February 2014 - Freeradius-Users - lists.freeradius.org

Proxy Realm to MS Radius
by Robert Kennedy 13 Feb '14

13 Feb '14

Hi Guys I've done quite alot of research on this and i do not seem to be finding a solve. I am trying to achieve users logging via wifi from which ever country they may be. I auth them via eap. Check the nas ip, then assign an ip for an ip pool, that all seems good, however i also require to auth certain realms off a seperate MS radius. That radius does a lookup on its ad and auths the users. For the life of me i cannot get my server to auth against there. I've tried sending mschapv2 but it doesnt seems to be passing to that server. It seems MS-CHAP-Challenge remains empty through out. I setup my basic server according to this guide, using the same methord for certs as the guide says. http://www.rrfx.net/2011/02/wpa2-enterprise-on-ubuntu-configuring.html The key line i think is this Login incorrect (Home Server says so): [robert(a)za.testrealm.net/<no User-Password attribute>] I am far from a radius expert, and feel free give me a hard time if i have made stupid mistakes. Any assistance will be appreciated. Below is my debug startup, i will send the auth failure shortly. ############################START UP############################## FreeRADIUS Version 2.1.12, for host i386-redhat-linux-gnu, built on Oct 3 2012 at 01:20:08 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/postgresql/dialup.conf including configuration file /etc/raddb/sqlippool.conf including configuration file /etc/raddb/sql/postgresql/ippool.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/coa main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server adserver { ipaddr = 10.77.82.21 port = 1812 type = "auth" secret = "xxxxxxxxxxxx" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } home_server_pool ad_auth { type = fail-over home_server = adserver } realm za.testrealm.net { auth_pool = ad_auth nostrip } radiusd: #### Loading Clients #### client 10.53.0.6 { ipaddr = 10.53.0.6 require_message_authenticator = no secret = "xxxxxxxxxxxx" shortname = "howifi" nastype = "other" } client 10.77.95.10 { ipaddr = 10.77.95.10 require_message_authenticator = no secret = "xxxxxxxxxxxx" shortname = "howifi" nastype = "other" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.key" certificate_file = "/etc/raddb/certs/server.pem" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating module "auth_log" from file /etc/raddb/modules/detail.log detail auth_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_postgresql" server = "127.0.0.1" port = "" login = "radius" password = "R@d1u5S3cur3P@ss!" radius_db = "radius" read_groups = yes sqltrace = yes sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.Op FROM radcheck inner join users on radcheck.username = users.strusername WHERE Username = '%{SQL-User-Name}' AND (users.imballowed + users.imbadded) > users.imbused AND users.dtExpire > now() ORDER BY radcheck.id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctSessionTime = (EXTRACT(EPOCH FROM ('%S'::timestamp with time zone - AcctStartTime::timestamp with time zone - '%{%{Acct-Delay-Time}:-0}'::interval)))::BIGINT, AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0 WHERE AcctStopTime IS NULL AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'::timestamp" accounting_update_query = "UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint) WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_update_query_alt = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval - '%{%{Acct-Session-Time}:-0}'::interval), '%{Acct-Session-Time}', '%{Acct-Authentic}', (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0, '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctStartDelay = 0, ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_stop_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctSessionTime = CASE WHEN '%{Acct-Session-Time}' = '' THEN (EXTRACT(EPOCH FROM ('%S'::TIMESTAMP WITH TIME ZONE - AcctStartTime::TIMESTAMP WITH TIME ZONE - '%{%{Acct-Delay-Time}:-0}'::INTERVAL)))::BIGINT ELSE NULLIF('%{Acct-Session-Time}','')::BIGINT END, AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0, FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_stop_query_alt = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval - '%{%{Acct-Session-Time}:-0}'::interval), ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), NULLIF('%{Acct-Session-Time}', '')::bigint, '%{Acct-Authentic}', '%{Connect-Info}', (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0)" group_membership_query = "SELECT GroupName FROM radhuntgroup WHERE nasipaddress='%{NAS-IP-Address}'" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW())" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql): Attempting to connect to radius@127.0.0.1:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 6 rlm_sql (sql): Released sql socket id: 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking pre-proxy {...} for more modules to load Module: Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.pre-proxy { attrsfile = "/etc/raddb/attrs.pre-proxy" key = "%{Realm}" relaxed = no } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_sqlippool Module: Instantiating module "sqlippool" from file /etc/raddb/sqlippool.conf sqlippool { sql-instance-name = "sql" lease-duration = 18000 pool-name = "" allocate-begin = "START TRANSACTION" allocate-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}'" allocate-find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND expiry_time < 'now'::timestamp(0) ORDER BY (username <> '%{SQL-User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE" allocate-update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{SQL-User-Name}', expiry_time = 'now'::timestamp(0) + '18000 second'::interval WHERE framedipaddress = '%I'" allocate-commit = "COMMIT" allocate-rollback = "ROLLBACK" pool-check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start-begin = "START TRANSACTION" start-update = "UPDATE radippool SET expiry_time = 'now'::timestamp(0) + '18000 second'::interval WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}'" start-commit = "COMMIT" start-rollback = "ROLLBACK" alive-begin = "START TRANSACTION" alive-update = "UPDATE radippool SET expiry_time = 'now'::timestamp(0) + '18000 seconds'::interval WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND framedipaddress = '%{Framed-IP-Address}' AND username = '%{SQL-User-Name}' AND callingstationid = '%{Calling-Station-Id}'" alive-commit = "COMMIT" alive-rollback = "ROLLBACK" stop-begin = "START TRANSACTION" stop-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{SQL-User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop-commit = "COMMIT" stop-rollback = "ROLLBACK" on-begin = "START TRANSACTION" on-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '%{Nas-IP-Address}'" on-commit = "COMMIT" on-rollback = "ROLLBACK" off-begin = "START TRANSACTION" off-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '%{Nas-IP-Address}'" off-commit = "COMMIT" off-rollback = "ROLLBACK" sqlippool_log_exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" defaultpool = "main_pool" } Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Instantiating module "ntdomain" from file /etc/raddb/modules/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } Module: Checking session {...} for more modules to load Module: Checking pre-proxy {...} for more modules to load Module: Instantiating module "pre_proxy_log" from file /etc/raddb/modules/detail.log detail pre_proxy_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server server coa { # from file /etc/raddb/sites-enabled/coa modules { Module: Checking recv-coa {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "ok" from file /etc/raddb/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Checking send-coa {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "coa" server = "coa" ipaddr = * port = 3799 } ... adding new socket proxy address * port 50826 ... adding new socket proxy address * port 59775 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on coa address * port 3799 as server coa Listening on proxy address * port 1814 Ready to process requests.

2 2

RE: Log when the proxy home_server has no response
by Chuang Okis 13 Feb '14

13 Feb '14

Hi Alan, Thanks for your response! Does that work on 2.2.0 ? Or maybe it works only on 3.x?Because I did a simple test yesterday but it seems not working on 2.2.0 :(I made a simple test, please refer log below: First, I set up a server 1 as a proxy server. It will proxy the request to server 2. Server 1 debug log:----rad_recv: Access-Request packet from host 172.30.179.22 port 35802, id=221, length=79 User-Name = "test@test" User-Password = "123" NAS-IP-Address = 172.30.179.22 NAS-Port = 0 Message-Authenticator = 0x82e274124fd26a6a5c9e2c8105d8f209# Executing section authorize from file /opt/freeRADIUS/etc/raddb/sites-enabled/default+- entering group authorize {...} expand: %{client:Gateway-Type} -> ALU++[control] returns notfoundrlm_perl: RAD_CONFIG: Tmp-String-8 = ALUrlm_perl: Added pair User-Name = test@testrlm_perl: Added pair User-Password = 123rlm_perl: Added pair NAS-Port = 0rlm_perl: Added pair NAS-IP-Address = 172.30.179.22rlm_perl: Added pair Message-Authenticator = 0x82e274124fd26a6a5c9e2c8105d8f209rlm_perl: Added pair Tmp-String-8 = ALU++[test_client_config] returns noop++[preprocess] returns ok[auth_log] expand: %{Packet-Src-IP-Address} -> 172.30.179.22[auth_log] expand: /opt/freeRADIUS/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /opt/freeRADIUS/var/log/radius/radacct/172.30.179.22/auth-detail-20140213[auth_log] /opt/freeRADIUS/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /opt/freeRADIUS/var/log/radius/radacct/172.30.179.22/auth-detail-20140213[auth_log] expand: %t -> Thu Feb 13 09:57:41 2014++[auth_log] returns ok++[chap] returns noop++[mschap] returns noop++[digest] returns noop[suffix] Looking up realm "test" for User-Name = "test@test"[suffix] Found realm "test"[suffix] Adding Realm = "test"[suffix] Proxying request from user test to realm test[suffix] Preparing to proxy authentication request to realm "test" ++[suffix] returns updated[eap] No EAP-Message, not doing EAP++[eap] returns noop++[files] returns noop++[expiration] returns noop++[logintime] returns noop++[pap] returns noop# Executing section pre-proxy from file /opt/freeRADIUS/etc/raddb/sites-enabled/default+- entering group pre-proxy {...}[attr_filter.pre-proxy] expand: %{Realm} -> testattr_filter: Matched entry DEFAULT at line 50++[attr_filter.pre-proxy] returns updatedSending Access-Request of id 165 to 172.30.179.22 port 1812 User-Name = "test@test" User-Password = "123" NAS-IP-Address = 172.30.179.22 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x323231Proxying request 0 to home server 172.30.179.22 port 1812Sending Access-Request of id 165 to 172.30.179.22 port 1812 User-Name = "test@test" User-Password = "123" NAS-IP-Address = 172.30.179.22 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x323231Going to the next requestWaking up in 0.9 seconds.Waking up in 19.0 seconds.rad_recv: Access-Request packet from host 172.30.179.22 port 35802, id=221, length=79Sending duplicate proxied request to home server 172.30.179.22 port 1812 - ID: 165Sending Access-Request of id 165 to 172.30.179.22 port 1812 User-Name = "test@test" User-Password = "123" NAS-IP-Address = 172.30.179.22 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x323231Waking up in 14.9 seconds.rad_recv: Access-Request packet from host 172.30.179.22 port 35802, id=221, length=79Sending duplicate proxied request to home server 172.30.179.22 port 1812 - ID: 165Sending Access-Request of id 165 to 172.30.179.22 port 1812 User-Name = "test@test" User-Password = "123" NAS-IP-Address = 172.30.179.22 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x323231Waking up in 9.9 seconds.Cleaning up request 0 ID 221 with timestamp +26Marking home server 172.30.179.22 port 1812 as zombie (it looks like it is dead).Sending Status-Server of id 205 to 172.30.179.22 port 1812 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?"Waking up in 3.9 seconds.rad_recv: Access-Accept packet from host 172.30.179.22 port 1812, id=205, length=20Received response to status check 1 (1 in current sequence)Waking up in 30.4 seconds.-----Then Server 2 received request from server 1, I put on the policy of "Do Not Response" here to let it not reply to server 1 as Timeout scenario. Server 2 debug log:-----rad_recv: Access-Request packet from host 172.30.179.21 port 3102, id=165, length=78 User-Name = "test@test" User-Password = "123" NAS-IP-Address = 172.30.179.22 Message-Authenticator = 0x3f6871b3d1076fa74b7e9bd33421cb40 Proxy-State = 0x323231# Executing section authorize from file /opt/freeradius/etc/raddb/sites-enabled/default+- entering group authorize {...}++- entering policy do_not_respond {...}+++[control] returns notfound+++[handled] returns handled++- policy do_not_respond returns handledNot responding to request 0Finished request 0.Going to the next requestWaking up in 29.9 seconds.rad_recv: Access-Request packet from host 172.30.179.21 port 3102, id=165, length=78Ignoring retransmit from client test-21 port 3102 - ID: 165, no reply was configuredWaking up in 24.9 seconds.rad_recv: Access-Request packet from host 172.30.179.21 port 3102, id=165, length=78Ignoring retransmit from client test-21 port 3102 - ID: 165, no reply was configuredWaking up in 19.9 seconds.rad_recv: Status-Server packet from host 172.30.179.21 port 3102, id=205, length=68 Message-Authenticator = 0x7407443309fd2696fedad4b6c91ee1eb NAS-Identifier = "Status Check. Are you alive?"Sending Access-Accept of id 205 to 172.30.179.21 port 3102Finished request 1.Cleaning up request 1 ID 205 with timestamp +23Going to the next requestWaking up in 9.9 seconds.Cleaning up request 0 ID 165 with timestamp +3Ready to process requests.----- As you can see, server 1 did not go into post-proxy-type fail section as I expect :(Is there anything I miss or doing wrong? Thanks! Okis > Chuang Okis wrote: > > we have some statistical requirements for eap-sim, I want know if I can > > identify and log it when we proxy Access-Request/Access-Challenge to > > external AAA home_server but no response back(timeout)? > > Read raddb/sites-available/default. Look for Post-Proxy-Type Fail.> > Alan DeKok. >

2 1

CoovaChilli FreeRADIUS setup with UAM
by Russell Mike 13 Feb '14

13 Feb '14

Dear List Greetings *Setup Example: * i have CoovaChilli / FreeRADIUS setup with UAM (Universal Access Manager) server. Basically means it is different web server than NAS it self (NAS = CoovaChilli). UAM serve the login page for hotspot users. Saying other way, separate web server for content management system (serving login page base on geographical location, distance, vlan numbers etc. etc..) When any of following condition becomes true 1.) User has fill the wrong password 2.) User calling outside of time slot 3.) User already downloaded the quota specified FreeRADIUS reject the access, which is obvious. Fine !!!! *Question: * how can i configure FreeRADIUS to send the reply messages (Your username/password is wrong) to UAM server rather than NAS ? i am very sure there would be a way to do it and i am not coming across using google search over a week. Thanks / Regards RM --

3 4

how is it correct to use radiusCheckItem AVP?
by Zeus Panchenko 12 Feb '14

12 Feb '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hello, I'm confused with my understanding of how it have to work - the AVP radiusCheckItem I hoped much I can use radiusCheckItem set to "Huntgroup-Name == ZyXEL" set in client LDAP object, to check whether client belongs to the huntgroup or not, to assign relevant profile to the client via check in users file. what I did: - ---[ quotation start: users ]------------------------------------------- # COMMUTATORS DEFAULT Ldap-Group == comm-shell, Cisco-AVPair =* "anything", User-Profile := "cn=comm-shell,ou=profiles,ou=radius,dc=org" Reply-Message = "%{User-Name}, you are comming as Cisco comm-shell.", Fall-Through = no DEFAULT Ldap-Group == comm-shell, Huntgroup-Name == ZyXEL, User-Profile := "cn=comm-shell,ou=profiles,ou=radius,dc=org" Reply-Message = "%{User-Name}, you are comming as ZyXEL comm-shell.", Fall-Through = no DEFAULT Ldap-Group == comm-shell, User-Profile := "cn=comm-shell,ou=profiles,ou=radius,dc=org" Reply-Message = "%{User-Name}, you are comming as comm-shell.", Fall-Through = no - ---[ quotation end ]--------------------------------------------------- - ---[ quotation start: ldap.attrmap ]----------------------------- checkItem Huntgroup-Name radiusHuntgroupName - ---[ quotation end ]------------------------------------------- - ---[ quotation start: client .ldif ]----------------------------- dn: radiusClientIdentifier=1.2.3.4,ou=clients,ou=radius,dc=org cn: 1.2.3.4 objectclass: radiusClient objectclass: top objectclass: radiusprofile radiusclientidentifier: 1.2.3.4 radiusclientsecret: testing123 radiusclientshortname: zyxel.comm.local radiusclienttype: cisco radiushuntgroupname: ZyXEL - ---[ quotation end ]------------------------------------------- - ---[ quotation start: commutators profile .ldif ]---------------- dn: cn=comm-shell,ou=profiles,ou=radius,dc=org cn: comm-shell objectclass: radiusprofile objectclass: person objectclass: top radiuscheckitem: Huntgroup-Name == ZyXEL radiusreplymessage: Hello, shell user. radiusservicetype: Administrative-User sn: comm-shell - ---[ quotation end ]------------------------------------------- - ---[ quotation start: commutator account .ldif ]----------------- dn: cn=test-comm,ou=users,ou=radius,dc=org cn: test-comm description: Commutators shell, test user. objectclass: radiusprofile objectclass: person objectclass: top radiusgroupname: comm-shell radiusreplyitem: cisco-avpair = "shell:priv-lvl=15" sn: test-comm userpassword: *********** - ---[ quotation end ]------------------------------------------- and here is what I have in debug: - ---[ quotation start: debug from radiusd -XX ]------------------- Wed Feb 12 20:10:46 2014 : Debug: - Added client 1.2.3.4 with shared secret testing123 rad_recv: Access-Request packet from host 1.2.3.4 port 1026, id=133, length=70 User-Name = "test-comm" User-Password = "***********" NAS-Identifier = "zyxel.comm.local" NAS-IP-Address = 1.2.3.4 Wed Feb 12 20:10:46 2014 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Wed Feb 12 20:10:46 2014 : Info: +group authorize { ... Wed Feb 12 20:10:46 2014 : Debug: rlm_ldap::ldap_groupcmp: User found in group comm-shell ... Wed Feb 12 20:10:46 2014 : Debug: rlm_ldap::ldap_groupcmp: User found in group comm-shell Wed Feb 12 20:10:46 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Feb 12 20:10:46 2014 : Info: [files] users: Matched entry DEFAULT at line 23 Wed Feb 12 20:10:46 2014 : Info: [files] expand: %{User-Name}, you are comming as comm-shell. -> test-comm, you are comming as comm-shell. Wed Feb 12 20:10:46 2014 : Info: ++[files] = ok ... Wed Feb 12 20:10:46 2014 : Debug: [ldap] extracted attribute Huntgroup-Name from generic item Huntgroup-Name == ZyXEL Wed Feb 12 20:10:46 2014 : Debug: [ldap] radiusReplyMessage -> Reply-Message = "Hello, shell user." Wed Feb 12 20:10:46 2014 : Debug: [ldap] radiusServiceType -> Service-Type = Administrative-User Wed Feb 12 20:10:46 2014 : Info: [ldap] looking for check items in directory... Wed Feb 12 20:10:46 2014 : Debug: [ldap] userPassword -> Cleartext-Password == "***********" Wed Feb 12 20:10:46 2014 : Debug: [ldap] userPassword -> Password-With-Header == "***********" Wed Feb 12 20:10:46 2014 : Info: [ldap] looking for reply items in directory... Wed Feb 12 20:10:46 2014 : Debug: [ldap] extracted attribute Cisco-AVPair from generic item cisco-avpair = "shell:priv-lvl=15" Wed Feb 12 20:10:46 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Feb 12 20:10:46 2014 : Info: ++[ldap] = ok ... Sending Access-Accept of id 133 to 1.2.3.4 port 1026 Reply-Message = "Hello, shell user." Service-Type = Administrative-User Cisco-AVPair = "shell:priv-lvl=15" - ---[ quotation end ]------------------------------------------- so, how can I make the commutators requests match the second rule from file users, not the third one? where am I wrong, please, I'm close to give up? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlL7v8QACgkQr3jpPg/3oyoc3gCaAxLr9v4rZjiW1JdNCUjrgiXi HlkAoI/MA1JlzHHaYrq3zzn+MEc45tsb =i7QQ -----END PGP SIGNATURE-----

1 0

Inheritance of eap.conf settings
by Jonathan Gazeley 12 Feb '14

12 Feb '14

Hi list, I'm neatening up my sprawling FreeRADIUS config and I've noticed something strange. Nothing uses the default eap.conf (and the default virtual server is disabled) but my understanding is that instantiations of the eap module, called like: eap eduroameap {} ... should inherit settings from eap.conf. In my eap.conf I've set: dh_file = /etc/raddb/certs/dh random_file = /dev/urandom And in my numerous EAP modules for various virtual servers, I've removed dh_file and random_file. Nothing complained about random_file being missing but apparently the dh_file being missing is an issue: rlm_eap_tls: Unable to open DH file - (null) rlm_eap: Failed to initialize type tls /etc/raddb/modules/rainboweap[17]: Instantiation failed for module "rainboweap" /etc/raddb/sites-enabled/rainbow-inner[17]: Failed to find "rainboweap" in the "modules" section. /etc/raddb/sites-enabled/rainbow-inner[13]: Errors parsing authenticate section. How come random_file was inherited while dh_file wasn't? Or have I misunderstood how this works, inerheritance doesn't exist, and it's just that random_file has a default value if undefined while dh_file doesn't? Thanks, Jonathan

4 3

Log when the proxy home_server has no response
by Chuang Okis 12 Feb '14

12 Feb '14

Dear all, we have some statistical requirements for eap-sim, I want know if I can identify and log it when we proxy Access-Request/Access-Challenge to external AAA home_server but no response back(timeout)? We now using perl to write our radius logs, so it would be great if we can identify "timeout" as response type and get the value from perl Hash - %RAD_* or somewhere outside by unlang. Is that possible? Best Regards, Okis

2 1

Re: Radius Issue, No response from server
by Rishabh.Shukla 12 Feb '14

12 Feb '14

Hello Alan, Thank you for your reply. I would like to highlight that I have checked that the machines can ping each other. Moreover, they are on the same network and the routing also works. Hence, to me it does not seem like a network issue. I would greatly appreciate any further help in this regard. Thanks Again. --------------------------------------------------------------------------- Best Regards, Rishabh On 2/12/2014 12:08 PM, Rishabh.Shukla wrote: ----- Forwarded Message ----- From: "Alan DeKok" <aland(a)deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, February 10, 2014 8:53:13 PM Subject: Re: Radius Issue, No response from server Rishabh.Shukla wrote: <blockquote> I have also stopped the iptables services still radius server is not listening and during debug we found that the request is not even reaching radius server and moreover I am not getting any error message at all. Then your network is broken. Fix it. This isn't a RADIUS issue. Ensure that the machines can "ping" each other, that they're on the same network, routing works, etc. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </blockquote>

2 1

Re: Radius Issue, No response from server
by Rishabh.Shukla 12 Feb '14

12 Feb '14

Hi, Thank you for your reply. I would like to highlight that I have checked that the switch and the radius server can ping each other. Moreover, they are on the same network and the routing also works. Hence, to me it does not seem like a network issue. I would greatly appreciate any further help in this regard. Thanks Again. ------------------------------------------------------------------------------------------- Best Regards, Rishabh On 2/12/2014 12:06 PM, Rishabh.Shukla wrote: ----- Forwarded Message ----- From: "HCC Mailing Lists" <hcc.lists(a)gmail.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, February 10, 2014 8:25:59 PM Subject: RE: Radius Issue, No response from server I may be stating the obvious, but since you have done the configuration perfectly and the packets are not reaching the RADIUS server you might check the configuration of the switch and the network to make sure they can reach each other. <blockquote> -----Original Message----- From: freeradius-users- bounces+hcc.lists=gmail.com(a)lists.freeradius.org [ mailto:freeradius - users-bounces+hcc.lists=gmail.com(a)lists.freeradius.org ] On Behalf Of Rishabh.Shukla Sent: Monday, February 10, 2014 09:11 To: freeradius-users(a)lists.freeradius.org Cc: Hiren Patel; Ronak Shah Subject: Radius Issue, No response from server Hello, I have deployed radius server + daloradius + MySQL in centos 6 and all <blockquote> configuration is done perfectly. I have added HP ProCurve switch </blockquote> 3400 <blockquote> CL as my NAS for sending authentication requests. The scenarios is this: the server is responding and accepting the packets locally but when I try to authenticate through the HP ProCurve switch the server does not respond. I have also stopped the iptables services still radius server is not listening and during debug we found that the request is not even reaching radius server and moreover I am not getting any error message at all. I will be grateful if anybody can help me out to overcome this </blockquote> problem. <blockquote> Thanks and regards Rishabh. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </blockquote> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </blockquote>

4 4

802.1x radius request reject.
by sampath jayashantha 12 Feb '14

12 Feb '14

Hi , I have created a user and added a node to that user. But im getting below access reject packet. :( Any clue ? rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=199, length=152 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200000c0173616d70617468 Message-Authenticator = 0xe791fd6ef5be4d1bbc964ebf48dcdefa server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_perl: Added pair NAS-Port-Type = Ethernet rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Calling-Station-Id = 78-45-C4-B5-AC-41 rlm_perl: Added pair Called-Station-Id = 00-0A-B7-BC-5A-84 rlm_perl: Added pair Cisco-NAS-Port = FastEthernet0/4 rlm_perl: Added pair Message-Authenticator = 0xe791fd6ef5be4d1bbc964ebf48dcdefa rlm_perl: Added pair User-Name = sampath rlm_perl: Added pair EAP-Message = 0x0200000c0173616d70617468 rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair NAS-IP-Address = 192.168.13.45 rlm_perl: Added pair NAS-Port = 50004 rlm_perl: Added pair Framed-MTU = 1500 rlm_perl: Added pair Auth-Type = EAP ++[packetfence] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 199 to 192.168.13.45 port 1812 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d33cbc0cb31e5b71f340264f3a Finished request 54. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=200, length=279 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d33cbc0cb31e5b71f340264f3a EAP-Message = 0x0201007919800000006f160301006a01000066030152fb07ded3e51b3a9c9aa55b0ba6f46016c14e1644de4fbd07186f436a4f3b4e000018002f00 350005000ac013c014c009c00a003200380013000401000025ff010001000000000c000a00000773616d70617468000a0006000400170018000b00020100 Message-Authenticator = 0x6aafb4e647c1076bc2b718e2181f6671 server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 1 length 121 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 111 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 006a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 049b], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 200 to 192.168.13.45 port 1812 EAP-Message = 0x0102040019c0000004df16030100310200002d030152fb07bc28df3e052535a0db2ea09acfb1e4bce937947a1f3b22eeb766292f1400002f000005 ff01000100160301049b0b0004970004940004913082048d30820375a003020102020900884ec713d33dcea8300d06092a864886f70d01010505003076310b3009060355040613 024341310b30090603550408130251433111300f060355040713084d6f6e747265616c3110300e060355040a1307496e766572736531123010060355040313093132372e302e30 2e313121301f06092a864886f70d0109011612737570706f727440696e76657273652e6361301e170d3134303133303038323134 EAP-Message = 0x325a170d3135303133303038323134325a3076310b3009060355040613024341310b30090603550408130251433111300f060355040713084d6f6e 747265616c3110300e060355040a1307496e766572736531123010060355040313093132372e302e302e313121301f06092a864886f70d0109011612737570706f727440696e76 657273652e636130820122300d06092a864886f70d01010105000382010f003082010a0282010100cb6e98c86adb80fda9fe7c0396961929f7fb69fe2fe295ea79c8b71b9375ef 72feee48711980d5a8fd428e6e3233e0daf800f73b0b7095f2d669c6bce2faaeda9d4734c0a20aaeeb948771b6cbf52daef842d4 EAP-Message = 0xcc7c33a9c611e08be2ffe2c786ad1b685d607f90126c4d262bed4c683e97cdd39c6d03a7c3f2d2acea03542ce43004008518611445858caecde8e5 84104684170db2327c16861bdb2a7e6d827cf4c25197275278d702626a3b2bbcaf28d011d37252e79b7d041c2c0f715134ba4d92afdd9c9f09411877ba134798ff6d74c11ea95f e96c2f70e2c4c42333f750dc88cca9fb13c960eff392c7981f34ab6b27169db27f9f1a8832a8901ffcf29b0203010001a382011c30820118301d0603551d0e04160414d35fe892 a095707f22eee3cb19be4b6cab49ee3c3081a80603551d230481a030819d8014d35fe892a095707f22eee3cb19be4b6cab49ee3c EAP-Message = 0xa17aa4783076310b3009060355040613024341310b30090603550408130251433111300f060355040713084d6f6e747265616c3110300e06035504 0a1307496e766572736531123010060355040313093132372e302e302e313121301f06092a864886f70d0109011612737570706f727440696e76657273652e6361820900884ec7 13d33dcea8300c0603551d130101ff0402300030090603551d1204023000300b0603551d0f0404030205e030130603551d25040c300a06082b0601050507030130110609608648 0186f8420101040403020640300d06092a864886f70d010105050003820101009e1fdecc9821df724b9d9c78b12af5551673703f EAP-Message = 0xd588ff15429f1f34ed6b7926 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d33dbf0cb31e5b71f340264f3a Finished request 55. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=201, length=164 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d33dbf0cb31e5b71f340264f3a EAP-Message = 0x020200061900 Message-Authenticator = 0x353191b59561f9f1fe76fed6e28ef8a9 server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 201 to 192.168.13.45 port 1812 EAP-Message = 0x010300ef19007bb5e27c4da9bd39dfefc5c3402654575ff7204a10c5e4f018a975a2630c5599830e34267ba452b94ac1b7e2442ea616aecc99dc4b 47687b862d9b4df2fc607342e483df9231cd5c320f09ad144ba7980db161959853db1ca476fcdee76a1fae8744e7583d57291c42904a8c353f7f1ee417e4625efd2a6d8662301c 778e81f944fa4fa66deacb7f01d8687b39b7cc9054c58e4e0a43146042677aa701399ca609a08a9a4bf7a57c9bf36f03898dc606d7fd92cefd01b3976d1f2c217ce90a8dd1a956 c7b0e34d4e99e54f6278e229e3ed458dc2c4f7512023ccd6384a517bef16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d33ebe0cb31e5b71f340264f3a Finished request 56. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=202, length=496 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d33ebe0cb31e5b71f340264f3a EAP-Message = 0x02030150198000000146160301010610000102010059580f2ba30cc29dc5a15d7df2a9dead82de23679970708fb1c0ace280aee5f6db7256ef1b8f 659768e6e6959d71b576fd75c2d10e484741edf492f0fa72cf2144616a2591fa8bf10da5959fbbd6f98e9d1ae6005c890cb35f4038e0015a8fe69801f8c6601f096a1b5fed5ddf 07c16cdf1845a9bc0fea83db38aa4dba5ab0448f1b78e51230b7d3dadaf1b369882273d34c58ffd4e2d11ad96c5136019a2591a4a667b230511e776e954539b63327cacec28be8 84ffe88fee2be913ee19e0c69396495a1242a0fbaeb5d10536cb5b26670d7e32ee27a4715b402bda8bf497a8564e1832f28df7f5 EAP-Message = 0x31026b26edf1c7a46c69b5f35940c27541d48a52a1e235d91403010001011603010030d7cb7d641679a62d43055e25b36a2a4e2c487b7b313cb39d 38a3bd9d2dc5a4920a83fe83098070b6211205c38efa7b68 Message-Authenticator = 0x69c90a78fea5c6b936dbe253ccf88a43 server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 3 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 202 to 192.168.13.45 port 1812 EAP-Message = 0x01040041190014030100010116030100302d72e9da629993e710a01375e44f3ff6c496bc91aafe3b5efea86d1af805a7b9a01238efc53d2efc31a7 ff63472088bf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d33fb90cb31e5b71f340264f3a Finished request 57. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=203, length=164 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d33fb90cb31e5b71f340264f3a EAP-Message = 0x020400061900 Message-Authenticator = 0x3c84ad083e4e9d0a8240786169b376cf server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 203 to 192.168.13.45 port 1812 EAP-Message = 0x0105002b19001703010020233ca5ac7fdbf4aee3541cb39f7899bb7e74ea734215947f14d822d238425e59 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d338b80cb31e5b71f340264f3a Finished request 58. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=204, length=201 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d338b80cb31e5b71f340264f3a EAP-Message = 0x0205002b19001703010020738e4cb80e9a4f1f0d240d62bd1cecdd81e2ceef1fcd8a736f92a620ab1e6827 Message-Authenticator = 0x4d5068c89b9e99b0fcac71687069f264 server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 5 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - sampath [peap] Got inner identity 'sampath' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0205000c0173616d70617468 server packetfence { [peap] Setting User-Name to sampath Sending tunneled request EAP-Message = 0x0205000c0173616d70617468 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sampath" NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 server packetfence-tunnel { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "sampath", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 5 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server packetfence-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010600211a0106001c103c9631cb9240941b8ff7cb26b01cdccd73616d70617468 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb763a09fb765baae8b5ff4f7e1e703c3 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010600211a0106001c103c9631cb9240941b8ff7cb26b01cdccd73616d70617468 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb763a09fb765baae8b5ff4f7e1e703c3 [peap] Got tunneled Access-Challenge ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 204 to 192.168.13.45 port 1812 EAP-Message = 0x0106004b190017030100407ea62a6842f0b519ec0bf48a630b60f7e9f84151bee10b16cba686cd23951470367e059996c25fe5f9ab0312a3af8e05 222bd031372641bbc939adbacd345ea6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d339bb0cb31e5b71f340264f3a Finished request 59. Going to the next request Waking up in 3.0 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=205, length=265 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d339bb0cb31e5b71f340264f3a EAP-Message = 0x0206006b190017030100605c575006ef74492c6d35cf856541302dd4f1fb1272c048206638ab77315df28a5585a4cbd8fe6b9accf1e03d27ac3c2c 64d8052b1d08f12dcc61829dbddd05acb0dff7a2427b7fb0f096fe68defb30cecd74a4b9321c185184166c83c77f60a7 Message-Authenticator = 0xdaa88d9bc6343059a93a80ca449d11ae server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 6 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020600421a0206003d31e3766c4f25bb1e54194b8e8fc97544ed0000000000000000fead0628b2da8557a51d90b546624ef9f4ee5e1bdf2eec4400 73616d70617468 server packetfence { [peap] Setting User-Name to sampath Sending tunneled request EAP-Message = 0x020600421a0206003d31e3766c4f25bb1e54194b8e8fc97544ed0000000000000000fead0628b2da8557a51d90b546624ef9f4ee5e1bdf2eec4400 73616d70617468 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sampath" State = 0xb763a09fb765baae8b5ff4f7e1e703c3 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 server packetfence-tunnel { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "sampath", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 6 length 66 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: sampath [mschap] Client is using MS-CHAPv2 for sampath, we need NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [sampath] (from client 192.168.13.45 port 50004 cli 78-45-C4-B5-AC-41 via TLS tunnel) } # server packetfence-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 205 to 192.168.13.45 port 1812 EAP-Message = 0x0107002b190017030100204facc5d6c6a20c7d1d8da40959527f726dbb84e495fd0ebc71ea913fc79b2b12 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d33aba0cb31e5b71f340264f3a Finished request 60. Going to the next request Waking up in 2.2 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=206, length=201 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d33aba0cb31e5b71f340264f3a EAP-Message = 0x0207002b19001703010020e803f872cda2fc4834ed5079ccedbc963ca3580ad74aada3ce4f6ef81e932f3a Message-Authenticator = 0x2b593816dc1b145744204630a7a77fee server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 7 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [sampath] (from client 192.168.13.45 port 50004 cli 78-45-C4-B5-AC-41) } # server packetfence Using Post-Auth-Type REJECT # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sampath attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 61 for 1 seconds Going to the next request Waking up in 0.4 seconds. Cleaning up request 54 ID 199 with timestamp +2742 Cleaning up request 55 ID 200 with timestamp +2742 Cleaning up request 56 ID 201 with timestamp +2742 Cleaning up request 57 ID 202 with timestamp +2742 Waking up in 0.4 seconds. Sending delayed reject for request 61 Sending Access-Reject of id 206 to 192.168.13.45 port 1812 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 58 ID 203 with timestamp +2743 Waking up in 1.2 seconds. Cleaning up request 59 ID 204 with timestamp +2744 Waking up in 0.8 seconds. Cleaning up request 60 ID 205 with timestamp +2745 Waking up in 2.7 seconds. Cleaning up request 61 ID 206 with timestamp +2747 Ready to process requests. Regards, Sampath Jayashantha

3 2

6. Recommended number of threads (McNutt, Justin M.) - Re: Freeradius-Users Digest, Vol 106, Issue 31
by Rui Ribeiro 12 Feb '14

12 Feb '14

We have 2500 wireless clients at peak time, and I have seen as much as 20 simultaneous authentications before I optimised the freeradius server. We only have one RADIUS server in operation, and another for failover. The number of users is one tree in the forest IMO. Have you timed how long one user takes to authenticate? What is the load of your current server? How long the associate systems take to answer? At the end of the day, again, IMO, you have to balance good sysadmin practices while fine-tuning the associated systems, and fine-tune your freeradius configuration as well. Pay well attention to the debug information, as you can fine tune unlang for some events to not repeat all the way in the several steps of the negotiation; also the latest 2.2 versions seem to perform better than the 2.1.X - we went from 50-90ms down to less than 10ms. Note: have a look at eapol_test and raddebug if you are not using them. Regards On 11 February 2014 22:01, <freeradius-users-request(a)lists.freeradius.org>wrote: > > > Message: 6 > Date: Tue, 11 Feb 2014 20:53:08 +0000 > From: "McNutt, Justin M." <McNuttJ(a)missouri.edu> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Recommended number of threads > Message-ID: > < > 81D8D62C6E5AD1499D9C16729DB5B3DEDED03CE8(a)UM-MBX-N02.um.umsystem.edu> > Content-Type: text/plain; charset="us-ascii" > > I've been seeing some unexplained failures to authenticate 802.1X clients > when my system is under heavier load, and I suspect that I don't have > enough threads running. For reference, I currently have four servers in a > load balanced group with identical configs. Thread settings are these: > > max_servers = 32 > min_spare_servers = 3 > max_spare_servers = 10 > max_requests_per_server = 0 > > We have about 14,500 wireless clients at peak times, though that number > will climb, I'm sure. > > Is there a rule of thumb that will tell me how many threads I should have > (max_servers)? Also, I suspect that there have been authentication > failures due to all threads on a server being busy. Is there a good way to > confirm that? I've poked around in the radiusd logs a bit, but haven't > found much, other than the odd "Login failed" with no reason given. (For > "normal" failures, there are two messages, one of which has a cause like > "bad password" or "account locked out" or some such thing.) > > Advice is welcome. > > --J >

1 0