November 2015 - Freeradius-Users - lists.freeradius.org

MAC authentication with freeradius
by Daniel Lopez 03 Nov '15

03 Nov '15

Hi, I'm using freeradius 2.1.12 with mysql module (freeradius-mysql) I want to authenticate users by MAC address, so in radcheck table I set the attribute Calling-Station Id == XX-XX-XX-XX-XX-XX, but it didn't work, user can't authenticate, when I delete this row, user can authenticate perfectly, so it seems this is not the way I should configure server to perform MAC authentication. Could somebody help me with this? Thanks [this is the output when I set Calling-Station-Id == XX-XX-XX-XX-XX-XX}: rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=158, length=158 User-Name = "dprueba" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "E8-DE-27-F7-83-A4:cdebiles.eti" Calling-Station-Id = "10-68-3F-82-42-16" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0200000c0164707275656261 Message-Authenticator = 0x4be696f8c2c8db73cf3e49464a80a84a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "dprueba", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> dprueba [sql] sql_set_user escaped user --> 'dprueba' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dprueba' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dprueba' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'dprueba' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id [sql] User found in group wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 158 to 10.25.4.250 port 44145 Framed-Protocol := PPP Framed-Compression := Van-Jacobson-TCP-IP Framed-MTU := 1500 Service-Type := Framed-User MS-Primary-DNS-Server := 10.25.1.10 Framed-IP-Netmask := 255.255.255.255 EAP-Message = 0x010100160410ce619bb1b16b584f4a55e298b518b595 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa65194aaa65090b9e5aa8a871ea68523 Finished request 36. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=159, length=170 User-Name = "dprueba" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "E8-DE-27-F7-83-A4:cdebiles.eti" Calling-Station-Id = "10-68-3F-82-42-16" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020100060319 State = 0xa65194aaa65090b9e5aa8a871ea68523 Message-Authenticator = 0x49e2f93415e6ffa01f754feda2629bd6 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "dprueba", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> dprueba [sql] sql_set_user escaped user --> 'dprueba' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dprueba' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dprueba' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'dprueba' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id [sql] User found in group wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 159 to 10.25.4.250 port 44145 Framed-Protocol := PPP Framed-Compression := Van-Jacobson-TCP-IP Framed-MTU := 1500 Service-Type := Framed-User MS-Primary-DNS-Server := 10.25.1.10 Framed-IP-Netmask := 255.255.255.255 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa65194aaa7538db9e5aa8a871ea68523 Finished request 37. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=160, length=364 User-Name = "dprueba" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "E8-DE-27-F7-83-A4:cdebiles.eti" Calling-Station-Id = "10-68-3F-82-42-16" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020200c81980000000be16030100b9010000b503015638bd689d9c6ee8b3f1a8853b65c2d8594789b893023905f46fa838fdcda289000048c014c00a00390038c00fc0050035c012c00800160013c00dc003000ac013c00900330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000044000b000403000102000a00340032000100020003000400050006000700080009000a000b000c000d000e000f001000110012001300140015001600170018001900230000 State = 0xa65194aaa7538db9e5aa8a871ea68523 Message-Authenticator = 0x4120527dda65730b1f014fa03c973746 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "dprueba", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 200 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 190 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 00b9], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0039], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 02c8], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 160 to 10.25.4.250 port 44145 EAP-Message = 0x0103040019c0000004641603010039020000350301e349bb58d1d3295ec527d76a7eebdca2d3fb2ae4cfac72f973ffbcff62a77a9b00c01400000dff01000100000b00040300010216030102c80b0002c40002c10002be308202ba308201a2a003020102020900ce69d09555557538300d06092a864886f70d01010b05003015311330110603550403130a77696669726164697573301e170d3135313032393135313530325a170d3235313032363135313530325a3015311330110603550403130a7769666972616469757330820122300d06092a864886f70d01010105000382010f003082010a02820101009c1433a91142092dabc37d5325c8eeb6 EAP-Message = 0x056e5c2013b734155ed595d570443d4b9a775fff03d74f88a6f77c3a77dd9339394d356639a69ff20868d94749a4683d0a7d72b13bf305c6fb760f1779401d713c872f90ed68c957f9f5c83d78be375233516f99c8e24fd6be6f98e804a00ad929b5681112ff83fb0d89b33aa9ce1e3406c05676b25eb62ffecd39f17361184a3e7438f6a83738c69a31285ebde0025a9fddbab018c07007d979dfd14bccd171f3994dde09244972aa69a2227fd4af075490577d77d6997c4b4e543872e5adc5860c356203e996f8eda8e90633078f60f24529efc19a311206e5e519517aa9b64d224416b4d27bd5daf5ffe66772cc710203010001a30d300b30090603 EAP-Message = 0x551d1304023000300d06092a864886f70d01010b050003820101001eb333a9023182bea3f5cff9d9bb6f237209706cd1b8aa42db6a1e2505f0355d5aab0e49640191fbc54464fd8bdaad9ac8633650c99178c78d09d9b9db9971c98b6283999da38050e411a9049eb93c355cd913f792795957e37e3376ec144d8de7bf6d434e3450029dc669a4ea176aeddfb612f280cc5a44ed86ecf0bb6b932b962f9b075eb63eb10af2e425f0909836cca41706f236d058fc7f50953ee08fbfd43bed06151eb2dbe1eb3184fe72b4f18ae17bfb5c2581b181fa260ab7c86837f9f748c9694a5db35ced09c94ef5e936659b1cc8e99d2b0d78abf8c03022c5c06d87 EAP-Message = 0x3d9820712b41eeabe4600486644990bc34b49890a14c0a2ffb9dc60483cf160301014b0c0001470300174104bb1283b8643e3a221a317f23a50a31b91f0799d4a8bebf1893b54c405da7cfa4cd07033b70a12d18c761eb1e11d6d4d7b967704f91dfc93ecf68d6642d019e5f01002cfc8504d595106cf4add50a3f5b31bf94daa316072eb0bb2f6e2883763a4918ae23c5f18c16d3ce50b86e3c3834882a874b5c25cc96d55b100b826e87267ec61b627c8846c2740fe2a5b33e241eff469723ac7d6bc838ae8e7145ab8c3b40e5c148e48e3af994b76f2cc1a8e3a63337b8acf961bd6c8f0724a902470a0f5d52c50d017556f75b5aa427a49af80e21 EAP-Message = 0x3f55b8c20d939065e7bf45cf Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa65194aaa4528db9e5aa8a871ea68523 Finished request 38. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=161, length=170 User-Name = "dprueba" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "E8-DE-27-F7-83-A4:cdebiles.eti" Calling-Station-Id = "10-68-3F-82-42-16" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020300061900 State = 0xa65194aaa4528db9e5aa8a871ea68523 Message-Authenticator = 0xe8ae7aafbf65523d200ffe429c2a66c0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "dprueba", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 161 to 10.25.4.250 port 44145 EAP-Message = 0x0104007419001aeaaf3170c28c77913b4c33a2dc5c4386afd7f37111872be8af7d575e4b323a56a89f84122b92b22f77f88514a1ac593d3e885beea192f419e198caaaab64e37478cb4f40365cbee9fb50eb0dabbecde54aae6482c7aab720d5006138438a26acbca734bc16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa65194aaa5558db9e5aa8a871ea68523 Finished request 39. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=162, length=308 User-Name = "dprueba" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "E8-DE-27-F7-83-A4:cdebiles.eti" Calling-Station-Id = "10-68-3F-82-42-16" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0204009019800000008616030100461000004241045751461749561a2d5d3194b5e79d548e8933be5aa103414fc3316cdfd2d30edab44a349495eecd34490465dc08f3270bf3ac231bcdedb40158cad7d15525d1b51403010001011603010030f69b46babe879f7a06ef536a075e1c7b034f341fae14fa451570db3c7767ebc66cbec2db5bb2dc58c6cabdf2700bc777 State = 0xa65194aaa5558db9e5aa8a871ea68523 Message-Authenticator = 0xf96563cc6ba01abaa1048cfff4efd9d0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "dprueba", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 134 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 162 to 10.25.4.250 port 44145 EAP-Message = 0x0105004119001403010001011603010030026f349689fa5da4363102163d0dd8908f1b5847d21dc1f95bbf9377d897232d5477a431b68c6d561f47c34ea8b3c2d0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa65194aaa2548db9e5aa8a871ea68523 Finished request 40. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=163, length=170 User-Name = "dprueba" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "E8-DE-27-F7-83-A4:cdebiles.eti" Calling-Station-Id = "10-68-3F-82-42-16" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020500061900 State = 0xa65194aaa2548db9e5aa8a871ea68523 Message-Authenticator = 0x00bd0e39e83e214fb866c735ff089d2b # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "dprueba", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 163 to 10.25.4.250 port 44145 EAP-Message = 0x0106002b190017030100208c4dccbdfac51bb4b216b385ee7d974f9e675fe16104eb4274dfc9bb5f263ca6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa65194aaa3578db9e5aa8a871ea68523 Finished request 41. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=164, length=244 User-Name = "dprueba" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "E8-DE-27-F7-83-A4:cdebiles.eti" Calling-Station-Id = "10-68-3F-82-42-16" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x02060050190017030100203f864e1a350a312975bdbbfcaf7ff2021d133bcb969b27210179851fc1ccb40b17030100206e0599cf15687f6c43aa33ec532c67e0ddc39ccb74fc3adb2473376d3b5bcb85 State = 0xa65194aaa3578db9e5aa8a871ea68523 Message-Authenticator = 0x14b99b8e5853b55670f8936e949ae9cd # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "dprueba", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - dprueba [peap] Got inner identity 'dprueba' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0206000c0164707275656261 server { [peap] Setting User-Name to dprueba Sending tunneled request EAP-Message = 0x0206000c0164707275656261 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "dprueba" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dprueba", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 6 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> dprueba [sql] sql_set_user escaped user --> 'dprueba' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dprueba' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'dprueba' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id [sql] User found in group wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Framed-Protocol := PPP Framed-Compression := Van-Jacobson-TCP-IP Framed-MTU := 1500 Service-Type := Framed-User MS-Primary-DNS-Server := 10.25.1.10 Framed-IP-Netmask := 255.255.255.255 EAP-Message = 0x010700211a0107001c10a58f1aff9e9e95e3df5667726e5b86da64707275656261 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x138ded3d138af7a13ad2c8138d486583 [peap] Got tunneled reply RADIUS code 11 Framed-Protocol := PPP Framed-Compression := Van-Jacobson-TCP-IP Framed-MTU := 1500 Service-Type := Framed-User MS-Primary-DNS-Server := 10.25.1.10 Framed-IP-Netmask := 255.255.255.255 EAP-Message = 0x010700211a0107001c10a58f1aff9e9e95e3df5667726e5b86da64707275656261 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x138ded3d138af7a13ad2c8138d486583 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 164 to 10.25.4.250 port 44145 EAP-Message = 0x0107004b19001703010040bdef2d38678359432d6266c8d7f420ba14921ee87fd862a0a7257e539659dcc0bec990abad261b9f26bbe5db1ac85bd262bf5de6fb73e3ae326f294d6060c824 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa65194aaa0568db9e5aa8a871ea68523 Finished request 42. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=165, length=308 User-Name = "dprueba" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "E8-DE-27-F7-83-A4:cdebiles.eti" Calling-Station-Id = "10-68-3F-82-42-16" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0207009019001703010020acb86b95706efaa775287c058b069664408382577b67bb85dbf0b0799c35f099170301006048783d63d8d53df67cc63b4e341b204c0b332e503cda2f22d44cef5660f2d60d0622885dd9e96b86e2a8948f60bfc5453e48eaaa1b118be663680db9d6de04cb9a9730bcdc7387e8f391ac68206356df81cb4e9d10e10835ef2ddd691ac730a6 State = 0xa65194aaa0568db9e5aa8a871ea68523 Message-Authenticator = 0x4773d1a02e02785f3c640a863b235080 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "dprueba", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020700421a0207003d312c29b4e62a18efaf1bca93031a9bc48a0000000000000000ff2b7cade8eb372e40905cc5552700f40738dbfcb23121840064707275656261 server { [peap] Setting User-Name to dprueba Sending tunneled request EAP-Message = 0x020700421a0207003d312c29b4e62a18efaf1bca93031a9bc48a0000000000000000ff2b7cade8eb372e40905cc5552700f40738dbfcb23121840064707275656261 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "dprueba" State = 0x138ded3d138af7a13ad2c8138d486583 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dprueba", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 66 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> dprueba [sql] sql_set_user escaped user --> 'dprueba' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dprueba' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'dprueba' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id [sql] User found in group wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: dprueba [mschap] Told to do MS-CHAPv2 for dprueba with NT-Password *[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.[mschap] FAILED: MS-CHAP2-Response is incorrec*t ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 Framed-Protocol := PPP Framed-Compression := Van-Jacobson-TCP-IP Framed-MTU := 1500 Service-Type := Framed-User MS-Primary-DNS-Server := 10.25.1.10 Framed-IP-Netmask := 255.255.255.255 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 Framed-Protocol := PPP Framed-Compression := Van-Jacobson-TCP-IP Framed-MTU := 1500 Service-Type := Framed-User MS-Primary-DNS-Server := 10.25.1.10 Framed-IP-Netmask := 255.255.255.255 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 165 to 10.25.4.250 port 44145 EAP-Message = 0x0108002b190017030100200f7edf20af25286e24f0a1ec03a04a5e4b893e385955244fa3c44457b30c81cb Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa65194aaa1598db9e5aa8a871ea68523 Finished request 43. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=166, length=244 User-Name = "dprueba" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "E8-DE-27-F7-83-A4:cdebiles.eti" Calling-Station-Id = "10-68-3F-82-42-16" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0208005019001703010020a60874f0b621b855a82de262f1330ac8a1b05f4708527620f981ef3722e3b1cf170301002006ae0d5ee86405c776ba893bd138d82d811bcf6916da13d0681a9d327692ef1b State = 0xa65194aaa1598db9e5aa8a871ea68523 Message-Authenticator = 0xa8b1ee9f9adf7785813d07e9b14f55a9 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "dprueba", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. *[peap] Peap state send tlv failure* [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> dprueba attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 44 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 44 Sending Access-Reject of id 166 to 10.25.4.250 port 44145 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 36 ID 158 with timestamp +40 Cleaning up request 37 ID 159 with timestamp +40 Cleaning up request 38 ID 160 with timestamp +40 Cleaning up request 39 ID 161 with timestamp +40 Cleaning up request 40 ID 162 with timestamp +40 Cleaning up request 41 ID 163 with timestamp +40 Cleaning up request 42 ID 164 with timestamp +40 Cleaning up request 43 ID 165 with timestamp +40 Waking up in 1.0 seconds. Cleaning up request 44 ID 166 with timestamp +41 Ready to process requests.

2 2

(no subject)
by Daniel Lopez 03 Nov '15

03 Nov '15

HI. I've been trying to fix this problem for weeks: The user "daniel" belongs to usergroup "wifi". In radgroupcheck I set the attribute Auth-Type := Accept for the group "wifi". When I try to connect from the terminal, server returns an Access-accept message, but however i can't still connect, screen of my device shows an eternal loop trying to connect but it doesn't do. I would preciate any help i can obtain from you. thanks. Freeradius server: rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=1, length=156 User-Name = "daniel" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "X.X.X.X.X" Calling-Station-Id = "X.X.X.X.X" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0203000b0164616e69656c Message-Authenticator = 0x3bf87f29f5f2af111857fd6706a12c92 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "daniel", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> daniel [sql] sql_set_user escaped user --> 'daniel' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'daniel' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'daniel' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'daniel' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id [sql] User found in group wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop *Sending Access-Accept of id 1 to 10.25.4.250 port 44145* Framed-Protocol := PPP Framed-Compression := Van-Jacobson-TCP-IP Framed-MTU := 1500 Service-Type := Framed-User Finished request 28. Going to the next request Waking up in 4.9 seconds. Cleaning up request 28 ID 1 with timestamp +673 Ready to process requests.

4 7

Error SHA2-Password authentication
by Kirchner, Christoph 03 Nov '15

03 Nov '15

Hello, I have a problem to get the configuration for user authentication with SHA2-Password up and running (also SHA/MD5-Password doesn't work). Everythink else works, also authentication with Cleartext-Password and Crypt-Password ##### Cleartext-Password: pap : Login attempt with password pap : User authenticated successfully Crypt-Password: pap : Login attempt with password pap : Comparing with "known-good" Crypt-password pap : User authenticated successfully ##### Version: Freeradius 3.0.3 OS: SLES12 Output: # radiusd -X Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 36131 Ready to process requests. Received Access-Request Id 7 from 10.10.10.2:62047 to 10.10.20.2:1812 length 46 User-Name = 'testuser' User-Password = '12345678' (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) files : users: Matched entry testuser at line 2 (0) [files] = ok (0) pap : Normalizing SHA2-Password from hex encoding, 64 bytes -> 32 bytes (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap : Login attempt with password (0) pap : Comparing with "known-good" SHA2-Password (0) ERROR: pap : SHA-256 digest does not match "known good" digest (0) pap : Passwords don't match (0) [pap] = reject (0) } # Auth-Type PAP = reject (0) Failed to authenticate the user. (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { ... } # empty sub-section is ignored (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response Sending Access-Reject Id 7 from 10.10.20.2:1812 to 10.10.10.2:62047 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 7 with timestamp +51 Ready to process requests. I think the hash is correct: # echo "12345678" | openssl dgst -sha256 # 2634c3097f98e36865f0c572009c4ffd73316bc8b88ccfe8d196af35f46e2394 /etc/raddb/users #testuser Cleartext-Password := "12345678" testuser SHA2-Password := "2634c3097f98e36865f0c572009c4ffd73316bc8b88ccfe8d196af35f46e2394" #testuser Crypt-Password := "s9Xk6K7lnMWek" What I'm doing wrong? I read the faq and documents, but I don't get it work. Yours Faithfully, Christoph

2 2

FreeRadius 3.0.10, radclient status failure
by Systems Administrator 02 Nov '15

02 Nov '15

Freeradius users, I upgraded from the freeradius package provided in Ubuntu 14.04.03 to Freeradius 3.0.10 and the radclient command I was using to track the status of the server is no longer providing the server status as it used to: # echo "Message-Authenticator = '0x00',FreeRADIUS-Statistics-Type = 3" | /usr/local/bin/radclient -c 1 -r 1 -t 8 -s 127.0.0.1:18121 status adminsecret (0) Can't determine expected response to Status-Server request, specify a well known RADIUS port, or add a Response-Packet-Type attribute to the request of filter # echo "Message-Authenticator = 0x00" | radclient 127.0.0.1:18121 status adminsecret (0) Can't determine expected response to Status-Server request, specify a well known RADIUS port, or add a Response-Packet-Type attribute to the request of filter previously the status module was listening on 18120, but now there is a section responsible for authentication: $PREFIX/sites-enabled/inner-tunnel: server inner-tunnel { ... listen { ipaddr = 127.0.0.1 port = 18120 type = auth } $PREFIX/sites-enabled/status: server status { listen { type = status ipaddr = 127.0.0.1 port = 18121 } ... Any advice is appreciated, Dennison Williams

3 4

Logging mschap error when send_error=yes
by Brian Julin 02 Nov '15

02 Nov '15

Currently I'm configuring new servers for an eventual 3.0.x migration, and decided to take a look at password-change. I have not got that far yet, just as far as playing around with the server behavior when EAP-MCHAPv2 is set to send_error = yes, which is a prerequisite for that. As soon as this is turned on we seem to lose the ability to log the exact error code returned by ntlm_auth, and this is actually one of the more critical log messages we need to detect locked accounts. With send_error=yes the flow out of the inner tunnel after a bad ntlm auth is as follows: (8) : ERROR: upn_mschap: Program returned code (1) and output 'Logon failure (0xc000006d)' (8) : Debug: upn_mschap: External script failed (8) : ERROR: upn_mschap: External script says: Logon failure (0xc000006d) (8) : ERROR: upn_mschap: MS-CHAP2-Response is incorrect (8) : Debug: modsingle[authenticate]: returned from upn_mschap (rlm_mschap) for request 8 (8) : Debug: [upn_mschap] = reject (8) : Debug: } # Auth-Type MS-CHAP = reject (8) : Debug: MSCHAP-Error:E=691 R=0 C=792471a3e2e250631e1353c26afb0b8f V=3 M=Authentication failed (8) : Debug: Found new challenge from MS-CHAP-Error: err=691 retry=0 challenge=792471a3e2e250631e1353c26afb0b8f (8) : ERROR: MSCHAP Failure (8) : Debug: eap: Sending EAP Request (code 1) ID 9 length 81 (8) : Debug: eap: EAP session adding &reply:State = 0xb5db88f6b4d292e4 (8) : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 8 (8) : Debug: [eap] = handled (8) : Debug: } # Auth-Type EAP = handled (8) : Debug: } # server eduroam_idpi_inner ... and there seems to be pretty much no toehold by which to get an unlang statement into that to store or log MSCHAP-Error or Module-Failure-Message. I haven't tried use_tunneled_reply as it is marked as deprecated in favor of the new state handling, but I've tried just about everything else I can think of. With send_error=no, default internal logging would normally log the ntlm_auth result, or we could catch it in the inner tunnel's post-auth Reject section: (8) : ERROR: upn_mschap: Program returned code (1) and output 'Logon failure (0xc000006d)' (8) : Debug: upn_mschap: External script failed (8) : ERROR: upn_mschap: External script says: Logon failure (0xc000006d) (8) : ERROR: upn_mschap: MS-CHAP2-Response is incorrect (8) : Debug: modsingle[authenticate]: returned from upn_mschap (rlm_mschap) for request 8 (8) : Debug: [upn_mschap] = reject (8) : Debug: } # Auth-Type MS-CHAP = reject (8) : Debug: eap: Sending EAP Failure (code 4) ID 8 length 4 (8) : Debug: eap: Freeing handler (8) : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 8 (8) : Debug: [eap] = reject (8) : Debug: } # Auth-Type EAP = reject (8) : Debug: Failed to authenticate the user (8) : Debug: Using Post-Auth-Type Reject (8) : Debug: # Executing group from file /etc/raddb/eduroam_idpi.conf (8) : Debug: Post-Auth-Type REJECT { So my first question is, am I missing a trick that would allow me to log the ntlm_auth result? The second thing is that, since the failure seems to promulgate down to the EAP layer in a different fashion (a new challenge seems to always be issued and the failure delayed until later packets, even when retries are not allowed) the normal logs get filled with the usual "The users session was previously rejected" stanza, which in this particular case is not very helpful since there's not much to read above them (and it's a lot of syslog bulk for a common logon failure.) No real question there, just an observation. The third thing is, while looking further into this I noticed the current code for dealing with locked accounts appears to be entirely based off SMB-Account-CTRL, which does not seem to exist when authing against an actual AD server rather than a local Samba setup. For password changes there is code to use the text returned from ntlm_auth instead, but locked or disabled accounts just end up sending 691/"Authentication failed" instead of the actual error. So I quick-hacked the C code to pass on the code/message for locks and disables. Second question: is there any particular reason why the code is the way it is, or is it just a not-implemented-yet situation?

2 2

Puppet module for FreeRADIUS
by Jonathan Gazeley 02 Nov '15

02 Nov '15

For anyone else who uses Puppet to manage their servers, I've just released v1.0.0 of my Puppet module for FreeRADIUS. This is the first version with support for FreeRADIUS 3 and it also has improvements in various areas (configuration of realms, SQL and LDAP to name a few). https://forge.puppetlabs.com/jgazeley/freeradius https://github.com/djjudas21/puppet-freeradius Thanks, Jonathan

1 0

Error receiving packet: Bad address (version 2.2.5 then 2.2.9)
by Bertalan Voros 02 Nov '15

02 Nov '15

Hello All, I have been getting the following symptoms on one of the three FreeRADIUS servers I look after. The one affected is on a network that is not managed by me, so there is a possibility that something has chagned around it that I was not told of. The server otherwise has been running without issues for years more or less, it was 2.25 until today, when out of desperation I upgraded it to 2.2.9 but still getting the same behavior like before. Symptoms. 1. The server appears to be not responding. 2. When running in debug mode, it starts up as normal. When there is a request received, the log/console runs away with either of the two below: *Error receiving packet: Bad address* *Waking up in 23.6 seconds.* *Ready to process requests.Ready to process requests.Ready to process requests.Ready to process requests.Ready to process requests.Ready to process requests.* It has a Windows NPS server downstream that it uses as its authentication source. The same configuration has been working flawlessly at the other two sites, so something might have changed on the affected one, I am just unable to figure out what. Have you ever encountered these symptoms? Any guidance will be appreciated. Bertalan

2 1

Authenticated device does not receive and IP, so continuously requests IP allocation
by Sophie Loewenthal 02 Nov '15

02 Nov '15

Hi, For a few weeks some devices have had their IP allocation "lost" en route. They authenticate, and IP is allocated but not received by the device. Afterwards a device continuously asking for an IP address, being allocated, and then asking again. This has happened intermittently with some devices on Vodafone APN. I did not see devices on other APNs affected. Please see the three Radius requests in debug mode at the end of this email in attachments. They are small files of approx 10Kb and were collected with options to radiusd -xxx /etc/raddb/users ( with comments and empty lines stripped but willing to resend if empty lines and # comments are needed ) # grep -v ^# users | grep -v ^$ DEFAULT NAS-IP-Address == 172.200.100.1, Pool-Name := vodafone DEFAULT NAS-IP-Address == 10.19.255.254, Pool-Name := proximus-carli DEFAULT NAS-IP-Address == 10.17.255.254, Pool-Name := proximus-mechelen DEFAULT Framed-IP-Netmask = 255.255.255.255 O/S and packages Centos 6.2 freeradius-mysql-2.1.12-1.el6.x86_64 freeradius-utils-2.1.12-1.el6.x86_64 freeradius-2.1.12-1.el6.x86_64 Example from logs: Thu Oct 29 00:00:15 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 594301 cli 31655418538) Thu Oct 29 00:00:15 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 594301 user 000006156) Thu Oct 29 00:01:12 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 146587 cli 31655418538) Thu Oct 29 00:01:12 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 146587 user 000006156) Thu Oct 29 00:02:39 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 983132 cli 31655418538) Thu Oct 29 00:02:39 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 983132 user 000006156) Thu Oct 29 00:05:01 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 928184 cli 31655418538) Thu Oct 29 00:05:01 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 928184 user 000006156) Thu Oct 29 00:07:33 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 575003 cli 31655418538) Thu Oct 29 00:07:33 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 575003 user 000006156) Thu Oct 29 00:08:27 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 728168 cli 31655418538) Thu Oct 29 00:08:27 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 728168 user 000006156) This happens continuously amounting to 1000s of IP allocations daily. I do not see Info: Released IP entries for this device. ( there were some earlier this month. ) I have tcpdump running with : tcpdump -s0 -ni eth0 port 1812 or port 1813 or port 3799 -vw /tmp/rad.pcap Some questions, - Could my ippool run out of addresses because the device is continuously requesting IP addresses? - Would you offer any improvements on the tcpdump parameters? - How could I check if Radius really sent the packet back to the client? - (wireshark/tcpdump question: Is there an expression I could use to find the radius packet sent back for Info: Allocated IP? e.g I could radius.User_Name == "00000123" in wireshark to find User-Name we used for authentication. Is there any useful info in the attached debugs indicating problems? Like why the device did not receive an IP. If not then I can start looking into networks/vpn and vodafone. Kind regards.

3 5

Add custom ldap attribute to replies
by Angel L. Mateo 02 Nov '15

02 Nov '15

Hello, I have my freeradius connected to an LDAP server. I want now to add the CN attribute of my ldap users' entries to the freeradius reply. So I have: - Created a custom attribute (I haven't found any better, is there any?). This is the definition in the dictionary: ATTRIBUTE X-Atica-CN 3002 string - I have mapped the ldap's cn attribute to this attribute. In my ldap module configuration I have: update { ... reply:X-Atica-CN := 'cn' } - I have changed my authorized file: DEFAULT Auth-Type = LDAP, Realm != DEFAULT User-Name = "%{User-Name}", X-Atica-CN = "%{reply:X-Atica-CN}", Fall-Through = No but when I try with radtest, this custom attribute is not in the reply. In the freeradius debug file I can see that the ldap attribute is read while parsing the authorize file: 0) [ldap] = updated (0) files_aplicaciones: users: Matched entry DEFAULT at line 3 (0) files_aplicaciones: EXPAND %{User-Name} (0) files_aplicaciones: --> <my login> (0) files_aplicaciones: EXPAND %{reply:X-Atica-CN} (0) files_aplicaciones: --> <my cn in the ldap> but the attribute is not returned to radtest. I have also tried to force the inclusion in the post-auth section, with: post-auth { update reply { reply:X-Atica-CN = &reply:X-Atica-CN } ... } and with this, the debug file shows: (0) update reply { (0) reply:X-Atica-CN = &reply:X-Atica-CN -> <my cn in the ldap> (0) } # update reply = noop but it is not shown in the radtest reply. Any help? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

3 3

Run a php script after user successfully logged in
by Arash Shams 01 Nov '15

01 Nov '15

Hello i want to pass two argument ( user and companyid ) after successfully login for each one . i know i have to add a statement to post Auth in site-enabled/default but i dont know how any one can help me please thank you

2 1