June 2014 - Freeradius-Users - lists.freeradius.org

too many "No EAP session matching state 0x…" with FR 3.0.x
by Michael Simon 13 Jun '14

13 Jun '14

Hi! After running FR 3.0.3 from GIT (FR 3.0.2 as well) for a while (a few hours) lots of “Error: rlm_eap (EAP): No EAP session matching state 0x…” appear in the log file. A restart of FR and the error messages are gone for the present. These requests come from RADIUS over TLS (radsec) clients explained in /etc/freeradius/sites-available/tls Is this a bug or a misconfiguration? Best wishes Michael Fri Jun 13 09:30:53 2014 : Auth: (10040) Login incorrect: [userxy(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:30:53 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x7c19d06a7714c91d Fri Jun 13 09:30:59 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x7c19d06a7714c91d Fri Jun 13 09:30:59 2014 : Auth: (10041) Login incorrect: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:30:59 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x7c19d06a7714c91d Fri Jun 13 09:31:20 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x6d7d7a2a6d6d63c6 Fri Jun 13 09:31:20 2014 : Auth: (10045) Login incorrect: [userxy(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:31:20 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x6d7d7a2a6d6d63c6 Fri Jun 13 09:31:27 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x6d7d7a2a6d6d63c6 Fri Jun 13 09:31:27 2014 : Auth: (10047) Login incorrect: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:31:27 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x6d7d7a2a6d6d63c6 Fri Jun 13 09:31:37 2014 : Auth: (10098) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 09:31:37 2014 : Auth: (10099) Login OK: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67 via TLS tunnel) Fri Jun 13 09:31:37 2014 : Auth: (10100) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:31:38 2014 : Auth: (10101) Login OK: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:32:18 2014 : Auth: (10152) Login OK: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67 via TLS tunnel) Fri Jun 13 09:32:18 2014 : Auth: (10154) Login OK: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:32:28 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x31cdab6e35cbb2ff Fri Jun 13 09:32:28 2014 : Auth: (10170) Login incorrect: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:32:28 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x31cdab6e35cbb2ff Fri Jun 13 09:32:40 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:40 2014 : Auth: (10203) Login incorrect: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:32:40 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:50 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:50 2014 : Auth: (10207) Login incorrect: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:32:50 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:53 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:53 2014 : Auth: (10208) Login incorrect: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:32:53 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:36:25 2014 : Auth: (10471) Login OK: [userxz(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 132 cli 68-A8-6D-0E-E4-CE via TLS tunnel) Fri Jun 13 09:36:25 2014 : Auth: (10472) Login OK: [user128(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 14088 cli 84-7A-88-75-92-4E via TLS tunnel) Fri Jun 13 09:36:25 2014 : Auth: (10473) Login OK: [userxz(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 132 cli 68-A8-6D-0E-E4-CE) Fri Jun 13 09:36:27 2014 : Auth: (10474) Login OK: [user128(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 14088 cli 84-7A-88-75-92-4E) Fri Jun 13 09:40:45 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x2acecbf92accd2dc Fri Jun 13 09:40:45 2014 : Auth: (10853) Login incorrect: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:40:45 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x2acecbf92accd2dc Fri Jun 13 09:40:48 2014 : Auth: (10876) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab via TLS tunnel) Fri Jun 13 09:40:48 2014 : Auth: (10877) Login OK: [user810(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 0 via TLS tunnel) Fri Jun 13 09:40:48 2014 : Auth: (10878) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:41:08 2014 : Auth: (10913) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0 via TLS tunnel) Fri Jun 13 09:41:08 2014 : Auth: (10914) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0) Fri Jun 13 09:41:14 2014 : Auth: (10927) Login OK: [user810(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 0) Fri Jun 13 09:43:05 2014 : Auth: (11158) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0 via TLS tunnel) Fri Jun 13 09:43:05 2014 : Auth: (11159) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0) Fri Jun 13 09:43:25 2014 : Auth: (11213) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0 via TLS tunnel) Fri Jun 13 09:43:25 2014 : Auth: (11214) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0) Fri Jun 13 09:44:41 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xc147e16bc145f804 Fri Jun 13 09:44:41 2014 : Auth: (11385) Login incorrect: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:44:41 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xc147e16bc145f804 Fri Jun 13 09:44:46 2014 : Auth: (11422) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab via TLS tunnel) Fri Jun 13 09:44:46 2014 : Auth: (11423) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c via TLS tunnel) Fri Jun 13 09:44:46 2014 : Auth: (11424) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:44:56 2014 : Auth: (11445) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:45:17 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x77b7713e7ca66843 Fri Jun 13 09:45:17 2014 : Auth: (11503) Login incorrect: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:45:17 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x77b7713e7ca66843 Fri Jun 13 09:45:21 2014 : Auth: (11537) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab via TLS tunnel) Fri Jun 13 09:45:21 2014 : Auth: (11538) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c via TLS tunnel) Fri Jun 13 09:45:21 2014 : Auth: (11539) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:45:31 2014 : Auth: (11570) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:45:49 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x58b807b453a81e77 Fri Jun 13 09:45:49 2014 : Auth: (11605) Login incorrect: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:45:49 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x58b807b453a81e77 [RESTART FR] Fri Jun 13 09:53:23 2014 : Info: Signalled to terminate Fri Jun 13 09:53:23 2014 : Info: Exiting normally Fri Jun 13 09:53:23 2014 : Info: rlm_ldap (ldap): Closing connection (0) Fri Jun 13 09:53:24 2014 : Info: rlm_ldap (ldap): Opening additional connection (0) Fri Jun 13 09:53:24 2014 : Info: Loaded virtual server <default> Fri Jun 13 09:53:24 2014 : Info: Loaded virtual server default Fri Jun 13 09:53:24 2014 : Info: Loaded virtual server inner-tunnel Fri Jun 13 09:53:24 2014 : Info: Ready to process requests Fri Jun 13 09:53:25 2014 : Info: ... adding new socket auth+acct from client (192.168.71.138, 45129) -> (*, 2083, virtual-server=default) Fri Jun 13 09:53:26 2014 : Info: ... adding new socket auth+acct from client (192.168.71.134, 53659) -> (*, 2083, virtual-server=default) Fri Jun 13 09:53:46 2014 : Auth: (89) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 331 cli CC-3A-61-6C-9E-60 via TLS tunnel) Fri Jun 13 09:53:46 2014 : Auth: (90) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 331 cli CC-3A-61-6C-9E-60) Fri Jun 13 09:54:27 2014 : Auth: (159) Login OK: [userxz(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 142 cli 68-A8-6D-0E-E4-CE via TLS tunnel) Fri Jun 13 09:54:27 2014 : Auth: (160) Login OK: [userxz(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 142 cli 68-A8-6D-0E-E4-CE) Fri Jun 13 09:54:39 2014 : Auth: (183) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 13302 cli CC-3A-61-6C-9E-60 via TLS tunnel) Fri Jun 13 09:54:39 2014 : Auth: (184) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 13302 cli CC-3A-61-6C-9E-60) Fri Jun 13 09:55:34 2014 : Auth: (235) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 48802 cli cc3a.616c.9e60 via TLS tunnel) Fri Jun 13 09:55:34 2014 : Auth: (237) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 48802 cli cc3a.616c.9e60) Fri Jun 13 09:55:40 2014 : Info: ... adding new socket proxy (132.195.90.135, 40115) -> home_server (192.168.71.134, 2083) Fri Jun 13 09:56:33 2014 : Auth: (363) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 34070 cli cc3a.616c.9e60 via TLS tunnel) Fri Jun 13 09:56:33 2014 : Auth: (364) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 34070 cli cc3a.616c.9e60) Fri Jun 13 09:59:03 2014 : Auth: (590) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 61201 cli cc3a.616c.9e60 via TLS tunnel) Fri Jun 13 09:59:03 2014 : Auth: (591) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 61201 cli cc3a.616c.9e60) Fri Jun 13 09:59:06 2014 : Info: rlm_ldap (ldap): Opening additional connection (1) Fri Jun 13 09:59:06 2014 : Auth: (615) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c via TLS tunnel) Fri Jun 13 09:59:06 2014 : Auth: (617) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:59:07 2014 : Auth: (630) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 21912 cli CC-3A-61-6C-9E-60 via TLS tunnel) Fri Jun 13 09:59:07 2014 : Auth: (631) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 21912 cli CC-3A-61-6C-9E-60) Fri Jun 13 09:59:37 2014 : Info: rlm_ldap (ldap): Closing connection (0), from 1 unused connections Fri Jun 13 10:02:23 2014 : Auth: (1074) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 10:02:23 2014 : Auth: (1075) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 10:02:26 2014 : Auth: (1087) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12433 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:02:26 2014 : Auth: (1088) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12433 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:02:28 2014 : Auth: (1102) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12433 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:02:28 2014 : Auth: (1103) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12433 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:03:12 2014 : Auth: (1187) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12519 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:03:12 2014 : Auth: (1188) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12519 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:03:13 2014 : Auth: (1200) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c via TLS tunnel) Fri Jun 13 10:03:13 2014 : Auth: (1201) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 10:03:29 2014 : Auth: (1258) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 10:03:29 2014 : Auth: (1259) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 10:03:30 2014 : Auth: (1272) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 10:03:30 2014 : Auth: (1273) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 10:03:31 2014 : Auth: (1286) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 10:03:31 2014 : Auth: (1287) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 10:04:27 2014 : Auth: (1361) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12754 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:04:27 2014 : Auth: (1362) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12754 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:05:20 2014 : Auth: (1489) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12964 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:05:20 2014 : Auth: (1490) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12964 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:05:50 2014 : Auth: (1543) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli f0-b4-79-14-a0-7d via TLS tunnel) Fri Jun 13 10:05:50 2014 : Auth: (1544) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli f0-b4-79-14-a0-7d) Fri Jun 13 10:06:16 2014 : Auth: (1563) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13158 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:06:17 2014 : Auth: (1564) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13158 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:06:21 2014 : Auth: (1579) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13175 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:06:21 2014 : Auth: (1580) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13175 cli FC-25-3F-DC-34-4D) -- --- Dipl.-Ing. Michael Simon ---- Bergische Universität Wuppertal - ZIM ------ Netzwerk- und Systemplanung -------- simon(a)uni-wuppertal.de --------- Tel. +49 202 439-2235 ---------- Fax. +49 202 439-2910

3 4

MSCHAP authentication against Active directory OR MySQL
by Krzysztof Grobelak 13 Jun '14

13 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello All, On my freeRADIUS instance i am able to authenticate MSCHAP requests against Active Directory using the ntlm_auth module and Samba aditionally i can authenticate another group of WiMAX devices with MACHAP against MySQL database. But if I enable the config for WiMAX devices the are being authenticated aginst Active Directory and not the MySQL db. Now I would like to be able to configure the server so that both groups can be authenticated local users against Active Directory and the WiMAX devices against database. Can you guys advice how i can make it happen? I suspect unlang will be needed to do this but if you could specify how exactly it would be awesome. would it be something along those lines?? authorise{ mschap{ if("%{NAS-IP-Address}" == "1.1.1.1"){ sql } else{ ntlm_auth } } } I hope I did not mixed up terminology too much ;) Regards, Krzysztof -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTma/YAAoJEM/U1HoKR/xkaq0IAJOcPRpsH61wh8sVHrafl0da mCVYN/T94FRSVsOgRtpCpz3zKtfiorla2bL06RN+EQhPxtyist8dX1xNyUnzETaR QcY+/OCDHtVtWX4GGiOMP75DaUNDOj76NtAGLZOe+48Jtjvv3aoSCO4MZgUhbIbN wY4vKxeuA5PJ0SVQD1D8rWIKxxZNwLj24gCowpAA9TJsS1qpqZfLMwYd+uu/vo1O 1ztX7rhkzFdNAn8fJkIpHQLPad0PcAohHevbwIzgivHBtM2euYHvgjFY7yQurSXh G0WuoeWSri3oc3QriTiMc+wIQb1QTSvyTzZwjXhcdB3D0NGJKe3MIPJfCQDIk80= =Fhp6 -----END PGP SIGNATURE----- Airspeed Telecom

2 2

question about 802.1x
by Daniel Soto 13 Jun '14

13 Jun '14

I have been trying without success to authenticate users in the 802.1x user file, is there a way to do it. ? I would create a default rule in the "users " file for all users starting at the domain " WINDOWS \ * " authenticate locally with the Auth -Type = Access My freeradius version is 2.1.12 thank you very much -- hi every body.

3 4

Unable to disconnect user after Max-Daily-Session
by Alexandre Rubert 13 Jun '14

13 Jun '14

Hello, I use Freeradius 2.1.10 for three years and my clients use coova to connect to my radius. In my MySQL database I set : radcheck : myusername --- Cleartext-Password --- := --- pass myusername --- Max-User-Machine --- := --- 1 myusername --- Max-All-Session --- := --- 300 myusername --- Max-Daily-Session --- := --- 170 radgroupreply: mygroup --- Acct-Interim-Interval --- := --- 90 radusergroup myusername --- mygroup --- 1 When I connect to my hotspot through coovachilli, I'm not disconnected after Max-Daily-Session (170seconds) but after Max-All-Session (300seconds) there is a Session-Timeout and I am disconnected. When I retry to connect Radius reply I've used all the time (300seconds) Now When I stay connected 200 seconds and disconnect mannualy. I can't reconnect due to the Max-Daily-Session. I think everything work but I'd like to be disconnected when I reach the Max-Daily-Session like when I reach the Max-All-Session. PS : Freeradius and Coova are not on the same machine, I don't know if it's a problem. Thanks

2 3

post-auth section in FR v2.1.12
by gabriel_skupien 13 Jun '14

13 Jun '14

I am using EAP-TLS and I am trying to use post-auth section to dynamically assign (based on the ldap group membership) vlan ID to the user. Leaving the LDAP part away for testing purposes and concentrating just on the post-auth section - I cannot make FR to override VLAN ID in post-auth section. Here is the config: post-auth { update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := "36" } exec Post-Auth-Type REJECT { attr_filter.access_reject } } And nothing happens here: .... # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[reply] returns noop ++[exec] returns noop Sending Access-Challenge of id 127 to X.X.X.X port 32769 Tunnel-Private-Group-Id:0 = "36" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd55884fdd75c9555353e80afe21cb577 Finished request 6. .... But it finally ends with this: ..... Sending Access-Accept of id 128 to X.X.X.X port 32769 Tunnel-Private-Group-Id:0 = "84" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Cisco-AVPair += "XXX" EAP-Message = 0xXXXX Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "XXXX" Finished request 7. Hence, 3 questions: 1) Does FR v2.1.12 support post-auth section? 2) Can you explain the aim of "Sending Access-Challenge" ? 2) Where is the best place to authorize users in LDAP while using EAP-TLS? Is it post-auth? ps. it works fine while authorizing users based on LDAP in the authorize section but we prefer to postpone this task to post-auth. In that way we can achieve to goals: -use ldap group membership for vlan assignments and -significantly reduce LDAP load jinx

4 8

syslog detail accounting
by Munroe Sollog 12 Jun '14

12 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I currently have freeradius 2.1.12 on a cent6 system. It is only being used to collect accounting data for a VPN. The RADIUS auth is happening somewhere else. The detail logs are currently being stored in /var/log/radius/radacct/<client IP>/detail-<daily-file>. However, while radius itself is logging to syslog, this detail file is not using syslog. My ultimate goal is to be able to forward all of these detail accounting logs to a central syslog server for analysis. My current solution is I have a daemon that watches all of the files, slurps it up and re-emits it as syslog data to an rsyslog server. I am hoping there is a way to configure freeradius to do this so I can dismantle my hack. - - Munroe -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Icedove - http://www.enigmail.net/ iQEcBAEBAgAGBQJTmdlmAAoJEPbbZiWCKDVCT88IAOzyHdS4wh1I4dsTAhCA+2e6 +Uty2U67YK3qRB3ZZ5MyZsmh1btIdwY9FqrbvHZJJrurMaekgI9sLaCwulbpfQC9 /TcJx7UqfWOSs+bJwk45sKOtB/DW9oC6KiBdaNXJzRPxg1KycptfEk25l+Qku84e sPEkH7lc4Agop7xdhEfftzPDnuDAulwIPCJcDKHl9jrKA76wgd+JTkH5CIZxLYH0 ow4teLwqozIRbD/BD3bFgrbK5y2w1jGMkBxKs1uf9M1p1gKbaYEL71ZUSBWF/2nx FmF6c2IMh2THYvKy4jK2BMWAp8e/r2Xc6KtmSAevQdSAMDNkH2CDIa5WsWbiuhs= =py0p -----END PGP SIGNATURE-----

5 8

RE: MSCHAPV2 authenticate including the suffix
by Dean Goldhill 12 Jun '14

12 Jun '14

Hello, Thanks for looking at this. I have attached 2 debug outputs, 1- using domain@user with TTLS & MSCHAPV2 (not EAP-MSCHAPV2) - does not work 2- using domain@user with TTLS & EAP-MSCHAPV2 - does work SO the issues is that when the username contains a suffix, using MSCHAPV2 (as opposed to EAP-MSCHAPV2) I get rejected. If using EAP-MSCHAPV2, it works fine. When using EAP-MSCHAPV2 the CHAP challenge and response messages are inside the EAP message, when using MSCHAPV2, the Chap messages are separate attributes within the inner tunnel. I.E: [ttls] Got tunneled request User-Name = "josef(a)testdomain.com" MS-CHAP-Challenge = 0x1bd3c8b9d05f712d166a28dc85032e3d MS-CHAP2-Response = 0xeb00e4aa1d015b333de96b68fa7258f868270000000000000000777975f5b969b39b08978f3ec81d1dd949960dde0f65af72 So this is 1- using domain@user with TTLS & MSCHAPV2 (not EAP-MSCHAPV2) - does not work: radiusd: FreeRADIUS Version 2.2.5, for host x86_64-redhat-linux-gnu, built on Apr 29 2014 at 09:18:14 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 192.168.42.114 { require_message_authenticator = no secret = "radius" shortname = "test" } client 192.168.42.16 { require_message_authenticator = no secret = "radius" shortname = "test2" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "192.168.152.3" port = "" login = "freeradius" password = "freeradius" radius_db = "ManagedRADIUSWiFi" read_groups = yes sqltrace = yes sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT '111', '%{SQL-User-Name}', 'Cleartext-Password', (select GuestAuthRADIUS ('%{SQL-User-Name}', '%{Calling-Station-Id}' ,'%{Packet-Src-IP-Address}')), ':='" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to freeradius@192.168.152.3:/ManagedRADIUSWiFi rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 36002 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=70, length=151 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User EAP-Message = 0x0201000e01616e6f6e796d6f7573 User-Name = "anonymous" NAS-Port = 44309 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x5753364a5128f3c9e44d876ffa66a057 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> anonymous [sql] sql_set_user escaped user --> 'anonymous' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT '111', '%{SQL-User-Name}', 'Cleartext-Password', (select GuestAuthRADIUS ('%{SQL-User-Name}', '%{Calling-Station-Id}' ,'%{Packet-Src-IP-Address}')), ':=' -> SELECT '111', 'anonymous', 'Cleartext-Password', (select GuestAuthRADIUS ('anonymous', 'AC-72-89-16-1B-1A' ,'192.168.42.16')), ':=' rlm_sql_mysql: query: SELECT '111', 'anonymous', 'Cleartext-Password', (select GuestAuthRADIUS ('anonymous', 'AC-72-89-16-1B-1A' ,'192.168.42.16')), ':=' [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'anonymous' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'anonymous' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'anonymous' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = BINARY 'anonymous' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 70 to 192.168.42.16 port 20008 EAP-Message = 0x010200160410274708d3fbb2f2884ede6102efa8fac5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13befe1b51ad39d66d296a9ad51 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=71, length=161 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13befe1b51ad39d66d296a9ad51 EAP-Message = 0x020200060315 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0xf289380646fc6271b4810647cfe84f1c # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> anonymous [sql] sql_set_user escaped user --> 'anonymous' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT '111', '%{SQL-User-Name}', 'Cleartext-Password', (select GuestAuthRADIUS ('%{SQL-User-Name}', '%{Calling-Station-Id}' ,'%{Packet-Src-IP-Address}')), ':=' -> SELECT '111', 'anonymous', 'Cleartext-Password', (select GuestAuthRADIUS ('anonymous', 'AC-72-89-16-1B-1A' ,'192.168.42.16')), ':=' rlm_sql_mysql: query: SELECT '111', 'anonymous', 'Cleartext-Password', (select GuestAuthRADIUS ('anonymous', 'AC-72-89-16-1B-1A' ,'192.168.42.16')), ':=' [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'anonymous' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'anonymous' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'anonymous' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = BINARY 'anonymous' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 71 to 192.168.42.16 port 20008 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13beee0a41ad39d66d296a9ad51 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=72, length=260 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13beee0a41ad39d66d296a9ad51 EAP-Message = 0x0203006915800000005f160301005a010000560301539878d34807df7593edd62e18def29542ada6f478c3f8ecdd45e04bef429d510000280039003800330032001600130035002f00150012000a0005000400090014001100030006000800ff01000005000f000101 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0xb15bf35f503ae46a166e90aa2cb51c83 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 3 length 105 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 95 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 005a], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 0036], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 08d0], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 72 to 192.168.42.16 port 20008 EAP-Message = 0x0104040015c000000b2b1603010036020000320301539877b727a2bb42e83ab4c8c3dfd371eda380e6cc19300db412e1a20a13701400003900000aff01000100000f00010116030108d00b0008cc0008c90003de308203da308202c2a003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361 EAP-Message = 0x746520417574686f72697479301e170d3134303631313135323730345a170d3135303631313135323730345a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d0a67f56d1218a0a58127603fe396e0160e12705798fdcffe06102c318b7ef9b2176b32f852224eeed482d2ae89f2a0e3b8b EAP-Message = 0xa64fa02f2fbaa1a39b287cd33eafabd326c98dba127ce8b0e44f48db533593598d5391fd079b633cbf92ab99027756e45356ec2ae2f0f32f28bceb364e0d2f123e6276560ef03a8a6fb1ebf4fd63b82006ddca60484df672e0ad74ea2188b295fbe028275a61cad572f73ab977ea9eba084c60677aef2bcc7762832524d649c1e832bd576f8b832583af68d50d6c8e8fa2bc68f417ad3e048042515ead2c650199bcf74b3459641692df0ba363a6c65e7d756e50ff80fc6dd178276bf719b41c1d9fc1338b9a7789a110287c1c4b0203010001a34f304d30130603551d25040c300a06082b0601050507030130360603551d1f042f302d302ba029a027 EAP-Message = 0x8625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d010105050003820101009d6e0fa587fab9dc4a9b4905c18f17669d904c6b5c3b1440304d5ce4625915e54cbbd7dfcce48441a51ed45798252e59ceede8362eb553b09e2c8d6be51940a1bb96ac0bcf06b7cdef5175605a7984c67b9058ac8a21f4b7397d3ac4f4e6677cd3302a78d865b433d2514255f6ae1b784f88ab2f01ec6ebd928591eeebd0dff400393bae2aa4acb14be31f56e824b9386f40ca8ed2e3026a17b27585d8079e7e86eb3a91c5dd07e552c31df48d67c4f8982e7aeb15358c5501bb7b5906f7935b06cb EAP-Message = 0x71200169cea51e7af1c334c0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13bede7a41ad39d66d296a9ad51 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=73, length=161 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13bede7a41ad39d66d296a9ad51 EAP-Message = 0x020400061500 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x9919f28a6ccf424901a11bc90785e61a # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 73 to 192.168.42.16 port 20008 EAP-Message = 0x0105040015c000000b2b1e7a5bff52453e4c9694a7407bf3e1e883321da050c6fa53e4a05a83d8c7077349330a2c1ac202be61c5c75833905c13f4ec0004e5308204e1308203c9a003020102020900dfa3486c6cb1f96e300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930 EAP-Message = 0x1e170d3134303631313135323730345a170d3135303631313135323730345a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c8fcd609bf8dd3edc91006985ff77c8643e8479cc90a5e4d5894e363b614dd90bf73272be715f9 EAP-Message = 0xe41b51c815ad8ce1cb9bfc5084ad728e75005644152bdd82e97809b77d2baa16e22fe4638a8516a11e9df56b7f6ea31e61f857caa5256a32d28a1d0f6e384f2ff4ee93e351069faf4ca06e682c7772ff53415e29f9bf076afe00f042d6c57063e558670fa4b5f4ad4a5ca28277fb789ca3e943f0f0b828831ae871a61aae88b3db06daae7df9356e4ab6afb2e6d148d9c2c9866e82ff857c9465ae636b517037f6bd8c8c9fbdafd5c5cd5305f015d4988f4cd34e38aaee5380a0f942f1c4c4b055a15c86b5f0aede98b5dc3b82d22cae163a484927fcf868bb0203010001a382013430820130301d0603551d0e041604140d99bc282493fbc134a9dec9 EAP-Message = 0xc277c212c932dd1d3081c80603551d230481c03081bd80140d99bc282493fbc134a9dec9c277c212c932dd1da18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900dfa3486c6cb1f96e300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777 EAP-Message = 0x772e6578616d706c652e636f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13bece6a41ad39d66d296a9ad51 Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=74, length=161 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13bece6a41ad39d66d296a9ad51 EAP-Message = 0x020500061500 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x42ccd33da273d165fe94cb08485725f3 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 74 to 192.168.42.16 port 20008 EAP-Message = 0x01060349158000000b2b6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010095c6536dc2a04e2b2508da21065191ea4ac1db7167daca4192246690a1087cf7b070972df9b8a62dd10be43c06f198c9d93f202ddf39691311bb27695fc8cb744f2218ffcdd6514f03078e595fc01ec9141342a81ac921a7396227603d7b4048222a29f38340ba361aacac3328e77cfcd520580aca674883469e5864b345e32a1c98bd9e74ce6e87ff7ff9b7f48608950bc56fb7ccae1aacea92edf7227813fc87390cce2bd04eb09881045a687723577faf1ba909af2beccfb646d835549e3d91dfe871212054884517001aa21426 EAP-Message = 0x97169fd53671f7a1944d9e1b03930cd247c33f567e49e8863f67e7625498cd069c8ee8ccdca8afab008e5160bfee716745160301020d0c0002090080ef8cb67830bf429c4b9ad4714e77aaa750c3db460d39315a8c6fcdfa5c4d9f2d1759901723a901aecd8a5488b65b6dea6dc9385ff769702783b1111064e222d4c4f9e1220b2b1863ca2764bed79f4de5cc029915f46e71b2e247f3efbea696b49dfaa6e54ed45fc427fdf0f3bfbf2e234172f350331fd40471e5a02d72504cf3000102008087eb3efa9305dc25e738b3c809d212dab5f3c46db43e605ec4567303aa8093ccfeea15eda7cfc4712b1c68c7d3ec96888cbf4a4c03d281c79aa0936f EAP-Message = 0xb282b38f87453a8f1f69ac5d9a930f1eeda767e6ddad449c6861cbe35c298b50c7d441b61c3e2ee9c76bccfbd99dd2476f5b340d95d06bfcfd49fa202130ea4aa8a6b23801003ff1e095cfb2fa5e706f707cc797f7379f7ee8d100ec4982a7d6eab8aa54f310a400189223023d0256c3fdc439f337b0448c61395d36988f388ccf4412dcfa41a0d3a0231ab9a5a05a6cd69ff658a95f12fad83dfb574ee0e7ae96327a7016af2eb3ff58977c7b14eb69c54e6dd9dee36c68cbe46999d5a774145d7816779d57cc5e90a9511522cc12ad85c7121daf5ae18fa867a84ddec3073073df68f410f14ad281c8b205e61c8bb568c3888af010738fed1cc7a204 EAP-Message = 0xdfd2cfdc7e48153e9f26e843b4c240024c7ad447963ae8b06ac5168336be99df211d9e31230cd0e5a9f600e84f9925461873a7dfe4d317e1555cb2fed7cda3ba3e01ee384b163bcfde16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13bebe5a41ad39d66d296a9ad51 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=75, length=363 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13bebe5a41ad39d66d296a9ad51 EAP-Message = 0x020600d01580000000c616030100861000008200809912a4353193f80d27e13256d7d9599ccf053866a1045ddb003667bf8c59aee651274ca600ec4f67a6e313a4b6acf4569185891b4241389077605ea710a5778ea9ed92a2f57eb700ccf60893eac836e9e5325d13b301a372a48c1a1c4be8eb4ac65693e704dac202aba70652931e3861506c6e57d9906ee323b338389fc79bea14030100010116030100308441ff34f8ba50ea7526ab96a8fdb322634eca5488c3d17293ef299b6df1f08513f772136509bd5a84587c797a20bb04 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x2c4cc7284a3bb559e0a44801d10521d0 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 6 length 208 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 198 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 75 to 192.168.42.16 port 20008 EAP-Message = 0x0107004515800000003b14030100010116030100304da578a541d3aeeb31afc9111c8ebb1e9ed16c02a7abf8b1549bfef95e0318ce49e87f19939786fa9f1526990c3f4bb1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13beae4a41ad39d66d296a9ad51 Finished request 5. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=76, length=314 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13beae4a41ad39d66d296a9ad51 EAP-Message = 0x0207009f1580000000951703010090572132c3bb100f7e832eb74bf857e6384aeb34021c9b0745c39f235bde009d1b409dad39bafeff6260237341e10c9fd063090c63503c2dbc3b1553de553c1873d88539fabe38c250f1dd1c9d2df2e9b2806190c098f4ebfd4a769c7f65154a1e02a708e129096b8d3e8fb0c6e8fe9bab2b43d71fcf6ad14e4fd8e676cb351b0e233467b65cccdbc25281355b3bdc0b40 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x16f5285e0cd4416af24a8e8fd9ba000c # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 7 length 159 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 149 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "josef(a)testdomain.com" MS-CHAP-Challenge = 0x1bd3c8b9d05f712d166a28dc85032e3d MS-CHAP2-Response = 0xeb00e4aa1d015b333de96b68fa7258f868270000000000000000777975f5b969b39b08978f3ec81d1dd949960dde0f65af72 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "josef(a)testdomain.com" MS-CHAP-Challenge = 0x1bd3c8b9d05f712d166a28dc85032e3d MS-CHAP2-Response = 0xeb00e4aa1d015b333de96b68fa7258f868270000000000000000777975f5b969b39b08978f3ec81d1dd949960dde0f65af72 FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] = ok [suffix] Looking up realm "testdomain.com" for User-Name = "josef(a)testdomain.com" [suffix] No such realm "testdomain.com" ++[suffix] = noop ++update control { ++} # update control = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop [sql] expand: %{User-Name} -> josef(a)testdomain.com [sql] sql_set_user escaped user --> 'josef(a)testdomain.com' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT '111', '%{SQL-User-Name}', 'Cleartext-Password', (select GuestAuthRADIUS ('%{SQL-User-Name}', '%{Calling-Station-Id}' ,'%{Packet-Src-IP-Address}')), ':=' -> SELECT '111', 'josef(a)testdomain.com', 'Cleartext-Password', (select GuestAuthRADIUS ('josef(a)testdomain.com', '' ,'192.168.42.16')), ':=' rlm_sql_mysql: query: SELECT '111', 'josef(a)testdomain.com', 'Cleartext-Password', (select GuestAuthRADIUS ('josef(a)testdomain.com', '' ,'192.168.42.16')), ':=' [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'josef(a)testdomain.com' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'josef(a)testdomain.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'josef(a)testdomain.com' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = BINARY 'josef(a)testdomain.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = ok Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +group MS-CHAP { [mschap] Creating challenge hash with username: josef(a)testdomain.com [mschap] Client is using MS-CHAPv2 for josef(a)testdomain.com, we need NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] = reject +} # group MS-CHAP = reject Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> josef(a)testdomain.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated } # server inner-tunnel [ttls] Got tunneled reply code 3 MS-CHAP-Error = "\353E=691 R=1" [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 76 to 192.168.42.16 port 20008 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds.

2 1

just two questions
by Chris Knipe 12 Jun '14

12 Jun '14

Hi All, >From the radmin command, I can see the following radmin> stats socket 10.255.251.2 1812 requests 645589 responses 641483 accepts 359013 rejects 282470 challenges 0 dup 0 invalid 0 malformed 0 bad_authenticator 0 dropped 3110 unknown_types 0 last_packet 1402555332 elapsed.1us 0 elapsed.10us 0 elapsed.100us 0 elapsed.1ms 0 elapsed.10ms 229378 elapsed.100ms 384248 elapsed.1s 27768 elapsed.10s 86 Now given my specific application that I use Radius for, the elapsed times are OK for the majority of requests (the sub 100ms range is fine). I just have a quick question and a thought perhaps. Under what circumstances will FR "drop" a request (i.e. dropped 3110). Also, would it be possible to be able to get stats for the thread pool through radmin as well? I've been experiencing very weird, intermittent and seemingly random timeouts from FR, and after increasing (doubling) the size of my thread pool, most of my issues seemed to have gone away. Surely, those kind of stats in terms of the thread pool will not only be very helpful, but it will be absolutely beneficial in terms of debugging performance issues? Also as a last note, maybe something like a "slow query" log option can be added as well, where we can log auth/acct requests to a while in instances where FR takes longer than a specific amount of time to process? Say, if it takes longer than 100ms to process a request, log the request to a specific file? Not only will it again help to troubleshoot and isolate performance issues, but it could possibly also mean that the entire server does not need to be run in debug mode to identify requests which takes long to process. Just a thought, and just my 2c :-) Thanks, Chris.

3 3

Accented words
by Javier Granda 12 Jun '14

12 Jun '14

I'm running a radius server with multiple eap modules, depending on the CommonName will be redirected to one or another module, the CommonName is like this: "<APELLIDO>, <NOMBRE> (AUTENTICACIÓN)," the problem is that it seems that FR does not recognize the accented literal "AUTENTICACIÓN". The log says "Evaluating (User-Name == "<APELLIDO>, <NOMBRE> (AUTENTICACI") -> FALSE". Any idea how to fix it?

2 1

MSCHAPV2 authenticate including the suffix
by Dean Goldhill 12 Jun '14

12 Jun '14

Hello, I am using an SQL backend. The usernames are stored with the full username including a suffix 'user(a)domain.com I am trying to use TTLS/PEAP with MSCHAPV2 So I want freeradius to authenticate the full username, not the stripped username. I want it to match 'user(a)domain.com<mailto:user@domain.com>' not 'user' When trying to authenticate, it says: [mschap] ERROR: User-Name (user(a)domain.com<mailto:user@domain.com>) is not the same as MS-CHAP Name (user) from EAP-MSCHAPv2. If I set the username in the database to just 'user' and send that through in the supplicant, it works. But I want it to work with the full username including the suffix in the database. Is this possible? Thanks for your help Dean.

3 6