August 2013 - Freeradius-Users - lists.freeradius.org

Re: Groups in active directory and checks in MySQL
by Atomikramp 26 Aug '13

26 Aug '13

Hello, sorry for the top quoting but i'm using a webmail for replying  which is really crap.   accordingly i'm posting here the debug log of a radtest. the authentication gets rejected because the group matches in the raddb/users with the following expression:   DEFAULT Ldap-Group == "fax", Auth-Type := Reject   i've tried commenting it out and adding this to mysql in the table radgroupcheck:   table: radgroupcheck Groupname: fax Attribute: Auth-Type op: := Value: Reject   but it's not giving the same result, the check against sql is ignored and the user is authed successfully.   here is the debug log:   rad_recv: Access-Request packet from host 127.0.0.1 port 45195, id=232, length=57 User-Name = "sogo1" User-Password = "userpassword" NAS-IP-Address = 192.168.4.82 NAS-Port = 80 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20130826 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20130826 [auth_log] expand: %t -> Mon Aug 26 07:56:19 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "sogo1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop   [ldap] Entering ldap_groupcmp() [files] expand: dc=plutone,dc=local -> dc=plutone,dc=local [files] WARNING: Deprecated conditional expansion ":-".  See "man unlang" for details [files] ... expanding second conditional [files] expand: %{User-Name} -> sogo1 [files] expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=sogo1)   [ldap] ldap_get_conn: Checking Id: 0   [ldap] ldap_get_conn: Got Id: 0   [ldap] performing search in dc=plutone,dc=local, with filter (sAMAccountName=sogo1)   [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))   [ldap] ldap_get_conn: Checking Id: 0   [ldap] ldap_get_conn: Got Id: 0   [ldap] performing search in dc=plutone,dc=local, with filter (&(cn=fax)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))))   [ldap] object not found   [ldap] ldap_release_conn: Release Id: 0   [ldap] ldap_get_conn: Checking Id: 0   [ldap] ldap_get_conn: Got Id: 0   [ldap] performing search in CN=sogo1,CN=Users,DC=plutone,DC=local, with filter (objectclass=*)   [ldap] performing search in CN=Fax,CN=Users,DC=plutone,DC=local, with filter (cn=fax) rlm_ldap::ldap_groupcmp: User found in group fax   [ldap] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 205 ++[files] returns ok [ldap] performing user authorization for sogo1 [ldap] WARNING: Deprecated conditional expansion ":-".  See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> sogo1 [ldap] expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=sogo1) [ldap] expand: dc=plutone,dc=local -> dc=plutone,dc=local   [ldap] ldap_get_conn: Checking Id: 0   [ldap] ldap_get_conn: Got Id: 0   [ldap] performing search in dc=plutone,dc=local, with filter (sAMAccountName=sogo1) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP.  Are you sure that the user is configured correctly? [ldap] user sogo1 authorized to use remote access   [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok [sql] expand: %{User-Name} -> sogo1 [sql] sql_set_user escaped user --> 'sogo1' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = '%{SQL-User-Name}'           ORDER BY id -> SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = 'sogo1'           ORDER BY id [sql] expand: SELECT groupname           FROM radusergroup           WHERE username = '%{SQL-User-Name}'           ORDER BY priority -> SELECT groupname           FROM radusergroup           WHERE username = 'sogo1'           ORDER BY priority rlm_sql (sql): Released sql socket id: 1 [sql] User sogo1 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set.  Not setting to PAP ++[pap] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] returns noop Found Auth-Type = Reject Auth-Type = Reject, rejecting user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sogo1  attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 232 to 127.0.0.1 port 45195 Reply-Message = "Not Allowed." Waking up in 4.9 seconds. Cleaning up request 7 ID 232 with timestamp +585 Ready to process requests.     I've noticed that in the rlm_sql debugging no query is performed against radgroupcheck could it be that i missed something in my configuration? yet i can't figure out what, i ran through my config files many times..   thanks. Francesco   --------- Original Message -------- Da: "Alan DeKok" <aland(a)deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Oggetto: Re: Groups in active directory and checks in MySQL Data: 23/08/13 21:32 Atomikramp wrote: > I'm in a situation now where i can successfully retrieve group > membership of users in the active directory LDAP tree using rlm_ldap, > and check them against files. OK. > so if i have a user with "memberOf" attribute set to groupA > and i set in the raddb/users the following entry: > > DEFAULTLdap-Group == "groupA", Auth-Type := Reject > Reply-Message = "Not Allowed." > > i successfully deny access to that user. That should map directly to the SQL tables. > Since i'm already using MySQL for storing accounting informations i was > really interested in being able to use the same backend (mysql) also for > performing checks against groups. > > If i perform checks against usernames using the table radcheck they work > properly (users retrieved from the LDAP backend), i've tried setting a > radcheck like the following: > userA Max-Daily-Session := 7200 > > and after 2 hours the user is unable to authenticate to the NAS because > the time allowed has expired. > > > But i cant seem to be able to do the same thing with the groups. Post the debug output. And what do you have in SQL? > i've configured sites-enabled/default like this: Note that the FAQ, README, "man" pages, and web pages ALL say to post the debug output. We really don't care about the configuration. It doesn't show what happens when the server receives a request. Alan DeKok. -- Caselle da 1GB, trasmetti allegati fino a 3GB e in piu' IMAP, POP3 e SMTP autenticato? GRATIS solo con Email.it: http://www.email.it/f Sponsor: PEPPA PIG: Acquista Peluche, Gadget e Abbigliamento Originale su mistercupido.com Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=12897&d=20130826 -- Caselle da 1GB, trasmetti allegati fino a 3GB e in piu' IMAP, POP3 e SMTP autenticato? GRATIS solo con Email.it http://www.email.it/f Sponsor: PEPPA PIG: Acquista Peluche, Gadget e Abbigliamento Originale su mistercupido.com Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=12897&d=26-8

2 1

Intermediate SSL certificate
by Matthew Ceroni 26 Aug '13

26 Aug '13

I am having an issue with intermediate SSL certificate and clients failing to validate the certificate. When using intermediate certs in for instance Apache there is a separate directive where you specify the intermediate certs. Then as part of the SSL handshake those certs are sent along to the client. I read that for FreeRadius just combine the cert with the intermediate cert into one file and then reference that in eap.conf:certificate_file. I have done that but clients are still failing certificate validation. Any help would be appreciated. Thanks

2 1

Groups in active directory and checks in MySQL
by Atomikramp 23 Aug '13

23 Aug '13

Hello everyone, i know this might be considered a bizarre situation but well... i was just wondering if it's possible to do such a thing.   I'm in a situation now where i can successfully retrieve group membership of users in the active directory LDAP tree using rlm_ldap, and check them against files.   so if i have a user with "memberOf" attribute set to groupA and i set in the raddb/users the following entry:   DEFAULTLdap-Group == "groupA", Auth-Type := Reject Reply-Message = "Not Allowed."   i successfully deny access to that user.   Since i'm already using MySQL for storing accounting informations i was really interested in being able to use the same backend (mysql) also for performing checks against groups.   If i perform checks against usernames using the table radcheck they work properly (users retrieved from the LDAP backend), i've tried setting a radcheck like the following: userA Max-Daily-Session := 7200   and after 2 hours the user is unable to authenticate to the NAS because the time allowed has expired.     But i cant seem to be able to do the same thing with the groups.   i've configured sites-enabled/default like this:   authorize { preprocess auth_log chap mschap digest suffix eap { ok = return } files ldap sql expiration logintime pap dailycounter }   authenticate { Auth-Type PAP { pap }   Auth-Type CHAP { chap }   Auth-Type MS-CHAP { mschap }   digest unix   Auth-Type LDAP { ldap }   eap }   preacct { preprocess acct_unique suffix files }   accounting { detail sql }   session { radutmp }     post-auth { ldap exec Post-Auth-Type REJECT { # log failed authentications in SQL, too. attr_filter.access_reject } }   pre-proxy { }   post-proxy { eap }   radiusd.conf like this prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct   name = freeradius   confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name}   db_dir = ${raddbdir}   libdir = /usr/lib/freeradius   pidfile = ${run_dir}/${name}.pid   user = freerad group = freerad   max_request_time = 30   cleanup_delay = 5   max_requests = 1024   listen { type = auth ipaddr = * port = 0 }   listen { ipaddr = * port = 0 type = acct }   hostname_lookups = no   allow_core_dumps = no   regular_expressions= yes extended_expressions= yes   log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no }   checkrad = ${sbindir}/checkrad   security { max_attributes = 200 reject_delay = 1 status_server = yes }   proxy_requests  = yes $INCLUDE proxy.conf   $INCLUDE clients.conf   thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 }   modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf $INCLUDE sql.conf $INCLUDE sql/mysql/counter.conf }   instantiate { exec expr expiration logintime }   and sql.conf   sql {         database = "mysql"         driver = "rlm_sql_${database}"         server = "localhost"         #port = 3306         login = "radius"         password = "<removed>"         radius_db = "radius"         acct_table1 = "radacct"         acct_table2 = "radacct"         postauth_table = "radpostauth"         authcheck_table = "radcheck"         authreply_table = "radreply"         groupcheck_table = "radgroupcheck"         groupreply_table = "radgroupreply"         usergroup_table = "radusergroup"         deletestalesessions = yes         sqltrace = no         sqltracefile = ${logdir}/sqltrace.sql         num_sql_socks = 5         connect_failure_retry_delay = 60         lifetime = 0         max_queries = 0         nas_table = "nas"         $INCLUDE sql/${database}/dialup.conf         $INCLUDE sql/${database}/counter.conf }   any help is really welcome. thanks and sorry if i couldn't explain myself properly please correct me.   -- Caselle da 1GB, trasmetti allegati fino a 3GB e in piu' IMAP, POP3 e SMTP autenticato? GRATIS solo con Email.it: http://www.email.it/f Sponsor: SUPERMARIO: Acquista Peluche e T-shirt Originali su mistercupido.com Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=12899&d=20130823 -- Caselle da 1GB, trasmetti allegati fino a 3GB e in piu' IMAP, POP3 e SMTP autenticato? GRATIS solo con Email.it http://www.email.it/f Sponsor: SIMPSON: Acquista Peluche, Gadget e Abbigliamento Originale su mistercupido.com Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=12901&d=23-8

3 2

RE: Escaping regex + character
by Franks Andy (RLZ) IT Systems Engineer 23 Aug '13

23 Aug '13

Yeh, I read that character classes don't need escaping in quite the same way somewhere, then tried it without escaping but didn't realise it was down to character position. I'll give it a try. Thanks guys. >> evluation >Well at least it'll evaluate instead of evluate now. :-P -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 23 August 2013 09:52 To: freeradius-users(a)lists.freeradius.org Subject: Re: Escaping regex + character On 08/23/2013 09:35 AM, Arran Cudbard-Bell wrote: > Or if you shift that hyphen one to the right, it'll probably work OK too :) Usually first in the range works: [-.a-z0-9] IIRC + doesn't need to be escaped inside a range, same as "." - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Escaping regex + character
by Franks Andy (RLZ) IT Systems Engineer 23 Aug '13

23 Aug '13

Hi All, Just a quick question - I've compiled FR3 with pcre regex libraries and it's working ok. I just can't get it to escape plusses ( + ) though I've tried between 0 and 6(!) backslashes but all result in: ERROR: Failed compiling regular expression: bad range inside [] at offset 10 (0) ERROR: Condition evluation failed because the value of an operand could not be determined It's the + in the character class I'm trying to escape. This is with two backslashes (what I'd expect to work as it does with dots - \\. (0) ? if ("%{Email-Address}" =~ /^[a-z0-9_-\+]+(\.[a-z0-9_-\\\+])*(a)[a-z0-9_-\\\+]+(\.[a-z0-9_-\\\+]+)*(\ .[a-z]{2,4})$/) (0) expand: "%{Email-Address}" -> 'a+b(a)c.de' ERROR: Failed compiling regular expression: bad range inside [] at offset 10 (0) ERROR: Condition evluation failed because the value of an operand could not be determined The regex works ok without the plusses, if not including them in the subject.. Thanks Andy

3 2

debian, wpa_supplicant, TTLS/TLS working, PEAP/TLS fails
by Martin Kraus 22 Aug '13

22 Aug '13

Hi. I managed to get EAP-TTLS/TLS working but EAP-PEAP/TLS fails after the outer TLS tunnel is established: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x992158e5992955e0 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! and then later on rlm_eap: No EAP session matching the State variable. [inner-eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request I've read the instructions but none of that seems to apply to my situation There is TLV result - failure in the supplicant log but I don't have a clue if that is a cause or a effect of the error in freeradius. Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP-PEAP: received 37 bytes encrypted data for Phase 2 Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=5): 01 07 00 05 +01 Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP-PEAP: received Phase 2: code=1 identifier=7 length=5 Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP-PEAP: Phase 2 Request: type=1 Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP-PEAP: Encrypting Phase 2 data - hexdump(len=18): [REMOVED] Aug 21 12:22:34 localhost wpa_supplicant[19681]: SSL: 90 bytes left to be sent out (of total 90 bytes) Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP: method process -> ignore=FALSE methodState=MAY_CONT +decision=FAIL Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP: EAP entering state SEND_RESPONSE Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP: EAP entering state IDLE Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAPOL: SUPP_BE entering state RESPONSE Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAPOL: txSuppRsp Aug 21 12:22:34 localhost wpa_supplicant[19681]: TX EAPOL: dst=00:24:14:3a:95:d0 Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAPOL: SUPP_BE entering state RECEIVE Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAPOL: startWhen --> 0 Aug 21 12:22:46 localhost wpa_supplicant[19681]: EAP-TLV: TLV Result - Failure Aug 21 12:22:47 localhost wpa_supplicant[19681]: wlan0: CTRL-EVENT-EAP-FAILURE EAP authentication failed Thanks for any help Martin

3 8

rlm_perl issue
by Dean, Barry 22 Aug '13

22 Aug '13

An interesting one for the list ... We are installing a Palo Alto firewall and it has a way to pass Username/IP mappings from FreeRADIUS to a Windows "User ID Agent", which is then queried by the firewall. The method employed is to use a Perl module (PAN::API), which has a simple API, basically: $var = PAN::API::UID-new( "ip of server" ); $var->add( "type <login/logout>", username, Framed-IP-Address ); $var-submit(); which is added in the "sub preacct ()" of the perl module... then call this in preacct {} There are a couple of issues with this module that I am going to try and address: 1) Connections "new" only instantiates an empty object "add" adds the values to a hash "submit" opens an TCP SSL connection, sends the hash as XML, then closes the connection. With all the work being done in "submit" you have to create and tear down an SSL TCP connection for EVERY accounting record! Which is a lot at my site! 2) Errors If the socket set-up fails, the PAN::API module calls croak(), which on my system terminated FreeRADIUS, which seems like what would happen? Thu Aug 22 13:53:03 2013 : Error: rlm_perl: perl_embed:: module = /etc/raddb/perl.pl , func = preacct exit status= Unable to connect socket. at /etc/raddb/perl.pl line 474 Socket setup failed I am guessing because of all the open/close socket activity? Looks like the Windows 2008R2 server either blocked this as a suspected DOS or the agent failed to cope with this kind of TCP activity? Obviously for problem 1, a better model would be to implement new methods on the object to open and close the SSL connection, then use a pattern like: { # Static block start my $object = PAN::API::UID->new( "<IP>" ); $object->connectssl(); sub preacct { $object->add( <params> ); $object->submit(); } } closing the SSL would not be needed in effect as we run "forever", and I wouldn't know where to place it as there is no function called on an rlm_perl module when FreeRADIUS is about to terminate, unless I am missing something. For problem 2, are there rules about what you should not do in an rlm_perl module? I would have thought exit(), die(), croak() etc are all bad and that returning quietly, optionally setting an error code, would be better? Then back in "sub preacct ()" you could check the error and log with &radiusd::radlog() and do a "return RLM_MODULE_NOOP"? Would you expect FreeRADIUS to terminate if an rlm_perl module called croak()? Anyone want to throw in 2 cents/pennies worth to this? Thanks in advance, as always, for your time ... -------------------------------------------------------- Barry Dean Principal Programmer/Analyst Networks Team Computing Service Department

2 1

ntlm_auth not respected
by Chris Parker 22 Aug '13

22 Aug '13

It seems that I have ntlm_auth configured to talk to Samba correctly. As it positively works when run from the CLI and FR even shows a positive login, but that positive login never seems to be sent to the authentication stage. More food for thought once I tackle this, is that when I try to link all this together with a Netgear WAP, plain-text users in the users file works perfectly fine. Log output: rad_recv: Access-Request packet from host 127.0.0.1 port 35826, id=114, length=57 User-Name = "wyse1" User-Password = "K503D" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "wyse1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=wyse1 [ntlm_auth] expand: --password=%{User-Password} -> --password=K503D Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [wyse1/K503D] (from client localhost port 1812) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> wyse1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 114 to 127.0.0.1 port 35826 Waking up in 4.9 seconds. Cleaning up request 7 ID 114 with timestamp +843 Ready to process requests.

2 10

User get after few minute
by Sokphak TOUCH 22 Aug '13

22 Aug '13

Dear All, I have issue with configure radius. I have one Juniper MX80 for doing as LNS in my lab and FreeRADIUS Version 2.1.12 installed. I can see there is successful connected log to radius but after around 1mn it connect again and again. I have check in MX80 but has no any significant log. Below is the full log in debug mode of radius during connect. Please advice rad_recv: Access-Request packet from host 22.0.0.77 port 51280, id=32, length=237 User-Name = "testuser(a)intel.com" Service-Type = Framed-User CHAP-Password = 0x6424072271437b7df6f638bd05496fe856 CHAP-Challenge = 0xcf44cbf713aedaac40824ffc535532d96e7b109b025cb2a3b0 Chargeable-User-Identity = "" Acct-Session-Id = "491" ERX-Dhcp-Mac-Addr = "0000.0000.0000" NAS-Identifier = "MX80-LAB-LNS" NAS-Port = 4095 NAS-Port-Id = "Ip:192.168.77.1:192 .168.77.2:55776:38107:10971:4534:2765160448" NAS-Port-Type = Virtual ERX-Attr-162 = 0x05f5e1 ERX-Attr-163 = 0x05f5e1 NAS-IP-Address = 22.0.0.77 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "eintel.com" for User-Name = "testuser(a)intel.com" [suffix] No such realm "eintel.com" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> testuser(a)intel.com [sql] sql_set_user escaped user --> 'testuser(a)intel.com' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser(a)intel.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser(a)intel.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = ' testuser(a)intel.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "testuser(a)intel.com" with CHAP password [chap] Using clear text password "saba" for user testuser(a)intel.comauthentication. [chap] chap user testuser(a)intel.com authenticated succesfully ++[chap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> testuser(a)intel.com [sql] sql_set_user escaped user --> 'testuser(a)intel.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x6424072271437b7df6f638bd05496fe856 [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( ' testuser(a)intel.com', '0x6424072271437b7df6f638bd05496fe856', 'Access-Accept', '2013-08-22 15:51:05') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( ' testuser(a)intel.com', '0x6424072271437b7df6f638bd05496fe856', 'Access-Accept', '2013-08-22 15:51:05') rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 32 to 22.0.0.77 port 51280 Framed-IP-Address = 10.1.1.123 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 32 with timestamp +177 Ready to process requests. Regards, SP

2 1

Re: debian, wpa_supplicant, TTLS/TLS working, PEAP/TLS fails
by Alan Buxey 22 Aug '13

22 Aug '13

TLS in PEAP. Yes I've seen it. And EAP-MSCHAPV2 in PEAP alan

3 2