September 2014 - Freeradius-Users - lists.freeradius.org

unlang test issue
by BALSIANOK, Peter 10 Sep '14

10 Sep '14

Hi, policy.d/Test policy_test { update reply { Framed-IP-Address := 0 Framed-IP-Netmask := 255.255.255.255 Cisco-AVPair += 'ip:dns-servers=10.10.10.10 10.10.10.11' Cisco-AVPair += 'lcp:interface-config=ip vrf forwarding OBU \nip unnumbered Loopback1' } if(<ipaddr>0.0.0.0 == &Framed-IP-Address) { update reply { Reply-Message := 'Some message' } reject } } I want to check value of the Framed-IP-Address attribute, but it seems the condition if(<ipaddr>0.0.0.0 == &Framed-IP-Address) ... does not work. Could you help me. radiusd: FreeRADIUS Version 3.0.5, for host i686-pc-linux-gnu, built on Sep 10 2014 at 06:41:34 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT .... Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 37055 Ready to process requests Received Access-Request Id 64 from 127.0.0.1:55574 to 127.0.0.1:1812 length 157 NAS-Port-Type = Virtual CHAP-Password = 0x0143d6783ff7ae79654650a37b8cfb1f9e Service-Type = Framed-User Called-Station-Id = 'SkyToll.OBU' Calling-Station-Id = '421945128228' Framed-Protocol = PPP CHAP-Challenge = 0xe5da1ef5c27f521eebbc9289ae5c9d34 User-Name = '231013950043478' Connect-Info = '8640000' NAS-IP-Address = 10.10.10.10 NAS-Port = 390 NAS-Port-Id = 'Uniq-Sess-ID390' (0) Received Access-Request packet from host 127.0.0.1 port 55574, id=64, length=157 (0) NAS-Port-Type = Virtual (0) CHAP-Password = 0x0143d6783ff7ae79654650a37b8cfb1f9e (0) Service-Type = Framed-User (0) Called-Station-Id = 'SkyToll.OBU' (0) Calling-Station-Id = '421945128228' (0) Framed-Protocol = PPP (0) CHAP-Challenge = 0xe5da1ef5c27f521eebbc9289ae5c9d34 (0) User-Name = '231013950043478' (0) Connect-Info = '8640000' (0) NAS-IP-Address = 10.10.10.10 (0) NAS-Port = 390 (0) NAS-Port-Id = 'Uniq-Sess-ID390' (0) # Executing section authorize from file ./sites-enabled/default (0) authorize { (0) policy_test policy_test { (0) update reply { (0) Framed-IP-Address := 0.0.0.0 (0) Framed-IP-Netmask := 255.255.255.255 (0) Cisco-AVPair += 'ip:dns-servers=10.10.10.10 10.10.10.11' (0) Cisco-AVPair += 'lcp:interface-config=ip vrf forwarding OBU \nip unnumbered Loopback1' (0) } # update reply = noop (0) if (<ipaddr>0.0.0.0 == &Framed-IP-Address) (0) if (<ipaddr>0.0.0.0 == &Framed-IP-Address) -> FALSE (0) } # policy_test policy_test = noop (0) [preprocess] = ok .... Peter Balsianok Voice & Data Services Operation Manager Orange Slovensko, a.s., ITN Dpt., Metodova 8, Bratislava, Slovak Republic main: +421 908 002405 mobile: +421 905 012405 e-mail: peter.balsianok(a)orange.com

2 1

perl xlat bug
by BALSIANOK, Peter 10 Sep '14

10 Sep '14

Hi, I have found bug in the rlm_perl module on the line 343 (parse & store params for perl function) Branch: 3.0.x %{perl:param} - does not work %{perl:param1 param2} - does not work Wrong: p = fmt; while ((q = strchr(p, ' '))) { XPUSHs(sv_2mortal(newSVpvn(p, p-q))); p = q + 1; } Possible solution: p = fmt; while ((q = strchr(p, ' '))) { XPUSHs(sv_2mortal(newSVpvn(p, q - p))); p = q + 1; } if (strlen(p) > 0) { XPUSHs(sv_2mortal(newSVpvn(p, strlen(p)))); } Peter

2 1

Re: Additional Huawei VSAs
by Iliya Peregoudov 10 Sep '14

10 Sep '14

Hello Arran I've received following notification from list manager: Your mail to 'Freeradius-Users' with the subject Re: Additional Huawei VSAs Is being held until the list moderator can review it for approval. The reason it is being held: Message body is too big: 3354205 bytes with a limit of 100 KB Either the message will get posted to the list, or you will receive notification of the moderator's decision. On 10.09.2014 11:57, Iliya Peregoudov wrote: > Hello Arran > > I have Equipment Customer account at the Huawei Technical Support > website. There are many document for different releases of Quidway ME60 > product. I've attached document for V600R008C00 release. RADIUS > attribute table is in Appendix A. > > > On 10.09.2014 7:31, Arran Cudbard-Bell wrote: >> Does anyone have definitions for the following Huawei VSA numbers? Or >> better yet, a comprehensive document showing all the current VSAs? >> >> Attribute numbers: >> 61, 62, 144, 145, 146, 147, 148, 149, 153, 159 >> >> 144-149 look like they might be queue counters. >> >> Thanks, >> -Arran >> >> Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> >> FreeRADIUS development team >> >> FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 >> >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >>

2 1

Is there a difference between radiusd -X vs Centos 6 startup radiusd
by Lord Felix 10 Sep '14

10 Sep '14

Hi, I verified that everything is working with radiusd -x command to see the debug code, but now I've got it to centos startup script but for some reason the code breaks? radiusd is running, but I cannot authenticate via freeradius anymore? Any suggestions on how to fix this? The difference I see in the startup script is that it includes -d $config_dir switch which points to /etc/raddb Is anyone experiencing this issue or had experienced this issue before? Thanks

2 1

Perl xlat
by BALSIANOK, Peter 10 Sep '14

10 Sep '14

Hi, I try to assign Framed-IP-Address via perl xlat, but freeradius stoped with panic. Pls, help me. policy.d/SkyToll: SkyToll { if(Called-Station-Id =~ /SkyToll\.OBU/) { if(User-name =~ /23101395(.*)/) { update reply { Framed-IP-Address := "%{perl: SkyToll %{1} %{Called-Station-Id} %{NAS-IP-Address}}" Framed-IP-Netmask := 255.255.255.255 Cisco-AVPair += 'ip:dns-servers=10.10.10.10 10.10.10.11' Cisco-AVPair += 'lcp:interface-config=ip vrf forwarding OBU \nip unnumbered Loopback1' } update control { Response-Packet-Type := Access-Accept } handled } else { update reply { Reply-Message := "Not valid IMSI" } reject } } } debug output: radiusd: FreeRADIUS Version 3.0.3, for host i686-pc-linux-gnu, built on Sep 1 2014 at 21:59:53 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /mnt/sdcard/software/freeradius-server-3.0.3/share/freeradius/dictionary including dictionary file /mnt/sdcard/software/freeradius-server-3.0.3/share/freeradius/dictionary.dhcp including dictionary file /mnt/sdcard/software/freeradius-server-3.0.3/share/freeradius/dictionary.vqp including dictionary file ./dictionary including configuration file ./radiusd.conf including configuration file ./proxy.conf including configuration file ./clients.conf including files in directory ./mods-enabled/ including configuration file ./mods-enabled/digest including configuration file ./mods-enabled/pap including configuration file ./mods-enabled/cache including configuration file ./mods-enabled/attr_filter including configuration file ./mods-enabled/chap including configuration file ./mods-enabled/linelog including configuration file ./mods-enabled/expr including configuration file ./mods-enabled/preprocess including configuration file ./mods-enabled/realm including configuration file ./mods-enabled/perl including configuration file ./mods-enabled/unpack including configuration file ./mods-enabled/files including configuration file ./mods-enabled/always including files in directory ./policy.d/ including configuration file ./policy.d/cui including configuration file ./policy.d/control including configuration file ./policy.d/filter including configuration file ./policy.d/eap including configuration file ./policy.d/nas including configuration file ./policy.d/SkyToll including configuration file ./policy.d/accounting including configuration file ./policy.d/dhcp including configuration file ./policy.d/operator-name including configuration file ./policy.d/canonicalization including files in directory ./sites-enabled/ including configuration file ./sites-enabled/default main { name = "radiusd" prefix = "/mnt/sdcard/software/freeradius-server-3.0.3" localstatedir = "/mnt/sdcard/software/freeradius-server-3.0.3/var" sbindir = "/mnt/sdcard/software/freeradius-server-3.0.3/sbin" logdir = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius" run_dir = "/mnt/sdcard/software/freeradius-server-3.0.3/var/run/radiusd" libdir = "/mnt/sdcard/software/freeradius-server-3.0.3/lib" radacctdir = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/mnt/sdcard/software/freeradius-server-3.0.3/var/run/radiusd/radiusd.pid" checkrad = "/mnt/sdcard/software/freeradius-server-3.0.3/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 0 status_server = yes allow_vulnerable_openssl = "yes" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { # Loaded module rlm_perl # Instantiating module "perl" from file ./mods-enabled/perl perl { filename = "./mods-config/perl/example.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_post_auth = "post_auth" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } rlm_perl (perl): parsing 'config' section... config { name = value sub-config { name = value of name from config.sub-config } } rlm_perl (perl): done parsing 'config'. } modules { # Loaded module rlm_digest # Instantiating module "digest" from file ./mods-enabled/digest # Loaded module rlm_pap # Instantiating module "pap" from file ./mods-enabled/pap pap { normalise = yes } # Loaded module rlm_cache # Instantiating module "cache" from file ./mods-enabled/cache cache { key = "%{User-Name}" ttl = 86400 max_entries = 16384 epoch = 0 add_stats = yes } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file ./mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "./mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file ./mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file ./mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "./mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file ./mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file ./mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "./mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file ./mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file ./mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "./mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file ./mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file ./mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "./mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file ./mods-config/attr_filter/accounting_response # Loaded module rlm_chap # Instantiating module "chap" from file ./mods-enabled/chap # Loaded module rlm_linelog # Instantiating module "linelog" from file ./mods-enabled/linelog linelog { filename = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file ./mods-enabled/linelog linelog log_accounting { filename = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expr # Instantiating module "expr" from file ./mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_preprocess # Instantiating module "preprocess" from file ./mods-enabled/preprocess preprocess { huntgroups = "./mods-config/preprocess/huntgroups" hints = "./mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file ./mods-config/preprocess/huntgroups reading pairlist file ./mods-config/preprocess/hints # Loaded module rlm_realm # Instantiating module "IPASS" from file ./mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file ./mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file ./mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file ./mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_unpack # Instantiating module "unpack" from file ./mods-enabled/unpack # Loaded module rlm_files # Instantiating module "files" from file ./mods-enabled/files files { filename = "./mods-config/files/authorize" usersfile = "./mods-config/files/authorize" acctusersfile = "./mods-config/files/accounting" preproxy_usersfile = "./mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file ./mods-config/files/authorize [./mods-config/files/authorize]:84 Cistron compatibility checks for entry dummy ... reading pairlist file ./mods-config/files/authorize [./mods-config/files/authorize]:84 Cistron compatibility checks for entry dummy ... reading pairlist file ./mods-config/files/accounting reading pairlist file ./mods-config/files/pre-proxy # Loaded module rlm_always # Instantiating module "reject" from file ./mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file ./mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file ./mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file ./mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file ./mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file ./mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file ./mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file ./mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file ./mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } } # modules radiusd: #### Loading Virtual Servers #### server { # from file ./radiusd.conf } # server server default { # from file ./sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 56160 Ready to process requests. Received Access-Request Id 107 from 127.0.0.1:39181 to 127.0.0.1:1812 length 157 NAS-Port-Type = Virtual CHAP-Password = 0x0143d6783ff7ae79654650a37b8cfb1f9e Service-Type = Framed-User Called-Station-Id = 'SkyToll.OBU' Calling-Station-Id = '421945128228' Framed-Protocol = PPP CHAP-Challenge = 0xe5da1ef5c27f521eebbc9289ae5c9d34 User-Name = '231013950043478' Connect-Info = '8640000' NAS-IP-Address = 85.237.224.1 NAS-Port = 390 NAS-Port-Id = 'Uniq-Sess-ID390' (0) # Executing section authorize from file ./sites-enabled/default (0) authorize { (0) verify_nas verify_nas { (0) if ( ! NAS-IP-Address ) (0) if ( ! NAS-IP-Address ) -> FALSE (0) } # verify_nas verify_nas = notfound (0) SkyToll SkyToll { (0) if (Called-Station-Id =~ /SkyToll\.OBU/) (0) if (Called-Station-Id =~ /SkyToll\.OBU/) -> TRUE (0) if (Called-Station-Id =~ /SkyToll\.OBU/) { (0) if (User-name =~ /23101395(.*)/) (0) if (User-name =~ /23101395(.*)/) -> TRUE (0) if (User-name =~ /23101395(.*)/) { (0) update reply { panic: memory wrap.

3 3

Re: eapol_test works but not wpa_supplicant with wired interface
by xxiao8 10 Sep '14

10 Sep '14

On 09/09/2014 02:29 PM, freeradius-users-request(a)lists.freeradius.org wrote: >> Message: 1 >> Date: Tue, 09 Sep 2014 12:51:44 -0500 >> From: xxiao8 <xxiao8(a)fosiao.com> >> To: freeradius-users(a)lists.freeradius.org >> Subject: eapol_test works but not wpa_supplicant with wired interface >> Message-ID: <540F3E30.50603(a)fosiao.com> >> Content-Type: text/plain; charset=windows-1252; format=flowed >> >> Hello, >> >> I just set up freeradius 2.1.2(default) on debian and try to do >> wpa_supplicant via wired interface to it. while eapol_test worked fine, >> when wpa_supplicant is used on the freeradius server side I can never >> see any incoming RADIUS packets(or any packets) at all. >> >> I'm running wpa_supplicant/eapol_test on a ubuntu 12.04 while the >> freeradius is hosted on a VM/debian-wheezy in the same bridged network. >> >> Am I missing something basic? all logs are below. >> >> Thanks, >> xxiao >> >> ==========config file used================== >> $cat ttls-mschapv2.conf >> ctrl_interface=/var/run/wpa_supplicant >> ap_scan=0 >> fast_reauth=1 >> network={ >> key_mgmt=IEEE8021X >> identity="bob" >> password="hello" >> eapol_flags=0 >> eap=TTLS >> anonymous_identity="anonymous" >> phase2="auth=MSCHAPV2" >> } >> >> ===============eapol_test works==================== >> $sudo eapol_test -c ttls-mschapv2.conf -a192.168.1.132 -p1812 >> -stesting123 -r2 >> RADIUS packet matching with station >> MS-MPPE-Send-Key (sign) - hexdump(len=32): 0e 41 0d 3b 24 75 5f 43 08 cc >> 1c 63 c6 f8 21 d5 9c 2f f2 89 dd ab d9 d9 31 18 39 00 16 c3 92 86 >> MS-MPPE-Recv-Key (crypt) - hexdump(len=32): e2 9b ce e2 c6 69 e9 d9 c0 >> 37 10 75 58 53 ba 51 a1 a4 38 b8 86 3d dc f5 6d 71 35 b1 18 a8 53 0f >> decapsulated EAP packet (code=3 id=6 len=4) from RADIUS server: EAP Success >> EAPOL: Received EAP-Packet frame >> EAPOL: SUPP_BE entering state REQUEST >> EAPOL: getSuppRsp >> EAP: EAP entering state RECEIVED >> EAP: Received EAP-Success >> EAP: Status notification: completion (param=success) >> EAP: EAP entering state SUCCESS >> CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully >> EAPOL: SUPP_PAE entering state AUTHENTICATED >> EAPOL: SUPP_BE entering state RECEIVE >> EAPOL: SUPP_BE entering state SUCCESS >> EAPOL: SUPP_BE entering state IDLE >> eapol_sm_cb: result=1 >> EAPOL: Successfully fetched key (len=32) >> PMK from EAPOL - hexdump(len=32): e2 9b ce e2 c6 69 e9 d9 c0 37 10 75 58 >> 53 ba 51 a1 a4 38 b8 86 3d dc f5 6d 71 35 b1 18 a8 53 0f >> No EAP-Key-Name received from server >> EAP: deinitialize previously used EAP method (21, TTLS) at EAP deinit >> ENGINE: engine deinit >> MPPE keys OK: 3 mismatch: 0 >> SUCCESS >> >> >> ======wpa_supplicant wired does not work=========== >> $ sudo wpa_supplicant -Dwired -ieth0 -cttls-mschapv2.conf -d >> wpa_supplicant v2.2 >> random: Trying to read entropy from /dev/random >> Successfully initialized wpa_supplicant >> Initializing interface 'eth0' conf 'ttls-mschapv2.conf' driver 'wired' >> ctrl_interface 'N/A' bridge 'N/A' >> Configuration file 'ttls-mschapv2.conf' -> '/tmp/ttls-mschapv2.conf' >> Reading configuration file '/tmp/ttls-mschapv2.conf' >> ctrl_interface='/var/run/wpa_supplicant' >> ap_scan=0 >> fast_reauth=1 >> Priority group 0 >> id=0 ssid='' >> wpa_driver_wired_init: Added multicast membership with packet socket >> Add interface eth0 to a new radio N/A >> eth0: Own MAC address: 18:03:73:e0:ba:f1 >> eth0: RSN: flushing PMKID list in the driver >> eth0: Setting scan request: 0.100000 sec >> EAPOL: SUPP_PAE entering state DISCONNECTED >> EAPOL: Supplicant port status: Unauthorized >> EAPOL: KEY_RX entering state NO_KEY_RECEIVE >> EAPOL: SUPP_BE entering state INITIALIZE >> EAP: EAP entering state DISABLED >> eth0: Added interface eth0 >> eth0: State: DISCONNECTED -> DISCONNECTED >> random: Got 20/20 bytes from /dev/random >> EAPOL: External notification - EAP success=0 >> EAPOL: External notification - EAP fail=0 >> EAPOL: External notification - portControl=Auto >> eth0: Already associated with a configured network - generating >> associated event >> eth0: Event ASSOC (0) received >> eth0: Association info event >> eth0: State: DISCONNECTED -> ASSOCIATED >> eth0: Associated to a new BSS: BSSID=01:80:c2:00:00:03 >> eth0: Select network based on association information >> eth0: Network configuration found for the current AP >> eth0: WPA: clearing AP WPA IE >> eth0: WPA: clearing AP RSN IE >> eth0: WPA: clearing own WPA/RSN IE >> eth0: Failed to get scan results >> EAPOL: External notification - EAP success=0 >> EAPOL: External notification - EAP fail=0 >> EAPOL: External notification - portControl=Auto >> eth0: Associated with 01:80:c2:00:00:03 >> eth0: WPA: Association event - clear replay counter >> eth0: WPA: Clear old PTK >> EAPOL: External notification - portEnabled=0 >> EAPOL: External notification - portValid=0 >> EAPOL: External notification - portEnabled=1 >> EAPOL: SUPP_PAE entering state CONNECTING >> EAPOL: SUPP_BE entering state IDLE >> EAP: EAP entering state INITIALIZE >> EAP: EAP entering state IDLE >> eth0: Cancelling scan request >> EAPOL: startWhen --> 0 >> EAPOL: SUPP_PAE entering state CONNECTING >> EAPOL: txStart >> TX EAPOL: dst=01:80:c2:00:00:03 >> EAPOL: startWhen --> 0 >> EAPOL: SUPP_PAE entering state CONNECTING >> EAPOL: txStart >> TX EAPOL: dst=01:80:c2:00:00:03 >> EAPOL: idleWhile --> 0 >> EAP: EAP entering state FAILURE >> eth0: CTRL-EVENT-EAP-FAILURE EAP authentication failed >> EAPOL: SUPP_PAE entering state AUTHENTICATING >> EAPOL: SUPP_BE entering state FAIL >> EAPOL: SUPP_PAE entering state HELD >> EAPOL: Supplicant port status: Unauthorized >> EAPOL: SUPP_BE entering state IDLE >> EAPOL authentication completed - result=FAILURE >> ^Ceth0: Removing interface eth0 >> eth0: Request to deauthenticate - bssid=01:80:c2:00:00:03 >> pending_bssid=00:00:00:00:00:00 reason=3 state=ASSOCIATED >> eth0: Event DEAUTH (12) received >> eth0: Deauthentication notification >> eth0: * reason 3 (locally generated) >> Deauthentication frame IE(s) - hexdump(len=0): [NULL] >> eth0: CTRL-EVENT-DISCONNECTED bssid=01:80:c2:00:00:03 reason=3 >> locally_generated=1 >> eth0: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="" auth_failures=1 >> duration=10 reason=AUTH_FAILED >> eth0: Auto connect disabled: do not try to re-connect >> eth0: Ignore connection failure indication since interface has been put >> into disconnected state >> eth0: State: ASSOCIATED -> DISCONNECTED >> EAPOL: External notification - portEnabled=0 >> EAPOL: SUPP_PAE entering state DISCONNECTED >> EAPOL: Supplicant port status: Unauthorized >> EAPOL: SUPP_BE entering state INITIALIZE >> EAP: EAP entering state DISABLED >> EAPOL: External notification - portValid=0 >> eth0: State: DISCONNECTED -> DISCONNECTED >> EAPOL: External notification - portEnabled=0 >> EAPOL: External notification - portValid=0 >> eth0: Cancelling scan request >> eth0: Cancelling authentication timeout >> Remove interface eth0 from radio >> Remove radio >> eth0: CTRL-EVENT-TERMINATING >> >> >> >> Message: 3 >> Date: Tue, 9 Sep 2014 18:18:00 +0000 >> From: A.L.M.Buxey(a)lboro.ac.uk >> To: FreeRadius users mailing list >> <freeradius-users(a)lists.freeradius.org> >> Subject: Re: eapol_test works but not wpa_supplicant with wired >> interface >> Message-ID: <20140909181800.GD12554(a)lboro.ac.uk> >> Content-Type: text/plain; charset=us-ascii >> >> hi, >> >> >> you need to look at your freeradius server in debug mode to see whats going on...and >> verify that the packets are being received by the server (eg by using 'tcpdump' tool or such >> looking for udp port 1812). you also need to eg check your freeradius server to ensure >> that the firewall isnt blocking said UDP 1812 port (eapol_test locally bypasses this....) >> and finally you need to verify your switch that you are doing 802.1X on to ensure that its >> sending auths to the right box...you should be able to do debug on the switch too.... >> >> alan >> >> >> ------------------------------ >> > Yes I did run freeradius -X -f and it receives lots of info from > eapol_test successfully, when I ran wpa_supplicant as described above I > received nothing at all either over 'freeradius -X -f' or from > 'tcpdump', it's like somehow wpa_supplicant is not sending out anything > to the multicast MAC? I made sure iptable is fully disabled, plus > eapol_test is running from the same machine where I ran > wpa_supplicant(non-localhost that is). > > Thanks! > xxiao > > I forgot to mention that I'm running against freeradius directly, from a Linux PC on the local LAN, so there is no switch involved at all, could this be a problem? can WPA_SUPPLICANT talk with freeradius _directly_? Thanks, xxiao

2 1

Additional Huawei VSAs
by Arran Cudbard-Bell 09 Sep '14

09 Sep '14

Does anyone have definitions for the following Huawei VSA numbers? Or better yet, a comprehensive document showing all the current VSAs? Attribute numbers: 61, 62, 144, 145, 146, 147, 148, 149, 153, 159 144-149 look like they might be queue counters. Thanks, -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Re: eapol_test works but not wpa_supplicant with wired interface
by xxiao8 09 Sep '14

09 Sep '14

On 09/09/2014 02:29 PM, freeradius-users-request(a)lists.freeradius.org wrote: > > Message: 1 > Date: Tue, 09 Sep 2014 12:51:44 -0500 > From: xxiao8 <xxiao8(a)fosiao.com> > To: freeradius-users(a)lists.freeradius.org > Subject: eapol_test works but not wpa_supplicant with wired interface > Message-ID: <540F3E30.50603(a)fosiao.com> > Content-Type: text/plain; charset=windows-1252; format=flowed > > Hello, > > I just set up freeradius 2.1.2(default) on debian and try to do > wpa_supplicant via wired interface to it. while eapol_test worked fine, > when wpa_supplicant is used on the freeradius server side I can never > see any incoming RADIUS packets(or any packets) at all. > > I'm running wpa_supplicant/eapol_test on a ubuntu 12.04 while the > freeradius is hosted on a VM/debian-wheezy in the same bridged network. > > Am I missing something basic? all logs are below. > > Thanks, > xxiao > > ==========config file used================== > $cat ttls-mschapv2.conf > ctrl_interface=/var/run/wpa_supplicant > ap_scan=0 > fast_reauth=1 > network={ > key_mgmt=IEEE8021X > identity="bob" > password="hello" > eapol_flags=0 > eap=TTLS > anonymous_identity="anonymous" > phase2="auth=MSCHAPV2" > } > > ===============eapol_test works==================== > $sudo eapol_test -c ttls-mschapv2.conf -a192.168.1.132 -p1812 > -stesting123 -r2 > RADIUS packet matching with station > MS-MPPE-Send-Key (sign) - hexdump(len=32): 0e 41 0d 3b 24 75 5f 43 08 cc > 1c 63 c6 f8 21 d5 9c 2f f2 89 dd ab d9 d9 31 18 39 00 16 c3 92 86 > MS-MPPE-Recv-Key (crypt) - hexdump(len=32): e2 9b ce e2 c6 69 e9 d9 c0 > 37 10 75 58 53 ba 51 a1 a4 38 b8 86 3d dc f5 6d 71 35 b1 18 a8 53 0f > decapsulated EAP packet (code=3 id=6 len=4) from RADIUS server: EAP Success > EAPOL: Received EAP-Packet frame > EAPOL: SUPP_BE entering state REQUEST > EAPOL: getSuppRsp > EAP: EAP entering state RECEIVED > EAP: Received EAP-Success > EAP: Status notification: completion (param=success) > EAP: EAP entering state SUCCESS > CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully > EAPOL: SUPP_PAE entering state AUTHENTICATED > EAPOL: SUPP_BE entering state RECEIVE > EAPOL: SUPP_BE entering state SUCCESS > EAPOL: SUPP_BE entering state IDLE > eapol_sm_cb: result=1 > EAPOL: Successfully fetched key (len=32) > PMK from EAPOL - hexdump(len=32): e2 9b ce e2 c6 69 e9 d9 c0 37 10 75 58 > 53 ba 51 a1 a4 38 b8 86 3d dc f5 6d 71 35 b1 18 a8 53 0f > No EAP-Key-Name received from server > EAP: deinitialize previously used EAP method (21, TTLS) at EAP deinit > ENGINE: engine deinit > MPPE keys OK: 3 mismatch: 0 > SUCCESS > > > ======wpa_supplicant wired does not work=========== > $ sudo wpa_supplicant -Dwired -ieth0 -cttls-mschapv2.conf -d > wpa_supplicant v2.2 > random: Trying to read entropy from /dev/random > Successfully initialized wpa_supplicant > Initializing interface 'eth0' conf 'ttls-mschapv2.conf' driver 'wired' > ctrl_interface 'N/A' bridge 'N/A' > Configuration file 'ttls-mschapv2.conf' -> '/tmp/ttls-mschapv2.conf' > Reading configuration file '/tmp/ttls-mschapv2.conf' > ctrl_interface='/var/run/wpa_supplicant' > ap_scan=0 > fast_reauth=1 > Priority group 0 > id=0 ssid='' > wpa_driver_wired_init: Added multicast membership with packet socket > Add interface eth0 to a new radio N/A > eth0: Own MAC address: 18:03:73:e0:ba:f1 > eth0: RSN: flushing PMKID list in the driver > eth0: Setting scan request: 0.100000 sec > EAPOL: SUPP_PAE entering state DISCONNECTED > EAPOL: Supplicant port status: Unauthorized > EAPOL: KEY_RX entering state NO_KEY_RECEIVE > EAPOL: SUPP_BE entering state INITIALIZE > EAP: EAP entering state DISABLED > eth0: Added interface eth0 > eth0: State: DISCONNECTED -> DISCONNECTED > random: Got 20/20 bytes from /dev/random > EAPOL: External notification - EAP success=0 > EAPOL: External notification - EAP fail=0 > EAPOL: External notification - portControl=Auto > eth0: Already associated with a configured network - generating > associated event > eth0: Event ASSOC (0) received > eth0: Association info event > eth0: State: DISCONNECTED -> ASSOCIATED > eth0: Associated to a new BSS: BSSID=01:80:c2:00:00:03 > eth0: Select network based on association information > eth0: Network configuration found for the current AP > eth0: WPA: clearing AP WPA IE > eth0: WPA: clearing AP RSN IE > eth0: WPA: clearing own WPA/RSN IE > eth0: Failed to get scan results > EAPOL: External notification - EAP success=0 > EAPOL: External notification - EAP fail=0 > EAPOL: External notification - portControl=Auto > eth0: Associated with 01:80:c2:00:00:03 > eth0: WPA: Association event - clear replay counter > eth0: WPA: Clear old PTK > EAPOL: External notification - portEnabled=0 > EAPOL: External notification - portValid=0 > EAPOL: External notification - portEnabled=1 > EAPOL: SUPP_PAE entering state CONNECTING > EAPOL: SUPP_BE entering state IDLE > EAP: EAP entering state INITIALIZE > EAP: EAP entering state IDLE > eth0: Cancelling scan request > EAPOL: startWhen --> 0 > EAPOL: SUPP_PAE entering state CONNECTING > EAPOL: txStart > TX EAPOL: dst=01:80:c2:00:00:03 > EAPOL: startWhen --> 0 > EAPOL: SUPP_PAE entering state CONNECTING > EAPOL: txStart > TX EAPOL: dst=01:80:c2:00:00:03 > EAPOL: idleWhile --> 0 > EAP: EAP entering state FAILURE > eth0: CTRL-EVENT-EAP-FAILURE EAP authentication failed > EAPOL: SUPP_PAE entering state AUTHENTICATING > EAPOL: SUPP_BE entering state FAIL > EAPOL: SUPP_PAE entering state HELD > EAPOL: Supplicant port status: Unauthorized > EAPOL: SUPP_BE entering state IDLE > EAPOL authentication completed - result=FAILURE > ^Ceth0: Removing interface eth0 > eth0: Request to deauthenticate - bssid=01:80:c2:00:00:03 > pending_bssid=00:00:00:00:00:00 reason=3 state=ASSOCIATED > eth0: Event DEAUTH (12) received > eth0: Deauthentication notification > eth0: * reason 3 (locally generated) > Deauthentication frame IE(s) - hexdump(len=0): [NULL] > eth0: CTRL-EVENT-DISCONNECTED bssid=01:80:c2:00:00:03 reason=3 > locally_generated=1 > eth0: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="" auth_failures=1 > duration=10 reason=AUTH_FAILED > eth0: Auto connect disabled: do not try to re-connect > eth0: Ignore connection failure indication since interface has been put > into disconnected state > eth0: State: ASSOCIATED -> DISCONNECTED > EAPOL: External notification - portEnabled=0 > EAPOL: SUPP_PAE entering state DISCONNECTED > EAPOL: Supplicant port status: Unauthorized > EAPOL: SUPP_BE entering state INITIALIZE > EAP: EAP entering state DISABLED > EAPOL: External notification - portValid=0 > eth0: State: DISCONNECTED -> DISCONNECTED > EAPOL: External notification - portEnabled=0 > EAPOL: External notification - portValid=0 > eth0: Cancelling scan request > eth0: Cancelling authentication timeout > Remove interface eth0 from radio > Remove radio > eth0: CTRL-EVENT-TERMINATING > > > > Message: 3 > Date: Tue, 9 Sep 2014 18:18:00 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: eapol_test works but not wpa_supplicant with wired > interface > Message-ID: <20140909181800.GD12554(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > hi, > > > you need to look at your freeradius server in debug mode to see whats going on...and > verify that the packets are being received by the server (eg by using 'tcpdump' tool or such > looking for udp port 1812). you also need to eg check your freeradius server to ensure > that the firewall isnt blocking said UDP 1812 port (eapol_test locally bypasses this....) > and finally you need to verify your switch that you are doing 802.1X on to ensure that its > sending auths to the right box...you should be able to do debug on the switch too.... > > alan > > > ------------------------------ > Yes I did run freeradius -X -f and it receives lots of info from eapol_test successfully, when I ran wpa_supplicant as described above I received nothing at all either over 'freeradius -X -f' or from 'tcpdump', it's like somehow wpa_supplicant is not sending out anything to the multicast MAC? I made sure iptable is fully disabled, plus eapol_test is running from the same machine where I ran wpa_supplicant(non-localhost that is). Thanks! xxiao

1 0

Re: Freeradius-Users Digest, Vol 113, Issue 26
by Rui Ribeiro 09 Sep '14

09 Sep '14

Hi Felix, The best approach is to use the LDAP groups to select your VLAN. As you are starting, I would also advise to upgrade to 2.2.5 or better yet, version 3. It would be better too, if you create a group for Wifi access instead of using the administrator group. You can select write the logic for the VLAN in the users file, or with unlang, if you search the arquive list you will find plenty of examples. Taken from the end of my post-auth, inner-tunnel. I still advise you to peruse the arquive, to understand it better. if ( Ldap-Group == "staff" ) { if (!(Operator-Name)) { update reply { User-Name := "%{request:User-Name}" Service-Type := "Framed-User" Framed-MTU := 1300 Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := "7" Reply-Message := "staff VLAN" } } } elsif ( Ldap-Group == "student" ) { if (!(Operator-Name)) { update reply { User-Name := "%{request:User-Name}" Service-Type := "Framed-User" Framed-MTU := 1300 Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := "9" Reply-Message := "student VLAN" } } } else { reject } Regards, Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > > Message: 2 > Date: Mon, 8 Sep 2014 04:14:31 -0400 > From: Lord Felix <felix107(a)msn.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: How-To for setting up ldap for Active Directory > Message-ID: <BAY172-W14882D57281A381E1D91438DC10(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Everyone, > > I'm new to freeRadius and I've been reading some of the mailing list > e-mails. > > I've got freeRadius with Cento 6 which is version 2.1.12 installed. > > So I've followed the instructions for getting freeRadius working ntlm_auth > with Windows 2012 Active Directory, based on the link below: > http://deployingradius.com/documents/configuration/active_directory.html > > Everything works great! > > The only issue is now I need Dynamic Vlan working and I also need to look > up mac address via from a mssql database to validate the user to allow > access to the network. > > After reading more about ntlm_auth, it will only respond to true or false > and this method doesn't really help with want I want to accomplish. > > What I need to do is based on what group the user belongs to, they are > assigned to that specific vlan. i.e. if you are a staff you go to VLAN 7 > and if you are a student you go to vlan 9. > > Is there any How-To guide for setting up ldap for Active Directory just > like the link above? > > I've tried to setup the ldap module and I'm running into issues. > > This is how my ldap config looks like: > > ldap { > server = "xxx.xxx.xxx" > basedn = "dc=xxx,dc=xxx,dc=xxx" > filter = > (&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(objectClass=person)) > groupmembership_attribute = "Administrators" > ldap_connections_number = 5 > timeout = 40 > timelimit = 30 > net_timeout = 10 > tls { > start_tls = no > } > dictionary_mapping = ${confdir}/ldap.attrmap > edir_account_policy_check = no > groupname_attribute = cn > groupmembership_filter = > "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" > groupmembership_attribute = memberOf > chase_referrals = yes > rebind = yes > ldap_debug = 0x0028 > keepalive { > idle = 60 > probes = 3 > interval = 3 > } > } > > > Here is my debug info, and I know it's not working, because I don't even > see it trying to contact the radius server, which is why I'm asking if > there is quick HowTo: > rad_recv: Access-Request packet from host 127.0.0.1 port 33583, id=125, > length=74 > User-Name = "xxxxxxx" > User-Password = "xxxxxxx" > NAS-IP-Address = xx.xx.xxxx > NAS-Port = 0 > Message-Authenticator = 0x1c451a3ee1cd4caabec9e764c4006d2b > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > ++[digest] returns noop > [suffix] No '@' in User-Name = "xxxxxx", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop > ++[files] returns noop > [sql] expand: %{User-Name} -> xxxx > [sql] sql_set_user escaped user --> 'xxxxxx' > rlm_sql (sql): Reserving sql socket id: 3 > [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE > Username = '%{SQL-User-Name}' ORDER BY id -> SELECT > id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'username' > ORDER BY id > [sql] expand: SELECT groupname FROM radusergroup WHERE username = > '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup > WHERE username = 'xxxxxx' ORDER BY priority > rlm_sql (sql): Released sql socket id: 3 > [sql] User username not found > ++[sql] returns notfound > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this. > ++[pap] returns noop > ERROR: No authenticate method (Auth-Type) found for the request: Rejecting > the user > Failed to authenticate the user. > Using Post-Auth-Type Reject > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> xxxxx > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 1 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 1 > Sending Access-Reject of id 125 to 127.0.0.1 port 33583 > Waking up in 4.9 seconds. > Cleaning up request 1 ID 125 with timestamp +2007 > Ready to process requests. > > > Someone also posted that they can get ntlm_auth working with groups and > you need to chat the stuff around? It would be great if someone can provide > a how on this to work with dynamic vlan. > > Any help would be greatly appreciated. > > Thanks > > -----

2 2

eapol_test works but not wpa_supplicant with wired interface
by xxiao8 09 Sep '14

09 Sep '14

Hello, I just set up freeradius 2.1.2(default) on debian and try to do wpa_supplicant via wired interface to it. while eapol_test worked fine, when wpa_supplicant is used on the freeradius server side I can never see any incoming RADIUS packets(or any packets) at all. I'm running wpa_supplicant/eapol_test on a ubuntu 12.04 while the freeradius is hosted on a VM/debian-wheezy in the same bridged network. Am I missing something basic? all logs are below. Thanks, xxiao ==========config file used================== $cat ttls-mschapv2.conf ctrl_interface=/var/run/wpa_supplicant ap_scan=0 fast_reauth=1 network={ key_mgmt=IEEE8021X identity="bob" password="hello" eapol_flags=0 eap=TTLS anonymous_identity="anonymous" phase2="auth=MSCHAPV2" } ===============eapol_test works==================== $sudo eapol_test -c ttls-mschapv2.conf -a192.168.1.132 -p1812 -stesting123 -r2 RADIUS packet matching with station MS-MPPE-Send-Key (sign) - hexdump(len=32): 0e 41 0d 3b 24 75 5f 43 08 cc 1c 63 c6 f8 21 d5 9c 2f f2 89 dd ab d9 d9 31 18 39 00 16 c3 92 86 MS-MPPE-Recv-Key (crypt) - hexdump(len=32): e2 9b ce e2 c6 69 e9 d9 c0 37 10 75 58 53 ba 51 a1 a4 38 b8 86 3d dc f5 6d 71 35 b1 18 a8 53 0f decapsulated EAP packet (code=3 id=6 len=4) from RADIUS server: EAP Success EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: Status notification: completion (param=success) EAP: EAP entering state SUCCESS CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully EAPOL: SUPP_PAE entering state AUTHENTICATED EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state SUCCESS EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: result=1 EAPOL: Successfully fetched key (len=32) PMK from EAPOL - hexdump(len=32): e2 9b ce e2 c6 69 e9 d9 c0 37 10 75 58 53 ba 51 a1 a4 38 b8 86 3d dc f5 6d 71 35 b1 18 a8 53 0f No EAP-Key-Name received from server EAP: deinitialize previously used EAP method (21, TTLS) at EAP deinit ENGINE: engine deinit MPPE keys OK: 3 mismatch: 0 SUCCESS ======wpa_supplicant wired does not work=========== $ sudo wpa_supplicant -Dwired -ieth0 -cttls-mschapv2.conf -d wpa_supplicant v2.2 random: Trying to read entropy from /dev/random Successfully initialized wpa_supplicant Initializing interface 'eth0' conf 'ttls-mschapv2.conf' driver 'wired' ctrl_interface 'N/A' bridge 'N/A' Configuration file 'ttls-mschapv2.conf' -> '/tmp/ttls-mschapv2.conf' Reading configuration file '/tmp/ttls-mschapv2.conf' ctrl_interface='/var/run/wpa_supplicant' ap_scan=0 fast_reauth=1 Priority group 0 id=0 ssid='' wpa_driver_wired_init: Added multicast membership with packet socket Add interface eth0 to a new radio N/A eth0: Own MAC address: 18:03:73:e0:ba:f1 eth0: RSN: flushing PMKID list in the driver eth0: Setting scan request: 0.100000 sec EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: Supplicant port status: Unauthorized EAPOL: KEY_RX entering state NO_KEY_RECEIVE EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED eth0: Added interface eth0 eth0: State: DISCONNECTED -> DISCONNECTED random: Got 20/20 bytes from /dev/random EAPOL: External notification - EAP success=0 EAPOL: External notification - EAP fail=0 EAPOL: External notification - portControl=Auto eth0: Already associated with a configured network - generating associated event eth0: Event ASSOC (0) received eth0: Association info event eth0: State: DISCONNECTED -> ASSOCIATED eth0: Associated to a new BSS: BSSID=01:80:c2:00:00:03 eth0: Select network based on association information eth0: Network configuration found for the current AP eth0: WPA: clearing AP WPA IE eth0: WPA: clearing AP RSN IE eth0: WPA: clearing own WPA/RSN IE eth0: Failed to get scan results EAPOL: External notification - EAP success=0 EAPOL: External notification - EAP fail=0 EAPOL: External notification - portControl=Auto eth0: Associated with 01:80:c2:00:00:03 eth0: WPA: Association event - clear replay counter eth0: WPA: Clear old PTK EAPOL: External notification - portEnabled=0 EAPOL: External notification - portValid=0 EAPOL: External notification - portEnabled=1 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE eth0: Cancelling scan request EAPOL: startWhen --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: txStart TX EAPOL: dst=01:80:c2:00:00:03 EAPOL: startWhen --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: txStart TX EAPOL: dst=01:80:c2:00:00:03 EAPOL: idleWhile --> 0 EAP: EAP entering state FAILURE eth0: CTRL-EVENT-EAP-FAILURE EAP authentication failed EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: Supplicant port status: Unauthorized EAPOL: SUPP_BE entering state IDLE EAPOL authentication completed - result=FAILURE ^Ceth0: Removing interface eth0 eth0: Request to deauthenticate - bssid=01:80:c2:00:00:03 pending_bssid=00:00:00:00:00:00 reason=3 state=ASSOCIATED eth0: Event DEAUTH (12) received eth0: Deauthentication notification eth0: * reason 3 (locally generated) Deauthentication frame IE(s) - hexdump(len=0): [NULL] eth0: CTRL-EVENT-DISCONNECTED bssid=01:80:c2:00:00:03 reason=3 locally_generated=1 eth0: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="" auth_failures=1 duration=10 reason=AUTH_FAILED eth0: Auto connect disabled: do not try to re-connect eth0: Ignore connection failure indication since interface has been put into disconnected state eth0: State: ASSOCIATED -> DISCONNECTED EAPOL: External notification - portEnabled=0 EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: Supplicant port status: Unauthorized EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 eth0: State: DISCONNECTED -> DISCONNECTED EAPOL: External notification - portEnabled=0 EAPOL: External notification - portValid=0 eth0: Cancelling scan request eth0: Cancelling authentication timeout Remove interface eth0 from radio Remove radio eth0: CTRL-EVENT-TERMINATING

2 1