type peap (76) peap : processing EAP-TLS (76) peap : eaptls_verify returned 7 (76) peap : Done initial handshake (76) peap : eaptls_process returned 7 (76) peap : FR_TLS_OK (76) peap : Session established. Decoding tunneled attributes. (76) peap : Peap state send tlv success (76) peap : Received EAP-TLV response. (76) peap : Client rejected our response. The password is probably incorrect. (76) peap : We sent a success, but received something weird in return. (76) eap : Handler failed in EAP/peap (76) eap : Failed in EAP select (76) [eap] = invalid (76) Failed to authenticate the user. (76) Login incorrect: [HOKIES\\dawson] (from client 198.82.171.153 port 29 cli 00-1d-e0-90-5f-db) (76) Using Post-Auth-Type Reject (76) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (76) group REJECT { (76) - entering group REJECT {...} (76) attr_filter.access_reject : expand: %{User-Name} -> HOKIES\dawson attr_filter: Matched entry DEFAULT at line 11 (76) [attr_filter.access_reject] = updated (76) Finished request 76. Waking up in 0.2 seconds. Waking up in 0.6 seconds. (76) Sending delayed reject Sending Access-Reject of id 139 to 198.82.171.153 port 32768 EAP-Message = 0x040c0004 Message-Authenticator = 0x00000000000000000000000000000000 ----- Production Success: Waking up in 4.9 seconds. User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020a005f1900170301005499a000fc4d08b0c067d3251047d61b836767466160c386b38d37d4b6c39b07ce3b09c85590c8a923419e6f0ae464ac472050214b71b4d641e06f8a439348319233d622cd7900f8f172726407b0010bcb54c6a1d6 State = 0x764462057e4e7bc59f1c525ed4400d40 Message-Authenticator = 0xd9566738adb17439ce7d7568c8bc8264 +- entering group authorize ++[mschap] returns noop rlm_eap: EAP packet type response id 10 length 95 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to HOKIES\dawson +- entering group authorize ++? if ("%{User-Name}" =~ /^(host\/.*)$/) expand: %{User-Name} -> HOKIES\dawson ? Evaluating ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE ++? if ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE ++- entering else else +++[control] returns notfound ++- else else returns notfound PEAP: Calling authenticate in order to initiate tunneled EAP session. +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Not-EAP proxy set. Not composing EAP ++[eap] returns handled PEAP: Tunneled authentication will be proxied to openradius PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. Tunneled session will be proxied. Not doing EAP. ++[eap] returns handled +- entering group pre-proxy preproxy_users: Matched entry DEFAULT at line 1 ++[files] returns ok User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address := 198.82.247.103 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type := Framed-User Framed-MTU = 1300 NAS-Port-Type := Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" MS-CHAP-Challenge = 0x20760eb105e545d6a131f324c1d30464 MS-CHAP2-Response = 0x0a4f84e590f059f31dc3ca5b621b238582190000000000000000385984c78f91f816edb8f1b279838a0a890bdd6573bac9f7 Proxy-State = 0x323433 Proxying request 9 to home server 198.82.247.67 port 1812 User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address := 198.82.247.103 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type := Framed-User Framed-MTU = 1300 NAS-Port-Type := Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" MS-CHAP-Challenge = 0x20760eb105e545d6a131f324c1d30464 MS-CHAP2-Response = 0x0a4f84e590f059f31dc3ca5b621b238582190000000000000000385984c78f91f816edb8f1b279838a0a890bdd6573bac9f7 Proxy-State = 0x323433 Going to the next request Waking up in 0.9 seconds. Framed-Protocol = PPP Service-Type = Framed-User MS-MPPE-Recv-Key = 0xe32365fe45921738025084f44fd7822a MS-MPPE-Send-Key = 0xf65c13fbcd70a80768ea868ec27085ff MS-CHAP2-Success = 0x0a533d46333146313034313438374339373131303542344546363341364339333146344135424141383434 MS-CHAP-Domain = "\nHOKIES" +- entering group post-proxy rlm_eap: Doing post-proxy callback PEAP: Passing reply from proxy back into the tunnel. PEAP: Passing reply back for EAP-MS-CHAP-V2 +- entering group post-proxy rlm_eap: Doing post-proxy callback rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x1cd469a0 2. rlm_eap_mschapv2: Authentication succeeded. MSCHAP Success ++[eap] returns ok PEAP: Got reply 11 PEAP: Got tunneled Access-Challenge PEAP: Reply was handled ++[eap] returns ok EAP-Message = 0x010b004a1900170301003f084cf62c48fb9b9e951aa3801c9a88bbe2078c7a667df320929296299bdff2863bf8572a744dac5d9409953cda9855feca24aa24b8205677fbf3f7e3767f36 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x764462057f4f7bc59f1c525ed4400d40 Finished request 9. Going to the next request Waking up in 4.9 seconds. User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020b001d19001703010012091d2f1089b72dd14c76daf331c2dc4de167 State = 0x764462057f4f7bc59f1c525ed4400d40 Message-Authenticator = 0xee39bc3d804727c33f69fc7d8172d2bf +- entering group authorize ++[mschap] returns noop rlm_eap: EAP packet type response id 11 length 29 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to HOKIES\dawson +- entering group authorize ++? if ("%{User-Name}" =~ /^(host\/.*)$/) expand: %{User-Name} -> HOKIES\dawson ? Evaluating ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE ++? if ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE ++- entering else else +++[control] returns notfound ++- else else returns notfound PEAP: Calling authenticate in order to initiate tunneled EAP session. +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler ++[eap] returns ok PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS ++[eap] returns handled EAP-Message = 0x010c00261900170301001badffc5c8196273037ffc5ae8b421cb5a11d4cdbf3d67e521a2dd10 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x764462057c487bc59f1c525ed4400d40 Finished request 10. Going to the next request Waking up in 4.9 seconds. User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020c00261900170301001be252b19386182f2a3d9b6255f0b51007da074f90f732568c1dfbb8 State = 0x764462057c487bc59f1c525ed4400d40 Message-Authenticator = 0xc04ab29e63cd60e30bfd3fed2ba3be09 +- entering group authorize ++[mschap] returns noop rlm_eap: EAP packet type response id 12 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success rlm_eap: Freeing handler ++[eap] returns ok perl_pool: item 0x17a6e7a0 asigned new request. Handled so far: 1 found interpetator at address 0x17a6e7a0 rlm_perl: no serial number; assuming non-TLS authentication rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair State = 0x764462057c487bc59f1c525ed4400d40 rlm_perl: Added pair Called-Station-Id = 00-21-55-4d-c4-40:CNS-Test rlm_perl: Added pair Message-Authenticator = 0xc04ab29e63cd60e30bfd3fed2ba3be09 rlm_perl: Added pair Airespace-Wlan-Id = 17 rlm_perl: Added pair EAP-Type = PEAP rlm_perl: Added pair NAS-IP-Address = 198.82.171.153 rlm_perl: Added pair Tunnel-Private-Group-Id = 1381 rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Calling-Station-Id = 00-1d-e0-90-5f-db rlm_perl: Added pair User-Name = HOKIES\\dawson rlm_perl: Added pair NAS-Identifier = cas-6509-3.wsm8b rlm_perl: Added pair EAP-Message = 0x020c00261900170301001be252b19386182f2a3d9b6255f0b51007da074f90f732568c1dfbb8 rlm_perl: Added pair NAS-Port = 29 rlm_perl: Added pair Framed-MTU = 1300 rlm_perl: Added pair User-Name = HOKIES\\dawson rlm_perl: Added pair MS-MPPE-Recv-Key = 0x4e3e827b7fb173dbe293fadd607586b838cd55ae5261090fd483569509a070de rlm_perl: Added pair EAP-Message = 0x030c0004 rlm_perl: Added pair MS-MPPE-Send-Key = 0xb43ef9e36d44d66d205184ee8ca81f0f14e3a52cd254bd27268c7c99f58a18b0 rlm_perl: Added pair Message-Authenticator = 0x00000000000000000000000000000000 rlm_perl: Added pair Auth-Type = EAP perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x17a6e7a0 ++[perl] returns ok Login OK: [HOKIES\\\\dawson/<via Auth-Type = EAP>] (from client cas-6509-3.wsm8b port 29 cli 00-1d-e0-90-5f-db) User-Name = "HOKIES\\\\dawson" MS-MPPE-Recv-Key = 0x4e3e827b7fb173dbe293fadd607586b838cd55ae5261090fd483569509a070de EAP-Message = 0x030c0004 MS-MPPE-Send-Key = 0xb43ef9e36d44d66d205184ee8ca81f0f14e3a52cd254bd27268c7c99f58a18b0 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 11. Going to the next request Waking up in 4.9 seconds.

1 1

different acctuniqueids with common keys?
by andrew＠sybaweb.com 06 Sep '11

06 Sep '11

I have a curious problem with my FreeRADIUS 2.1.10 installation. I'm using a PostgresQL backend and something close to the default config. It seems that sometimes (judging from the value of affected sessions this is a fairly rare occurrence) a duplicate entry is added to the radacct table which has a different acctuniqueid to its related duplicate entries. Relevant radconf2xml snippet is: <acct_unique> <key>User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port</key> </acct_unique> Related entries I'm looking at in the radacct table are: username, acctsessionid, nasipaddress, framedipaddress, nasportid. I have checked these with a script and confirmed that I have a number of entries which share all these attributes yet have different acctuniqueids. This is a problem for me since it causes my billing software to overconsume usage. I could change this to not use acctuniqueid, but a fixed acctuniqueid would make my life easier. Any ideas? Best, -AL.

6 7

Pre release of 2.1.12
by Alan DeKok 05 Sep '11

05 Sep '11

I've put some pre releases of 2.1.12 on the web site: http://git.freeradius.org/pre/ Please let me know if there are any problems. If not, this can become 2.1.12. Alan DeKok.

9 13

EAP-TLS/PEAP authentication problem(can not reply correct attribute)
by gary 02 Sep '11

02 Sep '11

Hi All I have NAS client which support WISPr standard working with freeradius 2.1.10+MySQL 5.5 install on Fedora OS. I create my test certificate and configure EAP-TLS/PEAP authentication well in my setup. I am using WINDOWS XP as client pc it can pass authentication but freeradius can not reply correct attribute I configured such as bandwidth control. I noticed in the reply attribute the vendor is Microsoft not WISPr. I wonder if this is WINDOWS default setting how can I modify so that FR can reply the correct attribute I configured? Best Regards Gary BROWAN COMMUNICATIONS INC. Tel:886-3-600-6899 ext.4842 Fax:886-3-597-2970 e-mail:gary.yang@browan.com

3 5

Example configuration that proxy PEAP MSCHAPv2 to an IAS server
by Glenn Machin 01 Sep '11

01 Sep '11

I using radiusd: FreeRADIUS Version 2.1.11. I cannot seem to get the RHEL5 (2.6.18-238.9.1.el5) ntlm_auth program to properly authenticate the challenge and nt-response packets. If I set the password using clear-text and also set MS-CHAP-Use-NTLM-Auth, the authentication works fine. The version of ntlm_auth is Version 3.5.4-0.83.el5 So my next step is to try to filter PEAP MSCHAPv2 requests and proxy them off to an IAS server. However I still want PEAP GTC packets handled on this server. Anyone doing such a thing? If so can you tell me how you set up eap.conf, sites-enabled/inner-tunnel and sites-enabled/default, or any other configuration files? Thanks

5 9

Symbol "Perl_hv_undef_flags" problem using rlm_perl
by david.suarezdelis＠telefonica.es 01 Sep '11

01 Sep '11

Greetings, I have installed a Debian 6 stable on a 64b machine. Using the factory freeradius-2.1.10 and perl-5.10.1 I got a symbol lookup problem, which sounded weird enough... So I downloaded both last stable versions (Freeradius-2.1.11 and Perl 5.14.1) and compiled them myself, making sure that all Perl symbols were available (I compiled everything with -g and -fPIC where it made sense). Using perlbrew I made sure that Freeradius was indeed finding the right Perl version and everything compiled and installed perfectly. However, when making some testing on localhost with radtest the problem reappeared (with exactly the same error as the debian packaged versions). I am not sure why this is failing, as the symbols are, indeel, available in libperl.a. I include the complete output of radiusd -X below with both the correct localuser test and the failed one. Thanks in advance for any hints. dwd PS- the output: root@myserver:/var/tmp/2.1.11/freeradius-server-2.1.11# sh -x /usr/local/sbin/rc.radiusd start + prefix=/usr/local + exec_prefix=/usr/local + sbindir=/usr/local/sbin + localstatedir=/usr/local/var + logdir=/usr/local/var/log/radius + rundir=/usr/local/var/run/radiusd + sysconfdir=/usr/local/etc + export LD_LIBRARY_PATH LD_RUN_PATH LD_PRELOAD + RADIUSD=/usr/local/sbin/radiusd + RADDBDIR=/usr/local/etc/raddb + DESC=FreeRADIUS + ARGS= + test -f /usr/local/sbin/radiusd + test -f /usr/local/etc/raddb/radiusd.conf + echo -n Starting FreeRADIUS: Starting FreeRADIUS:+ /usr/local/sbin/radiusd -X FreeRADIUS Version 2.1.11, for host x86_64-unknown-linux-gnu, built on Aug 30 2011 at 09:35:35 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/perl.ORIG including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/perl.EVOAR including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 127.0.0.1 { require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_perl Module: Instantiating module "perl" from file /usr/local/etc/raddb/modules/perl.ORIG perl { module = "/usr/local/etc/raddb/example.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/freeradius/freeradius.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/freeradius/freeradius.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 41585, id=20, length=62 User-Name = "test" User-Password = "hola1234" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Framed-Protocol = PPP # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry test at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "hola1234" [pap] Using clear text password "hola1234" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 20 to 127.0.0.1 port 41585 Service-Type = Framed-User Framed-Protocol = PPP Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 20 with timestamp +7 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 50419, id=37, length=65 User-Name = "un24956" User-Password = "hola1234" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Framed-Protocol = PPP # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "un24956", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 7 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = External # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group External {...} /usr/local/sbin/radiusd: symbol lookup error: /usr/local/lib/rlm_perl-2.1.11.so: undefined symbol: Perl_hv_undef_flags + echo radiusd radiusd + exit 0

3 2

Rating usage
by Shreya Shah 31 Aug '11

31 Aug '11

Is it possible to rate users based on their data usage and reject authentication to those users exceeding the limit ? I think I can achieve rating using counter.conf and reading the usage from radacct but not sure how to reject this user from authenticating when he exceeds this usage limit ? Thanks, Shreya.

2 1

problem with LDAP backend
by Frank Bonnet 31 Aug '11

31 Aug '11

Hello Still trying to use freeradius with chillispot I still have problems I'm trying to use mixed authentication MAC addresses for some video devices in the "users" file as follows : 00-06-F4-0D-08-66 Auth-Type := Local, User-Password == "xxxxxxxx" Framed-IP-Address = 192.168.182.213, Fall-Through = Yes LDAP backend for "real" users at the end of the "users" file I have this statement DEFAULT Auth-Type = LDAP Fall-Through = 1 This configuration were working well on a very old debian machine which died suddenly When I try to access the the chilli portal it ask radius for authentication but it dows not work. See below the debug trace of radius daemon. Help greatly appreciated, thank you. Wed Aug 31 16:52:39 2011 : Debug: Processing the authorize section of radiusd.conf Wed Aug 31 16:52:39 2011 : Debug: modcall: entering group authorize for request 15 Wed Aug 31 16:52:39 2011 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 15 Wed Aug 31 16:52:39 2011 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 15 Wed Aug 31 16:52:39 2011 : Debug: modcall[authorize]: module "preprocess" returns ok for request 15 Wed Aug 31 16:52:39 2011 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 15 Wed Aug 31 16:52:39 2011 : Debug: rlm_eap: No EAP-Message, not doing EAP Wed Aug 31 16:52:39 2011 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 15 Wed Aug 31 16:52:39 2011 : Debug: modcall[authorize]: module "eap" returns noop for request 15 Wed Aug 31 16:52:39 2011 : Debug: modsingle[authorize]: calling files (rlm_files) for request 15 Wed Aug 31 16:52:39 2011 : Debug: users: Matched entry DEFAULT at line 398 Wed Aug 31 16:52:39 2011 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 15 Wed Aug 31 16:52:39 2011 : Debug: modcall[authorize]: module "files" returns ok for request 15 Wed Aug 31 16:52:39 2011 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 15 Wed Aug 31 16:52:39 2011 : Debug: rlm_ldap: - authorize Wed Aug 31 16:52:39 2011 : Debug: rlm_ldap: performing user authorization for xxxxxxxx Wed Aug 31 16:52:39 2011 : Debug: radius_xlat: '(uid=xxx)' Wed Aug 31 16:52:39 2011 : Debug: radius_xlat: 'ou=Users,dc=esiee,dc=fr' Wed Aug 31 16:52:39 2011 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Wed Aug 31 16:52:39 2011 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Wed Aug 31 16:52:39 2011 : Debug: rlm_ldap: performing search in ou=Users,dc=esiee,dc=fr, with filter (uid=hrazdira) Wed Aug 31 16:52:39 2011 : Debug: rlm_ldap: checking if remote access for xxxxxxxx is allowed by uid Wed Aug 31 16:52:39 2011 : Debug: rlm_ldap: looking for check items in directory... Wed Aug 31 16:52:39 2011 : Debug: rlm_ldap: looking for reply items in directory... Wed Aug 31 16:52:39 2011 : Debug: rlm_ldap: user xxxxxxxx authorized to use remote access Wed Aug 31 16:52:39 2011 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Wed Aug 31 16:52:39 2011 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 15 Wed Aug 31 16:52:39 2011 : Debug: modcall[authorize]: module "ldap" returns ok for request 15 Wed Aug 31 16:52:39 2011 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 15 Wed Aug 31 16:52:39 2011 : Debug: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Aug 31 16:52:39 2011 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 15 Wed Aug 31 16:52:39 2011 : Debug: modcall[authorize]: module "pap" returns noop for request 15 Wed Aug 31 16:52:39 2011 : Debug: modcall: leaving group authorize (returns ok) for request 15 Wed Aug 31 16:52:39 2011 : Debug: rad_check_password: Found Auth-Type LDAP Wed Aug 31 16:52:39 2011 : Debug: auth: type "LDAP" Wed Aug 31 16:52:39 2011 : Debug: Processing the authenticate section of radiusd.conf Wed Aug 31 16:52:39 2011 : Debug: modcall: entering group authenticate for request 15 Wed Aug 31 16:52:39 2011 : Debug: modsingle[authenticate]: calling ldap (rlm_ldap) for request 15 Wed Aug 31 16:52:39 2011 : Debug: rlm_ldap: - authenticate Wed Aug 31 16:52:39 2011 : Auth: rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". Wed Aug 31 16:52:39 2011 : Debug: modsingle[authenticate]: returned from ldap (rlm_ldap) for request 15 Wed Aug 31 16:52:39 2011 : Debug: modcall[authenticate]: module "ldap" returns invalid for request 15 Wed Aug 31 16:52:39 2011 : Debug: modcall: leaving group authenticate (returns invalid) for request 15 Wed Aug 31 16:52:39 2011 : Debug: auth: Failed to validate the user. Wed Aug 31 16:52:39 2011 : Debug: Delaying request 15 for 1 seconds Wed Aug 31 16:52:39 2011 : Debug: Finished request 15 Wed Aug 31 16:52:39 2011 : Debug: Going to the next request Wed Aug 31 16:52:39 2011 : Debug: --- Walking the entire request list ---

2 1

Using rlm_passwd as a substitute for hunt groups
by Jan.Weiss＠t-systems.com 31 Aug '11

31 Aug '11

>Did you remember to actually define 'My-Device-Group' as an attribute? > >-Arran > >Arran Cudbard-Bell >a.cudbardb(a)freeradius.org > >RADIUS - Half the complexity of Diameter Dictionary: ATTRIBUTE My-Device-Group 3000 string

1 0

Special WIFI Router MAC check for the user’s first connection.
by 2394263740 31 Aug '11

31 Aug '11

Special WIFI Router MAC check for the user’s first connection. I’m using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql WIFI AP: Use WPA/WPA2 There’re about 100 WIFI APs in the network. All these APs use this free radius server. The whole thing is working fine. Now I got a requirement, this requirement need to check the WIFI AP MAC address for user’s first login. For example, WIFI AP 26, has the MAC address MAC26. I need ensure one WIFI user, say user 58, must connect to WIFI AP 26 for the first time. After the first connection, user 58 can connect to any WIFI AP in the network. Can someone give some advice on how to do it? Thanks! Tom

2 1