August 2014 - Freeradius-Users - lists.freeradius.org

freeradius on freebsd Segmentation Fault error
by Paul Manyika 06 Aug '14

06 Aug '14

2 1

multiattribute testing in git 1411859
by Franks Andy (RLZ) IT Systems Engineer 06 Aug '14

06 Aug '14

Hi, I saw the thread "multi-valued ldap-group attributes in rlm_cache" and figured that FR has been sorted to have multivalued attribute lookups in it now. I may be completely wrong but thought I'd test it anyway. I've got a simple case where I look up groups in ldap (AD 2008) mods-enabled/ldap [..] update { control:Ldap-MemberOf += 'memberOf' } .. and then a policy which takes the first value before the comma from the ldap group set that comes back: ldap-memberof-filter-regexp="^CN=([^,]*)" ldap-memberof-filter { update control { Tmp-String-0 !* ANY } foreach control:Ldap-MemberOf { if ("%{Foreach-Variable-0}" =~ /${policy.ldap-memberof-filter-regexp}/) { update control { Tmp-String-0 += "%{1}" } } } update control { Ldap-MemberOf !* ANY } foreach control:Tmp-String-0 { update control { Ldap-MemberOf += "%{Foreach-Variable-0}" } } update control { Tmp-String-0 !* ANY } } .. this works ok, and the "stripped" group name is processed and listed back to the original attribute name. I'd then expect to be able to add it to the cache as per Arran's suggestion from the thread where he says: >>update { >> control:ldap_xyz-Ldap-Group += &ldap_xyz-Ldap-Group[*] } >>So now, essentially: >>&ldap_xyz-Ldap-Group[0] and &ldap_xyz-Ldap-Group >>are synonymous in terms of update blocks, not matter what the operator is. So I do: update { control:Ldap-MemberOf += &control:Ldap-MemberOf[*] } .. but it either stops the server output when it's populating the cache - no segfault, just stops on that line and needs ctrl-c. Or it goes into a loop: (1) cache : Ldap-MemberOf += 'SSID_SaTH_Guest-Virgin-PRH' (1) cache : Ldap-MemberOf += 'SSID_SaTH_Guest-Virgin-PRH' (1) cache : Ldap-MemberOf += 'SSID_SaTH_Guest-Virgin-PRH' (1) cache : Ldap-MemberOf += 'SSID_SaTH_Guest-Virgin-PRH' (1) cache : Ldap-MemberOf += 'SSID_SaTH_Guest-Virgin-PRH' .. and also needs ctrl-c. Also, If I didn't fill the cache and had a section that said something like If (&control:Ldap-MemberOf [*] == "something") { .. Should it pick up all instances now in the check? It only seems to act on the first one still. I also tried "%{control:Ldap-MemberOf[*]", but that does the same. Again maybe my misinterpretation. I also briefly tried the ldap cache enabling and shared load balance redundant way of checking each ldap server (cache_attribute) but it only seems to pick up the first attribute still: Mods-enabled/ldap [..] Ldap ldap1 { Group { cacheable_name = yes cache_attribute = "Cached-Ldap-Group" [..] (1) ldap1 : Added control:Cached-Ldap-Group with value "SSID_SaTH_Guest-Virgin-PRH" (1) ldap1 : Added control:Cached-Ldap-Group with value "SSID_RSH_WiFi" (1) if (&control:Cached-Ldap-Group[*] == "SSID_RSH_WiFi") -> FALSE .. (1) if (&control:Cached-Ldap-Group[*] == "SSID_SaTH_Guest-Virgin-PRH") -> TRUE .. Maybe my testing is premature. Quite happy to keep testing if required! Thanks Andy

2 1

RE: radutmp
by Franks Andy (RLZ) IT Systems Engineer 06 Aug '14

06 Aug '14

Forgot to add to this - doing if (&control:Ldap-SpecificUTVid) { .. Fixes this, but loads of the stock files in policy.d also have this issue. Freeradius executable doesn't complain about using either if (attribute) or if (&attribute), so it's not obvious until you use radwho. I have changed a few, but there are quite a lot so I thought I'd confirm this first before changing them. Obviously if I'm pulling a new git then files may change and overwrite. Thanks Andy > Tue Aug 5 17:34:54 2014 : Error: if (control:Ldap-SpecificUTVid) { > > Tue Aug 5 17:34:54 2014 : Error: ^ Expected a module return code > > Have I missed something obvious? This always used to work ok. Probably needs an &control:Ldap-SpecificUTVid or the attribute hasn't been defined. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Simple 2 Server High Availability
by James Bensley 06 Aug '14

06 Aug '14

Hi All, I've had a scan of the archives and the Internet; I wish to deploy two new FreeRADIUS servers for a new network. I don't need fancy floating IPs like with LVS, incoming requests are load-balanced across both server IPs (but the session are "sicky" in that they always go to the same RADIUS once established). So all I need (I believe) is master-master MySQL replication so that authentication can be made against either RADIUS and updates like new users etc are replicated beween the two. For many people "master-master" is a bad phrase, is anyone doing this successfully? Post reading all I seem to need is the power of auto_increment_offset and auto_increment_increment to make my MySQL repliation safe from PK clashing issues. Can anyone who is doing this confirm what they have done or have you tried this and it failed terribly? If you have two servers for load-balacning how have you done it if you are using a different configuration? Cheers, James.

7 8

RE: radutmp
by Franks Andy (RLZ) IT Systems Engineer 06 Aug '14

06 Aug '14

Thanks Arran, Checked and it was using an old version of the radutmp config file for some reason, guess I just copied and pasted. Looks like what I put in was part of the comments field from that old version. Apologies Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Arran Cudbard-Bell Sent: 05 August 2014 18:07 To: FreeRadius users mailing list Subject: Re: radutmp On 5 Aug 2014, at 12:35, Franks Andy (RLZ) IT Systems Engineer <Andy.Franks(a)sath.nhs.uk> wrote: > Hi all, > > Doing some accounting with 3.1.0 (git #8be6046), and I've changed the radutmp module in a very small way to use stripped user name, and then user name if that isn't populated. > > i.e. in mods-available/radutmp: > > username = %{Stripped-User-Name:-%{User-Name}} > > during accounting it says : > > (225) radutmp : EXPAND /usr/local/var/log/radius/radutmp > > (225) radutmp : --> /usr/local/var/log/radius/radutmp > > (225) ERROR: radutmp : %{Stripped-User-Name:-%{User-Name}} > > (225) ERROR: radutmp : ^ Unknown module You've used the wrong syntax... should be: %{%{Stripped-User-Name}:-%{User-Name}} > > (225) [radutmp] = fail > > (225) } # accounting = fail > > Radwho also doesn't like me, all the policies I've written where I'm testing a control variable work fine in the FR main config but using radwho it complains that it's expecting a module return code : > > Tue Aug 5 17:34:54 2014 : Error: > /usr/local/etc/raddb/policy.d/vlan_override[4]: Parse error in > condition > > Tue Aug 5 17:34:54 2014 : Error: if (control:Ldap-SpecificUTVid) { > > Tue Aug 5 17:34:54 2014 : Error: ^ Expected a module return code > > Have I missed something obvious? This always used to work ok. Probably needs an &control:Ldap-SpecificUTVid or the attribute hasn't been defined. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

radutmp
by Franks Andy (RLZ) IT Systems Engineer 05 Aug '14

05 Aug '14

Hi all, Doing some accounting with 3.1.0 (git #8be6046), and I've changed the radutmp module in a very small way to use stripped user name, and then user name if that isn't populated. i.e. in mods-available/radutmp: username = %{Stripped-User-Name:-%{User-Name}} during accounting it says : (225) radutmp : EXPAND /usr/local/var/log/radius/radutmp (225) radutmp : --> /usr/local/var/log/radius/radutmp (225) ERROR: radutmp : %{Stripped-User-Name:-%{User-Name}} (225) ERROR: radutmp : ^ Unknown module (225) [radutmp] = fail (225) } # accounting = fail Radwho also doesn't like me, all the policies I've written where I'm testing a control variable work fine in the FR main config but using radwho it complains that it's expecting a module return code : Tue Aug 5 17:34:54 2014 : Error: /usr/local/etc/raddb/policy.d/vlan_override[4]: Parse error in condition Tue Aug 5 17:34:54 2014 : Error: if (control:Ldap-SpecificUTVid) { Tue Aug 5 17:34:54 2014 : Error: ^ Expected a module return code Have I missed something obvious? This always used to work ok. Thanks Andy

2 1

Disable radutmp/radwtmp ?
by Arnaud . 05 Aug '14

05 Aug '14

Hello, I use SQL to see my connections radius (table raddact etc.) The problem is that there are also entries in radutmp files / radwtmp which can cause a lot of bugs because I do not use them. It is a hotspot system with freeradius v 1.188.2.3. So to disable radutmp / radwtmp I must comment on certain lines in radiusd.conf. I commented that in accounting section (in bold): accounting { detail # daily # unix # radutmp # sradutmp sql # pgsql-voip } session { # radutmp sql } Is it good? By cons I also saw in radiusd.conf other things that appeal to radutmp as: radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp and radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } Should I also commented that? Or it is not necessary? When the radiusd.conf file will be good. Can I delete without radutmp radwtmp problem? Thank you for your help Regards

1 0

Fwd: warnings on users file
by rafa alfurqan 05 Aug '14

05 Aug '14

Hi all, again i've tried users configuration for a few times. i always failed when i'm trying these formats <1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org> 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0xBDA21CB60EF945da9A8BA56667B49027, EAP-Sim-SRES1 = 0x04d995bc, EAP-Sim-KC1 = 0xBBe0a7c68Aea1c00, EAP-Sim-Rand2 = 0x621F1DAC915B4dbf8A0842E88B97BBBE, EAP-Sim-SRES2 = 0xD9b5f235, EAP-Sim-KC2 = 0x33d1ae11914c4800, EAP-Sim-Rand3 = 0x6AD4284810DD42ca8A60A410F7746820, EAP-Sim-SRES3 = 0xB29eb39b, EAP-Sim-KC3 = 0x1E62ae2aA0a66400 but if i tried based on log, [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user " 1510101425520064(a)wlan.mnc101.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items so i do in one line, 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Sim-Rand1 = 0xBDA21CB60EF945da9A8BA56667B49027, EAP-Sim-SRES1 = 0x04d995bc, EAP-Sim-KC1 = 0xBBe0a7c68Aea1c00, EAP-Sim-Rand2 = 0x621F1DAC915B4dbf8A0842E88B97BBBE, EAP-Sim-SRES2 = 0xD9b5f235, EAP-Sim-KC2 = 0x33d1ae11914c4800, EAP-Sim-Rand3 = 0x6AD4284810DD42ca8A60A410F7746820, EAP-Sim-SRES3 = 0xB29eb39b, EAP-Sim-KC3 = 0x1E62ae2aA0a66400 i do the same when i follow this instruction http://lists.freeradius.org/pipermail/freeradius-users/2014-March/071123.ht… and the result is the warning is gone! so, it's okay to use that format? honestly i really new with freeradius, i'll appreciate for any helps. it's my log realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.0/24 { require_message_authenticator = no secret = "eap-sim" shortname = "eap-sim" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file �?x�??? modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to sub-module rlm_eap_sim Module: Instantiating eap-sim Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sim_files Module: Instantiating module "sim_files" from file /etc/freeradius/modules/sim_files sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 44186 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=151, length=259 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000038013135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 Message-Authenticator = 0xf77502a9d1ebb44e40a997fb52f4ad2a # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: authorized user/imsi 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] = ok [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 127 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 151 to 192.168.1.1 port 2049 EAP-Message = 0x017f0014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7659c0b27626d231a8579b0cb8f3e694 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=152, length=303 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x027f0058120a000007050000b7a1d8dbcbb4ebc3626016889cbfc212100100010e0e00333135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 State = 0x7659c0b27626d231a8579b0cb8f3e694 Message-Authenticator = 0x946a59632d3b96d1ba18ad68545b1eb6 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: authorized user/imsi 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] = ok [eap] EAP packet type response id 127 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x027f0058120a000007050000b7a1d8dbcbb4ebc3626016889cbfc212100100010e0e00333135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 State = 0x7659c0b27626d231a8579b0cb8f3e694 Message-Authenticator = 0x946a59632d3b96d1ba18ad68545b1eb6 EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000b7a1d8dbcbb4ebc3626016889cbfc212 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x3135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 [eap] Underlying EAP-Type set EAP ID to 128 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 152 to 192.168.1.1 port 2049 EAP-Message = 0x01800050120b0000010d0000bda21cb60ef945da9a8ba56667b49027621f1dac915b4dbf8a0842e88b97bbbe6ad4284810dd42ca8a60a410f77468200b05000066269155d778ece4a44df2898acaa745 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7659c0b277d9d231a8579b0cb8f3e694 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=153, length=243 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0280001c120b00000b0500004e314600d7dd8c432d922fe2e2f85e45 State = 0x7659c0b277d9d231a8579b0cb8f3e694 Message-Authenticator = 0xe28cce59df602509a3c3cfe9a99c5693 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: authorized user/imsi 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] = ok [eap] EAP packet type response id 128 length 28 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim MAC check succeed [eap] Underlying EAP-Type set EAP ID to 129 [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 153 to 192.168.1.1 port 2049 MS-MPPE-Recv-Key = 0x6e3afcc0cada4349d9e50c5b059f09a8561950974fc7a91ab4b085927b88ec4c MS-MPPE-Send-Key = 0xa1642e8992cf8c5937455aef07338c3b112ebbfcde037305d185b5367de606b0 EAP-Message = 0x03810004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" Finished request 2. Going to the next request Waking up in 3.9 seconds. Cleaning up request 0 ID 151 with timestamp +10 Cleaning up request 1 ID 152 with timestamp +11 Waking up in 1.0 seconds. Cleaning up request 2 ID 153 with timestamp +12 Ready to process requests. thank you

2 4

Adding a variable to Free Radius
by Nick Cameo 05 Aug '14

05 Aug '14

Hello Everyone, I would like to add a custom variable to get stored in our Free Radius DB. We have a functioning environment, and would like to know the suggested way of adding a new variable to the long list. The service is Session Initiation Protocol (SIP) Kind Regards, Nick from Toronto.

2 3

warnings on users file
by rafa alfurqan 04 Aug '14

04 Aug '14

Dear all, I'm trying to configure freeradius for eap-sim authenticatio. in my case my supplicant was success to connect the ap with eap-sim authentication, but in the freeradius log there's warnings on the users file. reading pairlist file /etc/freeradius/users [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user " 1510101425520064(a)wlan.mnc101.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user " 1510101425520064(a)wlan.mnc101.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user " 1510101425520064(a)wlan.mnc101.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items i have read anything about this but still i can't get fix this problem. what makes me confuse is why the supplicant could connect to the ap however i still got warnings on the log? this is my users configuration <1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org> 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0xBDA21CB60EF945da9A8BA56667B49027, EAP-Sim-SRES1 = 0x04d995bc, EAP-Sim-KC1 = 0xBBe0a7c68Aea1c00, EAP-Sim-Rand2 = 0x621F1DAC915B4dbf8A0842E88B97BBBE, EAP-Sim-SRES2 = 0xD9b5f235, EAP-Sim-KC2 = 0x33d1ae11914c4800, EAP-Sim-Rand3 = 0x6AD4284810DD42ca8A60A410F7746820, EAP-Sim-SRES3 = 0xB29eb39b, EAP-Sim-KC3 = 0x1E62ae2aA0a66400 if i have to follow the freeradius log, then i should do: 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org <http://lists.freeradius.org/mailman/listinfo/freeradius-users> EAP-Type := SIM EAP-Sim-Rand1 := <value>, EAP-Sim-SRES1 := <value>, EAP-Sim-KC1 := <value>, EAP-Sim-Rand2 := <value>, EAP-Sim-SRES2 := <value>, EAP-Sim-KC2 := <value>, EAP-Sim-Rand3 := <value>, EAP-Sim-SRES3 := <value>, EAP-Sim-KC3 := <value> but if i read the right format for the users file is like i did before, user check reply, reply, reply so, what i have to do for fix the warnings in users file? I'm using Ubuntu 10.04 desktop LTE, freeradius 2.2.5 for server, air-live for ap and blackberry 9320 for the supplicant. here's the log realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.0/24 { require_message_authenticator = no secret = "eap-sim" shortname = "eap-sim" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file �Bw�?B modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to sub-module rlm_eap_sim Module: Instantiating eap-sim Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sim_files Module: Instantiating module "sim_files" from file /etc/freeradius/modules/sim_files sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-Rand2" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-SRES2" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-KC2" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-Rand3" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-SRES3" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-KC3" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 47457 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=146, length=259 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000038013135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x3b7cec016f9e7d837e6c6fd3b4eb20ef # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org at line 204 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 226 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 146 to 192.168.1.1 port 2049 EAP-Message = 0x01e20014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2868fcaa2649d86228f5cbe0864a028 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=147, length=303 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02e20058120a000007050000e4e69b2af151f7b962b59341f135ec28100100010e0e00333135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 State = 0xa2868fcaa2649d86228f5cbe0864a028 Message-Authenticator = 0xdb930ab0a6fe572dc35ab89c7d62a32d # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 226 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org at line 204 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02e20058120a000007050000e4e69b2af151f7b962b59341f135ec28100100010e0e00333135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 State = 0xa2868fcaa2649d86228f5cbe0864a028 Message-Authenticator = 0xdb930ab0a6fe572dc35ab89c7d62a32d EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000e4e69b2af151f7b962b59341f135ec28 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x3135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 [eap] Underlying EAP-Type set EAP ID to 227 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 147 to 192.168.1.1 port 2049 EAP-Message = 0x01e30050120b0000010d0000bda21cb60ef945da9a8ba56667b49027621f1dac915b4dbf8a0842e88b97bbbe6ad4284810dd42ca8a60a410f77468200b05000054a12566dba5ea107876abb8ce63c51b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2868fcaa3659d86228f5cbe0864a028 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=148, length=243 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02e3001c120b00000b050000972372a41c5202143e5d4624453ee9a4 State = 0xa2868fcaa3659d86228f5cbe0864a028 Message-Authenticator = 0x84e6bf6274f86ccbbcf74dd0fd0ccdbc # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 227 length 28 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org at line 204 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim MAC check succeed [eap] Underlying EAP-Type set EAP ID to 228 [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 148 to 192.168.1.1 port 2049 MS-MPPE-Recv-Key = 0x4cf85cf91585ad5b0150cfcf0891da3c700186a1f529c33a77b858b7c2792425 MS-MPPE-Send-Key = 0x73cddffcb9182dcbdb08f9a1a75e96cfb11145d41b6a6734ddd8b2befa96c5c8 EAP-Message = 0x03e40004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" Finished request 2. Going to the next request Waking up in 3.8 seconds. Cleaning up request 0 ID 146 with timestamp +22 Cleaning up request 1 ID 147 with timestamp +22 Waking up in 1.0 seconds. Cleaning up request 2 ID 148 with timestamp +23 Ready to process requests.

1 0